Informative report. 
The perspective is USA/Europe centric, but there is detailed information on the extent of the international surveillance/spyware industry.
TL;DR:
“Offensive cyber capabilities are becoming increasingly privatized. Governments no longer need to devote significant resources to develop offensive cyber capabilities in house—in fact, almost any government can buy capabilities to accomplish a range of national security objectives, including the surveillance of domestic groups,…”