The surveillance industry is assisting state suppression. It must be stopped
Imagine a government with the power to spy on any critic, reporter or activist. A state with the capacity to extort or silence by tracking not just a person’s movements but her conversations, contacts, photos, notes, emails … the entire content of one’s digital life.
This may sound like something from dystopian fiction, but such targeted surveillance is a grim reality of the digital age. It is increasingly a tool of repressive governments to stifle debate, criticism and journalism. Over and over, researchers and journalists have been uncovering evidence of governments, with the help of private companies, inserting malware through surreptitious means into the smartphones, laptops and other devices belonging to people they are seeking to suppress: people who play essential roles in democratic life, facilitating the public’s right to information.
And it doesn’t end there – sometimes surveillance ends with the targets in detention, under physical assault or even murdered.
Just last month WhatsApp sued an Israeli surveillance company, the NSO Group, in a US court. The case alleges that the messaging platform was compromised by NSO technology, specifically to insert its signature product – spyware known as Pegasus – on to at least 1,400 devices, which enabled government surveillance (an allegation that NSO Group rejects).With Pegasus in their hands, governments have access to the seemingly endless amount of personal data in our pockets. The University of Toronto’s CitzenLab has found the Pegasus spyware used in 45 countries.
The global surveillance industry – in which the NSO Group is just one of many dozens, if not hundreds, of companies – appears to be out of control, unaccountable and unconstrained in providing governments with relatively low-cost access to the sorts of spying tools that only the most advanced state intelligence services previously were able to use.
The industry and its defenders will say this is a price to pay for confronting terrorism. We must sacrifice some liberty to protect our people from another 9/11, they argue. As one well-placed person claimed to me, such surveillance is “mandatory”; and, what’s more, it is “complicated, to protect privacy and human rights”.
All I can say is, give me a break. The companies hardly seem to be trying – and, more importantly, neither are the governments that could do something about it. In fact, governments have been happy to have these companies help them carry out this dirty work. This isn’t a question of governments using tools for lawful purposes and incidentally or inadvertently sweeping up some illegitimate targets: this is using spyware technology to target vulnerable yet vital people whom healthy democracies need to protect.
On the surface, it seems that constraining the global spyware industry could be impossible. The companies operate in an environment that brings together the shadowy worlds of intelligence and counter-terrorism, which are notoriously difficult for outsiders to penetrate or regulate. Many argue that constraining exports of such software would be folly, since Chinese surveillance companies will step in where western companies bow out. These are obstacles – but they are not arguments to avoid what has to be done to protect human rights. The push toward genuine reform must begin now, it must be global, and it should involve the following steps.
First, governments must indeed control the export of spyware. There are already existing frameworks to restrict the export of technology that has
military as well as commercial use. The most relevant, the so-called Wassenaar Arrangement, should be updated to go beyond “dual-use” technology, and cover spyware that is used to attack human rights. In turn, all governments will have to commit to implement globally agreed export controls.
For now, there is only one effective response in the face of such rampant abuse: stop all sales and transfers of the technology. In a report I presented to the UN in June, I called for an immediate moratorium on the transfer of spyware until viable international controls are in place. It is time for a genuine campaign to end unaccountable surveillance.
Second, companies must implement effective controls on their own technologies. The NSO Group, to its credit, has committed to observing the UN guidelines for businesses and human rights, but effective control means more than self-regulating policies. It means disclosure of clients and uses of technology, strict rules against misuse to violate human rights, regular monitoring, and kill switches where rights are violated. It also requires commitments from the companies not to transfer their technology to persistent human rights offenders nor to countries that lack rule-of-law controls on surveillance – and a refusal to support the use of the spyware for illegitimate purposes. These controls should be backed up by government sanctions for misuse.
Third, it is exceedingly difficult for the victims of spyware to hold governments, or the complicit companies, accountable for abuse and misuse.
Governments should make such legal actions possible, changing their laws to enable claims against companies or governments that are responsible for illegal surveillance – a kind of universal jurisdiction for lawsuits to control the spread of this pernicious technology.
There are few better examples of the dark side of the digital age than the private surveillance industry and its tools of repression. It is well past time to bring it under control.
• David Kaye is a law professor at the University of California, Irvine, the UN special rapporteur on freedom of expression, and the author of Speech Police: The Global Struggle to Govern the Internet
There is only one effective response in the face of such rampant abuse: stop all sales and transfers of the technology