—

having regard to the Treaty on European Union (TEU) and in particular Articles 2, 4, 6 and 21 thereof,

—

having regard to Articles 16, 223, 225 and 226 of the Treaty on the Functioning of the European Union (TFEU),

—

having regard to the Charter of Fundamental Rights of the European Union (the ‘Charter’), and in particular Articles 7, 8, 11, 17, 21, 41, 42 and 47 thereof,

—

having regard to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (1) (‘e-Privacy Directive’),

—

having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2),

—

having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (3),

—

having regard to Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA (4) (‘Cybercrime Directive’),

—

having regard to Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (5) (‘Dual-Use Regulation’),

—

having regard to Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (6) as amended by Council Decision (CFSP) 2021/796 of 17 May 2021  (7),

—

having regard to the Act concerning the election of the Members of the European Parliament by direct universal suffrage (8),

—

having regard to Decision 95/167/EC, Euratom, ECSC of the European Parliament, the Council and the Commission of 6 March 1995 on the detailed provisions governing the exercise of the European Parliament’s right of inquiry (9),

—

having regard to Decision (EU) 2022/480 of the European Parliament of 10 March 2022 on setting up a committee of inquiry to investigate the use of the Pegasus and equivalent surveillance spyware, and defining the subject of the inquiry, as well as the responsibilities, numerical strength and term of office of the committee (10),

—

having regard to Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (11) (‘Anti-Money Laundering Directive’),

—

having regard to the proposal for a regulation of the European Parliament and the Council of 16 September 2022 establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive 2010/13/EU (COM(2022)0457),

—

having regard to Article 12 of the Universal Declaration of Human Rights,

—

having regard to the judgment of the Court of Justice of the European Union (CJEU) in case C-37/20 (12) on the anti-money-laundering directive on the provision whereby the information on the beneficial ownership of companies incorporated within the territory of the Member States is accessible in all cases to any member of the general public is ruled invalid,

—

having regard to Article 17 of the International Covenant on Civil and Political Rights,

—

having regard to the Charter of the United Nations and the United Nations Guiding Principles on Business and Human Rights (13),

—

having regard to the statement of UN High Commissioner for Human Rights Michelle Bachelet of 19 July 2022 entitled ‘Use of spyware to surveil journalists and human rights defenders’,

—

having regard to the comment of Council of Europe Commissioner for Human Rights Dunja Mijatovic of 27 January 2023 entitled ‘Highly intrusive spyware threatens the essence of human rights’  (14),

—

having regard to the European Data Protection Supervisor’s (EDPS) Preliminary Remarks on Modern Spyware of 15 February 2022  (15),

—

having regard to the European Convention for the Protection of Human Rights and Fundamental Freedoms, and in particular Articles 8, 10, 13, 14 and 17 thereof and the protocols to that Convention,

—

having regard to Europol’s 2021 Serious and Organised Crime Threat Assessment (SOCTA) entitled ‘A Corrupting Influence: the Infiltration and Undermining of Europe’s Economy and Society by Organised Crime’,

—

having regard to the 2017 European Union Agency for Fundamental Rights (FRA) report entitled ‘Surveillance by intelligence services: fundamental rights safeguards and remedies in the EU’, and to the updates presented on 28 February 2023 to the Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA),

—

having regard to its resolution of 12 March 2014 on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs (16) and in particular to the recommendations contained therein on strengthening IT security in the EU’s institutions, bodies and agencies,

—

having regard to EDPS opinion 24/2022 of 11 November 2022 on the European Media Freedom Act,

—

having regard to the glossary on malware and spyware drawn up by the European Union Agency for Cybersecurity (ENISA),

—

having regard to the European Ombudsman’s Decision on how the European Commission assessed the human rights impact before providing support to African countries to develop surveillance capabilities (case 1904/2021/MHZ),

—

having regard to the statement 2 February 2023 by Ms Irene Kahn, UN Special Rapporteur on freedom of opinion and expression and Mr Fernand de Varennes, UN Special Rapporteur on minority issues demanding an investigation into the alleged spying programme targeting Catalan leaders (17),

—

having regard to the report on by the European Commission for Democracy through Law (Venice Commission) on the democratic oversight of the security services (18) and to its opinion entitled ‘Poland — Opinion on the Act of 15 January 2016 amending the Police Act and Certain Other Acts’  (19),

—

having regard to the report of the Committee of Inquiry to investigate the use of the Pegasus and equivalent surveillance spyware (A9-0189/2023),

—

having regard to Rule 208(12) of its Rules of Procedure,

A.

whereas, thanks to the efforts of CitizenLab and Amnesty Tech and numerous investigative journalists, it has been revealed that government bodies in several countries, both EU Member States and non-EU countries, have used Pegasus and equivalent surveillance spyware against journalists, politicians, law enforcement officials, diplomats, lawyers, business people, civil society actors and other actors, for political and even criminal purposes; whereas such practices are extremely alarming and demonstrate the risk of abuse of surveillance technologies to undermine fundamental human rights, democracy and electoral processes;

B.

whereas whenever the term ‘spyware’ is mentioned in the report, it means ‘Pegasus and equivalent surveillance spyware’ as defined in Parliament’s Decision to set up the PEGA Committee;

C.

whereas it has been observed that state actors have deliberately used spyware in a misleading manner by using spyware that can disguise itself as legitimate program, file or content (‘Trojan horse’), such as fake messages from public institutions; whereas in some cases public authorities have used phone operators to transmit malicious content to the targeted person’s device; whereas spyware can be deployed by exploiting zero-day vulnerabilities without the interaction of the target with infected content, can remove all traces of its presence after uninstallation and can anonymise the link between remote operators and server;

D.

whereas in the early days of mobile communication, eavesdropping was conducted through the interception of calls and, later, of text messages in plain format;

E.

whereas the emergence of encrypted mobile communication applications led to the emergence of the spyware industry exploiting existing vulnerabilities in smartphone operating systems to install software that imports spyware into the phone, including through ‘zero-click’ infections without the user’s knowledge or any action by the user, enabling the extraction of data before encryption; whereas such zero-click spyware, by its very design, makes effective and meaningful scrutiny of its use very difficult;

F.

whereas knowledge about vulnerabilities in software systems is traded directly between parties, or is facilitated by brokers; whereas this trade includes non-state actors and criminal organisations;

G.

whereas the acquisition, trading and hoarding of zero-day vulnerabilities fundamentally undermines the integrity and security of communications and cyber security of EU citizens;

H.

whereas spyware surveillance should remain the exception and always require effective, binding and meaningful prior judicial authorisation by an impartial and independent judicial authority, which must ensure that the measure is necessary, proportionate and strictly limited to cases affecting national security or involving terrorism and serious crime; whereas surveillance techniques are liable to be abused in environments without effective checks and balances;

I.

whereas any spyware surveillance must be scrutinised by an independent ex post oversight authority, which must ensure that any authorised surveillance is carried out in compliance with fundamental rights and in accordance with the conditions set out by the CJEU, the European Court of Human Rights (ECtHR) and the Venice Commission; whereas this ex post oversight authority should order the termination of surveillance immediately if it is found to be incompatible with the above-mentioned rights and conditions;

J.

whereas spyware surveillance failing to meet the requirements set out in Union law and the jurisprudence of the CJEU and the ECtHR runs counter to the values enshrined in Article 2 TEU and the fundamental rights enshrined in the Charter, in particular those in Articles 7, 8, 11, 17, 21 and 47 thereof, which recognise specific rights, freedoms and principles such as respect for private and family life, the protection of personal data, freedom of expression and information, the right to property, the right to non-discrimination, as well as the right to effective remedy, a fair trial and the presumption of innocence;

K.

whereas the rights of targeted persons are laid down in the Charter and international conventions, in particular the right to privacy and the right to a fair trial, as well as in Union rules on the rights of suspects and accused; whereas these rights have been confirmed by CJEU and ECtHR case-law;

L.

whereas the impact of targeted surveillance on women can be particularly grievous, as authorities may use the increased social scrutiny women are under to weaponise private and intimate data extracted through spyware for defamation campaigns;

M.

whereas it is clear from the testimonies of persons targeted that even if legal remedy and civil rights exist on paper, they mostly become void in the face of obstruction by government bodies, the absence or non-implementation of the right of persons targeted to be informed and the administrative obstacle of individuals having to prove they have been targeted; whereas even in systems with quick and open procedures, the nature of spyware makes it very hard to prove authorship and the nature and extent to which an individual has been targeted;

N.

whereas courts have not accepted the forensic evidence of independent experts but only evidence based on examination of the authorities, security or law enforcement that are allegedly behind an attack; whereas this leaves targets in a paradoxical situation with no viable option for proving a spyware infection;

O.

whereas the Polish government has weakened and eliminated institutional and legal safeguards, including proper oversight and scrutiny procedures, effectively leaving persons targeted without any meaningful remedy; whereas Pegasus surveillance spyware has been illegally deployed for political purposes to spy on journalists, opposition politicians, lawyers, prosecutors and civil society actors;

P.

whereas the Hungarian government has weakened and eliminated institutional and legal safeguards including proper oversight and scrutiny procedures, effectively leaving persons targeted without any meaningful remedy; whereas the Pegasus surveillance spyware has been illegally deployed for political purposes to spy on journalists, opposition politicians, lawyers, prosecutors and civil society actors;

Q.

whereas it has been officially confirmed that a Member of the European Parliament(MEP) for Greece and a Greek journalist have been both wiretapped by the Greek National Intelligence Service (EYP) and targeted with Predator spyware; whereas a former US-Greek employee at Meta was simultaneously wiretapped by the EYP and targeted with Predator spyware, the use of which is illegal under Greek law; whereas according to media reports, opposition and government party MPs in Greece, party activists and journalists have allegedly also been targeted with Predator spyware or conventional wiretapping by the EYP or both; whereas the Greek government denies having purchased or used Predator, but it is highly probable that Predator has been used by or on behalf of persons very close to the Prime Minister’s office; whereas the Greek government admitted it has granted export licences to Intellexa for the sale of the Predator spyware to repressive governments, such as Madagascar and Sudan; whereas the government has responded to the scandal with legislative amendments that further reduce the rights of targets to be informed after surveillance has taken place and is further hampering the work of independent authorities;

R.

whereas revelations identified two categories of spyware target in Spain; whereas the first includes the Prime Minister and the Minister of Defence, the Minister of the Interior and other high officials; whereas the second category are part of what is referred to as ‘CatalanGate’ by the Citizen Lab organisation, and includes 65 targeted persons, including political figures from the regional Government of Catalonia, Members of the pro-Catalan independence movement, MEPs, lawyers, academics and civil society actors; whereas in May 2022 the Spanish authorities admitted to targeting 18 persons with court authorisation, though they have so far not disclosed the warrants or any other information, invoking national security when accounting for the use of spyware surveillance in Spain; whereas 47 other persons have also been allegedly targeted, but not received any information other than from Citizen Lab;

S.

whereas no allegations of spyware infections have been confirmed in Cyprus; whereas Cyprus is an important European export hub for the surveillance industry and an attractive location for companies selling surveillance technologies;

T.

whereas there are strong indications that the governments of Morocco and Rwanda, among others, have targeted high profile Union citizens with spyware, including the President of France, the Prime Minister, the Minister of Defence and the Minister of the Interior of Spain, the then Prime Minister of Belgium, the former President of the Commission and former Prime Minister of Italy, and Carine Kanimba, the daughter of Paul Rusesabagina;

U.

whereas it can be safely assumed that all Member States have purchased or used one or more spyware systems; whereas most governments in the European Union will refrain from illegitimate use of spyware, but the risk of abuse is very plausible in the absence of a solid legal framework including safeguards and oversight, and in light of technical challenges in detecting and tracing infections;

V.

whereas most Member State governments and Member State parliaments have not provided the European Parliament with meaningful information about their legal frameworks governing the use of spyware beyond what was already publicly known, despite an obligation to do so pursuant to Article 3(4) of the Decision of the European Parliament, the Council and the Commission of 6 March 1995 on the detailed provisions governing the exercise of the European Parliament’s right of inquiry; whereas it is difficult to assess the enforcement of Union legislation and the safeguards, oversight and means of redress, which prevents the adequate protection of citizen’s fundamental rights;

W.

whereas Article 4(3) TEU reads ‘pursuant to the principle of sincere cooperation, the Union and the Member States shall, in full mutual respect, assist each other in carrying out tasks which flow from the Treaties’;

X.

whereas several key figures from the spyware industry have acquired Maltese citizenship, which facilitates their operations within and from the Union;

Y.

whereas many spyware developers and vendors are or have been registered in one or more Member States; whereas examples include NSO Group with corporate presence in Luxembourg, Cyprus, the Netherlands and Bulgaria; the parent company of Intellexa, Thalestris Limited, in Ireland, Greece, Switzerland and Cyprus; DSIRF in Austria; QuaDream in Cyprus; Amesys and Nexa Technologies in France; Tykelab and RCS Lab in Italy; and FinFisher (now defunct) in Germany;

Z.

whereas the European Union does not participate in the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies; whereas all Member States except Cyprus participate in the Wassenaar Arrangement, although Cyprus submitted a request to join the Wassenaar Arrangement a long time ago; whereas Cyprus is bound by the Dual-Use Regulation;

AA.

whereas Israel’s export regime (20) applies in principle to all Israeli citizens, even when operating from the EU; whereas Israel is does not participate in the Wassenaar Arrangement but claims to apply its standards nevertheless;

AB.

whereas the export of spyware from the Union to non-EU countries is regulated in the Dual-use Regulation, which was revised in 2021; whereas the Commission published its first implementation report in September 2022 (21);

AC.

whereas some spyware producers exporting to third countries establish themselves within the Union to gain respectability while trading in spyware with repressive regimes; whereas exports from the Union to repressive regimes or non-state actors are taking place, in violation of the EU export rules;

AD.

whereas Amesys and Nexa Technologies are currently being prosecuted in France for exporting surveillance technology to Libya, Egypt and Saudi Arabia; whereas Intellexa companies based in Greece reportedly exported their products to Bangladesh, Sudan, Madagascar and at least one Arab country; whereas FinFisher’s software is being used by dozens of countries all over the world, including Angola, Bahrain, Bangladesh, Egypt, Ethiopia, Gabon, Jordan, Kazakhstan, Myanmar, Oman, Qatar, Saudi Arabia, Turkey and Morocco’s intelligence services, which have been accused of using Pegasus spyware against journalists, human rights defenders, civil society and politicians by Amnesty International and Forbidden Stories; whereas it is unknown if export licences were granted for the export of spyware to all these countries; whereas former FinFisher executives have been charged by the public prosecutor’s office in Munich for exporting surveillance technology to Turkey without an export licence;

AE.

whereas the number of attendees at arms fairs and ISSWorld who were marketing spyware capabilities demonstrates the predominance of third country providers of spyware and related products and services, a significant number of which are headquartered in Israel (e.g. NSO Group, Wintego, Quadream and Cellebrite) and reveals prominent producers in India (ClearTrail), the United Kingdom (BAe Systems and Black Cube) and the United Arab Emirates (DarkMatter), while the United States Entity List blacklisting spyware producers located in Israel (NSO Group and Candiru), Russia (Positive Technologies) and Singapore (Computer Security Initiative Consultancy PTE LTD.) further highlights the diverse origins of spyware producers; whereas the fair is also attended by a wide range of European public authorities, including local police forces;

AF.

whereas Article 4 (2) TEU provides that national security remains the sole responsibility of each the Member State;

AG.

whereas, however, the CJEU has ruled (case C-623/17) that ‘although it is for the Member States to define their essential security interests and to adopt appropriate measures to ensure their internal and external security, the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law’;

AH.

whereas the CJEU has ruled (case C-203/15) that ‘Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication’;

AI.

whereas the CJEU has ruled (case C-203/15) that ‘Article 15(1) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review by a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union’;

AJ.

whereas the case-law of the ECtHR makes clear that all surveillance must occur in accordance with the law, serve a legitimate aim and be necessary and proportionate: whereas, moreover, the legal framework must provide precise, effective and comprehensive safeguards on the ordering, execution and potential redress opportunities against surveillance measures, which must be subject to adequate judicial review and effective oversight (22);

AK.

whereas the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), recently modernised as Convention 108+, applies to processing of personal data for state (national) security purposes, including defence; whereas all Member States are parties to this Convention;

AL.

whereas important aspects of the use of surveillance spyware for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, fall within the scope of EU law;

AM.

whereas the Charter lays down the conditions for the limitation of the exercise of fundamental rights, requiring that it must be provided for by law, respect the essence of the rights and freedoms concerned, be subject to the principle of proportionality and only be imposed if it is necessary and genuinely meets objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others; whereas when spyware is used, the level of interference with the right to privacy can be so severe that the individual is in fact deprived of it and the use cannot always be considered proportionate, irrespective of whether the measure can be deemed necessary to achieve the legitimate objectives of a democratic state;

AN.

whereas the e-Privacy Directive provides that Member States must ensure the confidentiality of communications; whereas the deployment of surveillance tools constitutes a restriction of the right to protection of terminal equipment afforded by the e-Privacy Directive; whereas such restrictions place national laws on spyware within the scope of the e-Privacy Directive in a similar way to national data retention laws; whereas frequent deployment of intrusive spyware technology would not be compatible with the Union legal order;

AO.

whereas under international law a state has the right to investigate potential crimes only within its jurisdiction and has to resort to the assistance of other states where the investigation has to be carried out in other states unless there is a basis for conducting investigations in other jurisdictions under an international agreement or in in Union law, in the case of Member States;

AP.

whereas the infection of a device with spyware and the subsequent collection of data takes place through the servers of mobile service providers; whereas as free roaming within the Union has resulted in persons sometimes having mobile contracts from other Member States than the one where they reside, there is currently no legal basis in Union law for the collection of data in the other Member State through the use of spyware;

AQ.

whereas David Kaye, the former UN Special Rapporteur on the promotion and protection of the right to freedom of expression (23) and Irene Khan, current UN Special Rapporteur on the promotion and protection of the right to freedom of expression (24), have called for an immediate moratorium on the use, transfer and sale of surveillance tools until rigorous human rights safeguards are put in place to regulate practices and guarantee that Governments and non-state actors use these tools in legitimate ways;

AR.

Whereas there are cases where spyware companies, in particular Intellexa, have not only sold the interception and extraction technology itself, but also the entire service, also referred to as ‘hacking as a service’ or ‘active cyberintelligence’, offering a package of surveillance and interception technology methods, as well as training for staff and technical, operational and methodological support; whereas this service could allow the company to be in control of the entire surveillance operation and aggregate the surveillance data; whereas this practice is almost impossible for the relevant authorities to oversee and control; whereas this makes it difficult to adhere to principles of proportionality, necessity, legitimacy, legality and adequacy; whereas this service is not permitted by Israel’s defence export agency (DECA); whereas Cyprus has been used to bypass existing limitations under Israeli law in order to provide hacking as a service;

AS.

whereas Member States must comply with Directive 2014/24/EU and Directive 2009/81/EC on public and defence procurement, respectively; whereas they must adequately justify derogations under Article 346(1)(b) TFEU, as Directive 2009/81/EC explicitly takes into account the sensitive characteristics of defence procurement and comply with the WTO Agreement on Government Procurement, as amended 30 March 2012 (25) if party to it;

AT.

whereas the EDPS has underlined that Member States have to respect the European Convention on Human Rights and the jurisprudence of the ECtHR, which sets limits to surveillance activities for national security; whereas, furthermore, when used for law enforcement purposes, surveillance has to comply with EU law and in particular Charter and EU directives such as the ePrivacy Directive and the Law Enforcement Directive;

AU.

whereas it has been reported that large financial institutions have tried to encourage spyware producers to refrain from applying appropriate human rights standards and due diligence and continue selling spyware to repressive regimes;

AV.

whereas in the Horizon 2020 programme, Israel is ranked third among Associated Countries for overall participation in the programme; whereas the Horizon Europe Agreement with Israel has an overall budget for 2021-27 of EUR 95,5 billion (26); whereas some funds have been made available to Israeli military and security companies through these European programmes (27);

AW.

whereas the main legislative instrument for Union development policies is Regulation (EU) 2021/947 (28) (‘Global Europe Regulation’) and Union funding may be provided through the types of financing provided for by the Financial Regulation; whereas assistance can be suspended in the event of degradation in democracy, human rights or the rule of law in third countries;