DEFENDING DEMOCRACY IN EXILE Policy Responses to Transnational Repression special rapporteur on freedom of opinion and expression, called in 2019 for a global moratorium on the sale of targeted surveillance technology, and a larger group of special rapporteurs repeated the call for a moratorium in response to the Pegasus Project’s findings.125 The United States took several steps aimed at curbing the commercial spyware industry in 2021. October updates to the Commerce Department’s licensing regulations restricted the sale of hardware and software that allows for the use or development of spyware to governments that violate human rights, including perpetrators of transnational repression such as Belarus, China, Russia, Saudi Arabia, and Vietnam.126 The rules allow for multiple exceptions, meaning the effectiveness of the changes hinges on the policy’s enforcement. In November, the Commerce Department banned the export of any US technology to NSO Group and Candiru, another Israeli company, because governments have used their spyware to “maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.”127 Finally, the National Defense Authorization Act, passed at the end of the year, directs the State Department to develop a list of spyware providers that the US government should not do business with due to their poor human rights records, establishing a pathway for transparency and future restrictions on the surveillance market.128 The efficacy of regulatory responses may also be undercut by authoritarian and illiberal governments that offer a safe haven to the spyware industry, and by democratic governments’ own contradictory policies. Dual-use regulations crafted by the EU came into force in 2021, restricting the export of and technical support for cybersurveillance technology that may be used to violate human rights.129 Robust implementation could help curtail spyware sales and access, particularly in light of connections between European countries and the spyware industry. In April 2022, Citizen Lab found “strong circumstantial evidence” pointing to Spanish authorities’ use of spyware.130 NSO Group’s 2021 transparency report noted that the company 30 @FreedomHouse exports products from Bulgaria and Cyprus—both EU member states—in addition to Israel.131 Hungarian authorities have allegedly used Pegasus to surveil lawyers and journalists, and the Polish security services have been accused of employing it against members of the Polish opposition.132 The Polish Senate, which is controlled by the opposition, established a special committee to investigate the matter.133 In March 2022, the European Parliament formed its own committee to examine the alleged illegal use of spyware by EU governments.134 The outcome of that inquiry may have implications for the implementation and development of European spyware regulations in the future. Private actors have also turned to the courts for relief in several countries. In October 2021, India’s Supreme Court ordered an investigation into authorities’ use of Pegasus after journalists and activists filed petitions.135 Apple, WhatsApp, and Facebook all initiated lawsuits in the United States in recent years, taking issue with the proliferation of surveillance software that exploits their technology.136 In April 2022, civil society organizations and Salah Hammouri filed a case in France against NSO Group for facilitating unlawful surveillance of Hammouri, a French-Palestinian human rights defender.137 The pitfalls and promise of government responses Governments are beginning to recognize the harm to human rights caused by spyware, but the recent regulatory and legislative steps address only a part of the problem and come after years of painstaking documentation by media outlets and civil society. Regulation tends to be reactive in nature, and governments intent on surveilling their opponents will search for ways around any existing guardrails. The efficacy of regulatory responses may also be undercut by authoritarian and illiberal governments that offer a safe haven to the spyware industry, and by democratic governments’ own contradictory policies. Both the FBI and German police have previously purchased Pegasus software.138 Curtailing the use of spyware in the future will require strengthening and consistently enforcing regulations, using strategic litigation, and defending the right to privacy more broadly, including by reforming domestic surveillance practices and safeguarding end-to-end encryption technologies. Proactive adjustment will also be necessary to meet new threats. One promising model for a flexible, collaborative, and rights-based approach is the Export #TransnationalRepression