2025 opened with a predictable but still urgent rhythm: new forensic revelations about commercial spyware, policy moves attempting to corral the surveillance market, and shifting private sector practices that change how police find evidence. For reporters covering surveillance, the pattern is clear. The tools and their misuse keep evolving, and so must our methods for finding, verifying, and explaining harms.
What to watch on spyware. Investigations from digital forensics groups continue to be the primary engine of new reporting. In 2024 researchers documented fresh Pegasus infections and attempts that targeted journalists, lawyers, and human rights defenders in multiple countries, confirming that mercenary spyware remains a global newsroom story and a forensic beat priority. Reporters should partner with independent labs and advocacy groups to validate device compromises and to protect sources who may be targeted.
Policy and accountability moves. Governments are no longer passive. U.S. Treasury sanctions and a State Department visa policy aimed at those who misuse spyware signaled enforcement tools for surveillance abuse, while other agencies have placed spyware vendors on restricted lists. These developments give reporters new documentary footholds: sanctions filings, entity lists, and visa policy notices are public records to mine for attribution and motive.
Facial recognition litigation and limits remain headline material. The multidistrict litigation against a major facial recognition vendor progressed through settlement negotiations and court hearings in recent months. The MDL produced a complex settlement structure that has raised questions about monetary relief, injunctive measures, and the future business models of biometric startups. Reporters must read dockets and settlement papers closely because the arrangements being proposed now will shape access to biometric databases for years.
Ring, Neighbors, and the shifting landscape of police access. After pressure from civil liberties organizations and reporters, corporate tweaks to home-camera platforms changed how some datasets are catalogued and how police request footage. Mapping projects that track police-tech relationships are already updating their categories to reflect the rise of third-party investigative platforms that aggregate commercial data for law enforcement use. Those platforms deserve as much scrutiny as hardware makers because they create new chains of access to private footage and commercial data.
Regulating AI-driven surveillance. The EU AI Act is already changing the regulatory frame for high-risk AI, including certain surveillance applications. Early enforcement steps focus on banned practices and transparency obligations, creating documentary hooks for reporting on automated decision systems used by police and private investigators. Local and national governments outside Europe are watching closely, and reporters should follow regulatory guidance, code-of-practice drafts, and procurement documents to identify where AI systems intersect with surveillance.
What this means on the ground for journalists. First, strengthen operational security inside newsrooms. Use device hygiene and modern hardening measures when communicating with sensitive sources and when storing forensic artifacts. Second, develop repeatable forensic workflows: maintain relationships with reputable labs, document chain of custody for device images, and secure legal counsel for disclosure and source protection questions. Third, make the technical legible. Readers need clear explainers that show how a hack or a biometric match worked and why it matters for civil liberties.
How to report smarter. File records requests that target vendor contracts, training materials, and state procurement records for third-party investigative platforms. Crosscheck forensic claims with multiple labs before naming vendors or attributing harm. Use sanctions and regulatory filings as sources for attribution and timelines. Collaborate across newsrooms on large technical data sets because surveillance stories are often multinational and resource intensive.
Finally, push for usable remedies. Investigative coverage should not stop at naming harms. Report on practicable fixes: procurement rules that ban unvetted spyware, contract clauses that forbid resale of commercial camera footage, procedural safeguards for law enforcement use of TPIPs, and funding for independent forensic capacity in newsrooms and civil society. Good surveillance journalism is both watchdog and field guide. It identifies the risk and then maps the steps users, policymakers, and technologists can take to reduce it.