CDT Europe welcomes the draft report issued on 8 November by Sophie in ‘t Veld, MEP and rapporteur for the European Parliament’s Committee of Inquiry on PEGASUS. The draft provides a strong basis for the probe to move forward.
The draft took on board a number of key recommendations from our testimony last month, such as the calls from CDT and other civil society organisations for an immediate moratorium on the sale, acquisition, transfer, and use of Spyware. Such swift action would be welcome and necessary. At the same time, as CDT highlighted, state-hacking tools, such as those the NSO group provided, enable an extraordinarily invasive and generalised form of surveillance, and therefore would de facto meet neither EU law standards nor the requirements under international human rights law. It will therefore be paramount that the guardrails and safeguards eventually introduced reflect the specific features of each Spyware, and, in cases such as NSO group tools, that complete prohibitions be considered.
The draft report also importantly challenges whether the EU’s Dual Use Regulation is fit for purpose as it calls for the repeal of all export licenses that are not fully in compliance with the ‘letter and the spirit of the law.’ This acknowledges that licenses have been issued under the Regulation despite considerable human rights risks. During our testimony, we detailed the loopholes in the Dual Use Regulation, some of which are at the heart of why the Regulation failed its ultimate test to protect against the export of such abusive Spyware. The draft report recognizes the need to re-open the Regulation in order to remedy these gaps, such as weakness in its transparency measures, an overly narrow definition of cyber-surveillance items, and ill-defined provisions on what constitutes a ‘serious human rights violation’.
CDT Europe focussed our recommendations to the Committee on the shortcomings of the due diligence provisions. We applaud the reference to the UN Guiding Principles on Business and Human Rights, but, at the same time, believe these should be baked into a revised version of the Dual Use Regulation, rather than dealt with separately, to ensure that their application is binding and specific in the particular context of export controls.
We also stressed during our intervention the need to protect the technology that enables secure communications in the first place, such as end-to-end encryption. We noted how the currently proposed Regulation on Child Sexual Abuse would undermine such protective technologies. The draft report takes this essential recommendation on board through its clear reference to the need to swiftly adopt the ePrivacy Regulation in line with case law on the restrictions for national security.
The draft report echoes our call for surveillance practices in Europe to be more generally brought under a stricter rule of law framework and stresses the need for judicial authorisation and review in cases of surveillance. It also evokes the jurisprudence of the European Court of Human Rights (not yet confirmed by the CJEU) that targeted persons have a right of notification after the surveillance has ended. This is a key element to ensuring any meaningful access to remedy and redress. The draft also rightly recognizes the need to comply with European law’s proportionality test – even, and especially, in cases where national security is at stake. We also note and appreciate that the draft report includes our recommendations to broaden the European Commission’s annual rule of law report to include reports of unlawful surveillance.
Whilst the report does again call on Europol to lead investigative efforts, which, as we highlighted, could be problematic given law enforcement’s potential conflicts of interest and duties in cases where such unlawful surveillance is state-sponsored, we welcome the more general acknowledgment throughout the draft report of the need for more independent oversight. This would include, but not be limited to, stronger powers for national governments and the European Parliament to investigate allegations.
Overall, the draft report is a positive step. We look forward to further engagement with the Committee, in particular, to share with it the findings of our ongoing research into the effectiveness of the EU Dual Use Regulation.