Software that surreptitiously installs itself on a mobile phone e they monitor every action of its owner, facial recognition systems and other forms of biometric identification, from walking analysis to iris scanning: the business of digital surveillance, which includes these and many other applications, has never been so thriving.
However, these are technologies that, if misused, can jeopardize the freedom of expression, confidentiality and the very freedom of individuals. And in the absence of certain and shared rules, a moratorium on their use is needed: it states this in a note a group of experts from the Office of the United Nations High Commissioner for Human Rights, taking a cue from the recent scandal sparked by the Pegasus smartphone surveillance software, from the Israeli company Nso Group.
a Amnesty International and Forbidden Stories report, released in July, highlighted how authoritarian governments around the world use the program to illegally control hundreds (if not thousands) of politicians, journalists and human rights activists.
tutorial
Privacy, 10 easy countermeasures to better defend ourselves
by Emanuele Capone
Human rights at risk
This can have a deleterious effect on the work of those monitored, and put the lives of many people at risk. How can investigative reporters keep the identity of their sources hidden, who often ask for anonymity for fear of reprisals, when their mobile phone book and every call made are visible to those who spy on them? How can activists be safe if their every move is tracked, putting them at risk of targeted arrests or assassinations?
For this reason, in the UN note, the Special Rapporteurs on the promotion and protection of the right to freedom of expression, on the situation of human rights defenders and on the freedom of assembly and association they underline how surveillance software can “endanger the lives of hundreds of individuals and the freedom of the media and undermine democracy, peace, security and international cooperation”.
It is not only Pegasus who is under accusation. A couple of years ago, for example, it turned out that the German firm FinFisher had sold to the Turkish government without permission, products then used to monitor opponents. Last September, Amnesty International revealed that French, Dutch and Swedish companies they provided the Chinese government with technologies useful for his mass surveillance programs.
The Israeli spy software is of particular concern due to the high degree of refinement (it is able to intercept everything that passes through the mobile phone, such as chats, calls, messages, geo-location) and for the installation methods, which are almost impossible to capture. Malware exploits so-called Zero-Day vulnerabilities, flaws in the operating system or a specific application that the manufacturer is not aware of and therefore cannot repair. An unanswered call via a messaging app may suffice or a fake message of which no trace remains to virtually take possession of the victim’s smartphone.
Despite Nso have readily denied any involvement in any malicious use of the spyware, the rapporteurs ask that the company demonstrate that it has carried out the necessary checks on the reliability of its customers and make the results of these internal investigations public.
The ambiguous relationship between controlled and controllers
In short: the appeal of the Special Rapporteurs comes loud and clear but the concrete risk is that it is the classic voice that rises in the desert.
Two years ago, the then Special Rapporteur on Freedom of Opinion and Expression, David Kaye, had made very similar recommendations, in a detailed report presented to the Human Rights Council of the United Nations. The however, the report was largely ignored by the Member States, who had preferred to set up a commission to study the impact of technology on this sector.
The relationship between subsidiaries and controllers in this sector is complex: in Europe, it is the states that should be vigilant on the fact that companies and startups operating in the branch of digital surveillance on their territory do not sell products to authoritarian regimes or to other subjects who intend to use them to violate human rights.
However, there is no unanimity of positions on the concrete modalities of this vigilance. And it has been discussed for at least 10 years: some states are pushing for a radical crackdown, others like Finland and Sweden have taken softer positions. In turn, the companies that produce the surveillance devices, according to some surveys, succeed thanks to intense lobbying efforts to significantly affect attempts to regulate them.
Some progress, from the legislative point of view, has been made: in May of this year, the EU Council has updated the export rules of so-called dual-use products, software and devices which, like surveillance technologies, can have both civil and military applications.
The new regulation introduced an obligation for EU authorities to provide detailed information on approved export licenses and related human rights risks, formalized some due diligence requirements for producers and strengthened coordination between Member States and the Commission for the enforcement of controls.
Progress well received by NGOs like Amnesty International, Reporters Without Borders, Privacy International e Human Rights Watch, which, however they would have liked more explicit and stringent constraints, towards both States and companies.
The case
180 journalists and 13 heads of state spied by Pegasus: here’s how they did it
by Arturo Di Corinto
Steps forward and open questions
As they say, “the devil can hide in the details”: the new regulation states, for example, that member states should consider the risk of these technologies being used “in connection with internal repression or the commission of serious violations of international human rights and international humanitarian law “, but does not clarify what is meant by” grave violation “of human rights.
Or companies are required to carry out due diligence practices, but it is not clear, in the field of the potential effects of human rights technology, what they consist of and how to prevent companies from cheating on delivering conclusions.
The appeal of the Special Rapporteur it is therefore part of a complex political and legislative framework and it is difficult to have immediate effects. However, it is an authoritative voice, which highlights the potential harmful effects of technological surveillance for those who live and work in repressive regimes, and which governments and civil society would do well to listen.
.