Spyware accountability through software liability framework
Atlantic Council proposes safe-harbor legislation to incentivize technology companies to detect and notify users of spyware infections by shielding them from products-liability suits.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Atlantic Council report examines the failure of existing legal mechanisms to hold spyware vendors accountable for human rights abuses and national security harms. Over 80 countries have procured spyware tools targeting journalists, activists, dissidents, and opposition figures. Litigation against spyware vendors has achieved limited success—no US or UK victim lawsuit has reached final judgment against a spyware vendor, despite cases like WhatsApp's $167M jury award against NSO Group remaining in ongoing appeal. The report identifies four barriers to accountability: victims' lack of awareness of compromise (spyware is designed to be undetectable), the deliberate obscurity of the spyware market through vendor name-changes and jurisdictional arbitrage, jurisdictional hurdles in establishing which courts can hear claims, and the risk that litigation discovery exposes threat-detection methods to vendors, enabling them to evade future detection. The authors propose a legislative safe-harbor framework that would shield compliant technology companies from products-liability claims related to spyware, contingent on their meeting standards including comprehensive threat notification, rapid vulnerability patching, responsible information-sharing with researchers, and enhanced security features for high-risk users. The framework acknowledges that perfect security against nation-state actors is not feasible, and aims to align incentives toward proactive mitigation rather than penalizing inevitable exploitation.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/404-accountability-not-found-spyware-accountability-through-software-liability
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs