Courts Add Spyware Counts to Wiretap Reports After Decades

US federal courts will add a dedicated spyware and hacking category to the annual Wiretap Report, giving the first public count of how often judges authorize network investigative techniques for live intercepts. Data collection begins with calendar year 2028; the numbers appear in the 2029 report.

The Administrative Office of the US Courts confirmed the change to TechCrunch and to Senator Ron Wyden. It closes a long statistical blind spot while leaving most remote device searches outside the ledger.

A New Line on the Old Wiretap Form

Court reporting forms nationwide will be updated so every judge-approved use of spyware or hacking tools for real-time interception is logged. The government calls these tools network investigative techniques, or NITs. They let agents capture calls and messages on encrypted apps such as Signal and WhatsApp before encryption locks the content.

The metric applies only to live wiretaps. It does not cover remote hacks that pull stored photos, files or location data from a device. Those operations travel under search-warrant rules, a separate legal track that stays off the Wiretap Report.

A spokesperson for the Administrative Office told TechCrunch the report is assembled from individual forms filed across the country all year. Forms and procedures must be revised before the new category can appear.

• Covered: spyware or NITs used to intercept ongoing communications (calls, texts, messages) in real time.
• Not covered: remote extraction of stored data, files, photos or location history from a device.
• First data year: 2028 authorizations, published in the 2029 Wiretap Report.

That distinction matters because encryption has already shifted investigative practice. Traditional network taps increasingly hit undecryptable traffic, pushing agents toward device-level tools.

Nearly Three Decades Without a Public Tally

The FBI has used hacking techniques and spyware for intercepts since at least 1998. Early public references include a high-profile organized-crime investigation that relied on keystroke-logging software installed under warrant. For almost thirty years those methods sat outside the published statistics.

Meanwhile the judiciary has issued annual Wiretap Reports published by the judiciary for nearly two decades under a congressional mandate that itself dates to Title III of the 1968 Omnibus Crime Control and Safe Streets Act. The reports already break out federal versus state orders, offense type, duration, cost, and whether the intercept was wire, oral or electronic. They never marked when the method of capture was itself a hack.

Encryption statistics inside recent reports already hinted at the gap. In 2025, officials encountered encryption on 296 federal wiretaps and could not decrypt 269 of them. State wiretaps showed encryption on 229 intercepts, with 217 left undeciphered. Those figures do not prove NIT use, yet they show why agents reach for tools that sit on the device rather than on the wire.

What the Existing Numbers Already Show

The latest full report supplies the baseline against which the new spyware line will eventually be read. Total authorized wiretaps fell sharply even before any NIT category existed.

According to the official summary, 1,735 wiretaps authorized in 2025 marked a 24 percent drop from the prior year. Federal authorizations fell 32 percent; state authorizations fell 14 percent. The Drug Enforcement Administration alone dropped from 1,157 to 416 after clearing a backlog the year before. Narcotics remained the lead offense category at 51 percent of applications. Average cost of a reported wiretap rose to $92,963.

Arrests linked to terminated wiretaps edged up to 5,633 while convictions fell to 503. The reports already document heavy message volumes on individual taps, sometimes hundreds of thousands of intercepts on a single order. None of those tables yet isolate how many of the electronic intercepts required a prior NIT implant.

Encryption Made the Old Taps Less Reliable

The 2025 numbers on encryption supply context for why a spyware category is arriving now. Agents still obtain traditional orders, but a growing share of the traffic they seek is unreadable without access on the endpoint.

• 296 federal wiretaps encountered encryption; 269 could not be decrypted.
• 229 state wiretaps encountered encryption; 217 remained undeciphered.
• Average original order still runs 30 days, with extensions common; some multi-extension taps last more than 300 days.

Crowd discussion of the new category quickly noted the practical implication: if traditional electronic taps increasingly return ciphertext, the uncounted NIT route becomes the real working method for encrypted messaging apps. Publishing the live-intercept spyware count will at least make that substitution visible. It will not reveal how often agents simply seize the phone and extract everything under a search warrant instead.

Advocates Call It Overdue, Then Point to the Gaps

Senator Ron Wyden has pressed for exactly this disclosure since 2017. He told TechCrunch the public remains largely in the dark about government spying methods and thanked the courts for agreeing to collect and publish the hacking data. He immediately added that Congress still needs to pass broader legislation.

Being able to point to a report saying that spyware was used X number of times will help with accountability, especially if it turns out that number is quite high. It’s hard to say that you’re using spyware as a surgical tool when you’ve deployed it tens of thousands of times.

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, made that point to TechCrunch. Brett Max Kaufman of the ACLU called the change an important and long-overdue step that should produce better-informed policy.

The same voices flag the remaining holes. Remote device searches stay invisible. The three-year lag before any number appears means today’s volume remains opaque. And the category still sits inside a reporting system built for telephone-era intercepts rather than software implants that can persist and pivot.

First Look in 2029, With Italy Already Public

Forms must be rewritten and procedures trained across federal and state courts. Collection therefore starts with 2028 orders. The first report containing the spyware/hacking line reaches the public in 2029.

Italy already publishes comparable figures. In 2023 Italian authorities logged spyware use against 4,321 targets. That single-year total gives American researchers a rough international reference point once the US series begins. Whether the American NIT wiretap count lands closer to hundreds or to thousands will shape the next round of oversight fights.

Until then the only hard numbers remain the traditional ones: falling overall authorizations, stubborn encryption encounter rates, and rising per-tap costs. The new line will sit beside those figures and force a comparison that has never been possible before.

Title III Reporting Still Leaves Larger Blind Spots

The Wiretap Report exists because 18 U.S.C. § 2519 requires the Administrative Office to tally applications, orders, extensions, offenses, locations, costs and results for wire, oral and electronic intercepts. It excludes Foreign Intelligence Surveillance Act activity. Supplementary reports later capture arrests and convictions that lag the original intercept year.

1. 1968, Title III creates the statutory reporting duty.
2. 1998 onward, FBI develops and deploys early NITs and keyloggers under warrant; no separate public tally.
3. 2017, Wyden begins formal push for hacking transparency in wiretap statistics.
4. February 2026, Wyden, Daines, Booker and Lee reintroduce the Government Surveillance Transparency Act.
5. August 2026, Administrative Office confirms the spyware/hacking category for 2028 data.
6. 2029, First published NIT wiretap numbers expected.

The Government Surveillance Transparency Act reintroduced in 2026 would go further. It would expand the annual reports to stored communications, metadata and gag orders, require eventual notice to targets, and end indefinite sealing of many surveillance dockets. That bill has not passed. The spyware category is an administrative step inside existing authority, not a full statutory rewrite.

When the 2029 report lands, lawmakers and researchers will finally have a denominator for live NIT intercepts. They will still lack a public count of the device searches that often accompany or replace them. The historical reporting system has caught up one step. The next steps remain political.

Frequently Asked Questions

What are network investigative techniques or NITs?

NITs are government hacking tools and commercial spyware used to gain access to a target device or network so agents can intercept communications or identify a user. In the wiretap context they typically install code that captures messages or calls before end-to-end encryption is applied, allowing real-time monitoring of apps that would otherwise be opaque on the wire.

What exactly will the new spyware category count?

It counts only judge-authorized uses of spyware or hacking tools to perform a live intercept of ongoing communications. Remote searches that extract already-stored content, photos, files or location history from a phone fall under different warrant procedures and will not appear in the Wiretap Report category.

When will the first public spyware wiretap numbers appear?

Data collection begins with calendar-year 2028 authorizations. The Administrative Office will publish those figures inside the annual Wiretap Report released in 2029, after forms and procedures have been updated across all reporting jurisdictions.

How long has the FBI used spyware or hacking tools for intercepts?

Public reporting and case history place the start of systematic FBI use of these techniques at least as early as 1998, when agents employed keystroke-logging and related methods under warrant in criminal investigations. No separate official tally of frequency has existed until the new category.

Does any other country already publish spyware use numbers?

Italy does. Public Italian data recorded spyware deployment against 4,321 targets in 2023, giving researchers an existing international benchmark once the first US Wiretap Report figures become available.

Will the Wiretap Report still exclude intelligence surveillance?

Yes. The report is limited to Title III criminal intercepts of wire, oral or electronic communications. Activity conducted under the Foreign Intelligence Surveillance Act remains outside its scope and will stay uncounted in these statistics.