A/HRC/41/35 38. At the domestic level, the enforcement of export controls varies, even among participating States in the Wassenaar Arrangement. For example, the United States has yet to adopt the 2013 additions of items related to intrusion software and Internet protocol network communications surveillance systems.48 However, the United States Commerce Department is conducting a broad review of the current framework and has been commissioned to establish an inter-agency process for setting new controls for both “emerging” and “foundational” technologies under the Export Control Reform Act of 2018.49 Israel, a non-participating State, has adopted export controls on dual-use items regulated under the Wassenaar Arrangement, but its enforcement of these controls is shrouded in secrecy.50 D. Absence of remedies for targeted surveillance 39. As part of a State’s duty to respect and ensure enjoyment of human rights, article 2 (3) (a) of the International Covenant on Civil and Political Rights imposes an obligation to provide victims of violations with access to an effective remedy. It is specified in article 2 (3) (b) that claims of such violations must be determined by competent judicial, administrative or legislative authorities, or by any other competent authority provided for by the legal system of the State. The Human Rights Committee has stressed that law enforcement and prosecutorial authorities should investigate allegations of violations promptly, thoroughly and effectively through independent and impartial bodies. 51 The duty to provide effective remedies also entails an obligation to protect individuals from acts by private sector entities that cause infringements, by exercising due diligence to prevent, punish, investigate or redress the harm caused by such acts by private persons or entities. 52 40. Victims of targeted surveillance have had little success in their efforts to obtain recognition of the harm suffered, let alone remedies for such harm. This is so even though, as explained by both the European Court of Human Rights and the High Commissioner for Human Rights, the mere threat of surveillance, even when secret, coupled with the lack of remedy, can constitute an interference with the right to privacy. 53 41. Litigation as a course of action to seek remedy against private surveillance companies that manufacture and sell tools and Governments that deploy them is uncertain. The lack of causes of action and remedies raises serious concerns about the likelihood of holding companies accountable for human rights violations. Alleged victims have commenced litigation or formal complaints against private surveillance companies or Governments in at least eight countries.54 However, the barriers to successful litigation and formal complaints are significant, including the lack of judicial oversight, remedies, causes of action, enforcement and data preservation. 42. In some cases, civil society organizations have requested that Governments investigate unlawful surveillance, but these requests are frequently rejected. In the United Kingdom, Privacy International made a criminal complaint against Gamma Group to the National Crime Agency, arguing that the company had violated multiple domestic laws when its subsidiary, FinFisher, sold surveillance technologies and provided assistance to the 47 48 49 50 51 52 53 54 12 5755/2018 INIT (15 May 2018); and Access Now, “EU: States push to relax rules on exporting surveillance technology to human rights abusers”, 11 June 2018. See Catherine Stupp, “Nine countries united against EU export controls on surveillance software”, Euractiv, 11 June 2018; and Moßbrucker, “Surveillance exports”. Privacy International submission, p. 5. John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law No 115–232 (2018). See “Israel-U.S. export controls”, export.gov, 20 July 2018. See also para. 43 below. General comment No. 31, para. 15. Ibid., para. 8. European Court of Human Rights, Roman Zakharov v. Russia (application No. 47143/06), judgment of 4 December 2015, para. 171; and A/HRC/27/37, para. 20. See Siena Anstis, “Litigation and other formal complaints concerning targeted digital surveillance and the digital surveillance industry”, Citizen Lab, 12 December 2018.