Why U.S. Courts Are Adding a Spyware Category to Wiretap Reports

The Administrative Office of the U.S. Courts confirmed this week that it will begin tracking a new “spyware/hacking” surveillance category in its annual Wiretap Report, starting with the 2028 edition to be published in 2029. The report has been issued for almost two decades and already breaks down authorized wiretaps by federal or state authority, state, crime type and other data.

Wiretaps let law enforcement obtain real-time access to calls, messages and other communications, and because they are highly invasive, judges require a relatively high evidence bar before authorizing them. The new category is designed to capture live interception carried out with hacking tools or spyware—including calls and messages on apps such as Signal and WhatsApp—which the FBI refers to as network investigative techniques, or NITs.

Senator Ron Wyden, who has pushed for this disclosure since 2017, welcomed the move as a step against “unnecessary secrecy.” Privacy advocates at the Electronic Frontier Foundation and the American Civil Liberties Union also supported the change, while noting it will not cover remote searches that extract stored data such as images, files and location from a device.

What the New Spyware Count Will and Won’t Reveal

The Wiretap-Search Distinction Limits the New Number

The new category will only capture cases in which a judge authorizes spyware or hacking tools to intercept communications in real time, not cases in which authorities remotely break into a phone to retrieve stored files or location data. The latter is legally treated as a search and falls outside the Wiretap Report, so the published figure will not be a complete count of government hacking.

Why Senator Wyden and Civil Liberties Groups Wanted a Baseline

Wyden has argued since 2017 that the public is “largely in the dark” about electronic surveillance. EFF cybersecurity director Eva Galperin said a public number will make it harder for the government to deny spyware use, and that deploying spyware tens of thousands of times would be hard to describe as a “surgical tool.” ACLU senior counsel Brett Max Kaufman called the change an important, overdue transparency step that should lead to better-informed policy.

What the Italy Comparison Can and Cannot Tell Us

Italy already publishes spyware data and reported use against 4,321 targets in 2023. That gives civil-liberties researchers a rough international benchmark, but legal definitions, population size and reporting systems differ enough that direct comparisons to future U.S. totals could mislead. The U.S. number will become useful primarily as a domestic baseline over time.

What Citizens, Researchers and Lawmakers Can Expect Next

  • Expect the first data in 2029, not sooner. The Administrative Office said the new category will start with the 2028 Wiretap Report, published the following year, after reporting forms and procedures are updated.
  • Do not read the new figure as total government hacking. It will count only live interception of communications through spyware or hacking tools; remote searches that extract stored data such as images, files and location remain outside the Wiretap Report.
  • Use the Italy baseline cautiously. Italy reported spyware use against 4,321 targets in 2023, but legal definitions and reporting systems differ, so direct comparisons to future U.S. totals may be misleading.
  • The Government Surveillance Transparency Act is the next lever. Senator Wyden and others reintroduced the bill earlier this year; it would require broader disclosure than the courts’ administrative change, so the transparency debate is not settled.