Abstract
In the digital age, privacy is crucial, yet national security often necessitates data access, creating tension. Policymakers must balance these needs, avoiding the false dichotomy of sacrificing privacy for security. Effective cybersecurity incorporates privacy protection. Spyware, client-side scanning, and similar technologies undermine system security and encryption, posing severe risks to democratic freedoms, including free speech and assembly. Spyware’s misuse extends authoritarian regimes’ influence, jeopardising democratic processes. To counter these threats, the EU must enforce strict regulations, enhance coordination between national and EU bodies, and bolster international cooperation. The establishment of a permanent PEGA Committee, rigorous export controls, and increased scrutiny of EU funds are essential. Strengthening cybersecurity measures protects democracy, ensuring privacy and security coexist in the digital era.
Introduction
In the age of the digital revolution, the importance of privacy cannot be overstated. Privacy is a fundamental human right that underpins the freedom of individuals to live without unwarranted surveillance or intrusion. It is the cornerstone of democratic societies, ensuring that citizens can express themselves freely and maintain autonomy over their personal information. However, the increasing emphasis on national security often creates tension with privacy as governments and institutions seek greater access to data to protect against threats.
The challenge for policymakers is to strike a balance between ensuring national security and protecting the privacy rights of individuals.
It is a common misconception that privacy must be sacrificed for the sake of national security. This binary thinking oversimplifies a complex issue. In reality, a system’s security is often only as strong as its weakest link. Effective cybersecurity must take into account the protection of individual privacy as a core component of national resilience.
The EU is infiltrated by spyware. In 2022, the Pegasus Project (The Guardian, 2022) revealed that NSO group (the company that owns Pegasus) has at least 22 clients in twelve different EU countries (Benjakob, 2022). This scandal was dubbed the EU Watergate (Joyner, 2022), which prompted the EU Parliament to establish the PEGA Committee (European Parliament, 2023).
The spyware industry presents a significant threat to both national and European security. By exploiting vulnerabilities and selling these to countries both within and outside the EU (Pruessing, 2022), this industry undermines the security and trust among nations. The unchecked proliferation of such technologies poses a risk not just to privacy but also to the integrity of international relations and the safety of citizens worldwide.
Spyware poses a threat similar to client-side scanning, where devices are scanned for illegal content before it is uploaded to the cloud. While intended to combat illegal activities, this approach fundamentally undermines the security of systems. Client-side scanning can be exploited to create back doors, potentially giving malicious actors and authoritarian regimes access to private data. It threatens the principle of end-to-end encryption, which is crucial for maintaining secure communications (Abelson et al., 2024).
Threats to democracy
Surveillance influences many rights and freedoms of citizens; it affects freedom of speech, association and peaceful assembly, and it has a dire effect on privacy and human rights (OHCHR, 2022). It undermines democracy and its institutions (European Parliament, 2022). Citizens who are spied on tend to abstain from participating in public discourse. Given that many journalists and political opposition leaders, among others, are targets of spyware, the quality of the democratic public sphere and the legitimacy of the electoral process are affected (European Parliament, 2022).
Furthermore, spyware technologies have enabled transnational repression. Dissidents from autocratic regimes who left their countries seeking protection were not safe from the reach of these regimes. This extends the influence of authoritarian regimes beyond their borders, impacting the democratic fabric of other nations (Al-Jizawi et al., 2022).
In the broader context of cybersecurity, these threats to democracy are not limited to spyware alone.
Authoritarian regimes and malicious actors leverage various cyber tools to conduct disinformation campaigns, spread fake news, and exploit societal divisions through divisive populism (Munkøe & Mölder, 2022). These tactics are designed to erode public trust in democratic institutions and processes. We have also seen the alleged targeting of presidents, prime ministers, MEPs, and other officials of liberal democracies from other countries (Richard & Rigaud, 2023).
The interlinkages between defence, internal security, home affairs, the rule of law, migration, and external security policies are critical in addressing these threats. Cybersecurity is a multifaceted issue that intersects with all these areas. Ensuring robust cybersecurity measures is essential to protect not only the integrity of democratic institutions but also the fundamental values of society.
Moreover, the chilling effect of surveillance and cyber threats cannot be understated. When citizens fear that their online activities are being monitored, they are less likely to exercise their freedom of expression, leading to a less vibrant and open democratic society. This suppression of free speech and dissent stifles innovation, critical discourse, and the healthy functioning of a democratic state.
Therefore, new members of the European Parliament must advocate for comprehensive cybersecurity strategies that protect against both internal and external threats. This involves addressing the vulnerabilities exploited by the spyware industry and ensuring that security measures do not infringe upon the privacy and freedoms of individuals. Only through a balanced and holistic approach can the resilience of democracy be maintained in the digital age.
The European single market
Asaf Lubin (2023) argues that spyware companies are not technology companies selling technologies; they are selling vulnerabilities in technologies. He further argues that governments should not allow private actors to hoard vulnerabilities, adding: ‘The more we allow commercial actors to possess these tools and make profit from zero-days, the more we corrupt and degenerate the vulnerabilities equity process is’.
The abuse of spyware stands as a significant threat to democracy and fundamental rights. This threat is acutely felt in the EU, where spyware companies have established a strong foothold, exploiting the EU’s internal market and free movement and, in the process, benefiting from weak enforcement of export regulations. As a result, the trade in spyware has flourished, often under the guise of being ‘EU regulated’, with the EU’s reputation for strict regulation being used as a mark of quality and respectability.
The spyware problem intertwines with other global issues such as migration, commodities, and fund flows. The EU’s actions in relation significant spyware clients, are good examples of how human rights and the right to privacy get the hit in international relations with the EU (Richard & Rigaud, 2023).
The European Union is a global beacon of privacy rights policies (Giovanni De Gregorio, 2021). Indirectly or directly supporting the threat of commercial spyware is a breach of the values of privacy rights, whether within the EU, in the EU market and exports, or through EU foreign relations, is an undermining of the idea of the European Union.
Recommendations
The EU must take a more proactive stance in regulating spyware and protecting privacy rights. To achieve this, the EU Commission should assert itself more forcefully in enforcing existing laws on spyware use and export, while balancing its role as treaty guardian with maintaining good relations with Member States. Non-compliance should be prosecuted more rigorously to ensure adherence to regulations.
The PEGA Committee should be established as a permanent body, serving as an ongoing forum for addressing new developments, identifying loopholes, and regularly updating regulations. This continuous dialogue will be crucial in adapting to evolving threats and technologies.
To bridge the gap between enforcement and laws, the EU should consider creating an EU-wide enforcement body for spyware regulations or significantly improve coordination between EU and national enforcement bodies. This approach would address the current disparity between national security competencies and the influence of spyware companies.
The EU single market requires reinforcement of its legal and judicial framework to ensure adherence to market rules. A reassessment of the balance between economic and social rights within the market is also necessary to maintain its integrity and effectiveness.
Export controls need harmonisation across EU countries, particularly for dual-use technologies. Increased transparency in export control licences is crucial, with information shared with the Commission while respecting national security concerns. The EU Commission’s capacity for export control should be enhanced, allowing for more proactive investigations into compliance with EU export control laws.
In its international role, the EU must balance short-term and long-term objectives in foreign aid and investments, implementing stronger internal scrutiny mechanisms for fund allocation. Increased transatlantic cooperation on spyware regulation could involve creating joint blacklists or whitelists of spyware companies.
Oversight should be strengthened by expanding the roles of the European Public Prosecutor’s Office (EPPO) and EU Ombudsman, particularly in overseeing funding allocation to ensure alignment with human rights objectives.
Finally, there is significant potential in enhancing transatlantic cooperation on spyware regulation. Increased collaboration between the EU and the US could lead to more effective control of the global spyware industry. This could involve the establishment of joint blacklists or whitelists of spyware companies, a strategy that may significantly disrupt the operations of entities that pose threats to privacy and security.
These measures, implemented cohesively, would significantly enhance the EU’s ability to protect privacy rights and regulate the spyware industry effectively, both within its borders and in its international relations.
References
- Abelson, H. et al. (2024). ‘Bugs in Our Pockets: The Risks of Client-Side Scanning’. Journal of Cybersecurity, 10(1). https://arxiv.org/abs/2110.07450.
- Al-Jizawi, N., Anstis, S., Barnett, S., Chan, S., Leonard, N., Senft, A., & Deibert, R. (2022). ‘Psychological and Emotional War: Digital Transnational Repression in Canada’. Citizen Lab, 1 March. https://citizenlab.ca/2022/03/psychological-emotional-war-digital-transnational-repression-canada/.
- Benjakob, O. (2022). ‘Pegasus Spyware Maker NSO Has 22 Clients in the European Union. And It’s Not Alone’. Haaretz, 9 August. https://www.haaretz.com/israel-news/security-aviation/2022-08-09/ty-article/.premium/israeli-spyware-maker-nso-has-22-customers-in-12-eu-countries-and-its-not-alone/00000182-8403-df1d-a3a7-ae9bce800000.
- European Parliament (2022). ‘The Impact of Pegasus on Fundamental Rights and Democratic Processes’. https://op.europa.eu/en/publication-detail/-/publication/9517000e-faaa-11ed-a05c-01aa75ed71a1/language-en.
- European Parliament. (2023). ‘Committee of Inquiry to Investigate the Use of Pegasus Surveillance Spyware’. 2 June. https://www.europarl.europa.eu/committees/en/pega/home/highlights.
- The Guardian (2022). ‘The Pegasus Project’. https://www.theguardian.com/news/series/pegasus-project.
- Joyner, E. (2022). ‘The EU Watergate: Pegasus Spyware Scandal Grows’. DW, 11 August. https://www.dw.com/en/eu-watergate-the-pegasus-spyware-scandal-keeps-spreading/a-63687981.
- Lubin, A. (2023). ‘Selling Surveillance’. Indiana Legal Studies Research Paper no. 495. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4323985.
- Munkøe, M., & Mölder, H. (2022). ‘Cybersecurity in the Era of Hypercompetitiveness: Can the EU Meet the New Challenges?’. CIDOB. https://www.redalyc.org/journal/6957/695774517022/.
- OHCHR (Office for the Commissioner for Human Rights) (2022). ‘Spyware and Surveillance: Threats to Privacy and Human Rights Growing, UN Report Warns’. Press release, 16 September. https://www.ohchr.org/en/press-releases/2022/09/spyware-and-surveillance-threats-privacy-and-human-rights-growing-un-report.
- Pruessing, J. (2022). ‘Pegasus Spyware in Europe’. Student Working Paper Series, Hertie School Centre for Digital Governance, 10 October. https://www.hertie-school.org/fileadmin/2_Research/2_Research_directory/Research_Centres/Centre_for_Digital_Governance/5_Papers/Student_publications/Student_working_paper_series/Targeted_spyware_Pruessing_.pdf.
- Richard, L., & Rigaud, S. (2023). Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy. New York: Henry Holt, 2023.
