A/HRC/41/35/Add.3 I. Overview of submissions 1. This supplemental annex accompanies the June 2019 thematic report to the Human Rights Council of the Special Rapporteur on the protection and promotion of the right to freedom of opinion and expression. With increasing frequency, governments are using privately developed technologies to hack into digital devices and spy on the online activities of civil society advocates, journalists, activists, academics, opposition figures and government critics. Such intrusive surveillance has reportedly facilitated the commission of human rights abuses offline, including arbitrary detention, torture and extrajudicial killings. The use of these technologies also interferes with the right to organize and assemble, both online and offline. In his report, the Special Rapporteur evaluates the human rights obligations of States and the responsibilities of companies concerning the sale, licensing and export of private surveillance technologies. 2. A call for submissions was issued on 18 December 2018, and requested input from States and civil society to share information concerning the regulatory frameworks that may be applicable to the development, marketing, export, deployment, and/or use of surveillance technologies by private companies. 1 Eleven States and thirty-three non-governmental groups and individuals made submissions to the Special Rapporteur. The Special Rapporteur is grateful for all the submissions he received. 3. This annex provides a summary of issues and concerns raised by States, civil society and other stakeholders in these submissions. Readers are encouraged to look at the submissions themselves for more detailed information. This annex should also be read in conjunction with the Special Rapporteur’s report, which articulates principles that he believes should guide the regulation of the private surveillance industry. Finally, this annex reflects only the submissions received and should not be understood as a broader literature review related to the topics discussed in the main report. II. Private surveillance tools 4. A majority of the submissions focus on malware, spyware, and other types of dualuse technologies that are manufactured, sold, and serviced by private surveillance companies and used by governments to target members of civil society. Many of these tools have been discussed in the main report. This section elaborates on some of these discussions, and describes additional trends and concerns raised in the submissions. Intrusion Software 5. Private surveillance companies use intrusion software to break into a target system and to monitor activity on the device and access as well as download information off the device. Companies usually send socially engineered messages to trick a target into clicking on a malicious link, but some forms of intrusion software, known as “zero-click technology,” can be installed on a device without any action from the target (NYU Global Justice Clinic (“GJC”), 7). The producers of intrusion software most frequently mentioned in the submissions we received are NSO Group, Hacking Team, FinFisher, Cyberbit, and M.L.M. Protection. 6. NSO Group is an Israeli Q Cyber Technologies company, with headquarters in Luxembourg, and currently owned by Novalpina Capital (Citizen Lab, 6-8). Citizen Lab found that the company may have sold intrusion spyware to government agencies in 45 countries, and there is evidence that at least six of those countries have used spyware to monitor civil society. (Citizen Lab, 8) The most well-known product sold by NSO Group appears to be Pegasus, a type of spyware. Id. The Saudi regime may have used Pegasus to track the communications of the journalist Jamal Khashoggi before his murder. (Id; Human Rights Foundation (“HRF”), 4). 1 https://freedex.org/2018/12/13/call-for-submissions-the-surveillance-industry-and-human-rights/. 3