What prompted Democratic Senator Ron Wyden on August 21, 2026, to ask the U.S. Government Accountability Office (GAO) for an unclassified, comprehensive review of how the FBI, Drug Enforcement Administration, ICE’s Homeland Security Investigations, and Secret Service use hacking

Wyden’s request was prompted by what he described as a long-running accountability gap: federal agencies have used highly intrusive hacking and spyware capabilities for decades, yet Congress and the public lack even the basic reporting, safeguards, and judicial-disclosure information available for more conventional surveillance. 712

• Unlike wiretaps and pen-register/trap-and-trace surveillance, federal agencies do not publicly issue annual statistics on hacking operations—leaving the frequency, purpose, scope, and collateral effects of such intrusions unknown. 167
• Wyden said DOJ and the FBI had repeatedly failed to provide the greater transparency Congress sought, so an independent, unclassified GAO review was necessary. 712
• He was concerned both with civil-liberties risks—such as hacking devices belonging to unidentified or innocent people—and with whether judges receive enough technical information to evaluate warrants properly. 712
• The request also reflected cybersecurity and insider-threat concerns. The alleged theft and sale of sophisticated L3Harris tools by former executive Peter Williams illustrated how government-grade capabilities can escape control and be repurposed by hostile foreign actors and criminals.
• Wyden placed the issue in historical context: the FBI’s documented use of keystroke-logging malware in the 1999 Scarfo investigation showed that federal computer intrusion is not new, but its oversight and transparency mechanisms have not kept pace. 712

In short, he sought GAO scrutiny because powerful surveillance exploits can expose deeply private data and create systemic security risks, while the government has provided insufficient evidence that their use, storage, vulnerability handling, court presentations, and internal controls are adequately constrained.