US sanctions founder of spyware maker Intellexa for targeting Americans

The U.S. government announced Tuesday sanctions against the founder of the notorious spyware company Intellexa and one of his business partners.

This is the first time the U.S. government has targeted specific people, in addition to companies, with sanctions related to the misuse of commercial spyware. And it signifies an escalation of the White House and U.S. government’s efforts to curb the spyware industry.

“Today’s actions represent a tangible step forward in discouraging the misuse of commercial surveillance tools, which increasingly present a security risk to the United States and our citizens,” said Brian E. Nelson, U.S Treasury’s under secretary for terrorism and financial intelligence, was quoted as saying in a press release. “The United States remains focused on establishing clear guardrails for the responsible development and use of these technologies while also ensuring the protection of human rights and civil liberties of individuals around the world.”

The U.S. Treasury imposed sanctions on Tal Dilian, the founder of Intellexa and a veteran of the spyware industry; and Sara Aleksandra Fayssal Hamou, who is not as well-known as Dilian.

Hamou, according to the Treasury, has a leadership role in Intellexa, is an expert in off-shoring, and provided the company managerial services, such as renting office space in Greece.

The U.S. government alleges that Hamou, as well as Dilian and his companies had a role in developing spyware that was used to target Americans, including U.S. government officials, journalists, and policy experts. The government did not provide evidence to support the claim that Intellexa spyware was used against U.S. government officials,

The sanctions also target the Intellexa Consortium, which includes Intellexa S.A., a Greece based spyware developer company which has exported its tools to authoritarian regimes; the Ireland-based Intellexa Limited, which acts as a reseller for the consortium; Cytrox AD, a North Macedonia-based company in the consortium; the Hungary-based Cytrox Holdings ZRT, which developed the Predator spyware; and the Ireland-based Thalestris Limited.

Sanctions are an important tool in the U.S. government’s armory of bureaucracy against cyber criminals, ransomware actors, and now, spyware makers. Sanctions are issued by the U.S. Treasury to make it illegal for U.S. individuals or businesses to transact with a sanctioned entity, such as in this case paying for access to spyware. By imposing sanctions against Dilian and his associates by name, the U.S. government aims to make it far more difficult for the individuals to profit from commercial surveillance.

In this case, the sanctions mean U.S. companies and persons are prohibited from dealing with Intellexa, Cytrox, as well as Dilian and Hamou, which includes financial transactions, and also material or technological support, according to a U.S. government official, who spoke on a background call with the media, in which reporters agreed not to quote the government officials by name.

Dilian and Hamou could not be reached for comment.

These sanctions will impact Dilian and Hamou specifically, but they will also send a message to other people involved in the spyware industry.

“The impact and scale on these two individuals is going to change their lives. Their lives — as they know it — are over,” said John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, who has investigated government spyware for more than a decade.

“If I’m a mercenary spyware company, I should be getting really worried,” added Scott-Railton. “The reckless companies that are at the heart of that problem are going to feel the considerable displeasure of the U.S. government.”

Today’s sanctions are the latest in a series of enforcement actions taken by the Biden administration against commercial spyware makers in recent years.

In 2021, the Department of Commerce imposed export controls on NSO Group, one of the most well-known spyware makers, as well as Candiru, another Israel-based spyware maker. Then in 2023, the same controls were imposed against Cytrox and Intellexa.

And earlier this year, the U.S. government announced that the State Department could impose visa restrictions to people believed to have been involved or facilitated the abuse of commercial spyware around the world.