A Senator Wants to Know How Federal Agencies Have Been Secretly Hacking People

Senator Ron Wyden has asked a federal watchdog agency to investigate how the FBI, the Drug Enforcement Administration, ICE's Homeland Security Investigations, and the Secret Service use hacking tools and spyware in criminal investigations. TechCrunch

In a letter dated August 21, 2026, Wyden said there is very little public information about how often these tools are used, how broadly they are deployed, and what rules keep them from being misused. Federal agencies have been using hacking tools for more than two decades. Wyden asked the Government Accountability Office, or GAO, to publish an unclassified report with its findings and recommendations.

The request fills a gap that Wyden identified directly. The government publishes annual statistics on phone wiretaps, but there is no comparable public record for hacking operations. Wyden said the Department of Justice and the FBI have repeatedly ignored congressional requests for more transparency across several presidential administrations.

The letter asks the GAO to look into several specific questions. Wyden wants to know whether federal agents have used hacking tools for unauthorized or personal reasons, and what safeguards exist to prevent that. He also asked the GAO to examine how agencies buy, store, and protect hacking tools so they do not leak out. And he wants to know whether agencies report security flaws they discover to a government program that decides whether those flaws should be fixed by tech companies or kept secret for use in investigations.

Wyden also asked the GAO to look at how agencies inform judges when they request permission to use hacking tools, and whether they tell judges about the risk that innocent people could be caught up in the process. When agents hack into a computer remotely, unlike tapping a specific phone line, they can accidentally access devices and data belonging to people who are not under investigation.

The letter pointed to the case of Peter Williams, a former executive at defense contractor L3Harris, who stole advanced hacking tools and sold them to a Russian broker. Those tools were later used by Russian intelligence services against Ukraine and by Chinese cybercriminals to steal from cryptocurrency owners. The case shows what can happen when government contractors do not keep tight control over hacking tools.

The earliest known FBI use of spyware dates to 1999, when the bureau installed software on the computer of Philadelphia mobster Nicodemo S. Scarfo that recorded every keystroke he made. The bureau was investigating illegal gambling and loan sharking. The software captured the password Scarfo used to protect his encrypted files, letting investigators read files they could not otherwise open. That operation set a precedent for law enforcement hacking that has continued for over 25 years with very little public information about its scale or oversight.

Wyden's request to the GAO is not a law and does not force anyone to act. It is a call for an audit that, if done, would produce findings and recommendations rather than enforceable rules. The GAO works at the direction of Congress but decides for itself how to prioritize its reviews.

The request stands out because it brings together several concerns that have usually been discussed separately. The letter covers how transparent agencies are about their hacking, how courts are involved, how internal misuse is prevented, whether security flaws are disclosed, and how the tools themselves are kept secure. Each of these topics has been debated by privacy advocates, security researchers, and law enforcement for years, but they have rarely been treated as one connected oversight question.

The question of whether to disclose security flaws is especially important. When agencies find a vulnerability — a weakness in software that could let someone break in — they can either tell the company so it can issue a fix, or keep it secret so they can use it themselves. A government process called the Vulnerabilities Equities Process is supposed to guide that decision. Critics have long said the process is not transparent and leans toward keeping flaws secret. Wyden's letter asks the GAO to check whether agencies that acquire hacking tools are submitting flaws to that process at all.

The concern about innocent people being affected also connects to an ongoing legal debate. A 2016 change to federal rules allows judges to issue warrants for remotely accessing computers outside their local area when the location is hidden by technology. Privacy advocates have argued that these warrants are approved routinely without judges being told enough about the methods used or the risk to people who are not targets.

Wyden's letter essentially asks the GAO to pull all of these threads into one public report. Whether the GAO takes up the review, and on what timeline, is up to the agency.

The broader context worth noting is that federal hacking tools have operated in a transparency void for over 25 years. Traditional surveillance like phone wiretaps comes with public statistics and a long paper trail. Government hacking, by contrast, sits in a grey zone where rules exist but the public record of how they are applied does not. Wyden's letter does not change that on its own, but if the GAO agrees to look into it, the resulting report could give lawmakers and the public a first systematic view of how often these tools are used, against whom, and with what safeguards — or whether agencies even keep the records needed to answer those questions.