The Atlantic Council researchers detail how spyware vendors are skirting restrictions by renaming, starting new companies, or by changing legal jurisdictions
International efforts to rein in online surveillance tools are being systematically skirted, researchers say.
Context & Ripple Effects
The Atlantic Council’s finding fits a longer record of restrictions failing to halt government spyware deployment: reporting on spyware use continuing despite NSO sanctions showed that sanctions against a named vendor did not remove the underlying demand.
The vendor landscape is also broader than a few high-profile companies. Google’s mapping of roughly 40 commercial-spyware vendors underscored the challenge of targeting an ecosystem rather than one supplier.
First-order effects
- Naming, reincorporating, or moving jurisdictions can preserve vendors’ access to customers and commercial operations while making restrictions tied to a particular legal entity less effective.
- Restricting governments must spend more investigative effort connecting successor companies, personnel, and corporate structures to already constrained spyware suppliers.
Second-order effects
- Buyers seeking surveillance capabilities gain more routes to comparable tools when suppliers can reappear under new identities, weakening the practical deterrent of vendor-specific measures.
- Enforcement is pushed toward ownership, control, and supply-chain scrutiny rather than simple company-name lists—raising compliance burdens for investors, intermediaries, and customers.
Third-order effects
- If corporate mobility remains easier than cross-border coordination, commercial spyware controls will increasingly depend on whether governments can regulate networks of affiliates and enablers, not just individual vendors.
- The pattern strengthens the case that export and sanctions regimes need durable attribution and shared enforcement mechanisms; otherwise restrictions may redirect suppliers rather than reduce market capacity.
The trend: Commercial spyware regulation is moving from blacklisting visible vendors toward the harder task of tracking mobile corporate networks and their enabling supply chains.