Freedom House government agencies to purchase personal data from data brokers rather than obtaining a warrant. And in the European Union (EU), policymakers negotiating over the final text of the proposed EU AI Act should ensure that it prohibits the use of AI in technologies that are widely known to infringe on human rights, including facial recognition, so-called “predictive policing,” and real-time biometric identification. Policymakers should refrain from mandating the introduction of “back doors” to digital devices and services, requiring that messages be traceable, or reducing intermediary liability protections for providers of end-to-end encryption. In the United States, any reforms to Section 230 of the Communications Decency Act should not undermine the ability of intermediaries and service providers to offer robust encryption. Weakening encryption would endanger the lives of activists, journalists, members of marginalized communities, and ordinary people around the world. The US government is leading the international community in its efforts to combat commercial spyware abuses. In March 2023, the administration of President Joseph Biden announced an executive order that, among other mandates, bars federal agencies from the “operational” use of commercial spyware products that pose a threat to national security or counterintelligence, or that could be employed by foreign governments to violate human rights or target people from the United States. While this is a welcome step forward, the White House should work with Congress to make the order’s provisions permanent law through bipartisan legislation, ensuring that the prohibition remains in place under future administrations. Governments should work closely with civil society to ensure that democracies’ lists of prohibited companies are swiftly and appropriately updated as the industry evolves. The US Commerce Department’s Bureau of Industry and Security has imposed special licensing requirements on several surveillance firms whose foreign government clients had used their technologies to target journalists, activists, and others. The addition of these firms to the bureau’s Entity List was a positive development, and others engaged in such practices should be subjected to the same restrictions. While the European Parliament launched a committee of inquiry to investigate the use of Pegasus and other spyware tools, the European Commission still needs to take formal action. The EU should follow the example of the United States and rein in the commercial surveillance market. Robust action from Brussels would send a very strong signal to spyware purveyors that their irresponsible trade will no longer be tolerated, particularly those operating within the EU’s borders. To guarantee effective international cooperation on spyware, the United States and like-minded democracies will need to encourage other governments to implement common standards. Governments that signed the Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware, as well as those that joined the Export Controls and Human Rights Initiative, should follow through on their commitments and encourage like-minded states to join. Companies Companies should mainstream end-to-end encryption in their products and uphold other robust security protocols, including by resisting government requests to provide special decryption access. Companies should also resist government data requests that contravene international human rights standards or lack a valid judicial warrant. Digital platforms should use all available legal channels to challenge such problematic requests from state agencies, whether they are official or informal, especially when they relate to the accounts of human rights defenders, civil society activists, journalists, or other at-risk individuals. Businesses exporting surveillance and censorship technologies that could be used to commit human rights abuses should publicly report annually on the human rights related due diligence they are conducting before making sales, the due diligence obligations they are requiring from their resellers and distributors, and their efforts to identify requests from customers that suggest the technologies may be used for repressive purposes. The reports should include a list of countries to which they have sold such technologies. @freedomhouse freedomhouse.org 33