A/HRC/41/35 Government of the United Kingdom, in partnership with a technology industry association, produced a set of guidelines for the cybersecurity industry in which they stress the importance of preventing and mitigating human rights risks “through appropriate design modification” at the earliest stages of product development. C. International and domestic export control 34. Export controls are an important element of the effort to reduce the risks caused by the private surveillance industry and the repressive use of its tools. However, their effectiveness is limited. First, the relevant international export control regime – the nonbinding Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, in which 42 States participate – is tailored to reduce threats to regional and international security. While that is a laudable and necessary objective, the framework is ill-suited to addressing the threats that targeted surveillance pose to human rights; indeed, it lacks guidelines or enforcement measures that would directly address human rights violations caused by surveillance tools. Second, the focus on exports is an imperfect proxy for addressing the central problem: the use of such technologies to target lawful expression, dissent, reporting and other examples of the exercise of human rights. 35. The Wassenaar Arrangement nevertheless promotes important goals of “transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies”. Participating States are expected to apply export controls to all items on the list of dual-use goods and technologies.42 As such, the Wassenaar Arrangement has been (or should be) internalized in domestic law and policy by participating and nonparticipating States; unfortunately, there is no enforcement mechanism to ensure its translation into domestic law or its implementation by the relevant domestic agencies. 36. In 2013, the participating States added items related to “intrusion software” and Internet Protocol network communications surveillance systems to the list of dual-use technologies. According to the list, intrusion software is “‘software’ specially designed or modified to avoid detection by ‘monitoring tools’, or to defeat ‘protective countermeasures’”, which either extracts data from a computer or network device or modifies the “standard execution path” of a program to allow “the execution of externally provided instructions”.43 37. The detailed reports of surveillance-related abuses demonstrate that the export control regime centred on the Wassenaar Arrangement has not meaningfully limited the spread of surveillance technologies and their use for repressive purposes. A stalled effort by European parliamentarians to strengthen the human rights protections in European export laws and policies demonstrated the challenges of reform. Their effort explicitly called for expansion of the list of dual-use items and catch-all controls, and the consideration of “respect for human rights in the country of final destination” of the surveillance technologies.44 In January 2018, this proposal went through first reading in the European Parliament, originally gathering support to implement stronger controls on exports of dualuse technology.45 However, the proposal has since received criticism from at least nine member States, which argued for weaker human rights protections.46 The future of the legislation is now unclear.47 42 43 44 45 46 See Wassenaar Arrangement, “List of dual-use goods and technologies and munitions list”. Ibid., p. 221. See European Commission, “Proposal for a regulation of the European Parliament and of the Council setting up a Union regime for the control of exports, transfer, brokering, technical assistance and transit of dual-use items (recast)”, 28 September 2016; and Lucie Krahulcova, “The European Parliament is fighting to strengthen the rules for surveillance trade”, Access Now, 8 December 2017. For an overview of the legislative history of the aforementioned proposed regulation, see EUR-Lex, Doc. 52016PC0616. Delegations of Cyprus, Czechia, Estonia, Finland, Ireland, Italy, Poland, Sweden and the United Kingdom, “For adoption of an improved EU Export Control Regulation 428/2009 and for cybersurveillance controls promoting human rights and international humanitarian law globally”, WK 11