A/HRC/23/40 responding to mobile phone signals in order to extract the unique subscriber identification module (SIM) card number of all mobile phones within a certain territory. 37. States are also increasingly acquiring software that can be used to infiltrate an individual’s computer, mobile phone or other digital device. 24 Offensive intrusion software, including so-called “Trojans” (also known as spyware or malware), can be used to turn on the microphone or camera of a device, to track the activity conducted on the device, and to access, alter or delete any information stored on the device. Such software enables a State to have complete control of the device infiltrated, and is virtually undetectable. B. Mass communications surveillance 38. Costs and logistical hurdles to conduct surveillance on a mass scale continue to decline rapidly, as technologies allowing for broad interception, monitoring and analysis of communications proliferate. Today, some States have the capability to track and record Internet and telephone communications on a national scale. By placing taps on the fibreoptic cables, through which the majority of digital communication information flows, and applying word, voice and speech recognition, States can achieve almost complete control of tele- and online communications. Such systems were reportedly adopted, for example, by the Egyptian and Libyan Governments in the lead-up to the Arab Spring.25 39. In many States, mandatory data retention is facilitating massive collection of communications data that can later be filtered and analysed. Technologies enable the State to scan phone calls and text messages to identify the use of certain words, voices or phrases, or filter Internet activity to determine when an individual visits certain websites or accesses particular online resources. “Black boxes” can be designed to inspect the data flowing through the Internet in order to filter through and deconstruct all information about online activity. This method, called “deep-packet inspection”, allows the State to go beyond gaining simple knowledge about the sites that individuals visit, and instead analyse the content of websites visited. Deep-packed inspection, for example, has been reportedly employed by States confronted with recent popular uprisings in the Middle East and North Africa region.26 40. Another tool used regularly by States today is social media monitoring. States have the capacity physically to monitor activities on social networking sites, blogs and media outlets to map connections and relationships, opinions and associations, and even locations. States can also apply highly sophisticated data mining technologies to publicly available information or to communications data provided by third party service providers. At a more basic level, States have also acquired technical means to obtain usernames and passwords from social networking sites such as Facebook.27 C. Access to communications data 41. In addition to intercepting and tracking the content of individuals’ communications, States may also seek access to communications data held by third party service providers and Internet companies. As the private sector collects progressively larger amounts of 24 25 26 27 Toby Mendel, Andrew Puddephatt, Ben Wagner, Dixi Hawtin, and Natalia Torres, Global Survey on Internet Privacy and Freedom of Expression, UNESCO Series on Internet Freedom (2012), p. 41. European Parliament, Directorate-General for External Policies, Policy Department, After the Arab Spring: New Paths for Human Rights and the Internet in European Foreign Policy (2012), pp. 9-10. Mendel et al., op. cit., p. 43. European Parliament, op. cit., p. 6. 11