A/HRC/41/35 human rights obligations and must be conducted on the basis of a legal framework, which must be publicly accessible, clear, precise, comprehensive and non-discriminatory. 26. While these principles apply in all cases of targeted surveillance, they have particular force when expression in the public interest is implicated. Targeted surveillance creates incentives for self-censorship and directly undermines the ability of journalists and human rights defenders to conduct investigations and build and maintain relationships with sources of information (A/HRC/38/35/Add.2, para. 53). The Committee has emphasized that restrictions may never be invoked as a justification for the muzzling of any advocacy of multiparty democracy, democratic tenets and human rights.32 Attacks on a person because of the exercise of his or her right to freedom of expression may not be justified by article 19 (3).33 The Committee further singled out the importance of protecting journalists and persons who engaged in the gathering and analysis of information on the human rights situation and who published human rights-related reports, including judges and lawyers.34 These protections extend to the confidentiality of sources, which international and regional human rights mechanisms (in the African, European and inter-American systems) have emphasized should be protected under law (A/70/361, para. 5). 27. In addition to the primary obligations not to interfere with privacy or restrict expression, States also have duties to protect individuals against third-party interference. Article 2 of the International Covenant on Civil and Political Rights, reflecting the primary duties of States, imposes an obligation to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the Covenant. 35 Article 17 (2) of the Covenant provides that everyone has the right to the protection of the law against unlawful interference with his or her privacy. However, it is not clear that States generally afford affirmative legal protections against targeted surveillance. This is certainly true of transnational surveillance, even when committed by foreign entities against one’s own citizens.36 In one instance concerning the allegations of targeted surveillance in Mexico, the Special Rapporteur for freedom of expression in the Inter-American Commission on Human Rights and the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression conducted a joint mission to the country in which they raised the issue of the Government’s use of the Pegasus spyware. They urged the Government to allow an independent investigation of the allegations that the spyware was deployed against journalists (A/HRC/38/35/Add.2, paras. 52–55). To date, the efforts to investigate the allegations have not clarified the situation, despite the orders of the National Institute for Transparency, Access to Information and Personal Data Protection of Mexico that the Government reveal the nature of its contracts to obtain Pegasus. 37 28. It is clear from the Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework adopted by the Human Rights Council in 2011, that a State’s duty to protect includes a duty to take appropriate steps to prevent, investigate, punish and redress human rights abuse by third parties (A/HRC/17/31). In the Guiding Principles, States are urged to exercise adequate oversight in order to meet their international human rights obligations when they contract with, or legislate for, business enterprises to provide services that may have an impact on the enjoyment of human rights (ibid., p. 10). 32 33 34 35 36 37 General comment No. 34, para. 23. Ibid. Ibid. See also Human Rights Committee, general comment No. 31 (2004) on the nature of the general legal obligation imposed on States parties to the Covenant. Note that under general comment No. 31, article 17 on privacy is specifically included as an example of an article in which there are positive obligations on States parties to address the activities of private persons or entities. See Nate Cardozo, “D.C. circuit court issues dangerous decision for cybersecurity: Ethiopia is free to spy on Americans in their own homes”, Electronic Frontier Foundation, 14 March 2017. See Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, “Fiscalía general de la República tiene oportunidad histórica para acabar con la impunidad en caso Pegasus: Salas Suárez”, 27 March 2019; and Juan Arvizu, “Ordena Inai a PGR abrir contrato de compra de Pegasus”, El Universal, 17 April 2018. 9