A/HRC/23/40 and is thus vulnerable to manipulation by the State as a means of justifying actions that target vulnerable groups such as human rights defenders, journalists or activists. It also acts to warrant often unnecessary secrecy around investigations or law enforcement activities, undermining the principles of transparency and accountability. C. Unregulated access to communications data 61. Access to communications data held by domestic communications service providers is often mandated by legislation or a condition upon which licences are issued. As a result, States are generally provided with carte blanche access to communications data with little oversight or regulation. For example, a 2012 Brazilian law on money laundering gives police the power to access registration information from Internet and communication providers without a court order.39 At the international level, the provision of access to communications data is regulated by bilateral Mutual Legal Assistance Treaties. However, this cooperation also often occurs outside of the law on the basis of the voluntary compliance of the service provider or Internet company. As such, access to communications data can be obtained in many States without independent authorization and with limited oversight. D. Extra-legal surveillance 62. A number of the surveillance capabilities listed above fall outside of existing legal frameworks, but have nevertheless been widely adopted by States. Offensive intrusion software such as Trojans, or mass interception capabilities, constitute such serious challenges to traditional notions of surveillance that they cannot be reconciled with existing laws on surveillance and access to private information. These are not just new methods for conducting surveillance; they are new forms of surveillance. From a human rights perspective, the use of such technologies is extremely disturbing. Trojans, for example, not only enable a State to access devices, but also enable them to alter – inadvertently or purposefully – the information contained therein. This threatens not only the right to privacy and procedural fairness rights with respect to the use of such evidence in legal proceedings. Mass interception technology eradicates any considerations of proportionality, enabling indiscriminate surveillance. It enables the State to copy and monitor every single act of communication in a particular country or area, without gaining authorization for each individual case of interception. 63. Governments often do not acknowledge the use of such technologies to conduct surveillance, or argue that such technologies are being legitimately employed under the ambit of existing surveillance legislation. Although it is clear that many States possess offensive intrusion software, such as Trojan technology, the legal basis for its use has not been publicly debated in any State, with the exception of Germany. In that context, the province of North Rhine-Westphalia passed legislation in 2006 authorizing the “secret access to an information technology system” (§ 5.2 no. 11, North Rhine-Westphalia Constitution Protection Act), which was understood to be technical infiltration which is effected either by installing a spy programme or taking advantage of the security loopholes of the system. The German Federal Constitutional Court quashed the law in February 2008, ruling that such measures would only be in conformity with human rights if they were 39 16 Brazilian Federal Law 12683/2012. Article 17-B. Available at: http://www.planalto.gov.br/ccivil_03/_Ato2011-2014/2012/Lei/L12683.htm.