European companies export surveillance software. Governments use it to spy on journalists, track activists and silence political opponents. Now, human rights organisations are calling on Brussels to stop European technology from fuelling repression abroad.
Bulgaria exported surveillance technology to Azerbaijan in 2022. Poland sent telecommunications interception systems to Rwanda a year later. Both countries have documented histories of surveillance being used against journalists, activists and political opponents.
Human rights organisations say the EU must do more to prevent its technology from enabling such abuses. In a joint letter to the EU’s Trade Commissioner Maroš Šefčovič, Access Now, Amnesty International, Human Rights Watch, the Committee to Protect Journalists, Privacy International, Data Rights, SMEX, 7amleh and the Centre for Democracy and Technology Europe warn of an “increasing number of harmful exports of surveillance technology” from EU countries.
“EU and member state data (…) shows abundant exports of surveillance technology to countries where a considerable risk exists of the technology being used for internal repression and other human rights violations.”
— Joint letter issued to Commissioner Šefčovič
The letter comes as the Commission evaluates the EU’s Dual-Use Regulation. The law governs exports of goods and technologies that can serve both civilian and military purposes, including certain surveillance tools. Revised in 2021, the regulation aims to prevent European technology from facilitating repression abroad. The Commission is due to report its findings by September 2028.
“The evaluation of the dual-use regulation is an opportunity for the Commission to ensure that the human rights safeguards achieved in the 2021 recast of the framework are operationalised to be effective in practice and actually prevent the export of harmful cyber surveillance items that are enabling human violations across the world,” Rand Hammoud, director of security, surveillance and human rights at the Centre for Democracy and Technology Europe, told EU Perspectives.
Lack of transparency
Surveillance technologies can help authorities investigate crimes. But they can also be used to intercept communications, track people’s movements and access private devices. All without their knowledge or consent.
Concerns about the effectiveness of EU safeguards are not new. “At the time the 2021 recast of the Dual-Use Regulation was adopted, civil society organizations, many of which are signatories to this letter, raised concerns that it did not go far enough in preventing EU member states from exporting surveillance technology that risks human rights violations,” the letter states.
EU rules require certain surveillance technologies to obtain an export licence before they can be sold abroad. Other technologies are not automatically subject to these controls, but national authorities can require a licence if there is a risk that they could be used for human rights violations. This mechanism is known as the catch-all clause.
The organisations argue that the Commission’s 2024 guidelines leave a significant gap. The guidelines explain how companies should assess human rights risks associated with technologies not explicitly covered by export controls. However, they do not provide equivalent guidance for products that already require a licence.
Transparency is another concern. According to the organisations, the Commission’s guidelines have restricted the information made public about surveillance exports. That, claims the letter, “severely limits the information available to civil society, journalists, exporters and the general public about exports of surveillance technology”.
A Human Rights Watch investigation illustrates the scale of the problem. Researchers requested export licensing records from all 27 EU member states but obtained relevant data from only seven. The available records revealed exports of surveillance technology to more than two dozen countries with histories of human rights violations.
Selling European surveillance
The organisations argue that the available evidence points to continued exports of surveillance technology despite the risks.
“EU and member state data since then shows abundant exports of surveillance technology to countries where a considerable risk exists of the technology being used for internal repression and other human rights violations,” they warn.
They are therefore calling on the Commission to use the evaluation to “strengthen export controls for listed and unlisted cybersurveillance items”, ensuring that human rights risks are assessed regardless of whether a technology is already covered by export restrictions.
They also want greater transparency. Each licence application should publicly identify the exporter, describe the end user and destination, state its value and indicate whether authorisation was granted or refused, including the reasons.
Another concern is the catch-all clause, which the organisations say “places too much reliance on exporter-triggered due diligence”. They want national authorities to identify potentially dangerous exports more proactively, instead of relying primarily on companies to flag risks.
The letter also calls for regular reviews of emerging surveillance tools, closer alignment with EU rules on artificial intelligence and mechanisms to provide remedies to victims.
