Sanctioned Surveillance Firms and the Western Companies Still Supplying Them

The US government has blacklisted the world’s best-known surveillance companies, from Chinese camera and facial recognition makers such as Hikvision, Dahua and SenseTime to spyware vendors NSO Group, Candiru and Intellexa. But each sanction tool restricts something different, and none of them cuts a company off from Western technology entirely. Investigations have documented Western cloud hosting, retail distribution, app-store availability and investment that continued to reach some of these firms after they were listed.

Main US actions against surveillance firms

The reasons differ by group. The 2019 Chinese listings cited involvement in human rights abuses in China’s campaign against Uyghurs and other Muslim minorities in Xinjiang (Federal Register, 2019). Treasury said a SenseTime subsidiary had developed facial recognition that could determine a target’s ethnicity, with a focus on Uyghurs (Treasury, 2021). For NSO Group and Candiru, Commerce found they supplied spyware to foreign governments that used it to target officials, journalists, activists, academics and embassy staff (Federal Register, 2021).

What each sanction restricts

News coverage uses “sanctioned” loosely, but the four main US tools work very differently:

These differences explain how Western companies can still deal with listed firms. Most Chinese surveillance firms are on the Entity List rather than the SDN list, so US companies need a license to send them regulated technology, but buying their cameras, hosting their apps or serving their customers is not automatically prohibited. Among the firms covered here, only the Intellexa consortium faces full SDN asset blocking.

Documented Western ties after listing

None of these cases, as reported, involved a court finding that a Western company broke sanctions law.

Amazon’s cloud and retail ties

IPVM’s 2022 investigation found that Amazon’s cloud division ran backend infrastructure for Hikvision and Dahua remote-viewing platforms, while its marketplace sold the companies’ products under other brand names (IPVM, 2022). Amazon told IPVM it complies with applicable laws, including Section 889 of the 2019 NDAA. Senator Marco Rubio responded by calling for an investigation. IPVM’s report is a snapshot from 2022; we could not verify whether these arrangements have changed since.

Relabeling and government buyers

White labeling can hide a sanctioned manufacturer even from government purchasing systems. A year before the Amazon report, IPVM traced Hikvision and Dahua products sold through the GSA Advantage portal under other brands to federal buyers, despite the procurement ban. Contractors said they had been misled by distributors, and GSA said it relied on contractor certifications and was improving checks (IPVM, 2021).

App stores

Entity List rules govern exports to the listed companies; they do not by themselves stop consumers from downloading a listed company’s software. When we checked on October 1, 2026, Hikvision’s Hik-Connect consumer app was still listed on Google Play with more than 50 million downloads (Google Play, 2026). We did not test the app’s data flows.

Western ties to spyware vendors

Spyware shows the most direct Western involvement. Intellexa was set up as an EU-based alliance, and the 2023 Predator Files investigation by Amnesty International and the European Investigative Collaborations network concluded that European states had failed to regulate the trade (Amnesty International, 2023). Treasury says Predator can infect devices through one-click and zero-click attacks and give operators access to messages, photos, location and microphone recordings (Treasury, 2024).

NSO Group, still on the Entity List, came under US majority ownership in October 2025. The company said its headquarters and core operations remain in Israel (TechCrunch, 2025). As of our check of the Federal Register on October 1, 2026, we found no notice removing NSO Group from the Entity List.

Western tech firms have also exposed and fought spyware vendors. Microsoft and Citizen Lab exposed Candiru in 2021, and Microsoft patched two Windows zero-days the company had exploited; Microsoft counted at least 100 victims in countries including Spain and the UK (Citizen Lab, 2021). In WhatsApp’s lawsuit against NSO, a US jury awarded more than $167 million in 2025; the judge later cut damages to about $4 million but permanently barred NSO from targeting WhatsApp (TechCrunch, 2025).

What this means for you

• Check who really made your camera. Relabeled Hikvision and Dahua products have been sold under other brands, and firmware pages, FCC IDs and companion apps often reveal the original manufacturer.
• Know what a companion app connects to. A camera’s app and cloud service decide where your footage goes, so prefer local recording if you are uncomfortable with a vendor’s cloud.
• Keep phones and computers updated. Candiru’s attacks relied on Windows zero-days that Microsoft later patched, and Predator uses one-click and zero-click exploits; installing security updates promptly closes known holes.
• If you invest, note that US persons cannot buy securities of NS-CMIC-listed companies, and check fund holdings if this matters to you.
• Most listed surveillance firms still sell worldwide, so “sanctioned” does not mean “gone.” The sanctions mainly limit what Americans can sell them or invest in.

Methodology

The sanctions table is based on Federal Register documents (retrieved from govinfo.gov) and US Treasury press releases; we also checked the Federal Register for later removal notices for NSO Group and Intellexa entities. Evidence of Western ties comes from IPVM investigations, Amnesty International’s Predator Files work, Citizen Lab, TechCrunch and our own check of a Google Play listing on October 1, 2026.

Sanctions lists change, so confirm current status on the official Commerce and OFAC lists. Reports that some Intellexa-linked individuals were later delisted could not be confirmed from an official source during our research, so only designations are reported here. The investigations cited are snapshots in time, and the companies named may have changed practices since. Allegations about chip or component supply that we could not verify from an accessible primary or investigative source are left out. Inclusion of a company here does not imply it violated any law.