Spyware accountability through software liability framework

Atlantic Council proposes safe-harbor legislation to incentivize technology companies to detect and notify users of spyware infections by shielding them from products-liability suits.

This Atlantic Council report examines the failure of existing legal mechanisms to hold spyware vendors accountable for human rights abuses and national security harms. Over 80 countries have procured spyware tools targeting journalists, activists, dissidents, and opposition figures. Litigation against spyware vendors has achieved limited success—no US or UK victim lawsuit has reached final judgment against a spyware vendor, despite cases like WhatsApp's $167M jury award against NSO Group remaining in ongoing appeal. The report identifies four barriers to accountability: victims' lack of awareness of compromise (spyware is designed to be undetectable), the deliberate obscurity of the spyware market through vendor name-changes and jurisdictional arbitrage, jurisdictional hurdles in establishing which courts can hear claims, and the risk that litigation discovery exposes threat-detection methods to vendors, enabling them to evade future detection. The authors propose a legislative safe-harbor framework that would shield compliant technology companies from products-liability claims related to spyware, contingent on their meeting standards including comprehensive threat notification, rapid vulnerability patching, responsible information-sharing with researchers, and enhanced security features for high-risk users. The framework acknowledges that perfect security against nation-state actors is not feasible, and aims to align incentives toward proactive mitigation rather than penalizing inevitable exploitation.

Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/404-accountability-not-found-spyware-accountability-through-software-liability