ExecutiveOrdersEO
EO 14093Executive OrderBiden · D Quiet signal

Executive Order 14093

Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security

This executive order prohibits U.S. government agencies from operationally using commercial spyware that poses significant counterintelligence, security, or human rights risks. It establishes a framework for interagency coordination through intelligence assessments, certification requirements, due diligence procedures, and reporting to ensure government use of spyware aligns with national security interests and democratic values.

Federal Register Open PDF 88 FR 18957

Impact dates

  1. First annual report on operational use due

  2. Agencies submit first implementation report to APNSA

  3. Agencies complete review of existing operational uses and discontinue prohibited uses

  4. Agencies develop internal controls and oversight procedures

  5. APNSA convenes interagency discussion after intelligence assessment

  6. DNI issues first classified intelligence assessment

Key directives

  • Prohibit operational use of commercial spyware posing significant counterintelligence, security, or improper use risks
  • DNI to issue classified intelligence assessment within 90 days, then semiannually
  • Agency heads must certify spyware safety before operational use; certification non-delegable
  • Agency heads must notify APNSA and wait 7 days before operational use
  • Review and discontinue existing prohibited operational uses within 90 days of intelligence assessment
  • Develop internal controls and oversight procedures within 180 days
  • Federal Acquisition Security Council to consider intelligence assessments for supply chain risk evaluation
  • Waiver authority limited to 1 year, with 72-hour presidential notification

Who is ordered

Timeline

Immediate

  • Prohibition on operational use takes effect for agencies making new determinations
  • Agencies must provide ongoing credible information to DNI

Near term (90d)

  • DNI must issue first classified intelligence assessment (by June 25, 2023)
  • Agencies must review existing operational uses and discontinue prohibited uses within 90 days of intelligence assessment
  • APNSA must convene interagency discussion within 30 days of intelligence assessment

Long term

  • Agencies must develop internal controls within 180 days (by September 23, 2023)
  • First implementation report due within 6 months (by September 27, 2023)
  • Annual reporting on operational use begins within 1 year (by March 27, 2024)
  • Semiannual intelligence assessments continue indefinitely

Risks & tensions

  • Certification and waiver authorities concentrated in senior officials (SecDef, AG, DHS, DNI, CIA Dir, NSA Dir) may create bottlenecks
  • 7-day APNSA notification delay before operational use could impede time-sensitive operations
  • Vague standard 'as soon as reasonably possible without compromising ongoing operations' for discontinuing prohibited uses allows agency discretion and potential delay
  • Scope limited to 'operational use'—testing, research, and countermeasure development exempted, creating potential loophole
  • Effectiveness depends on intelligence assessment quality and agency compliance with information sharing
  • May conflict with existing vendor relationships and classified procurement practices; waiver process (72-hour presidential notification) suggests anticipated exceptions
Executive Order 14093: Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security · Executive Orders