A/HRC/41/35 on how to optimize their malware to compromise the digital communications, computer devices and Wi-Fi networks of surveillance targets. 22 19. Just as the companies and the purchasers are tightly connected, so too are the companies and Governments in the countries in which they are based. Some of the companies have powerful voices in their countries’ export control regimes and have undermined efforts to strengthen them. For instance, in 2016, credible allegations suggested that, as a result of pressure from industry lobbyists, certain forms of surveillance technology had been removed from a proposed list of additions to the European Union list of dual-use goods and technologies subject to export controls.23 During recent negotiations on the European Union export control regime, business interests were alleged to have influenced the decision to significantly curtail the inclusion of human rights safeguards in proposed regulatory changes, despite broad agreement on their adoption in the European Parliament.24 20. It has also been indicated in recent reports that many individuals with intelligence and law enforcement expertise and experience move between government and private sector positions. This revolving door may enable former government experts to support private actors whose tools may be used to violate human rights. 25 In a 2019 report, Reuters revealed that several former United States National Security Agency employees moved to a private company to support United Arab Emirates signals intelligence programmes under the code-name “Project Raven”.26 The employees in question allegedly deployed their expertise to surveil political opponents of the authorities of the United Arab Emirates and target citizens of the United States. Government regulation of the “revolving door” with respect to the private surveillance industry appears at best weak and likely does not exist in many, if not most, legal systems. III. Legal framework A. State obligations 21. Targets of surveillance suffer interference with their rights to privacy and freedom of opinion and expression whether the effort to monitor is successful or not. 27 The target need have no knowledge of the attempted or successful intrusion for the interference with their right to privacy to be complete. Indeed, Governments generally seek tools that intrude without the knowledge of the target. However, it is critical to see such interference as part of an overall effort to impose consequences on the target. If conducted for unlawful purposes, the attempt at surveillance – and the successful operation – may be used in an effort to silence dissent, sanction criticism or punish independent reporting (and sources for that reporting).28 The sanctions may not be applied to the targets but to their networks of contacts. In environments subject to rampant illicit surveillance, the targeted communities know of or suspect such attempts at surveillance, which in turn shapes and restricts their capacity to exercise the rights to freedom of expression, association, religious belief, culture 22 23 24 25 26 27 28 Ibid. See Reporters Without Borders, “International regulations: broken or blocked by lobbies”, 14 March 2017. See Daniel Moßbrucker, “Surveillance exports: how EU Member States are compromising new human rights standards”, netzpolitik.org, 29 October 2018. See Privacy International, “Switching hats: why South Africa’s surveillance industry needs scrutiny”, 14 December 2016; and Alex Kane, “How Israel became a hub for surveillance technology”, The Intercept, 17 October 2016. See Christopher Bing and Joel Schectman, “Inside the UAE’s secret hacking team of American mercenaries”, Reuters, 30 January 2019; Robert Chesney, “Project Raven: what happens when U.S. personnel serve a foreign intelligence agency”, Lawfare, 11 February 2019; and Sarah McKune submission, pp. 7–8. Global Justice Clinic, New York University School of Law, submission, p. 6. See Human Rights Foundation submission. 7