Senator Ron Wyden Asks GAO to Review Federal Use of Hacking Tools

Sen. Ron Wyden and Rep. Greg Casar are asking the U.S. Government Accountability Office to investigate how federal law enforcement agencies use hacking tools and spyware against Americans, citing limited public information about the scope, frequency and safeguards surrounding the technology.

In an Aug. 21 letter to the GAO, the lawmakers requested a comprehensive review covering the FBI, Drug Enforcement Administration, Secret Service and Homeland Security Investigations.

Lawmakers seek greater oversight of government hacking

Federal law enforcement agencies have used hacking and spyware as investigative tools for more than 25 years. Wyden and Casar noted that, unlike wiretaps and pen registers, the government does not publish annual reports detailing its hacking operations, leaving the public with limited information about how frequently the tools are deployed.

The lawmakers want the GAO to examine whether federal personnel have ever used hacking capabilities for unauthorised or personal purposes. They also asked for a review of technical logging, auditing and access controls intended to detect and prevent misuse.

A second area of scrutiny involves how agencies acquire, store and secure offensive hacking technology. The letter asks whether security vulnerabilities used by law enforcement are submitted to the government’s Vulnerabilities Equities Process, which evaluates whether software flaws should be disclosed to enable their remediation.

The request cites the case of a former senior L3Harris official who was sentenced after stealing and reselling sensitive hacking tools originally developed for U.S. intelligence agencies to a Russian broker.

GAO asked to examine what agencies tell courts

Wyden and Casar also want investigators to review how hacking requests are presented to federal judges. Their letter specifically asks whether warrant applications disclose risks including system instability, data corruption, exposure of information belonging to non-targets and the possibility that third parties could discover and reuse government hacking tools.

The lawmakers also raised concerns about operations involving unknown targets, bulk hacking or techniques that could inadvertently collect information from innocent people. They requested an unclassified GAO report containing findings and recommendations, with a classified annex if sensitive operational details require one.

FBI hacking techniques date back decades

One of the earliest publicly documented examples dates to a late-1990s investigation involving the Philadelphia organised-crime figure Nicodemo Scarfo. Investigators encountered a computer file protected with Pretty Good Privacy encryption and installed a keystroke-recording tool to capture the password needed to access it. The case was detailed in contemporary reporting on the FBI surveillance operation.

The new GAO request does not seek to prohibit law enforcement hacking. Instead, it asks the government watchdog to determine what safeguards, cybersecurity controls and judicial disclosures currently govern some of the federal government’s most intrusive digital investigative tools.