US senator requests watchdog review of federal agencies' hacking tool use against Americans

Senator Wyden’s letter to the GAO formally requests an audit of how four federal agencies use hacking tools and spyware in investigations involving Americans. The request frames the issue as a transparency gap: while wiretaps and pen registers are subject to annual public reporting, hacking operations remain undocumented. This asymmetry leaves engineers and security teams without visibility into the scale or methods of government tool deployment, complicating risk assessments for systems that might be targeted or collateral damage in operations.

The audit would examine three core areas: potential abuse of tools for unauthorized purposes, technical safeguards to prevent leaks, and compliance with vulnerability disclosure programs. For engineers, the second point is particularly relevant. The letter cites a case where stolen hacking tools were later used by Russian and Chinese actors, underscoring the risk of supply-chain compromise. If the GAO finds agencies fail to secure tools adequately, it could prompt stricter procurement or storage requirements, increasing operational overhead for vendors and integrators.

Wyden’s request also targets judicial oversight, asking whether agencies disclose the risks of hacking tools when seeking warrants. Current practice may omit details about unintended targets or technical side effects, such as malware spreading beyond the intended device. For engineers building or auditing systems, this lack of disclosure complicates threat modeling. A GAO finding that courts are not fully informed could lead to new reporting standards, requiring agencies to document tool behavior and failure modes in warrant applications.

The letter notes that federal agencies have ignored prior congressional requests for transparency, suggesting this review may face resistance. If the GAO proceeds, its unclassified report could provide the first public baseline on how often and under what conditions hacking tools are used. For engineers, this would offer a rare data point to weigh against the risk of government access when designing encryption, authentication, or monitoring systems. Without it, the status quo, where tool use is inferred from leaks or court filings, remains the only reference.