The Treasury Department last week removed three individuals connected to a commercial spyware operation from the U.S. sanctions list, according to an update released by the department.
The Office of Foreign Assets Control removed Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou from its list of specially designated nationals. All three had been linked to the Intellexa Consortium, the company behind the Predator commercial spyware platform.
Hamou was sanctioned in March 2024, while Harpaz and Gambazzi were added in September 2024 as part of the Biden administration’s broader effort to curb the development and spread of commercial spyware.
At the time, U.S. officials accused Intellexa of enabling the proliferation of surveillance technologies to authoritarian regimes and alleged that its software had been used to covertly monitor U.S. government officials, journalists, and policy experts.
Founded in 2019, the Intellexa Consortium has operated as a marketing umbrella for several offensive cyber companies offering spyware and surveillance tools. Marketed under the Predator brand, the technology can infiltrate electronic devices through so-called zero-click attacks, which require no action by the user. Once installed, the spyware can extract data, track a device’s location and access applications and personal information, including messages, call logs, contacts, microphone recordings, and stored media.
The decision to lift sanctions on the three individuals prompted criticism from researchers and digital rights advocates.
Natalia Krapiva, senior tech-legal counsel at Access Now, said on the social platform X that the government should explain the rationale behind the move.
“The public deserves to know why,” Krapiva wrote, warning that removing sanctions without clear justification could signal that targeting U.S. officials and journalists carries limited consequences.
John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, also questioned the decision, saying it was unclear whether the delisted individuals had ceased involvement in sanctioned activities.
“Did delisted individuals fully step away from sanctioned activities? When? What are their economic activities now?” Scott-Railton wrote, citing reports of continued efforts to evade sanctions within the broader Predator ecosystem.
The Treasury Department noted the removals Dec. 30 alongside other sanctions actions but did not provide an explanation. The department did not immediately respond to a request for comment.