A/HRC/41/35 B. Corporate responsibility 29. Because the companies in the private surveillance industry operate under a cloak of secrecy, the public lacks any information about the way in which they may – if at all – consider the human rights impacts of their products. Given the nature of the industry and the widespread use of its products for purposes that are inconsistent with international human rights law, it is difficult to imagine that they do in fact take such impacts into account. Put another way: given the broad public knowledge of the repression practised by many of their clients, the companies cannot seriously claim to lack insight into the repressive uses of their tools. 30. The Guiding Principles provide a framework for assessing whether surveillance companies respect the rights of those affected by their products and services. In particular, there is an emphasis in the Guiding Principles on policy commitments to respect human rights; due diligence processes to identify, prevent, mitigate and account for human rights impacts; consultation with affected groups; ongoing evaluation of the effectiveness of human rights policies; and effective grievance mechanisms for affected rights holders (A/HRC/17/31, paras. 15–25). 31. By every measure, the companies would appear to fail to meet even these minimum baselines. The few companies that have published their customer policies gesture vaguely at the need to respect human rights. Hacking Team, for instance, states that it reviews “potential customers before a sale to determine whether or not there is objective evidence or credible concerns that Hacking Team technology provided to the customer will be used to facilitate human rights violations”, but does not explain what it does with such information, or even identify which human rights its technologies might implicate. 38 The NSO Group claims to operate in accordance with a Business Ethics Committee, “which includes outside experts from various disciplines, including law and foreign relations”, and suggests that it may cancel work if its products are put to “improper use”.39 On its website, it also states that it will “investigate any credible allegation of product misuse”, but there is no indication of whether that includes human rights violations. 40 32. In short, companies have not disclosed instances of meaningful action, such as putting in place due diligence processes that identify and avoid causing or contributing to adverse human rights impacts through their own activities and that prevent or mitigate adverse human rights impacts that are directly linked to their operations, products or services by their business relationships (A/HRC/17/31, annex, principle 13) There is, for example, no public information suggesting that human rights assessments are a routine component of due diligence during sales, that companies give decisive weight to these assessments and that these assessments continue throughout the life cycle of the product and any contract for after-sales support. Indeed, mounting evidence of the industry’s central role in facilitating gross human rights abuses, coupled with its steadfast refusal to explain its safeguards, makes it difficult to avoid the conclusion that such self-regulation lacks substance. 33. The guidance of the European Commission on implementing the Guiding Principles in the information and communications technology sector highlights the importance of “human rights by design”.41 The extraordinary risk of the misuse of surveillance products means that companies should anticipate the illicit use of their software and begin engineering solutions for the inevitable negative impacts. In a promising move, the 38 39 40 41 10 Hacking Team, Customer Policy. See NSO statement of 17 September 2018. Available at https://citizenlab.ca/wpcontent/uploads/2018/09/NSO-Statement-17-September-2018.pdf. As a Citizen Lab puts it, “NSO’s statements about a Business Ethics Committee recall the example of Hacking Team’s ‘outside panel of technical experts and legal advisors … that reviews potential sales.’ This ‘outside panel’ appears to have been a single law firm, whose recommendations Hacking Team did not always follow” (Marczak and others, “Hide and seek”). See www.nsogroup.com/about. See European Commission, ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights (Luxembourg, 2013).