Skip to Content

EU Contractor Security & Surveillance Program

Protecting Encryption & EU Dual Use Export Controls to Support Human Rights


The Centre for Democracy and Technology (CDT), based in Washington, D.C. and Brussels, is a leading technology policy organisation that fights to put democracy and human rights at the center of the digital revolution. As a 27-year old 501(c)3 nonpartisan nonprofit organisation, CDT works to promote democratic values by shaping technology policy and architecture, with a focus on equity and justice. 

The Centre for Democracy & Technology, Europe’s Security & Surveillance Program works at the European-level to ensure that people are free from unwarranted surveillance. In line with international human rights law standards, we advocate that government surveillance should have strict, independent oversight and checks against bias. We also believe that the European Union and its Member States should play a positive role in global debates on better protections against such surveillance, in line with the EU’s own human rights foreign policy.

To support this work, CDT is seeking a consultant to contribute to two projects. Depending on the background of the applying contractors, CDT may decide to award each project to different contractors. Contractors can also choose to apply for one or both projects in accordance with their availability and expertise.

Project A: Research scoping project on the implementation of the recast of the EU’s Dual Use Regulation to support human rights

In response to concerns about the export of cyber surveillance technologies to rights-abusing countries during the uprisings across the Middle East and Northern Africa, it was agreed that the EU’s Dual Use Regulation needed to be updated. After lengthy negotiations, the recast Dual Use Regulation entered into force on 9 September 2021. However, the recast still left room for improvement. In particular, the recast included a narrow definition of cyber surveillance, included a weak catch-all control clause for unlisted cyber surveillance items, and failed to provide criteria to determine what would count as a ‘serious human rights violation’ when considering issuing export licenses. Furthermore, the due diligence provisions imposed on larger exports were not inline with international human rights standards in relation to business and human rights. The Pegasus scandal has since rocked the globe and exposed the perils of unlawful government surveillance facilitated by tech companies. At least two EU member states have been accused of having allowed NSO Group to successfully export from their States. 

CDT Europe would like to engage in a research project examining the Dual Use Regulation, especially as it is being looked at as a potential international model. The questions we would like to explore include: what do recent events tell us about the loopholes and failures in the Dual Use Regulation system? Are the practical measures to help fully implement the Regulation as suggested by civil society at the time of agreement of the recast being implemented?

The framework of this consultancy would be to complete an initial scoping project that would help define an eventual more extensive research report.


The consultant would produce a maximum 15-page scoping paper which would explore the following:

  • A summary of the existing research and conclusions about the implementation of the Dual Use Regulation.
  • A thought-through recommendation on which four EU countries would make strategic sense to do further research with regard to the implementation of the Dual Use Regulation.
  • An analysis of the current quality of consultations between the Dual-Use Coordination Group (DUCG) and civil society and academia.
  • A list of stakeholders that should be included for interview or consultation in the final research project.
  • A collection of existing reported cases over the past three years where the Regulation failed to prevent export of cyber surveillance technologies that were used to violate human rights.
  • A definition of the more precise research questions on which the final project should focus, with the overall aim of identifying the current weaknesses in the Dual Use Regulation, and formulating recommendations on what an effective international export control regime should include.


The research scoping paper should be completed in approximately 8 weeks (the “research period”) with the following tasks:

  • Kick-off meeting
  • Desk research
  • Partial draft of the paper provided to CDT after approximately 3 weeks of the research period, with a follow up check-in meeting to discuss feedback and next steps.
  • Complete draft of the paper provided to CDT after approximately 6 weeks of the research period, with a follow up check-in meeting.
  • Additional research or meetings based on follow-up questions from CDT in weeks 7 and 8 of the research period, with final version of the paper to be provided at the end of week 8.

Project B: Analysis and advocacy support on our project to protect encryption in EU laws

The European Commission has proposed a Regulation to Combat Child Sexual Abuse Material Online. The draft Regulation has such a broad scope, applying to both hosting services and providers of internal communications, and mandating scanning of all communications, that, in its current draft, it very concerningly amounts to giving a mass surveillance mandate to law enforcement authorities. The proposal would also effectively break end-to-end encryption, with dire consequences to democracy worldwide. 


The Consultant would support CDT Europe’s advocacy on this file by:

  • Providing technical and legal analysis on the text as the legislative process progresses.
  • Consulting with NGOs engaged on this file, including organisations dedicated to protecting children, and with the CDT office in Washington, D.C.
  • Providing input with technical knowledge and expertise about the shortcomings of scanning technologies during convenings with stakeholders.
  • Providing at least two blog posts analyzing provisions of the proposal and suggesting amendments to protect human rights.
  • Monitoring developments on the file, and supporting CDT’s advocacy.


  • The negotiations on the CSA file are expected to run from September 2022 until at least Autumn 2024; the contract would cover a maximum number of days within this period to be determined. 

To Apply

Please submit a CV, a writing sample and details of your consultancy rate to [email protected].

All selected applicants will be interviewed by telephone/video call, during which time we may ask interviewees to submit references or a writing sample.

Due to the large number of applications we receive, only applicants selected for interviews will be contacted.

The Center for Democracy & Technology is an equal opportunity employer, and does not discriminate on the basis of race, gender, ethnicity, sexual or gender orientation, religion, or disability.