Governments have been urged to prioritise human rights due diligence for spyware technologies as they convene for the Summit for Democracy 2023. In a joint statement published today (27 March 2023), 46 civil society organisations expressed concern about spyware technology being repeatedly used to silence journalists, surveil human rights defenders, muzzle dissent, suppress freedom of expression of minority groups, intimidate academia and discourage peaceful protests.

The statement highlights examples of how unlawful and arbitrary use of spyware has degraded human rights and civic freedoms, particularly the right to privacy. It also includes examples of government officials being targeted, underlining their stake in making strides towards mandatory human rights due diligence. The statement calls out companies for haphazardly selling and exporting hacking technologies, which has impacted democratic processes, deepened authoritarian rule and harmed human rights around the world.

Under the UN Guiding Principles on Business and Human Rights, investors, including venture capital firms, have a responsibility to undertake human rights due diligence when investing in spyware -- particularly due to the scope, severity of impact and low likelihood for remedy when the technology is abused. Despite this, transparency around due diligence practices by tech investors is often limited. Those investing in spyware are even more opaque, with responses to questions from civil society rarely addressing the salient human rights risks at hand.

Meredith Veit, Technology & Human Rights Researcher at the Business & Human Rights Resource Centre, said: “Companies and investors must acknowledge the grave threat spyware poses to people and their rights, and urgently work towards preventing and mitigating any further harm. This starts with greater transparency and accountability. The technology sector’s consistent prioritisation of short-term profits has direct, negative consequences for human rights – particularly for marginalized communities and at-risk groups. We have already seen examples of spyware companies evading export licenses, while NSO Group’s Pegasus spyware has been linked to at least 300 acts of physical violence in more than 45 countries worldwide.

“States also have a significant role in regulating and holding spyware companies accountable when they fail to comply with international human rights standards. The European Union is already leading the way with the European Media Freedom Act and the Corporate Sustainability Directive, among others—but even in Europe, more is needed to effectively prevent the abuse of technology. On day one of the Summit for Democracy on 28 March 2023, government officials will convene with corporate executives for the 2023 Forum on Business and Democracy, which promises to focus on how the private sector can strengthen democracy around the world, including by countering the misuse of technology and protecting civic space. To achieve this objective, the unlawful and arbitrary use of spyware technology cannot be left off the agenda.”

// ENDS

Note to editors:

• The Business & Human Rights Resource Centre is an international NGO that tracks the human rights impacts (positive and negative) of more than 10,000 companies across nearly 200 countries. We seek responses from companies when concerns are raised by civil society.
• The Summit for Democracy 2023 will include the 2023 Forum on Business and Democracy (28 March 2023). This half-day side event will spotlight the importance of the private sector’s commitments to advancing democracy, with a particular focus on countering the misuse of technology, fighting corruption, protecting civic space and advancing labour rights. Signatories of the joint statement have called upon the governments and corporate executives in attendance to prioritise putting human rights due diligence for spyware technologies on the agenda.