TNR Watch: Delivering Accountability for Spyware Abuse

Landmark rulings: In late January, a British court ordered the Saudi government to pay more than $4 million in damages to London-based activist Ghanem al-Masarir after it was found responsible for infecting his phone with Pegasus spyware and later directing an assault on him. Judge Pushpinder Saini determined that the Saudi actions were “grossly intrusive” and that Riyadh “had a clear interest in and motivation to shut down the claimant’s public criticism of the Saudi government.”

In another case related to spyware, the UK Supreme Court is reviewing whether the Bahraini government has sovereign immunity from claims that it installed German-made FinFisher software on the laptops of two UK-based Bahraini dissidents. Notably, an appellate court has already ruled that Bahrain could not claim sovereign immunity for “personal injury” caused to individuals in the United Kingdom even if the digital infiltration was carried out remotely from outside the country.

Questions remain about how such rulings against foreign states will be enforced; the Saudi government stopped participating in al-Masarir’s case after the British court rejected Riyadh’s claims of sovereign immunity. Nevertheless, these cases are an important step toward accountability for digital transnational repression.

Remote control: At least 19 of the 48 state perpetrators of transnational repression identified by Freedom House have used spyware to monitor the communications and movements of dissidents living abroad. The abuse of such invasive tools places activists, journalists, and others at a huge disadvantage, forcing them to protect themselves against governments with high levels of digital expertise and far greater resources. Surveillance technology also frequently enables physical acts of transnational repression. For example, Citizen Lab analysts uncovered evidence that the Saudi government planted NSO Group spyware on the devices of journalist Jamal Khashoggi’s closest acquaintances before his 2018 assassination in Istanbul.

Ongoing advocacy: Freedom House works to counter the proliferation and abuse of commercial spyware technology through a number of initiatives, including the Pall Mall Process led by the United Kingdom and France, which seeks to combat the irresponsible use of commercial cyberintrusion capabilities. Freedom House has contributed to the process’s Code of Practice for States, which outlines how governments can leverage their export-control authorities to mitigate the risks of malicious spyware, as well as the forthcoming Code of Practice for Industry, which will promote responsible behavior in the private sector.