A/HRC/41/35/Add.4 18. The first speaker expanded the scope of discussions by mentioning, beside targeted surveillance with malware, three other categories of surveillance tools: data mining tools, facial recognition, and marketing of vulnerabilities. Another participant drew attention to the issue of government use of open source intelligence to collect information that is publicly available, such as for example through CCTV surveillance cameras or social media surveillance. It was highlighted that political parties sometimes use this information without any form of consent. 19. Many participants stressed the importance for companies to endorse certain principles and norms in order to avoid adverse effects of their products on public freedoms. Microsoft was given as an example: it has recently adopted a set of principles and rules with respect to fairness, transparency, accountability, non-discrimination, consent and lawful surveillance in the development and deployment of their technologies. This seems to suggest that some companies are willing to commit. However, the question of how to make sure that these norms and principles will be endorsed was raised. 20. A participant observed as a recent trend that some internet companies have started to decline government’s requests to collect and share information. Therefore, many States are trying to get rid of intermediaries in order to conduct their own surveillance. Some States even have the capacity and resources to develop their own tools. One participant insisted on the importance of States’ disclosing which tools they have purchased and what type of information they are collecting. Another key issue mentioned is the problem of access to information, notably when some States consider that the information they are collecting is associated with national security threats. It has been noted that the private surveillance industry benefits from the opacity of security laws. 21. The increasing use of private surveillance by many governments throughout the world without any transparency or any sort of accountability is also associated with a serious problem of impunity. In Mexico for example, it was mentioned that there have been more than 20 cases of surveillance with malware thoroughly documented without any consequences to date. Many examples were given to illustrate that many transactions take place directly between governments. 22. Additionally, several participants agreed on the importance of working on the supply side through a stricter export control regime as the most effective way to prevent the use of technologies by authoritarian regimes. 23. A participant said that phishing tools and network surveillance are not being effectively addressed in the legal framework in Latin America, which makes strategic litigation more difficult. In general, States fail to consistently support requests for investigations. For example, Israel denied a request to compel NSO group to answer questions about their products and services being used in Mexico. 24. The relationship between governments and companies, not only during the development and enhancement of these technologies, but also once it has been transferred, has also been extensively discussed. The fact that former military and security personnel are using their expertise with companies and then contracted by governments is a source of concern. The issue of the customization of the surveillance tools by governments has also been put forward. Citizen Lab published a report last year on how certain tools are being marketed as customizable: for example, certain forensic software are being remodeled in improper ways. 25. Finally, the gendered nature of the digital surveillance industry and its masculine approach was further discussed. It is important to take into consideration the neocolonial dimensions of surveillance, particularly given that colonial patterns are being reproduced in the drafting of certain surveillance laws. C. Session 3: State Responsibility and Targeted Surveillance 26. Participants discussed how to define state responsibility and what would be the most effective means of regulating private surveillance technologies. It was noted that the export 5