This order says federal agencies may not use commercial spyware when credible information shows it would create significant counterintelligence or security risks for the U.S. government, or significant risks that a foreign government or foreign person could misuse it. It defines commercial spyware a