Urgent need to escape the surveillance technology jungle

The “Pegasus Project” investigation has shown that the Pegasus spyware developed by the Israeli company NSO Group is systematically used for surveillance that violates the most fundamental human rights safeguards. Just the number of journalists targeted by this technology – nearly 200 – confirms the degree to which the surveillance technology sector is escaping regulation.

The Wassenaar Arrangement – which is the main multilateral agreement for controlling the exportation of dual-use products and technology and which dates back to 1996 – has once again proved largely inadequate and inoperative.

There are many reasons for this, starting with its area of application, which is not limited to surveillance technology and covers all types of dual-use products and technology, and its purpose, which is to regulate them in their entirety, treating them all as one, rather than treating each type separately. Its legal scope is limited and it lacks any independent control mechanism. It groups only 40 countries, which don’t include two dual-use exporting countries, Israel and Cyprus. And it functions by consensus, giving each participating government a right of veto, which encourages minimal regulation.

The European Union’s 2009 Dual-Use Regulation was finally updated in a laborious process completed in March and is due to take effect in September. Inspired by the Wassenaar Arrangement, and without any influence on exporting states that are not parties to the regulation, it will not suffice to fill the gaps.

“The law of the jungle cannot prevail any longer,” said Iris de Villars, the head of RSF’s Tech Desk. “The Pegasus affair must serve as the trigger for adopting a general moratorium on the surveillance technology exports and for starting work on an international regulation worthy of the name.”

On 19 July, RSF asked democratic governments to impose an immediate moratorium on the sale of surveillance technology until safeguards have been established to prevent its oppressive use. And on 21 July, RSF urged the Israeli Prime Minister to impose an immediate moratorium on surveillance technology exports until a protective regulatory framework has been established.

The announcement by the head of the Knesset’s foreign affairs and defence committee on 23 July that a panel was being set up to review export licences was a step in the right direction but nothing indicates that this unilateral review will lead to guarantees that the same will not happen again in the future.

RSF recommends the development of a global legal framework for regulating surveillance technology based on the UN Guiding Principles on Business and Human Rights and providing for adaptation to national legislation.

Legislative reforms are needed in all the countries concerned in order to impose a due diligence requirement as regards human rights on companies that produce and export this technology.

Companies should be required to identify, prevent and mitigate the potential and actual negative effects of their activities and value chain on human rights, and to report publicly and regularly on the obstacles encountered and the measures taken, with the possibility of being held criminally liable if they fail to do so.

Governments should be required to publish at least quarterly information on the surveillance technology export licences they have approved or denied, and to include information about the nature of the equipment, a description of the product, the country of destination, the end user and the final use.

Governments must also improve their capacity to investigate the circumvention of export controls when there are serious grounds for suspecting that human rights violations have been committed using exported surveillance technology.

RSF will join initiatives calling for a moratorium and aimed at beginning work on drafting international regulations of this kind.