US adds two European surveillance firms to export control list

By Jarrett Renshaw, David Shepardson and Karen Freifeld

WASHINGTON (Reuters) -The U.S. Commerce Department on Tuesday added two European-based surveillance firms to its economic trade blacklist as part of efforts by President Joe Biden’s administration to counter the misuse of commercial spyware.

The department added Hungary-based surveillance company Cytrox and Greece-based cyber-surveillance firm Intellexa, along with an Intellexa-related entity in Ireland and a Cytrox-related entity in North Macedonia.

Cytrox and Intellexa are two of a number of firms that provide clients with the ability to hack into smartphones and other devices, giving them intimate access to their targets’ private data. Like their better-known competitor, Israel’s NSO Group, they have been implicated in abusive surveillance.

The Commerce Department said the companies were being added “for trafficking in cyber exploits used to gain access to information systems, thereby threatening the privacy and security of individuals and organizations worldwide.”

Cytrox and Intellexa did not immediately reply to requests for comment.

Reuters reported last year that a Greek prosecutor opened an investigation into an allegation by a journalist that his smartphone had been infected by surveillance software in an operation by the country’s intelligence service. The journalist told Reuters he believed his phone had been infected by Predator spyware developed by Cytrox and said the Predator spyware is sold in Greece by Intellexa.

Reuters reported in 2021 that Predator was found on the phone of exiled Egyptian opposition figure Ayman Nour. It reported in 2020 that Intellexa was working with intelligence agencies in Southeast Asia and Europe.

Officials and lawmakers on both sides of the Atlantic are taking a harder look at spyware merchants who sell their wares to authoritarian countries and democracies alike.

A senior British minister said in April there were “more and more adversaries able to buy and sell sophisticated cyber tools” that could be deployed to cause “serious damage.”

(Reporting by Jarrett Renshaw, David Shepardson and Karen Freifeld; Additional reporting by Raphael Satter; Editing by Doina Chiacu and Will Dunham)