A/HRC/32/38 conduct surveillance may depend on the extent to which business enterprises cooperate with or resist such surveillance. 1. Requests for customer data 58. As Internet service providers, social networking platforms, search engines, cloud service providers and other companies transmit or amass enormous quantities of customer data, the volume of government requests for user information based on local laws and regulations has also begun to rise. Several major Internet companies have reported an increase in requests.43 Many of these requests are issued by law enforcement and intelligence agencies. State oversight of these requests varies, ranging from prior judicial authorization44 to high-level executive approval45 to none at all. Licensing agreements and the law may limit the ability of the private sector to resist these requests or compel accountability. Even content-hosting platforms, which lack physical presence in certain jurisdictions where they operate, may face the wholesale blocking of their service and attempts to intimidate employees of corporate subsidiaries. Nevertheless, companies in all areas of the information and communications technology industry are capable of establishing and exercising varying degrees of leverage in their relationships with States to resist or mitigate the harm caused by abusive application of the law. Effective strategies of resistance include: the inclusion of human rights guarantees in licensing agreements and other relevant contracts; restrictive interpretations of government requests; negotiations with government officials about the scope of such requests; judicial challenge of overbroad requests or laws; providing affected individuals, the media or public with relevant information; and suspension of service within, withdrawal from, or decisions not to enter a particular market. 2. Sale of surveillance and censorship equipment 59. The private sector supplies hardware, software and other technologies that enable States to intercept, store or analyse communications and other information. Infrastructure vendors, hardware manufacturers and software developers may design or customize products on behalf of States, or supply dual use equipment and technology that States subsequently tailor for their own needs. Internet and telecommunication service providers may also purchase equipment or software from these companies to install on their network components in order to comply with legally mandated interception protocols in the States where they operate. States may rely on these products and services to target, harass or intimidate members of vulnerable groups. 3. Covert surveillance 60. States may also covertly tap into the technical infrastructure belonging to service providers and content platforms in order to intercept a wide variety of information, including communications, user account information, and telephone and Internet records. States reportedly tamper with computer hardware while en route to customers, infiltrate private networks and platforms with malicious software, hack into specific devices, and exploit other digital security loopholes. When business enterprises have notice of such surveillance, questions concerning their human rights responsibilities may arise, such as providing notice to customers or mitigating such harm through security measures. Companies that sell equipment and services to Governments to implement covert 43 44 45 16 See recent transparency reports from Google, Facebook, Dropbox, Twitter and Microsoft. Sweden, Act on Signal Surveillance for Defense Intelligence Activities, sect. 4 (3). Australia, Telecommunications (Interception and Access) Act 1979, sect. 9 (1).