Mobile phones are becoming more essential and more powerful. But they aren’t keeping up with phone spyware, which is getting more aggressive and harder to detect. As it does, an unsettling vision of the future is arising: One where we all carry surveillance devices without intending to. It sounds dystopian, but that future is more or less arriving now. The mobile devices of politicians, human rights defenders, journalists, and other individuals have been compromised — all by so-called Pegasus spyware made by Israeli company NSO Group, which the Commerce Department blacklisted last year. This advanced spyware can be installed on devices through what are called “zero-click” vulnerabilities, where the spyware installs itself without the targeted individual clicking on a malicious link or doing anything to activate it. And once Pegasus has infiltrated a phone, there’s no easy way to tell it’s there. So who’s protecting you? Mobile-phone makers are some of the biggest and most sophisticated software makers on the planet, and they're worried. "A world where nobody can trust the phone in their pockets…that’s such a dangerous world," says Shane Huntley, the director of Google’s Threat Analysis Group. Apple took steps Wednesday to secure devices of users targeted by spyware, including launching “Lockdown Mode,” which blocks most message attachments, further secures web browsing, and blocks incoming calls if the user hasn’t previously interacted with the caller. Apple will offer up to $2 million bounties to threat researchers who find vulnerabilities in Lockdown Mode. Google warns customers whose devices are compromised by spyware, and keeps its Google Play Protect program updated to alert customers about potentially dangerous apps on their phones. Verizon claims to use anti-spyware software to protect devices. NSO claims that Pegasus can’t be used with U.S. numbers, but the danger has already grown well beyond a single company. Google has said it is tracking more than 30 groups selling vulnerabilities or surveillance capabilities. And last month, Google said Italian company RCS Labs was behind spyware found on phones in Italy and Kazakhstan. As politicians find their phones at increasing risk of compromise and spyware rises to the public’s attention, there may be a role for Capitol Hill to play. Sen. Ron Wyden (D-Ore.), a member of the Senate Intelligence Committee, told me that Congress needs to pass legislation “to set enforceable cybersecurity standards” for mobile devices, force the Federal Communications Commission to require phone companies to patch vulnerabilities and sanction spyware companies like NSO. “The U.S. government can do a lot to fight back against foreign hackers, predators and criminals who use spyware to stalk Americans,” Wyden said. “Unfortunately, its response has been far too little, far too late to protect American families or our national security.”
| 
