A/HRC/41/35 I. Introduction 1. The General Assembly has condemned unlawful or arbitrary surveillance and interception of communications as “highly intrusive acts” that interfere with fundamental human rights (see General Assembly resolutions 68/167 and 71/199). However, unlawful surveillance continues without evident constraint. Submissions for the present report detailed case after case of Governments using surveillance software developed, marketed and supported by private companies. Surveillance of specific individuals – often journalists, activists, opposition figures, critics and others exercising their right to freedom of expression – has been shown to lead to arbitrary detention, sometimes to torture and possibly to extrajudicial killings. Such surveillance has thrived amid weak controls on technology transfers to Governments with well-known policies of repression. The market is shrouded in secrecy; indeed, our knowledge of the problem exists mainly because of the digital-forensic work of non-governmental researchers and tenacious reporting by civil society organizations and the media. 2. The problem is serious enough that the Special Rapporteur concludes the present report with a call not merely for tighter regulation of surveillance exports and restrictions on their use, but for an immediate moratorium on the global sale and transfer of the tools of the private surveillance industry until rigorous human rights safeguards are put in place to regulate such practices and guarantee that Governments and non-State actors use the tools in legitimate ways. 3. The Special Rapporteur proposes a legal and policy framework for regulation, transparency and accountability within the private surveillance industry. He begins by identifying the problem, emphasizing its focus on targeted surveillance, leaving aside the issue of bulk interception, collection and retention of private data (often referred to as “mass surveillance”). He then highlights the obligations human rights law imposes on States and the related responsibilities of companies. In part IV, he proposes a framework to improve on existing laws and policies by incorporating protection of the rights to freedom of opinion and expression, based on existing international human rights law. He concludes by making recommendations for key actors. 4. Preparation of the present report benefited from 11 submissions by States and 33 by civil society. The Office of the High Commissioner for Human Rights organized a two-day consultation with experts in Bangkok in December 2018. The submissions and the talks held during the consultation are summarized in an addendum to the present report. 1 II. Governments and the private surveillance industry 5. We live in an age of readily available, easy to abuse and difficult to detect tools of digital surveillance. In his groundbreaking surveillance report in 2013, the previous mandate holder, Frank La Rue, noted that weak regulatory environments had provided fertile ground for arbitrary and unlawful infringements of the rights to privacy and freedom of opinion and expression (A/HRC/23/40, para. 3). In his inaugural report the following year on privacy in the digital age, the High Commissioner for Human Rights concluded that practices in many States involved a lack of adequate national legislation and/or enforcement, weak procedural safeguards and ineffective oversight, all of which had contributed to a lack of accountability for unlawful digital surveillance (A/HRC/27/37, para. 47). 6. Some States develop targeted surveillance tools within their own agencies and departments, others repurpose existing “off the shelf” crimeware products and others may 1 I especially want to thank Amos Toh, Desiree Murray, Cristina Butoiu, Matthew Marcoly and Kyoolee Park of the International Justice Clinic, University of California, Irvine School of Law, for their assistance in the preparation of the present report and its addendum. 3