A regular citizen (typically a jealous lover) can do this too. Ikeymonitor is an example.
My point is that if a regular person can do this, the CIA can do much more.
Ikeymonitor can turn on camera, video, microphone, record all calls and messaging, even social media platforms, key loggers reveal passwords, tracks locations and the user never sees any signs of this. In fact, unless you know what to look for, you can't even find it in the device to remove it if you knew it was there.