Spyware could destroy our democracies

The illegal use of spyware in Europe is a clear and present danger to European democracy. It is as simple as that. The only upside to this story is that it is covered with the correct amount of urgency by some of the finest journalists in Europe. Long gone are the days when technology was a niche subject for both politicians and the media. It is now front and centre. If you are a journalist who covers technology in the year 2023, then there is a good chance that you are writing about democracy. More precisely, you could well be covering potential threats to democracy. Concerning spyware, it is safe to leave out the ‘potential’.

The danger spyware poses in Europe lies in the fact that the perpetrators are the ones that are supposed to keep us safe from threats, including digital ones. They are our own national governments. In pursuing ever more digital capabilities, governments are choosing to be at odds with the rights and safety of the citizens they ought to protect. They amass more data than ever and operationalise it in ways that are sometimes beyond the pale. They acquire tools, such as spyware, for which they cannot be held accountable. When they discover a vulnerability in the devices used by millions of people, they keep quiet, hoping one day to exploit the weakness. Just pause on that for a second. Governments choose not to remedy a risk to your safety in order to exploit it later. Why is that?

The short answer is that digital means have become a source of power. It is not strange for organisations to want more power, especially executives. In a democracy, we have countervailing forces for exactly this reason: to push back when one part of the government becomes too powerful.

The sad reality is that parliaments, as the most prominent countervailing forces, often cooperate in the excessive transfer of digital power. They update laws that govern data collection by police and secret services in ways that weaken accountability. In the European Union, with its multiple EU institutions, 27 national governments and a host of national and regional parliaments, only one body has thoroughly investigated the use of spyware: the European Parliament. It was necessary work, but so far, everyone else has stayed silent. A present-day omertá, a code of silence.

What about the courts then? Well, to this day, no EU citizen targeted by spyware has had any legal recourse, let alone legal remedy, with precious few exceptions. Who do you sue when the government denies even using the stuff on you? It is like chasing shadows. If there is one red line in this story, is that it is about power.

In a democracy, power is limited. Now though, governments have the means to access information about the people that are there to hold them accountable. This is the path to absolute power. It is no coincidence that judges, lawyers, opposition politicians, NGOs and journalists find themselves targeted in some EU countries. The built-in checks on power, which are the cornerstones of democracy, are identified and ultimately disabled. This is how spyware has the potential to dismantle democracy and allow absolute power to grow.

Bear in mind that wielding spyware in itself is a form of absolute power. No matter how responsibly these tools are used, there is no meaningful accountability for using them in any of the EU member states. Governments use spyware illegally without any pushback from the courts or parliaments.

With many parliaments unaware of the problem and courts too slow or unable to push back, much now depends on the Fourth Estate. It is up to the press to keep the fire burning until more politicians wake up to the danger. As national parliaments fail to apply pressure, journalists keep uncovering shady netherworlds where spyware vendors and governments meet. This is not an easy task, and many journalists fulfil it at their own peril. A chilling effect emanates from this whole murky business of spyware.

The knowledge that your government wields such a powerful tool can be an enormous burden on any journalist who wants to investigate spyware abuse or any kind of government abuse of power for that matter. How do you protect sources or your loved ones? How do you protect yourself? Such threats water down scrutiny of digital abuse with every day that passes without curbing this problem.

Privacy is a fundamental right – an extremely important one. It separates democracies from totalitarian societies. That is why it is enshrined as an essential European value. That is why we cannot give up on it. Especially not when national governments see it as a nuisance. Europe walked the path to totalitarianism before, and tragically, arrived there. It was only liberated from it after millions were killed and imprisoned. Never again, became one of the drivers of European integration. The idea was that an integrated Europe could correct its member states when they veered toward totalitarianism again. It was the duty of supranational communitarian bodies, first and foremost the European Commission to guard against this. It is therefore all the sadder that the European Commission now leaves it to the member states to police themselves, which in practice amounts to no policing at all. Europe’s spyware problem is, in conclusion, much more than just a technology story.