The Spyware Industrial Complex

Over the last decade, commercial surveillance vendors (CSVs) have capitalized off the demand for full service cyber espionage tools from government customers. The demand has created an incentive model for firms to develop intrusion technologies, further proliferating the spyware industry at the risk of human rights and the security of users. Missteps of spyware companies resulting in the erroneous surveillance of civil society has been well documented by watchdog groups like University of Toronto’s Citizen Lab and Amnesty International. Rather than the misapplication of surveillance tools as is often covered in the media, this report will examine the ecosystem that supports the development, selling, and sustainment of commercial spying. Reports by Steven Feldstein and Brian Kot, Google’s Threat Analysis Group, and other works will be drawn on throughout this analysis. This paper aims to define the features and patterns of cyber espionage firms that produce the spyware utilized in the “pay-to-play” model.