The EU’s Human Rights Sanction Regime could target malicious spyware vendors

Europe has a substantial spyware problem. Despite regulating dual-use technology (ie, spyware) exports, countries have continued to grant export licenses for the sale of spyware to repressive governments. For example, the Greek government has acknowledged granting export licenses to the company Intellexa to sell its Predator spyware to the Sudanese government. A European Parliament report lists more instances. 

Europe’s spyware problem

Human rights abuses of this technology come from inside Europe’s borders, too: Greece, Spain, Hungary, and Poland, all EU member states, have used spyware on domestic political opposition groups, a shocking departure for democratic states. 

In response to this problem, the European Parliament established the PEGA Committee of Inquiry to “investigate alleged infringement or maladministration in the application of EU law in relation to the use of Pegasus” and similar software. PEGA’s final report called for a multitude of responses, including coordinated action at the European Union level and better enforcement of existing legislation, such as export control regimes. However, better enforcement is difficult since it is largely left up to individual member states. 

The Global Human Rights Sanction Regime

A tool which the PEGA report did not mention, the EU’s Global Human Rights Sanction Regime, offers another way to target bad actor spyware vendors. 

Adopted in 2020 and currently extended until 2026, the Regime provides for financial sanctions and travel restrictions on those “responsible for, providing support to or otherwise involved in serious human rights violations or abuses.” It mirrors the US Magnitsky Act. Seven other countries have adopted similar measures. 

The Regime has been applied to 67 natural and legal persons and 20 entities. Sanctioned individuals include a member of the Russian FSB accused of torturing a detained journalist, the acting Taliban Minister for Higher Education, several people involved in abuses against Uyghurs in China, and torture, extrajudicial, summary or arbitrary executions and killings in South Sudan and Eritrea. 

Sanctions apply not only to those responsible for abuses, but also to those providing “financial, technical, or material support for, or are otherwise involved in”  designated acts, “including by planning, directing, ordering, assisting, preparing, facilitating, or encouraging such acts.”

However, most of the sanctioned individuals have been high-level officials plausibly “responsible” for human rights abuses. The closest the Regime has come to designating someone as a “supporter” is its 2023 sanction of nine Russian judges that sentenced a Kremlin critic to 25 years imprisonment; the judges were alleged only to have participated in a judicial system that has been “systematically” used to violate human rights. 

Adapting the Regime for spyware

The European Union should not shy away from designating malicious actors as supporters of human rights abuses. The US, whose Magnitsky Act contains similar language, has done so multiple times. The EU Regime allows it, and the gravity of the offences the Regime has responded to so far certainly merit punishing supporters as well as primary violators.  

Spyware companies whose products have been used in human rights abuses would fall under this category. Consider the example of the NSO Group. The Israeli company made spyware called Pegasus, which was linked to human rights abuses, including offences against political dissidents, human rights activists, and other protesters. 

The NSO Group does not use information obtained from its spyware to determine targets or carry out abuses, but it can still be considered as “providing support to” the abusing entities because it provided a technological tool that made those abuses possible. The Regime could classify the company and key employees as violators, subjecting them to financial sanctions and travel restrictions within the EU. 

The NSO Group is far from the only entity possibly subject to designation. The United States has already placed on its sanctions list Intellexa, a consortium of spyware companies that has been linked to rights abuses, and Candiru, another Israeli spyware firm implicated in the targeting of politicians in Catalonia. 

The United States has adopted a strict liability standard. By contrast, in Europe, it is unclear what degree of knowledge a spyware company must have about the use of its products to be liable, and many spyware companies disclaim knowledge of misuse. Adopting a strict liability standard would encourage actual know-your-customer policies. 

Benefits and complications 

One drawback of the Regime is that it requires unanimity to impose sanctions. Some EU countries may be customers of the companies under consideration, so they would be unwilling to impose sanctions on them. However, vetoing the designation of a vendor as notorious as the NSO Group at the European Union Council level would risk exposure and public condemnation for that government. 

Although the unanimity rule may make it harder for the EU to agree to designate an entity as a violator, once designated, a company would be subject to sanctions from 27 states, the EU members. Even if several countries failed to enforce the Regime, other EU states’ enforcement would still affect the targeted country. To illustrate, let’s say one state refuses to enforce the Regime; companies would still be subject to sanction in the remaining 96% of countries. In contrast, under the dual-use export control regulations, if one country refuses to enforce, an offending company has 100% access to their target market. Essentially, the default consequences of underenforcement are reversed under the Regime compared to dual-use regulations.

Export controls on dual-use technologies have been the primary approach to combating spyware abuses in the last ten years. However, there is room for substantially more regulatory creativity. The Regime is a key component of diversifying and strengthening regulation to limit the proliferation of spyware, now.