Georgetown Law
Technology Review

A secretive, new weapon is steadily challenging the global balance of power. Authoritarian and democratic regimes alike are clamoring for commercially available “spyware” technologies that enable them to surreptitiously track and monitor the private communications of almost anyone, anywhere in the world.

The leading spyware vendor, NSO Group, has become infamous for its Pegasus product, which has been linked to invasive, high profile digital attacks on journalists, political dissidents, lawyers, and activists around the world. These attacks not only violate human rights but have also led to physical violence and death.

The proliferation of military-grade digital surveillance tools through an unregulated commercial spyware market presents a growing threat to democracy and human rights, from press freedoms to fundamental rights of privacy, expression, assembly, and association. For governments, including the United States, commercial spyware is both a compelling new intelligence tool as well as a significant national security challenge. Major technology platforms are also implicated in the rise of the spyware industry, given the significant resources they must invest in countermeasures to protect their products and users from attacks.

Thus far, international regimes governing both state and non- state actors’ commitments to human rights have failed to sufficiently regulate the spyware industry. However, a wave of court cases in the United States represents a novel opportunity to hold spyware firms accountable for human rights violations stemming from the use of their products. After introducing the Pegasus spyware technology and its human rights impacts, this Note reviews the viability of existing international governance and accountability mechanisms— international human rights law, export regimes, industry self- regulation, and multi-stakeholder proposals—in the context of spyware regulation. Finally, this Note examines three cases against NSO in U.S. courts to show how technology firms and individuals may be able to hold NSO liable for illegal activities in the absence of other effective regulatory regimes.

Continue Reading