The United States has emerged as the largest investor in commercial spyware—a global industry that has enabled the covert surveillance of journalists, human rights defenders, politicians, diplomats, and others, posing grave threats to human rights and national security.
In 2024, 20 new US-based spyware investors were identified, bringing the total number of American backers of this technology to 31. This growth has largely outpaced other major investing countries such as Israel, Italy, and the United Kingdom, according to a new report published today by the Atlantic Council.
The study surveyed 561 entities across 46 countries between 1992 and 2024, identifying 34 new investors. This brings the total to 128, up from 94 in the dataset published last year.
The number of identified investors in the EU Single Market, plus Switzerland, stands at 31, with Italy—a key spyware hub—accounting for the largest share at 12. Investors based in Israel number 26.
US-based investors include major hedge funds D.E. Shaw & Co. and Millennium Management, prominent trading firm Jane Street, and mainstream financial-services company Ameriprise Financial—all of which, according to the Atlantic Council, have channeled funds to Israeli lawful-interception software provider Cognyte, a company allegedly linked to human rights abuses in Azerbaijan and Indonesia, among others.
Another notable example of a new US-based investment in spyware is the late-2024 acquisition of Israeli spyware vendor Paragon Solutions by AE Industrial Partners, a Florida-based, national-security-focused private equity firm. Paragon made headlines last week when its one-year contract with Immigration and Customs Enforcement (ICE)—first reported by WIRED in October 2024—was suddenly reactivated after a lengthy pause.
Civil society groups described the move by the Trump administration as “extremely troubling” and said it “compounds the civil liberties concerns surrounding the rapid and dramatic expansion of ICE’s budget and authority.”
Paragon was linked to alleged misconduct in Europe after WhatsApp reported that Italian journalists and civil society members had been targeted with its technology. An Italian parliamentary committee found that the government had used its Graphite spyware to only surveil human rights defenders. However, University of Toronto’s Citizen Lab confirmed the targeting of an Italian journalist and identified potential Paragon customers in Australia, Canada, Denmark, Cyprus, Singapore, and Israel.
Paragon, responding to the committee’s findings, accused Italian authorities of refusing to conduct a thorough technical verification—an assessment it argued could have resolved the issue.
Apart from focusing on investment, the Atlantic Council notes that the global spyware market is “growing and evolving,” with its dataset expanded to include four new vendors, seven new resellers or brokers, 10 new suppliers, and 55 new individuals linked to the industry.
Newly identified vendors include Israel’s Bindecy and Italy’s SIO. Among the resellers are front companies connected to NSO products, such as Panama’s KBH and Mexico’s Comercializadora de Soluciones Integrales Mecale, as highlighted by the Mexican government. New suppliers named include the UK’s Coretech Security and UAE’s ZeroZenX.