“This industry seems to just keep growing,” said Eric Kind, director of AWO, a London-based data rights law firm and consulting agency. “Ten years ago, there were just a few companies. Now there are 20 or more, aggressively pitching their stuff at trade shows around the world.”

Jeff Bezos’ phone hacked after WhatsApp chat with Saudi Crown Prince Mohammed bin Salman

Spyware developers have maintained that they sell their technology to law enforcement and intelligence agencies to help catch criminals and terrorists. But as the surveillance trade has grown, it has been repeatedly criticised because its technology has been used to target activists, journalists and most recently, Bezos, the world’s richest person.

Last week, it was revealed that the smartphone of Bezos was allegedly compromised by spyware sent to him from a WhatsApp account belonging to Mohammed bin Salman, the crown prince of Saudi Arabia. The Saudi Embassy has denied the allegation.

While investigators have not identified the spyware that they suspect was used on Bezos’ iPhone, they cited NSO Group and Hacking Team as developing malware capable of such an attack. NSO has denied involvement, as has Memento Labs, which acquired the Hacking Team last year.

“Companies and governments make the argument that they need spyware tools in order to address counterterrorism and other kinds of violent crime,” David Kaye, the United Nations special rapporteur on freedom of opinion and expression, said on Thursday in an interview. “But the problem is you have no legal framework to ensure that when you sell and transfer the technology, it is actually used for those legitimate purposes and that it is used according to basic rule-of-law standards, such as surveillance only according to warrants issued by a court.”

Kaye and another UN expert, Agnes Callamard, the special rapporteur on summary executions and extrajudicial killings, said on January 22 that the allegations involving Bezos’ smartphone were “a concrete example of the harms that result from the unconstrained marketing, sale and use of spyware”. Kaye described the current spyware trade as a “free for all” and, along with Callamard, called for a moratorium on the global sale and transfer of private surveillance technology.

Rory Byrne, co-founder of Security First, an organisation that provides digital security advice to journalists and human rights activists, said he expected to see an uptick in episodes involving spyware as the technology spreads.

“The truth is, it’s becoming easier and easier and easier for governments to build the capability themselves or to just buy it off the shelf,” Byrne said.

Only a few countries – including the UK, Germany, Austria and Italy – have any kind of legal framework governing hacking by law enforcement, said Ilia Siatitsa, legal officer and director of the government programme at Privacy International.

iPhone hacking firm updates digital forensics tool after Apple refuses FBI request to unlock phones

In 2016, a new law in the UK expanded and defined how police and spies in the country could hack devices, which it termed “equipment interference”. The tactic must be approved either by a senior police chief or a government minister and then, in most cases, additionally authorised by a current or former High Court judge, known as a judicial commissioner.

In the US, the Federal Bureau of Investigation has since the late 1990s been using forms of spyware to gather information on electronic communication. The FBI has since obtained expanded powers to hack computers across the US, as long as it has obtained a search warrant from a judge to use the method.

In most countries, however, “there is not a clear picture of what governments are permitted by law to do” in terms of hacking, said Siatitsa. “The fact is that we don’t even know which governments are engaging in this. It’s very problematic. It goes against the international human rights framework, which requires that if there’s interference with our privacy, it must be explicitly provided for by law.”

Demand for the technology has increased among law enforcement agencies, who have turned to hacking as a method of spying on encrypted messages sent using popular apps such as WhatsApp, Signal and Telegram, Kind said. But other factors have made the technology appealing, too. Hacking allows law enforcement and intelligence agencies to maintain constant surveillance on targets who frequently travel internationally, according to Kind.

How to protect your smart home devices from hackers

“Hacking tools allow you to get access to all the communications on a device no matter where the target is in the world, no matter what platform they are using or who they are communicating with,” Kind said. “That’s why hacking is so attractive to governments. It’s a single tool that they can use to get access to all communications on your phone at one easy point of access.”

Italy’s GR Sistemi is among the companies that have marketed surveillance technology, offering government agencies a spyware system named “Dark Eagle”. Company marketing brochures, which were published by Privacy International, said the technology could be used to hack smartphones and computers, providing “full interception of Skype and other encrypted communication software”.

The Dark Eagle system can covertly capture images from a person’s webcam, record sent and received email, capture instant messenger conversations and monitor web traffic, according to the company’s documents. The company did not respond to a message seeking comment.

Israel’s Wintego Systems has offered its customers a spy tool that it claims can intercept Wi-fi traffic, steal their login credentials to their accounts, and extract “years of archived email, contacts, messages, calendars, and more”, according to company documents. A Wintego representative did not return messages seeking comment.

UN approves Russian-sponsored, China-backed bid on new cybercrime convention

India’s ClearTrail Technologies, meanwhile, has marketed a system named Astra, which it describes as a “remote infection and monitoring framework” and promises “non-traceable payload delivery”, according to documents published by Privacy International. Once ClearTrail’s spyware is delivered to a computer or mobile phone, it can gather data stored on the device, including location, screen shots, Skype calls and search history, according to the documents. The company did not return a message seeking comment.

Similar spyware tools have also allegedly been developed by Israel’s MerlinX, France’s Nexa Technologies, California-based SS8 Networks, according to company profiles and research reports, and Bloomberg News found at least a dozen other companies that appear to sell similar technology. MerlinX, Nexa and SS8 did not return a message seeking comment.

In recent years, some spyware developers have come under fire because their products have been sold to authoritarian governments whose security agencies have used the technology to target political opponents and critics.

FinFisher, which did not return a message seeking comment, has previously said its technology is necessary in the fight against terrorism and serious organised crime.

Spyware sold by Israel’s NSO Group has been linked to hacks that have targeted human rights activists, journalists and politicians in countries including Morocco, Saudi Arabia and Mexico. Similar technology sold by Italy’s Hacking Team has been traced to hacks on activists and journalists in countries including Morocco, Ethiopia and the United Arab Emirates. Both companies have said they sell their equipment to law enforcement and intelligence agencies to fight crime and terrorism.

“Our products are only used to investigate terror and serious crime,” an NSO spokesman said in a statement last week.

Memento Labs, which acquired Hacking Team, did not respond to a message seeking comment. But in a post on its LinkedIn page, the company said: “Memento Labs underlines its position in condemning any misuse of hacking technologies and capabilities, having always acted in compliance with all the relevant international laws.”

Governments that possess hacking technologies are more likely to use them to target high-profile individuals than ordinary citizens, according to Byrne, of Security First.

“You have to understand who is likely to target you,” Byrne said. “It’s important not to panic and become too paranoid.”