Executive Order 14093: Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security
President: Joseph R. Biden Jr.
Prohibited federal operational use of commercial spyware posing counterintelligence, security or human-rights risks and required agencies to apply due-diligence safeguards and reporting.
Status: In effect. Is Executive Order 14093 still in effect? Yes. Executive Order 14093 remains in effect. The reviewed Federal Register disposition table records no revocation, and the signed order has no automatic expiration; its risk-screening, certification and reporting framework is continuing rather than a completed one-time report.
What does Executive Order 14093 do?
Biden prohibited federal operational use of commercial spyware when an agency determines that it poses significant counterintelligence, security or foreign-misuse risks. The policy addressed tools capable of accessing a computer without the user’s consent, extracting content, recording audio or video, or tracking location. It was not a prohibition on every cybersecurity program or every form of lawful surveillance. Signed text.
The risk assessment covers harm to US government systems or personnel and misuse against activists, journalists, dissidents and other people without lawful safeguards. Agencies must assess the vendor’s conduct and mitigation, not simply rely on a product’s name. They also cannot bypass the prohibition by requesting or directly enabling a third party’s operational use. A senior designated official must certify a permissible-use determination; the agency then notifies the National Security Adviser and ordinarily waits at least seven days before use. Signed text.
The order also created information-sharing and oversight duties, including an initial DNI assessment, subsequent semiannual assessments, review of existing use, internal controls and recurring agency reports. It permits specified nonoperational research and testing and narrowly conditioned waivers for extraordinary circumstances. It does not by itself sanction a vendor internationally or ban private possession of all spyware; export controls, sanctions and criminal law are separate legal mechanisms. Signed text.
Before and after
Before the order
Agencies had existing procurement and intelligence requirements, but this order imposed a uniform presidential risk framework across covered operational use. It required a new certification and notification process and examination of existing products. Buying a tool under an earlier contract no longer resolved whether its ongoing use met the new screening criteria. Signed text.
After the order
The order was signed March 27, 2023. On March 5, 2024, Treasury sanctioned members of the Intellexa consortium as part of the wider anti-spyware effort, using separate sanctions authority rather than an automatic consequence of this order. A March 18, 2024 international joint statement expanded commitments to counter misuse. Those complementary measures should not be confused with proof that every classified agency inventory or certification was publicly released; the official order anticipates sensitive intelligence and reporting. Official follow-up record 1. Official follow-up record 2.
Who had to do what
| Agency / office | Action | Timing / position |
|---|---|---|
| Agency heads | Screen proposed and existing spyware use, provide credible new vendor/risk information to DNI, submit determinations and notify the National Security Adviser before use; stop prohibited operational use and create controls and reports. | Use after at least seven days’ notice unless further process waived; existing-use review within 90 days after the DNI assessment; internal controls within 180 days; implementation report within six months; operational-use reports within one year and annually thereafter. |
| Director of National Intelligence | Issue classified integrated spyware-risk assessments, incorporate agency determinations and provide relevant procurement information across agencies. | Initial assessment within 90 days of signing; semiannual assessments thereafter. |
| National Security Adviser or designee | Convene agencies to consider the DNI assessment; receive use notifications, review findings, procurement notices and waiver justifications. | Meeting within 30 days of the assessment; nonoperational procurement notification within 45 days; waiver notification within 72 hours. |
| Federal Acquisition Security Council | Consider the DNI assessment in evaluating commercial-spyware supply-chain risk under its existing legal authority. | During relevant risk evaluations; no separate fixed deadline. |
| Secretary of Defense | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
| Attorney General (delegation only to Deputy Attorney General) | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
| Secretary of Homeland Security | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
| DNI acting as designated relevant official | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
| CIA Director | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
| NSA Director | Certify permissible operational-use determinations and, where extraordinary circumstances and lack of feasible alternative justify it, authorize a temporary waiver; notify the president through the National Security Adviser and notify DNI. | Certification before use; waiver not longer than one year; issue/revocation notification within 72 hours. |
What happened next
Biden signed the commercial-spyware operational-use safeguards. Official source
Treasury sanctioned Intellexa consortium members under separate sanctions authority as part of the broader anti-spyware response. Official source
Additional governments joined the international commitment against commercial-spyware proliferation and misuse. Official source
Legal and source detail
How it works legally
The framework must operate consistently with applicable intelligence and procurement law and section 6318 of the fiscal-year 2023 National Defense Authorization Act. Research, testing, cybersecurity analysis, countermeasure development and investigations of criminal sale or use are treated separately from operational use. A waiver requires extraordinary circumstances and no feasible alternative and cannot last more than one year. The order does not supply a new surveillance warrant, legalize unlawful interception or create a private cause of action. Classified assessments and reporting are not equivalent to public certification of any particular product. Signed text.
Sources by type
If a source is unavailable, first check the cited publisher or another official repository. The cited publisher remains the authority.
Primary and official sources
Orders, laws, court records and official implementation material.
How we checked this
Last checked against the sources above on September 9, 2026. How we research →