Freedom House Governments Government surveillance programs should adhere to the International Principles on the Application of Human Rights to Communications Surveillance, a framework agreed upon by a broad consortium of civil society groups, industry leaders, and scholars. The principles, which state that all communications surveillance must be legal, necessary, and proportionate, should also be applied to AI-driven and biometric surveillance technologies, targeted surveillance tools like commercial spyware and extraction software, and open-source intelligence methods such as social media monitoring. In the United States, lawmakers should reform or repeal existing surveillance laws and practices, including Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333, to better align them with these standards. Broad powers under Section 702 and Executive Order 12333 have allowed US government agencies to collect and access Americans’ personal data without meaningful transparency or oversight. Congress should also close a legal loophole that allows US government agencies to purchase personal data from commercial brokers rather than obtaining a warrant. Policymakers should refrain from mandating the introduction of “back doors” to digital devices and services, requiring that messages be traceable, or reducing intermediary liability protections for providers of end-to-end encryption. Weakening encryption would endanger the lives of activists, journalists, members of marginalized communities, and ordinary people around the world. Governments should restrict the export of surveillance technologies of concern, including commercial spyware, and should solicit input from civil society when considering how to strengthen export controls to protect human rights. The US Commerce Department’s Bureau of Industry and Security has taken several important steps to this effect, including adding commercial spyware firms to its Entity List—which subjects them to specific export restrictions—and initiating regular civil society consultations. The US Congress should pass legislation to codify provisions of Executive Order 14093 that prohibit the operational use of commercial spyware products by federal agencies. The US government should continue to lead the international community in its efforts to combat the abuse of commercial spyware by encouraging signatories to the Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware to follow through on their commitments. Like-minded democracies, in Europe and elsewhere, should follow suit, including through the Pall Mall Process led by the United Kingdom and France, among other forums. Bold action from these democracies would be an important step in combating spyware purveyors’ irresponsible global trade. Companies Companies should mainstream end-to-end encryption in their products, support anonymity software, and uphold other robust security protocols, including by notifying victims of surveillance abuses and resisting government requests to provide special decryption access. Companies should also resist government data requests that contravene international human rights standards or lack a valid judicial warrant. Digital platforms should use all available legal channels to challenge such problematic requests from state agencies, whether they are official or informal, especially when they relate to the accounts of human rights defenders, civil society activists, journalists, or other at-risk individuals. Businesses exporting surveillance and censorship technologies that could be used to commit human rights abuses should report publicly and annually on the human rights–related due diligence they are conducting before making sales, the due diligence obligations they are requiring from their resellers and distributors, and their efforts to identify requests from customers that suggest the technologies may be used for repressive purposes. The reports should include a list of countries to which they have sold such technologies. These businesses should also adhere to obligations and responsibilities outlined in the UN Guiding Principles on Business and Human Rights. @freedomhouse freedomhouse.org 31