Spyware makers express concern after US sanctions spyware veteran

Earlier this week, the U.S. government announced sanctions against the founder of a controversial government spyware maker, Tal Dilian, and his business associate, Sara Aleksandra Fayssal Hamou.

In announcing the sanctions, U.S. Treasury officials accused Dilian and Hamou of developing and selling spyware that was then used to target Americans, including U.S. government employees, as well as policy experts and journalists — actions that enabled human rights violations around the world.

The move was the first of its kind. Until now, the U.S. government had targeted spyware companies — not the individuals who head them — putting them on blocklists and imposing sanctions that prevent any U.S. person or company from financing or transacting with them. But from now on, it seems like the gloves are off. If the U.S. government thinks someone sold spyware to authoritarians and dictators, or their company’s spyware was used against the wrong targets, it will go directly after the people running those spyware companies.

And people who used to work in the government spyware industry expressed concern.

“Wow. That’s big,” said a former head of a spyware maker that sold to governments, when TechCrunch shared the news of the sanctions with him.

The person, who like others quoted in this story spoke on the condition of anonymity, said that he was concerned, but at the same time he was confident his former company followed regulations and did things the right way, unlike Dilian, the founder of Intellexa, which the Treasury also sanctioned.

“He sold to anyone who was willing to pay,” said the former spyware head.

The person also added that — in his opinion — Dilian made a mistake when trying to get around the restrictions previously imposed on his company by the U.S. government. In 2023, the Biden administration put Dilian’s companies Intellexa and Cytrox on a blocklist called the “entities list.” Once a company is on this list, U.S. businesses and individuals to export certain goods, which can include software, to the blocklisted company anymore.

“I think this is what pissed off the Americans,” said the former spyware head.

Another person who used to work in the spyware industry said that Dilian “moves like an elephant in a crystal shop,” implying Dilian’s activities were not concealed, if not brazen.

“In that particular space of spyware sellers you have to be extremely balanced and attentive…but he didn’t care,” the person said.

At the same time, the person said he is happy to have left the industry, because the times have changed.

According to a third person working in the spyware industry, the sanctions against Dilian and his business associate Hamou should make the whole market have a moment of reflection.

“If I had to come back to work actively in this industry, and I couldn’t find an exclusive customer that is extremely trustworthy, [sanctions] would be a risk,” the third person said. “A company, however serious, can never be 100% sure about how its customers act, and the political developments that can embroil them.”

Before this week’s sanctions, the last action the U.S. government took against spyware makers was to announce that the State Department could impose travel bans and visa restrictions for people involved in facilitating or enabling abuses with spyware.

Prior to this in 2021, the U.S. Department of Commerce added to its blocklist NSO Group, an Israel-based spyware maker whose tools have been documented to have been used against journalists, politicians, dissidents and human rights defenders in several countries like Hungary, Mexico, Poland, Saudi Arabia and Spain. Two years later, in 2023, Cytrox and Intellexa were also put on the same list as NSO Group.

Given that, just like Intellexa, NSO Group and Candiru — another Israeli spyware maker — were put on the denylist, it would make sense for the U.S. government to target the founders and executives of these two other companies.

But it’s unclear if the people running those companies are concerned.

Dilian could not be reached for comment. Hamou did not respond to a request for comment.

A previous version of this story mischaracterized the impact when a company is added to the entities list.