A/HRC/41/35/Add.3 business relationships between States and private surveillance companies also hinders the development and implementation of principled, rights-oriented regulation. (Id.) For example, the risk assessments that several EU States conduct have not stemmed the tide of surveillance exports to States where such tools have been used to violate human rights. (Amnesty International, 6; Privacy International, 7) Even the proposed reforms to the EU framework contain “unduly narrow definition of human rights and fails to require that states deny license for surveillance exports that pose human rights risks.” (Amnesty International, 5) Lack of Transparency 33. In addition to inadequate international and national export control measures, several submissions identify the lack of transparency as a major problem. States, whether members of Wassenaar or not, generally do not exchange information on their licensing standards and decisions with other States. (Sarah McKune, 5) Even where States disclose information about licensing decisions and export control measures, “this practice is far from uniform, and within the EU efforts to establish more substantive reporting through export regulations have stalled.” (Id.) 11 EU members, including France and Italy, refuse to make any licensing data available to public. (Privacy International, 6) This lack of transparency may be attributable to “the broader ecosystem of private financing that fuels much of the industry.” (Sarah McKune, 8) Since companies are funded by private investors, key strategic decisions, including company’s approaches to human rights, are formulated behind closed doors. The limited public information available about the private surveillance industry has mainly surfaced as a result on civil society and academic research and investigative reporting. (Id., 5) But even these sources are under threat, as NGOs, academics, journalists and public interest lawyers are harassed, censored, surveilled, attacked and blacklisted. (Id.; see also Center for Legal and Social Studies (“CELS”), 4) 34. Submissions argue that the lack of transparency has various implications for human rights. Even in countries that “provide an element of transparency into licensing procedures, the limited information made public makes it difficult to scrutinize the adequacy of these procedures.” (Amnesty International, 6.) Despite the cutting-edge forensic research provided by NGOs, academics, journalists and others, such material is still unable to provide a comprehensive picture of how targets are hacked or spied on, and how their surveillance is linked to other human rights abuses. This makes it difficult for victims to obtain evidence necessary to bring litigation and precludes meaningful public scrutiny and oversight. Id. Overbroad Domestic Surveillance Laws 35. Domestic surveillance laws are frequently overbroad and vague, giving the authorities wide discretion to deploy high-tech surveillance tools. China’s “far-reaching and draconian Cybersecurity Law,” for example, provides authorities with “broad powers to restrict and penalize online expression” and also ban VPNs “without government preapproval.” (CHRD, 1.) Human rights defenders fear that this law provides the government with broad authority to deploy a host of invasive surveillance tools including data extracting technology, facial recognition software, and “grid management” police surveillance systems. (Id.) Cybersecurity and computer crime laws that provide government authorities with broad powers to conduct surveillance have also been enacted in the Philippines, Singapore, Thailand and Vietnam. (SEAPA, 1-6.) Even if these laws were “sufficiently clear,” they may still fail to meet the standards of necessity, proportionality and legitimacy of objectives. (GJC, 9) 36. While several States ban unauthorized surveillance, these restrictions generally do not apply to government surveillance. Azerbaijan’s Criminal Code, for example, imposes “criminal liability for using technical means provided for obtaining information secretly by persons who are not authorized.” (Azerbaijan, 2.) In Russia, Article 24 of the Constitution states that the “collection, holding, and use and spread of information about one’s private life, without his authorization, are not permissible.” (Russia, 1) However, neither of these restrictions address the problem of legally authorized surveillance that is overbroad and repressive. Constitutional protections of the right to privacy also frequently beg the 9