US courts will start publishing how often the government uses spyware

The FBI has hacked phones with spyware since 1998. For thirty-one years, the public knew it happened but never knew how often. That opacity ends in 2029, when the Administrative Office of the U.S. Courts publishes the first Wiretap Report that includes a "spyware/hacking" category. The report will count every time a judge authorized a wiretap executed through network investigative techniques — the government's euphemism for planting malware that siphons live Signal calls, WhatsApp messages, and other encrypted streams.

This is a victory for transparency, but a qualified one. The new data will capture only interceptions: real-time taps on communications in transit. It will not count the separate, arguably more invasive practice of remotely compromising a device to vacuum up stored photos, location logs, contact lists, and encrypted databases at rest. That activity falls under search-warrant authority, not wiretap law, and disappears into a statistical black hole. The distinction matters. A wiretap glances at the conversation; a device search ransacks the diary, the photo album, and the map of everywhere the target has been.

The judiciary's explanation for the decade-plus lag is pure bureaucracy. "Before the new data can appear in the annual report, reporting forms and procedures need to be updated to accommodate the new categories," a spokesperson told TechCrunch. Forms. Procedures. The FBI has deployed NITs against drug cartels, terrorists, and domestic criminals since the Clinton administration, yet the courts needed twenty-six years to redesign a form. That delay served power. Without numbers, oversight committees could not ask whether spyware warrants numbered in the dozens or the thousands. They could not test the government's assurances that these tools remain "extraordinary measures" against a rising tide of routine use.

Senator Ron Wyden forced the issue. His office pressed the Administrative Office for a commitment, and the judiciary responded with a timeline: the 2028 Wiretap Report, published in 2029, will carry the first figures. Wyden's leverage came from the Wiretap Report's existing credibility. Since 2003, the annual publication has broken down audio taps, oral bugs, and electronic message intercepts by jurisdiction, crime type, and issuing court. It is the only national ledger showing how often the state pierces the veil of private conversation. Adding spyware to that ledger forces the same granularity: which districts, which crimes, which judges.

The numbers will surprise no one inside the intelligence community. They will shock the public. A single wiretap once hoovered millions of text messages over three months. Multiply that by an unknown quantity of NIT authorizations and the scale of surveillance becomes visible for the first time. That visibility is the prerequisite for any democratic reckoning with the FBI's expanding toolkit. Encryption pushed the bureau from passive collection to active implantation. The legal framework — Title III of the Omnibus Crime Control Act — was written for copper wires, not zero-click exploits. Courts have stretched the statute to fit malware, but Congress has never debated whether the fit is legitimate or merely convenient.

Expect the first report to undercount. The new category applies only when a judge explicitly authorizes a wiretap via hacking. If investigators deploy spyware under a search warrant instead — arguing they seek stored data, not live comms — the wiretap report stays silent. The government already draws that line strategically. The distinction between "intercept" and "access" is a lawyer's artifice; the code on the phone does not care. But the statistics will care, and the gap will become the next battleground.

Wyden's office knows this. The senator's next move will likely be legislation requiring parallel reporting for device-intrusion searches. The judiciary's concession on wiretaps proves that shame works — eventually. Thirty-one years is a long eventually. The first spyware count will arrive in a world where the FBI has already moved toward supply-chain exploits, router implants, and AI-assisted attribution. The report will measure yesterday's battlefield. The fight now is to ensure the next accounting does not take another three decades.