Four things we learned when US spy chiefs testified to Congress

Cyberattacks, regional conflict, weapons of mass destruction, terrorism, commercial spyware, AI, misinformation, disinformation, deepfakes and TikTok. These are just some of the top perceived threats that the United States faces, according to the U.S. government’s intelligence agency’s latest global risk assessment.

The unclassified report published Monday — sanitized for public release — gave a frank annual window into the U.S. intelligence community’s collective hive mind about the threats it sees facing the U.S. homeland based on its massive banks of gathered intelligence. Now in an election year, the top U.S. spies increasingly cite emerging technology and cybersecurity as playing a factor in assessing its national security posture.

In an unclassified session with the Senate Intelligence Committee on Monday, the top leaders across the U.S. government’s intelligence agencies — including the FBI, NSA, CIA and others — testified to lawmakers largely to answer their questions about the current state of global affairs.

Here’s what we learned from the hearing.

At least 74 countries use commercial spyware

In the last few years, the U.S. government turned its attention to the government spyware industry, currently made of companies like NSO Group and Intellexa, and previously Hacking Team and FinFisher. In its annual report, the intelligence community wrote that, “from 2011 to 2023, at least 74 countries contracted with private companies to obtain commercial spyware, which governments are increasingly using to target dissidents and journalists.”

The report does not clarify where the intelligence community got that number, and the Office of the Director of National Intelligence did not respond to a request for comment asking to clarify.

But last year, the Carnegie Endowment for International Peace, a Washington, D.C. think-tank, released a report on the global spyware industry that included the same number of countries as well as the same dates as the new intelligence community report. The Carnegie report, written by Steven Feldstein and Brian Kot, referenced data that the two collected, which they said came from sources such as digital rights groups and security researchers that have studied the spyware industry like Citizen Lab, the Electronic Frontier Foundation and Privacy International, as well as news reports.

It’s important to note that the Carnegie dataset, as the authors explained last year, includes what we refer to as government or commercial spyware, meaning tools to remotely hack and surveil targets remotely, such as those that NSO and Intellexa make. But it also includes digital forensic software used to extract data from phones and computers that are physically in the possession of the authorities. Two of the most well-known makers of this type of tools are Cellebrite and Grayshift, both of which are widely used in the United States as well as in other countries.

U.S. says it’s struggling to counter ransomware

The U.S. says ransomware is an ongoing risk to U.S. public services and critical infrastructure because cybercriminals associated with ransomware are “improving their attacks, extorting funds, disrupting critical services, and exposing sensitive data.”

Ransomware has become a global problem, with hacking gangs extorting companies in some cases millions of dollars in ransom payments to get their stolen files back. Some cybersecurity experts have called on governments to outright ban ransom payments as necessary to stop hackers profiteering from cybercrime.

But the U.S. has shunned that view and takes a different approach, opting to systematically disrupt, dismantle and sanction some of the worst offenders, who are based in Russia and outside of the reach of U.S. justice.

“Absent cooperative law enforcement from Russia or other countries that provide cyber criminals a safe haven or permissive environment, mitigation efforts will remain limited,” the threat assessment reads. In other words, until Russia — and a few other hostile states — give up their criminals, expect ransomware to continue to be the modern-day snow day.

U.S. warns of growing use of AI in influence operations

The use of generative AI in digital influence operations isn’t new, but the wide availability of AI tools is lowering the bar for malicious actors engaging in online influence operations, like election interference and generating deepfakes.

The rise of detailed and convincing deepfake imagery and video is playing its role in information warfare by deliberately sowing confusion and discord, citing Russia’s use of deepfake imagery against Ukraine on the battlefield.

“Russia’s influence actors have adapted their efforts to better hide their hand, and may use new technologies, such as generative AI, to improve their capabilities and reach into Western audiences,” warned the report.

This was something echoed by NSA cybersecurity director Rob Joyce earlier in January about how foreign hackers are using chatbot tools to generate more convincing phishing emails, but that AI is also useful for digital defense.

The report also noted that China is increasingly experimenting with generative AI, noting that TikTok accounts run by a Chinese military propaganda arm “reportedly targeted candidates from both political parties during the U.S. midterm election cycle in 2022.”

There are no laws limiting U.S. spies from buying Americans’ data

U.S. spy agencies have caught on to a popular practice: Why get a warrant for data when they can just buy it online? Given how much data we share from our phone apps (which many don’t give a second thought), U.S. spy agencies are simply buying up vast troves of Americans’ commercially available location data and internet traffic from the data brokers.

How is that legal? After a brief exchange with the head of the Defense Intelligence Agency — one of the agencies confirmed to have bought access to a database containing Americans’ location data — Sen. Ron Wyden noted that the practice was allowed because there is no constitutional or statutory limit on buying commercially available data.

In other words, U.S. spy agencies can keep buying data on Americans that is readily available for purchase until Congress puts a stop to the practice — even if the root of the problem is that data brokers shouldn’t have our data to begin with.