Cybersecurity Policy Report, Digital Rights Groups Seek EU Restrictions on Spyware, (Feb 22, 2023)
European Union lawmakers should impose strict controls on the use of commercial spyware and take enforcement actions against member states that deploy spyware against journalists and dissidents, according to a coalition of digital rights advocates.
In comments filed yesterday with the European Parliament’s Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware (PEGA), European Digital Rights (EDRi) called for a “ban on state hacking unless the operation meets eleven fundamental, cumulative and non-negotiable conditions.”
Those conditions include, among other things, that state-sponsored hacking should be used only to investigate the most serious crimes and national security threats.
“Only investigation and prosecution of extremely severe crimes, in narrowly defined and exceptional circumstances, could justify as legitimate aims in a democratic society the deployment of spyware,” it said.
“We firmly believe that many hacking methods developed and currently available on the market, including the use of spyware as investigated by the PEGA Committee, do not meet by nature these eleven conditions, in particular the necessity and proportionality test,” EDRi said.
“No safeguard can mitigate the human rights violations they entail. Therefore, we strongly encourage the PEGA Committee to call for a ban on spyware technologies that risk affecting the essence of or that excessively interfere with fundamental rights as soon as possible in the European Union,” the group said.
The PEGA committee was formed last year to investigate the use by EU member states of spyware, including Pegasus, a surveillance tool provided by NSO Group Technologies Ltd. The committee has issued a draft report, and EDRi, which is a coalition of more than 47 digital rights groups, said it welcomed many of the committee’s proposals.
EDRi cited a recent decision by the Court of Justice of the European Union that called for restrictions on how law enforcement and national security agencies collect and use data in investigations.
“The national security exception [for hacking and surveillance] cannot become the rule and render inapplicable the protections afforded by EU secondary law read in the light of Articles 7, 8 and 11 and Article 52(1) of the EU Charter of Fundamental Rights. Member States may therefore only implement surveillance measures if they are consistent with EU law,” it said.
EDRI also called for, among other things, a ban on “commercial trade” in cyber vulnerabilities and an obligation to disclose the findings of vulnerability research. New vulnerabilities discovered by researchers and government agencies—known as “zero-day” vulnerabilities—are frequently sold in secret transactions or retained by agencies for use in cyber operations.
“Whatever actions the EU will take to regulate state hacking practices, it will likely have an important impact on the debates and political developments taking place at the international level,” EDRi said.
“It is therefore crucial to reiterate Europe’s leadership in privacy and data protection and build a strong and clear legal framework that can serve as a benchmark internationally,” it added. “For that, the EU must not shy away from drawing strict red lines by prohibiting methods and practices that are irreconcilable with fundamental rights, standards and international legal instruments.”
EDRi’s membership includes accessnow, Amnesty International, the Committee to Protect Journalists, the Electronic Frontier Foundation, and the Electronic Privacy Information Center, among others.
News: InternationalLegislation DataPrivacy DataSecurity