A/HRC/41/35 2. Establish public mechanisms for approval and oversight of surveillance technologies 52. Judicial authorization of government use of surveillance technologies is necessary but insufficient. The purchase of these technologies should also be subject to meaningful public oversight, consultation and control. In recent years, as the use of surveillance technologies has proliferated among law enforcement bodies in the United States, several communities have instituted civilian control boards to regulate their use and purchase. The city of Oakland in California, for instance, adopted an ordinance with several features regarding the purchase of surveillance technology that could be replicated by States. 66 These include: (a) An approval process, carried out by the relevant departments, that takes into account the State’s human rights obligations; (b) Public notice of such purchases through regular processes, and public consultations on issues such as the human rights implications of such purchases and whether the technologies at issue will be effective at achieving their intended purposes; (c) Regular public reporting on such approvals, purchases and uses. 53. Particularly in States that allow subnational organs a certain autonomy in the purchase of law enforcement tools, community control of such purchases should be encouraged and enforced. Given the clear public interest in maintaining the privacy and security of widely available commercial software, public oversight mechanisms should also be empowered to set policies on the stockpiling of vulnerabilities and the development of relevant exploits. 3. Provide victims with domestic legal tools of redress 54. For the reasons described above, it is difficult for the targets of unlawful or arbitrary surveillance to bring claims against Governments. Some of the barriers are structural, such as the unavailability in many legal systems for claims against government actors. Both legislatures and the courts may also bar these claims when they grant excessive deference to perceived national security and law enforcement interests. Some claims may be difficult to pursue because of the difficulty and expense of proving the existence of surveillance or attributing the surveillance to State actors – or even to specific State agencies that would be the targets of a lawsuit. Individual targets of surveillance often do not know of the surveillance being carried out against them – or, if they do, it may be beyond the tolling of a statute of limitations.67 It is, in other words, extremely rare for a claimant to succeed in domestic legal claims arising from allegedly unlawful surveillance. 55. States that are serious about the abuse of surveillance technologies should take steps to enable individual claims against both State and non-State actors. This will, for many States, necessarily involve ensuring that the rules concerning jurisdiction, evidence, timeliness and other basic threshold conditions are fit for purpose in the digital age. They should, for instance, ensure that courts can accept and evaluate as evidence the forensic analysis of technical experts. National legislation should also establish causes of action against private entities that take into account changes in corporate ownership (known as “disposals” or “makeovers”), which often complicate the efforts of victims to seek accountability and redress.68 Alternative forms of redress, such as truth commissions that enable victims of gross human rights abuses facilitated by digital surveillance to give testimony and that examine corporate complicity in these abuses, should also be considered. 56. At the same time, targeted surveillance is not always territorially contained. When States reach beyond their borders to conduct targeted surveillance, it may be difficult for the individuals targeted by such surveillance to bring claims against the offending State. Some of the same evidentiary and other burdens as in domestic claims may be present in 66 67 68 16 See American Civil Liberties Union of Northern California, “Oakland becomes latest municipality to reclaim local control over surveillance technologies used by local law enforcement”, 2 May 2018. See Roman Zakharov v. Russia. Access Now submission, p. 8.