A/HRC/41/35 Government of Bahrain.55 The European Centre for Constitutional and Human Rights and Privacy International also filed a criminal complaint in Munich, Germany, calling for an investigation into the company, but the public prosecution authorities refused the request. 56 Even when States open investigations to determine whether government surveillance violated human rights norms or State laws, the investigations can be arbitrary or disorganized. 43. Alternatives to litigation, providing for remedies consistent with international human rights law, appear unavailable. For instance, after an Amnesty International staff member was the target of a suspicious WhatsApp message allegedly linked to Pegasus, the organization wrote to the Ministry of Defence of Israel asking that the NSO Group’s export licence be revoked.57 The country’s Defence Export Control Agency sent a letter in response, stating that it does not provide information on its policies on granting export licences or any information on the actual licences themselves.58 The Agency did not confirm or deny the existence of the export licence, but did note that “that export licences issued by the Israeli [Ministry of Defence] to NSO Group in relation to its government clients are consistent with international obligations”.59 The lack of regional and international pressure and non-disclosure policies justified on the basis of national security prove to be significant barriers. 44. Privacy International has also filed complaints with the Organization for Economic Cooperation and Development (OECD) National Contact Points for Germany and the United Kingdom against Gamma and Trovicor for their alleged roles in the targeted surveillance of political opponents by the Government of Bahrain. 60 The complaint against Trovicor asked the National Contact Point for Germany to “ascertain whether the company breached the OECD Guidelines for Multinational Enterprises by exporting surveillance products to Bahrain, where the authorities use such products in human rights abuses, including the arrest, detention and torture of political opponents and dissidents”.61 However, the National Contact Point rejected the complaint on the basis that the evidence of Trovicor’s presence in Bahrain was not sufficient. In a virtually identical complaint to the National Contact Point for the United Kingdom, multiple civil society organizations alleged similar violations against Gamma.62 The National Contact Point accepted the complaint and released an initial assessment in June 2013, in which it was stated that: “while neither party has provided direct evidence about a supply by Gamma to Bahrain, the evidence provided suggests that the company’s product may have been used against Bahraini activists. The [National Contact Point] considers that this substantiates the issues in respect of the company’s obligations to do appropriate due diligence and to address impacts.”63 55 56 57 58 59 60 61 62 63 See Privacy International, “Criminal complaint to national cyber crime unit on behalf of Bahraini activists”, 13 October 2014. Lawsuits against the NSO Group have also been filed in Israel and Cyprus: see David D. Kirkpatrick and Azam Ahmed, “Hacking a prince, an emir and a journalist to impress a client”, New York Times, 31 August 2018. See European Centre for Constitutional and Human Rights, “FinFisher: no investigation into GermanBritish software company”, 12 December 2014. Amnesty International submission, p. 8. Ibid. Ibid. According to the organization’s website, the main role of a National Contact Point “is to further the effectiveness of the Guidelines by undertaking promotional activities, handling enquiries, and contributing to the resolution of issues that may arise from the alleged non-observance of the guidelines in specific instances”. See Privacy International, “OECD complaint: Trovicor exporting surveillance technology to Bahrain”, 1 February 2013. See Privacy International, “German OECD NCP unwilling to investigate role of German company in human rights violations in Bahrain”, 20 December 2013. United Kingdom, Department for Business Innovation and Skills, “Initial assessment by the UK National Contact Point for the OECD Guidelines for Multinational Enterprises: complaint from Privacy International and others against Gamma International UK Limited, June 2013” (London, 2013), para. 25. 13