A/HRC/41/35 containing malicious links either impersonate the target’s contacts or trick the target into believing that they are clicking on a benign link related to their work, advocacy or personal affairs. For example, a WhatsApp message linked by researchers to Pegasus spyware was sent to an Amnesty International staff member urging him to cover a protest, including a link that it claimed would lead to additional information. 9 Clicking on the link would likely have downloaded the spyware on his device. Network surveillance 11. Some technologies work on a network to enable targeted surveillance. For instance, the Russian System for Operative Investigative Activities involves the installation of a device on telecommunications networks that enables interception of communications. The system is privately manufactured and marketed and is widely used in the Russian Federation and further afield in Central Asia. For example, the company Protei manufactures equipment that ensures that the system’s technologies, such as eavesdropping and Internet interception tools, work in countries like Uzbekistan and Kazakhstan. 10 Facial and affect recognition 12. Facial recognition technology seeks to capture and detect the facial characteristics of a person, potentially profiling individuals based on their ethnicity, race, national origin, gender and other characteristics, which are often the basis for unlawful discrimination. 11 Affect recognition seeks to infer a person’s feelings, emotions or intentions from facial expressions, based on highly questionable classification systems.12 Perhaps no other environment demonstrates the comprehensive intrusiveness of these technologies better than China. Credible reporting suggests that the Government of China, using a combination of facial recognition technology and surveillance cameras throughout the country, “looks exclusively for Uighurs based on their appearance and keeps records of their comings and goings for search and review”.13 Much of the technology deployed by the Government appears to be produced domestically, by both State-owned and private enterprises.14 International Mobile Subscriber Identity catchers (Stingray) 13. International Mobile Subscriber Identity catchers mimic nearby cell towers to intercept communications and location data being transmitted by personal communication devices. Such catchers are widely used around the world, often by law enforcement and intelligence agencies. A private company in the United Kingdom allegedly sold such catchers and other spyware to the Philippines, and many fear that these tools were used to track and monitor drug users in the Government’s widely criticized war on drugs. 15 Deep Packet Inspection 14. Deep Packet Inspection enables the monitoring, analysis and redirection of traffic passing through communications and Internet networks. It can also be used to redirect users to sites infected with malware and block them from accessing certain websites. Such devices were reportedly installed on Türk Telekom’s network, and deployed to redirect 9 10 11 12 13 14 15 See Bill Marczak, John Scott-Railton and Ron Deibert, “NSO Group infrastructure linked to targeting of Amnesty International and Saudi dissident”, Citizen Lab, 31 July 2018. Andrei Soldatov and Irina Borogan, The Red Web: The Struggle Between Russia’s Digital Dictators and the New Online Revolutionaries (New York, PublicAffairs, 2015), pp. 190–191. See, e.g., Internet Lab submission, p. 6; and Center for Internet and Society submission, p. 12. AI Now Institute, AI Now Report 2018 (New York, New York University, 2018), pp. 13–14. See Paul Mozur, “One month, 500,000 face scans: how China is using A.I. to profile a minority”, New York Times, 14 April 2019. Human Rights in China submission, pp. 2–3. See also A/HRC/39/29, para. 14. See Sofia Tomacruz, “You think your data, communication devices are safe? Think again”, Rappler, 17 March 2018. 5