The Atlantic Council has released its second yearly report: “Mythical Beasts: Exploring the Depths of the Global Spyware Market.”

There is too much enriching information to condense, but here are two highlights:

Initially, the authors discovered a marked increase in the quantity of US-based investors in spyware over the last year, compared to the sample size of the spyware market documented in the first Mythical Beasts project. In the inaugural edition, the United States ranked as the second-largest investor in the spyware sector, trailing Israel. In that version, twelve investors were identified as being based in the United States—­compared to this second edition, where twenty new US-based investors were noted as financing the spyware field in 2024. This signifies a considerable growth in US-based investments in spyware for 2024, propelling the United States to become the foremost investor in this subset of the spyware market. This is significant in magnitude, as US-based investment from 2023 to 2024 substantially surpassed that of other prominent investing countries highlighted in the first dataset, such as Italy, Israel, and the United Kingdom. It also underscores a significant disparity, pointing to the evident enforcement gap between the influx of US dollars and the policy measures instituted by the US. Despite multiple policy actions from the US, like the inclusion of spyware vendors on the Entity List, alongside the broader global leadership the United States has exhibited via sanctions and diplomatic efforts, US investments persist in financing the very entities that US policymakers are striving to counter.

Secondly, the authors expanded on the vital function that resellers and brokers fulfill within the spyware market, noting that this group remains significantly under-examined. These entities serve as intermediaries, concealing the relationships between vendors, suppliers, and purchasers. Frequently, intermediaries link vendors to emerging regional markets. Their representation in the dataset is likely underrepresented due to the ambiguous nature of brokers and resellers, rendering corporate structures and jurisdictional arbitrage more intricate and difficult to untangle. While their increase in the second edition of the Mythical Beasts project could be attributed to a broader, more comprehensive data-gathering initiative, there is insufficient reporting on resellers and brokers, leaving these entities not systematically comprehended. As noted in the inaugural report, the operations of these suppliers and brokers highlight a crucial information deficit for proponents of more effective policies centered on national security and human rights. These findings bring the current landscape of the spyware market and the larger cyber-proliferation realm into sharper relief, reinforcing the necessity to study and highlight these actors who otherwise obstruct the transparency and accountability efforts by both state and non-state entities within the spyware market.

Excellent work. Review the entire document.