An investigation shows how, despite US sanctions on the NSO Group, government spyware use is booming, including the DEA's secret deployment of Graphite spyware
which employ former Israeli cyberintelligence veterans. After questions from The New York Times, the Greek government admitted that it gave one of them, Ronen Bergman / @ronenbergman : Congress and the White House warned about risks to the United States posed by foreign commercial spyware but, as The Times reveals- there are exceptions.The White House is allowing the D.E.A. to continue its use of Graphite, the hacking tool made by Israel-based Paragon, for its Antonella Napolitano / @svaroschi : In which the Greek government admits that it gave Intellexa licenses to sell Predator to Madagascar, a country with a history of repression. (nice to see @insidestory_gr getting recognition for groundbreaking reporting) https://www.nytimes.com/... Edward Snowden / @snowden : “The Drug Enforcement Administration is secretly deploying spyware from an Israeli firm,” writes the @NYTimes. “The United States has played both arsonist and firefighter” in terms of digital security, funding a deadly bazaar for state hackers. https://www.nytimes.com/... Edward Snowden / @snowden : One notorious digital armaments dealer dismissed his involvement in human rights abuses. “We work with the good guys.” He added, “And sometimes the good guys don't behave.” Yeah, you know what they call good guys that don't behave? Bad guys. https://t.co/ozc18aQQPl Ronen Bergman / @ronenbergman : New: The USG has secretly deployed Israeli-made powerful hacking tools that invade mobile phones and vacuum up data. This was uncovered as part of a New York Times investigation into the booming global spyware market W\ @MarkMazzettiNYT @MatinaStevis https://www.nytimes.com/... Xenia Kounalaki / @xkounalaki : After questions from The New York Times, the Greek government admitted that it gave the company, Intellexa, licenses to sell Predator to at least one country with a history of repression, Madagascar. https://www.nytimes.com/... Antonella Napolitano / @svaroschi : The article also has an important view from the US, new tools, tension between strong regulations and needs of agencies like the DEA. And a very predictable - yet botched - attempt of Intellexa to market their tools to the Ukrainian government. https://www.nytimes.com/...
Context & Ripple Effects
This investigation lands at the end of an arc the coverage has been building since NSO's Pegasus became a fixture of Israeli diplomacy — sold under export license as a de facto diplomatic instrument — and after Edward Snowden's call for an outright spyware trade ban went unheeded. Washington responded by sanctioning NSO, but the Financial Times reporting in this corpus already showed the US reshaping the market to favor allied vendors like Paragon.
Today's revelations test that policy from two directions: the White House is quietly exempting its own DEA from the crackdown by allowing continued use of Paragon's Graphite, while Greece's admission that it licensed Intellexa to sell Predator to Madagascar shows allied-state vendors running the same proliferation playbook NSO was punished for.
First-order effects
- The DEA can keep deploying Graphite against mobile phones under explicit White House allowance, even as Congress and the White House publicly warn about the risks of exactly this class of foreign-built commercial spyware.
- Intellexa faces exposure on two fronts: the Greek government's admission of Madagascar Predator licenses invites scrutiny of its export chain, and its botched marketing attempt to Ukraine shows it hunting for new state customers as traditional markets close.
Second-order effects
- Paragon's position as the preferred vendor in the US-favoring market structure gives it a moat rivals like Intellexa lack — pushing excluded vendors toward looser-regime buyers such as Madagascar and failed pitches like Ukraine.
- NSO's sanctioning, set against the DEA's Graphite exemption, hands competitors a ready-made argument that enforcement targets geopolitics rather than the technology, complicating any future US case against allied vendors.
Third-order effects
- If the pattern holds, the commercial spyware industry splits into a sanctioned tier and an allied tier blessed by exporting governments — a structure Google's TAG report on roughly 40 vendors implicitly challenges by urging governments to combat the trade wholesale rather than selectively.
- Selective enforcement risks legitimizing proliferation: every state that secures an exemption for its own agencies loses standing to restrict the same tools abroad, making blanket bans like Snowden's harder to enact and export-license regimes the de facto global rule.
The trend: Commercial spyware is consolidating into a two-tier market where sanctions punish geopolitical rivals while allied vendors like Paragon thrive with their customers' own governments as clients.