EU moves to protect journalists from spyware

European Union lawmakers are aiming to protect journalists from member states targeting them with spyware following a number of high-profile incidents across the bloc.

Alongside measures promoting ownership transparency and editorial independence, the European Media Freedom Act (EMFA) proposed on Friday will introduce “strong safeguards against the use of spyware against media, journalists and their families.”

Article 4 of the regulation — an EU instrument which has direct effect without member states’ needing to reflect it with their own legislation — introduces a general prohibition on member states trying to:

“detain, sanction, intercept, subject to surveillance or search and seizure, or inspect media service providers or, if applicable, their family members, their employees or their family members, or their corporate and private premises, on the ground that they refuse to disclose information on their sources, unless this is justified by an overriding requirement in the public interest.”

It also explicitly bans any attempt to:

“deploy spyware in any device or machine used by media service providers or, if applicable, their family members, or their employees or their family members, unless the deployment is justified, on a case-by-case basis, on grounds of national security”

However the proposals are novel for the European Union which typically takes a back seat to members both when it comes to media regulation and to laws affecting security, which are generally considered a matter of sovereignty for each state.

The proposals may still be resisted by governments — represented in the European Council — who deem them contrary to their interests.

Announcing the EMFA, Věra Jourová, the European Commission's vice-president for values and transparency, said: “We have seen over the past years various forms of pressure on the media. It is high time to act. We need to establish clear principles: no journalist should be spied on because of their job; no public media should be turned into propaganda channels.” Jourová has acknowledged that the proposals will receive resistance from some member states.

Numerous incidents have emerged across the EU in recent years of journalists being hacked in what appear to be politically-charged circumstances. Many of them were uncovered by the University of Toronto’s interdisciplinary Citizen Lab, including cases in Hungary, Catalonia in Spain, and Greece.

Reuters reported in April that senior officials at the European Commission itself had also been targeted by spyware provided by embattled Israeli vendor NSO Group, which was sanctioned by the U.S. last November, partly for being used to target journalists. The company has denied that officials could have been targeted by its tools.

John Scott-Railton, a senior researcher at Citizen Lab, told The Record that surveillance of the media is a threat to democracy.

“We’ve seen attacks over the past several years against journalists in Europe using sophisticated spyware and other digital techniques. That’s just one part of the kind of threats facing the media today,” he said. “We find digital threats, surveillance and hacking against journalists wherever we scratch, and it’s deeply disturbing to see these threats growing in Europe.”

A joint statement from media groups welcomed the EMFA, however they cautioned that the measures including those against the surveillance of journalists should be expanded and strengthened.

In his analysis of the proposal, Damian Tambini, a senior lecturer at the London School of Economics, described the EMFA as "a major shift in EU policy on the media, and a welcome shot in the arm for democracy across the Union" but expected "hard fought" battles ahead as the "reforms stretch the legal competence of the Union and because they undermine authoritarian controls on the media."