The Global Spyware Market Index

More than 3,000 people in 73 countries have been targeted in state-sponsored spyware attacks since 2015. 76% of the companies responsible for manufacturing the technology are based in Europe, the U.S. and Israel.
Spyware Market Index Header Image
Samuel Woodhams
Christine O'Donnell
Samuel Woodhams & Christine O'Donnell

As new reports regarding the sale, transfer and use of spyware emerge we will update this page to reflect the latest figures.

Key Findings

  • 73 countries have bought and/or used invasive spyware technology since 2015.
  • Spyware firms: 78% are based in countries considered full or flawed democracies by the EIU.
  • Suspected customers: 54% are authoritarian or hybrid regimes, with only 8% considered full democracies.
  • FinFisher has the most reported state customers (34), followed by Circles (25), and NSO Group (23).
  • Spyware targets: more than 3,000 have been identified, although the true figure is likely far higher.
  • Activists & dissidents have been targeted in 25 countries, followed by political figures (23) and journalists (17).

Introduction

Since 2015, 73 governments around the world have purchased and/or used invasive spyware manufactured by 17 companies. Europe and the U.S. are home to almost 50% of these companies. When combined with Israel, the figure rises to 76%.

Their customers are predominantly repressive regimes looking for new ways to control the flow of information and stifle dissent. Less than 10% of suspected customers are considered full democracies by the Economist Intelligence Unit.

This report reveals how companies based in economically developed and largely democratic states are profiting from exporting highly invasive surveillance technologies to repressive regimes where its misuse is likely.

We analyzed almost 100 reports and articles published since 2015 and documented approximately 250 individual transactions between governments and private companies. While some of these deals may have been made before 2015, they were not unearthed until more recently.

The findings provide a comprehensive view of this largely unrestricted and highly secretive market and demonstrate the need for meaningful regulation and increased transparency within the sector.

The technologies discussed in this report can all secretly monitor someone’s digital activity from afar. They range from highly sophisticated and expensive exploits such as NSO’s “zero-click attacks” to those that exploit widespread vulnerabilities in telecommunication protocols.

The impact of these tools on civil society is increasingly well known, with the likes of NSO Group becoming household names due to their alleged role selling invasive tools to repressive regimes that use them to track down and silence dissidents. Despite growing evidence, most of the companies named in this report have vehemently denied enabling human rights abuses.

“The private surveillance industry is a free-for-all… States and industry are collaborating in the spread of technology that is causing immediate and regular harm to individuals and organisations that are essential to democratic life” – David Kaye, former UN Special Rapporteur on Freedom of Expression

The true number of those impacted by spyware is almost impossible to discern, particularly given that many people will fall victim to the technology and not notice.

Despite this, we have found over 3,000 individuals that have been affected. While their precise identities are often concealed due to security concerns, many of those identified are prominent figures that play an important role in defending freedom of expression and promoting human rights.

Activists & dissidents were the most frequently targeted, followed by government officials and journalists. We also discovered that spyware had been used to target individuals across nation state boundaries at least 85 times, including the targeting of Rwandan political figures based in Belgium.

This report shows that despite repeated criticisms and attempted regulation, the commercial spyware industry continues to grow unabated. Estimated to be worth $12 billion, it is clear more needs to be done to reign in the industry to protect human rights and safeguard freedom of expression.

Spyware Vendors

The following table shows the five largest spyware companies based on the number of suspected customers.

Details of our full findings are available on this Google data sheet.

FinFisher GmbH / Gamma Group

Location: Germany (Previously UK & Germany)
Number of suspected customers: 33
Client regime type: 6% full democracies

FinSpy is a highly intrusive spyware suite initially manufactured by UK headquartered Gamma Group. Production of the spyware shifted to FinFisher GmbH in 2013, a Germany-based company.

Since its inception, the company has sold invasive surveillance tools to governments and state agencies around the world. Once infected, a victim’s device is silently monitored in real time allowing the end-user to intercept communications, access private data, monitor geolocation, and record audio and video.

The company gained notoriety when it was revealed that the company had sold FinSpy to the Egyptian government’s State Security Investigations Service. The intelligence body was known for committing egregious human rights abuses during Hosni Mubarak’s rule. Since then, researchers have documented the repeated abuse of the company’s spyware against activists and political opponents in authoritarian countries such as Ethiopia, Turkey and Uganda.

In 2019, Reporters Without Borders alleged the company was responsible for enabling Turkish authorities to target journalists and oppositional voices in the country. The following year, the company’s headquarters were raided by police after it was reported that the company had been exporting its technology without the relevant licences.

Circles

Location: Israel
Number of suspected customers: 25
Client regime type: 12% full democracies

Circles is a lesser-known company in the surveillance industry. According to a recent report by the University of Toronto’s Citizen Lab, it has sold its equipment to at least 25 countries including several countries with poor human rights records such as Nigeria, UAE and Vietnam.

Leaked documents show the system is designed to exploit telecommunication protocol vulnerabilities. Customers can akso purchase a separate system called “Circles Cloud.” This tool allows users to connect to telecommunication companies’ infrastructure around the world.

Such attacks are known as Signaling System 7 (SS7) Attacks. They allow an end user to capture information including voice calls, messages and live location information.

The researchers also found that the government agencies connected to the Circles’ technology have a history of exploiting digital surveillance methods for human rights abuses. Such wide-reaching surveillance continues an established pattern of international intimidation, where dissidents and exiled citizens fear for their safety irrespective of which country they are in.

NSO Group

Location: Israel
Number of suspected customers: 23
Client regime type: 10% full democracies

Founded in 2010, the Israel-based NSO group has built a reputation for providing one of the most “sophisticated pieces of cyberespionage software” ever seen.

The company’s most well known software, Pegasus, is capable of covertly tracking every detail of a target’s digital activity, giving the user access to a target’s camera, files and even encrypted messages. The malware is traditionally delivered via a carefully designed phishing message, although details of “zero-click exploits” have recently emerged.

The company is renowned for selling its technology to governments globally and its spyware has been frequently linked to human rights abuses in countries including Mexico, UAE and Rwanda.

Despite the numerous lawsuits and investigations surrounding the use of Pegasus against human rights activists, journalists and dissidents, NSO still claims that its technology is sold to carefully vetted customers intended to fight terrorism and crime.

In one of the biggest revelations to date, an internal investigation by WhatsApp revealed 1,400 devices had been infected with Pegasus in 2019. NSO Group is part-owned by London-based investment firm, Novalpina Capital. The transaction valued NSO at $1 billion in 2019.

Suspected State Actors

This table shows the countries with the most extensive and varied spyware arsenals based on the number of different vendors from whom they are reported to have purchased technology.

Details of our full findings are available on this Google data sheet.

Mexico

Over the past decade, Mexico has become renwoned for its use of spyware. We found Mexico, along with the UAE, to have the most spyware tools in their arsenal. Authorities in Mexico are reported to have access to tech made by Ability Inc., Circles, and NSO Group as well as Hacking Team and FinFisher.

Mexico have reportedly been NSO Group’s biggest customer, spending $80 million on their surveillance technologies between 2011 and 2017.

NSO’s products have reportedly been used against some of the country’s most outspoken human rights lawyers, journalists and anti-corruption activists. In 2020, Mexico was deemed the most dangerous place for journalists by the Committee to Protect Journalists, with nine journalists killed last year alone.

It has even been suggested that the authorities with access to spyware may end up supplying it to organised crime groups. According to a statement provided by a Mexican official to the Cartel Project, “The police who have the technology would just sell it to the cartels.”

UAE

The United Arab Emirates is reported to have purchased spyware from Circles, FinFisher, Hacking Team and NSO Group. The country even has its own bespoke hack-for-hire team from cybersecurity firm DarkMatter, which uses a cutting-edge hacking platform known as Karma.

The Emirates were Hacking Team’s second-biggest clients, behind only Morocco, reportedly paying the company more than $634,500 to target 1,100 devices with spyware in 2015. Moreover, leaked contracts suggested a total licensing fee of at least $18 million for NSO Group’s surveillance software.

The rise in surveillance technology in the Middle East has had serious implications for pro-democracy activists in the region. Ahmed Mansoor, a prominent human rights activist, has reportedly been repeatedly targeted with spyware. Researchers found that his devices had been digitally targeted with technology made by FinFisher, Hacking Team and NSO Group over recent years.

Political espionage has also been a dominant driving force behind the UAE’s use of spyware. The Emirati target list has reportedly included Saudi Arabia’s Prince Mutaib bin Abdullah, Lebanon’s Prime Minister Saad Hariri and Sheikh Tamim bin Hamad of Qatar.

Morocco

Digital attacks have been symptomatic of a larger trend of increasingly repressive governance in Morocco. A 2015 leak of Italian spyware vendor Hacking Team’s emails revealed that the Moroccan government had spent close to $4 million on the company’s Remote Control System (RCS) software.

“Surveillance in Morocco is carried out in an open and brazen way… Surveillance is a type of punishment. You can’t behave freely. It is part of their strategy to make you suspect you’re being watched so you feel like you’re under pressure all the time.” – Abdessadak El Bouchattaoui, Moroccan Human Rights Defender

A 2020 report by Amnesty International revealed a sustained campaign by the Moroccan government to spy on prominent journalist and activist, Omar Radi, using NSO Group’s Pegasus. The revelation came just days after NSO had pledged to prevent its products being used to target human right defenders.

Targets

The following table displays the types of individuals targeted with spyware and the countries where they were located at the time of attack.

Details of our full findings are available on this Google data sheet.

Activists & Dissidents

It is of little surprise that human rights defenders, activists and dissidents are the most frequently targeted group given the repressive governments who have purchased the technology. These individuals are vital in promoting freedom of expression and democratic ideals, something many repressive regimes would rather silence than listen to.

Omar Abdulaziz

Omar Abdulaziz is a prominent pro-democracy Saudi activist who resides in Canada.

According to a lawsuit filed by Abdulaziz, the Saudi royal court allegedly had access to Jamal Khashoggi’s communications with Abdulaziz as they’d installed NSO’s spyware on his phone.

The exploit was later confirmed with “high confidence” by research group Citizen Lab. They identified the end user as an operator linked to the government of Saudi Arabia. The spyware attack on Abdulaziz took place in summer of 2018, just months prior to the assassination of Khashoggi in the Saudi consulate in Istanbul.

Maati Monjib and Abdessadak El Bouchattaoui

Two human rights defenders from Morocco were reportedly targeted with NSO Group’s Pegasus spyware, according to a 2019 report by Amnesty International. The findings detail the two victims as Maati Monjib, a historian and activist advocating for freedom of expression, and Abdessadak El Bouchattaoui, a human rights lawyer.

Monjib has faced repeated reprisals from the Moroccan state. In 2015 he was accused of “endangering state security” under Article 206 of the Penal Code and most recently has been sentenced to 1 year in prison on charges of money laundering. Bouchattaoui similarly faced imprisonment in 2017 after his vocal criticism of the use of excessive force by authorities during the 2016/2017 popular uprisings which led to the arrest of 400 protestors. He has been living in exile in France since 2018.

Political Figures

Political figures have frequently found themselves entangled in political cyberespionage campaigns in countries were political debate is stifled or seen as a threat to the authoritarian status quo.

Faustin Rukundo, Frank Ntwali & Placide Kayumba

According to a 2019 Financial Times report, three prominent Rwandan opposition party members were revealed to have been targeted with NSO Group’s Pegasus spyware.

Rukundo and Ntwali are both members of the of the Rwanda National Congress, an exiled opposition group, while Kayumba is a Belgium-based member of Rwanda’s FDU-Inkingi opposition coalition. Under the current presidency of Paul Kagame, critics of the government or ruling party of the Rwandan Patriotic Front have often been reported as missing or dead in unexplained circumstances around the world, with three colleagues of Kayumba’s FDU-Inkingi group disappearing in 2019 alone.

“It’s a grave violation… All of my colleagues at the centre of the part are monitored and threatened on a daily basis with assassination, disappearance, imprisonment.” – Placide Kayumba

Roger Torrent

Roger Torrent and at least two other pro-independence Catalan politicians were reportedly targeted with NSO’s Pegasus spyware in what was believed to be the first use of spyware to target a political figure in a European democracy,

The Spanish Interior Ministry, National Police and Civil Guard claim that they never hired the services of the NSO Group, while the Spanish Intelligence agency commented that it “always acts in clear accordance with the law”.

Journalists

Journalists are frequently targeted due to their role criticising governments with poor human rights records. As Ron Deibert of Citizen Lab has written: “The reckless and abusive use of commercial spyware to target journalists, their associates, and their families adds to the numerous and growing risks that journalists worldwide now face… Thanks to companies like NSO Group, unscrupulous dictators and autocrats now have a powerful tool to aid in their sinister aims to stifle dissent and quell controversial reporting.”

Ben Hubbard

In 2018, The New York Times’ correspondent, Ben Hubbard, received a suspicious text message. He was working and reporting from Saudi Arabia when he received a text that read: “Ben Hubbard and the story of the Saudi royal family.” Later, researchers at Citizen Lab determined that the text included an exploit link for Pegasus. He was the first American journalist to have been targeted with the technology. Fortunately, Hubbard did not open the link and was therefore not affected.

Alejandro Santos

In January 2020, it was reported that the Colombian military had purchased an invasive spyware tool from Mollitiam Industries, a Spanish cyberintelligence firm.

The company was listed as one of Reporters Without Borders’ 20/2020 list of press freedom’s digital predators after it was alleged the military have used the tool to “spy on supreme court judges, politicians, journalists and journalists’ sources.” The targets are said to include Alejandro Santos, the editor of the news magazine, Semana.

Methodology

We analyzed close to 100 documents, news articles and reports published since 2015 documenting the spyware manufacturer, suspected end user and all available information regarding the targets. We used rankings from the Economist Intelligence Unit and Freedom House to provide further analysis of both vendor country and the regime type of those purchasing the technology.

Access the The Global Spyware Market Index raw data on this Google Sheet.

The authors of all our investigations abide by the journalists’ code of conduct.