Congress plans to vote on a bill to ban firms that sell spyware from working with the US government; experts say the surveillance market will be hard to curtail
Suzanne Smalley / CyberScoop :
Context & Ripple Effects
Congress's planned vote extends a sanctions-first playbook into procurement law. Washington previously hit the sector with entity-list sanctions against NSO Group and three other vendors in 2021, then in 2023 added European firms Intellexa and Cytrox to an export prohibition list cutting them off from US tech. A ban on government contracts closes a different door: the ability of spyware makers to sell to, or work alongside, the US government itself.
The vote lands amid growing evidence that the tools outpace the rules. Google's TAG catalogued roughly 40 commercial spyware vendors and urged governments toward more aggressive action, while Atlantic Council researchers documented how vendors dodge existing restrictions through renaming, new companies, and changed legal jurisdictions — which is exactly why experts doubt this bill can shrink the market.
First-order effects
- Spyware vendors that currently hold or pursue US government contracts lose that revenue channel outright if the bill passes, adding a procurement ban on top of the sanctions and export prohibitions already aimed at firms like NSO Group, Intellexa, and Cytrox.
Second-order effects
- Vendors facing exclusion can be expected to respond with the evasion tactics already documented by Atlantic Council researchers — rebranding, spinning up new entities, or relocating across jurisdictions — which pushes enforcement away from company names and toward the underlying technology and its buyers.
Third-order effects
- If the pattern holds, US policy converges on supply-chain containment rather than vendor-by-vendor punishment: blocking access to US tech and markets becomes the durable lever, even as experts' skepticism suggests the global surveillance market keeps operating outside the reach of any single government's blacklist.
The trend: US policy on commercial spyware is escalating from targeted sanctions to structural exclusion, while vendors rebrand and relocate faster than enforcement can pin them down.