Civil liberties groups call for EU-wide ban on spyware

An association of civil liberties and human rights organizations across Europe has called for a European parliamentary inquiry to recommend that spyware is banned throughout the EU.

The European Digital Rights (EDRi) association on Tuesday called for the European Parliament committee investigating spyware to amend its recommendations around the technology, focusing on an outright end to its use rather than reforming the governance systems to ensure it doesn’t abuse human rights. 

“No safeguard can mitigate the human rights violations [spyware tools] entail. Therefore, we strongly encourage the PEGA Committee to call for a ban on spyware technologies,” the association argued.

Officially known as The Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware (PEGA), it does not have a significant amount of power to shape legislation.

It also doesn’t have the same powers that most other parliaments provide to official inquiries, as it has complained. For instance, PEGA cannot compel witnesses to deliver evidence, as in other parliamentary systems, nor can it or its members bring a legislative motion to Parliament to change a law that has already been passed.

The committee can — under the European Parliament’s rules of procedure — request a debate on a completed non-binding report; and it can recommend that the European Council and Commission themselves come up with a change in the law — as indeed its recent draft recommendations on spyware did.

However, EDRi said it believed PEGA must go farther than its recommendations and “must call for an EU-wide ban on spyware.”

A draft report from PEGA’s rapporteur published last year found that governments in the European Union have used “spyware on their citizens for political purposes and to cover up corruption and criminal activity.”

Sophie in ’t Veld, the Dutch MEP who served as the rapporteur, complained that no meaningful action was being taken by EU institutions to tackle the abuses highlighted in her report.

The European Commission did propose legislation in September that would protect journalists from being targeted with spyware, but that law has yet to receive the Council’s support. Even if it were enacted, it would not cover other targets of the technology.

A number of the controversial tools have been linked to state-sponsored killings and human rights abuses around the globe, despite the software developers’ claims that they are only used for law enforcement purposes.

Other than the notable sanctions imposed by the United States in November 2021 against spyware vendors NSO Group and Candiru, few attempts have been made to mitigate the potential risks the industry poses.

Those that have, such as Greece, have done so in the wake of domestic scandals in which the government was itself accused of using the technology illegally. Greece's parliament banned the sale of spyware in December.

Regulating in this area is a challenge under EU law. Article 4 of the Treaty on European Union stresses that “national security remains the sole responsibility of each Member State,” limiting the Commission’s ability to interfere in what member states consider to be national security matters.