The organisers of the 2023 Summit for Democracy (which includes the governments of Costa Rica, the Netherlands, the Republic of Korea, the United States and Zambia) have outlined clear objectives to counter the misuse of technology, protect civic space and defend human rights defenders. To achieve these objectives, the unlawful and arbitrary use of spyware technology cannot be left off the agenda.

Civil society is calling for protections against spyware to be prioritised and duly deliberated upon during the 2023 Summit, using the UN Guiding Principles on Business & Human Rights as a foundation for the discussion. Forty-six civil society organisations expressed their concerns about spyware via a joint letter, urging states to act.

Drawing on case studies, research and analysis by various human rights organisations, the joint letter reminds states of the responsibilities of investors, including venture capital (VC) firms, to carry out human rights due diligence. The world’s 50 largest VC firms (3/4 of which are domiciled in the United States) have raised US $309 billion over the past five years, and a great portion of that is invested in technology. Yet, there is very little evidence that VCs are considering salient human rights risks or requiring that companies effectively mitigate them prior to making funding choices. VCs’ decisions ultimately impact which technologies are developed and deployed, and the processes behind investments in spyware, including which firms are involved, are often entirely opaque which prevents adequate accountability.

The letter calls for states to ban the sale of spyware until a system of safeguards is in place to prevent human rights abuses and hold companies liable for their negative human rights impacts. It also calls for states to develop comprehensive human rights due diligence and transparency requirements for investors.

Shortly following the publication of the joint statement, the Biden Administration issued an Executive Order on Prohibition on Use by the United States Government of Commercial Spyware that Poses Risks to National Security. The executive order prohibits US federal entities from using spyware that has been misused by foreign actors to enable human rights abuses, and addresses the fact that democratic governments are at risk when their employees are targeted by malicious actors armed with spyware technology. The White House confirmed that at least 50 U.S. government employees are suspected or confirmed to have been targeted with commercial spyware.