{"id":24022,"date":"2023-04-20T00:33:12","date_gmt":"2023-04-20T07:33:12","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=24022"},"modified":"2024-01-23T09:10:03","modified_gmt":"2024-01-23T17:10:03","slug":"un-treaty-spyware","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/un-treaty-spyware\/","title":{"rendered":"How a New UN Cybercrime Treaty Could Lead to the Repression of Civil Liberties"},"content":{"rendered":"\n

Spyware is arguably one of the most insidious threats to privacy today. While other forms of privacy invasion \u2013 CCTV surveillance or even browser cookies \u2013 are more or less obvious, spyware is designed to be hidden, and for you to remain unaware of its presence on your systems. That\u2019s why the NSO leak<\/a> back in 2021 caused such a stir. If you didn\u2019t catch it, the NSO Group is one of the leading spyware companies, and the leak revealed information about who their targets were.<\/p>\n\n\n\n

Since then, the world of spyware has not stood still. The NSO Group has continued to release new spyware that has been deployed against civil society targets<\/a> around the world. Greece was rocked by a continuing scandal<\/a> that centered on the use and sale of Predator spyware. And, as I reported back in January, Meta\u2019s lawsuit against NSO for the latter\u2019s alleged use of WhatsApp to spy on people<\/a> is going forward.<\/p>\n\n\n\n

The matter of commercial spyware is serious enough for governments to have taken notice, and now it seems they\u2019re bent on taking action as well. Unfortunately, some parties are trying to use this opportunity to give authorities more power to do things like content moderation, invade citizens\u2019 online privacy, and even restrict their freedom of speech.<\/p>\n\n\n\n

Spyware Becomes a Matter of Sovereignty<\/h2>\n\n\n\n

Recently, President Biden has issued an Executive Order<\/a> (EO) imposing a \u201cProhibition on Use by the United States Government of Commercial Spyware that Poses Risks to National Security\u201d. This forbids any part of the US government to use spyware from a company whose products have been used to spy on US citizens without their consent, or<\/p>\n\n\n\n

\n

to collect information on activists, academics, journalists, dissidents, political figures, or members of non-governmental organizations or marginalized communities in order to intimidate such persons; curb dissent or political opposition; otherwise limit freedoms of expression, peaceful assembly, or association; or enable other forms of human rights abuses or suppression of civil liberties<\/p>\n<\/blockquote>\n\n\n\n

The Electronic Frontier Foundation points out that the EO does not name any company specifically, which might lead some government agencies to think that they can use foreign spyware from less well-known vendors. In fact, rather embarrassingly, a few days after the EO was published, it was revealed that the US government had been using spyware from the NSO Group<\/a>.<\/p>\n\n\n\n

Building on Biden\u2019s EO, the governments of Australia, Canada, Costa Rica, Denmark, France, New Zealand, Norway, Sweden, Switzerland, the United Kingdom, and the United States issued a \u201cJoint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware\u201d, which concluded<\/a>:<\/p>\n\n\n\n

\n

Our efforts will allow us to work collectively for the first time as we develop and implement policies to discourage the misuse of commercial spyware and encourage the development and implementation of responsible use principles that are consistent with respect for universal human rights, the rule of law, and civil rights and civil liberties.<\/p>\n<\/blockquote>\n\n\n\n

Fine sentiments, but moving from words to deeds is likely to be hard and slow. The lack of any coherent effort to stamp out or even simply control commercial spyware is confirmed by the fact that Poland, Greece and Spain were invited to sign the declaration, but according to an article in Foreign Policy declined<\/a> to do so.<\/p>\n\n\n\n

Regulating Spyware Can Turn Into Repression<\/h2>\n\n\n\n

That lends a particular importance to a UN Cybercrime Treaty<\/a> that is currently under discussion. As an EFF timeline of the treaty<\/a> shows, work began on this back in 2017, with a draft version of the treaty submitted by Russia. That in itself should be an indication that the proposed treaty is not quite what it seems. <\/p>\n\n\n\n

As Human Rights Watch warned in 2021<\/a>, instead of protecting people from cybercrime, if drafted in the wrong way, the treaty could undermine basic human rights like privacy and freedom of speech. How? By giving governments the right to tighten their control over the Internet.<\/p>\n\n\n\n

In 2022, the EFF and ten civil society organizations published a letter<\/a> supported by many other groups and academics around the world warning again that the treaty risks \u201crunning afoul of international human rights laws\u201d. More recently, the EFF has written an updated and detailed criticism of key clauses in the treaty, including those affecting privacy<\/a>:<\/p>\n\n\n\n

\n

The general expansion of surveillance powers in the draft includes squishy language that law enforcement could use to authorize hacking into our devices without further public debate. That language should be clarified to remove ambiguities about which powers are intended.<\/p>\n\n\n\n

The draft treaty also oddly refers to allowing authorities to use \u201cspecial investigative techniques\u201d without ever defining what those are. The current language, indeed, could allow any type of surveillance technology \u2013 from malware to IMSI catchers [discussed previously on our blog<\/a>], machine learning prediction, and other mass surveillance tools \u2013 as well as any tool or technique that may exist in the future.<\/p>\n<\/blockquote>\n\n\n\n

Manipulating UN Treaty for Their Own Benefit<\/h2>\n\n\n\n

The EFF has other concerns too. For example, treaty negotiators have proposed a variety of provisions that would expand surveillance powers across international borders, as well as within each country. These include interception of content, real-time collection of data, and admission of digital evidence. <\/p>\n\n\n\n

There is also a provision for \u201cspontaneous information\u201d, which refers to the ability of governments to share the results of their electronic surveillance with other governments whenever domestic law allows this. Although this capability is already present in many countries, the EFF believes that enshrining it in a UN treaty will encourage the practice, even with countries that have a poor human rights record.<\/p>\n\n\n\n

The EFF has many other comments on the current state of the treaty. But its main point is that it doesn\u2019t believe a UN Cybercrime Treaty is necessary, and that drawing one up comes with serious risks that it will make things worse, not better. In particular, the EFF calls for human rights such as the protection of privacy and freedom of expression to be \u201cbaked into\u201d the treaty to ensure that they are respected, whatever the rest of the treaty may say. Doing so would also set a good precedent for future UN treaties dealing with the digital domain.<\/p>\n\n\n\n