Commercial Spyware and International Law: State Duties and Export Controls

Introduction

Commercial spyware is regulated by international law even though no comprehensive universal treaty specifically prohibits its development, sale, acquisition, or use. States that deploy these technologies remain subject to applicable international human rights obligations, particularly Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which protects individuals against arbitrary or unlawful interference with privacy. Governments that authorize spyware exports or regulate commercial surveillance companies face additional responsibilities under relevant domestic and regional legal systems. These obligations differ according to the state's conduct, jurisdiction, and applicable legal commitments.

The international controversy surrounding Pegasus spyware, developed by the Israeli company NSO Group, illustrates the difficulties of regulating privately manufactured surveillance capabilities used by public authorities. Commercial spyware can provide intelligence and law enforcement agencies with access to communications, location information, stored files, and device functions without the knowledge of the individuals concerned. Investigations have documented its deployment against journalists, lawyers, political opponents, and human rights defenders. Such operations raise questions extending beyond privacy to freedom of expression, political participation, and the accountability of government institutions.

Two distinct legal questions govern the international response. The first concerns the circumstances in which a state may lawfully conduct intrusive digital surveillance. The second concerns the regulation of companies and governments involved in supplying that technology. International human rights law establishes substantive restrictions on governmental conduct, while mechanisms such as the Wassenaar Arrangement and the European Union's dual-use export regime seek to control the international distribution of sensitive surveillance capabilities. Neither export authorization nor a government's assertion of national security interests resolves the separate question of whether a particular surveillance operation is lawful.

1. Commercial Spyware, Pegasus, and Government Purchasers

Commercial spyware generally refers to surveillance software developed or supplied by private companies that enables customers to covertly compromise digital devices and collect information. Its defining characteristic is the ability to obtain access without the device user's informed consent, often while concealing the intrusion. Commercial suppliers may market these systems to government intelligence services, law enforcement agencies, and other public authorities for counterterrorism, criminal investigations, or national security operations.

Pegasus is among the most extensively investigated examples. Developed by NSO Group, it has been associated with sophisticated techniques that exploit vulnerabilities in mobile operating systems and communications applications. Some documented attacks have used zero-click exploits, allowing a device to be compromised without the target opening a malicious link or attachment. Once installed, spyware may obtain messages, photographs, contact information, location data, and other sensitive material. Depending on its capabilities and configuration, it can also activate microphones or cameras (OHCHR, 2022).

End-to-end encryption does not necessarily protect communications when the device itself has been compromised. Encryption protects information during transmission between communicating parties, but spyware operating on an endpoint may access messages after decryption or before encryption occurs. Commercial intrusion software can consequently expose information that would otherwise remain protected against interception during transmission.

The broader commercial surveillance market includes technologies associated with companies such as Candiru and the Intellexa consortium. Products differ in their technical functions, methods of deployment, and commercial arrangements. Intrusion software should also be distinguished from telecommunications interception systems, network-monitoring products, and forensic extraction tools used with physical access to a device. These distinctions affect legal classification and the application of export controls.

The relationship between surveillance companies and government customers can extend beyond a conventional software purchase. Suppliers may provide exploit development, installation support, technical maintenance, infrastructure management, and software updates. Some systems depend on continuing access to vulnerabilities or remote services controlled by the manufacturer. The interaction between private companies and public authorities forms part of the wider global digital surveillance infrastructure, in which privately developed technologies expand governmental information-gathering capabilities.

The expression mercenary spyware is frequently used in cybersecurity research to describe commercially supplied intrusion technology. It does not establish that the developers or operators meet the legal definition of mercenaries under international humanitarian law. Nor does the commercial nature of a product determine whether its use is unlawful. The relevant inquiry concerns the technology's capabilities, the authority directing its deployment, the persons affected, and the legal safeguards governing the operation.

The distinction between purchasing and operating spyware is equally significant. Acquisition may involve procurement rules, vendor assessments, contractual obligations, and information-security requirements. Operational deployment raises additional questions about surveillance authorization, necessity, proportionality, and access to collected information. A government may comply with procurement procedures while subsequently conducting an unlawful surveillance operation, or acquire a technically capable system without having adequate means to supervise its use.

2. Spyware Under International Human Rights Law

International human rights law applies to state surveillance activities regardless of whether the technology was developed by a government or purchased from a commercial supplier. The ICCPR provides the principal universal treaty framework, while regional instruments establish additional obligations for states within their respective systems. These protections do not depend on the existence of a treaty devoted specifically to spyware.

Article 17 of the ICCPR protects individuals against arbitrary or unlawful interference with privacy, family, home, and correspondence. Article 19 protects freedom of expression, while Articles 21 and 22 address peaceful assembly and association. Spyware operations may affect several of these rights simultaneously, particularly when surveillance exposes confidential communications, political affiliations, or participation in lawful civic activities.

Human rights obligations do not establish an unconditional prohibition on all covert surveillance. Governments may possess legitimate reasons to investigate serious crimes or threats to national security. The legal question is whether an interference with protected rights satisfies the requirements applicable to the particular activity and treaty. The existence of domestic authorization, an intelligence mandate, or a counterterrorism objective does not eliminate the need for an independent assessment of lawfulness.

2.1 ICCPR Article 17 and the Lawfulness of Surveillance

Article 17 contains two related protections. Interference with privacy must not be unlawful, and it must not be arbitrary. The distinction is significant because conduct authorized by national legislation may still violate the Covenant if the interference is unreasonable or otherwise incompatible with its requirements.

In General Comment No. 16, adopted in 1988, the United Nations Human Rights Committee explained that states must protect individuals against interference originating from public authorities and private persons or legal entities. Paragraph 1 identifies the obligation to adopt legislative and other measures protecting privacy. Paragraph 4 clarifies that interference authorized by domestic law must remain consistent with the Covenant's provisions, aims, and objectives (Human Rights Committee, 1988).

A lawful surveillance system requires legislation that identifies the circumstances in which public authorities may interfere with private communications. Rules expressed in broad terms, without meaningful limits on governmental discretion, create a risk of arbitrary interference. The legal framework must provide an adequate basis for evaluating the purpose, scope, duration, and implementation of surveillance measures.

Necessity and proportionality are central to evaluating intrusive surveillance under international human rights law, although their precise formulation depends on the relevant right and legal system. Necessity concerns whether the interference responds to a legitimate objective that cannot adequately be achieved through less intrusive means. Proportionality concerns the relationship between the objective pursued and the severity of the interference imposed.

Commercial spyware presents particular difficulties because its technical capabilities may considerably exceed the information needed for an investigation. A government investigating one suspected offense could potentially obtain years of communications, private photographs, professional correspondence, location histories, and information about individuals unrelated to the investigation. The fact that a device can be compromised does not establish that collecting everything accessible on it is legally justified.

The Office of the United Nations High Commissioner for Human Rights has emphasized that spyware's extensive access to personal information can make it difficult to reconcile its deployment with international human rights requirements. Its 2022 report on privacy in the digital age identified the need for strict safeguards and called for restrictions on technologies whose use could not be adequately controlled (OHCHR, 2022).

Technical design also affects legal compliance. If a surveillance system cannot reliably limit what information is collected, how long it is retained, or who may access it, procedural authorization alone may provide insufficient protection. The assessment must consider both the initial decision to conduct surveillance and the continuing consequences of operating the technology.

These requirements form part of the broader protection of privacy and data protection in the digital age. They do not establish that every instance of targeted surveillance is prohibited. They require states to justify the particular interference by reference to applicable law, legitimate objectives, and safeguards capable of preventing abuse.

2.2 Other Rights, Judicial Safeguards, and Remedies

Spyware may interfere with rights beyond personal privacy. Access to a journalist's communications can expose confidential sources, unpublished investigations, and professional contacts. Surveillance of lawyers may compromise communications protected by legal professional confidentiality. Monitoring political opponents or civil society organizations can reveal membership, strategy, and internal discussions.

These consequences may discourage individuals from communicating freely or participating in lawful political activity. The effect is not limited to information actually collected. Awareness of possible surveillance can cause journalists to avoid sensitive sources, activists to withdraw from organizations, and individuals to restrict communications. The protection of privacy is closely connected to the effective exercise of expression, association, and peaceful assembly.

The European Court of Human Rights has developed substantial jurisprudence concerning safeguards against secret surveillance. In Roman Zakharov v. Russia (Application No. 47143/06, 2015), the Grand Chamber found that the Russian system governing interception of mobile telephone communications failed to provide adequate safeguards against arbitrary interference with Article 8 of the European Convention on Human Rights. The judgment considered the scope of surveillance powers, authorization procedures, supervision, data handling, and available remedies.

In Szabó and Vissy v. Hungary (Application No. 37138/14, 2016), the Court found deficiencies in legislation authorizing secret anti-terrorism surveillance. The absence of sufficiently effective independent authorization and supervisory safeguards contributed to the finding of an Article 8 violation. The judgment also addressed the importance of notification and remedies when surveillance can no longer be kept secret for legitimate investigative purposes.

More recently, in Pietrzak and Bychawska-Siniarska and Others v. Poland (Applications Nos. 72038/17 and 25237/18, 2024), the Court found that Polish legislation governing secret surveillance and access to communications data lacked adequate protection against arbitrariness and abuse. The deficiencies included insufficient scrutiny of surveillance authorization, inadequate subsequent review, and limited safeguards for communications protected by legal professional privilege.

The Court's 2024 judgment concerned the compatibility of the legislative framework with Article 8, rather than a determination that particular Pegasus operations were unlawful. Its reasoning nevertheless demonstrates why the existence of judicial authorization does not necessarily compensate for deficiencies in the broader system of surveillance supervision.

These judgments establish important regional standards, but their holdings should not be converted into universally identical procedural requirements under every human rights treaty. They demonstrate that meaningful safeguards must address the surveillance process as a whole, including authorization, execution, retention, supervision, and opportunities for legal challenge.

Access to effective remedies is particularly difficult when surveillance remains secret. Article 2(3) of the ICCPR requires states parties to provide effective remedies for violations of Covenant rights. However, victims may be unable to establish that their devices were compromised, identify the responsible authority, or obtain evidence held under national security restrictions. The effectiveness of the remedy depends partly on whether independent institutions can investigate conduct that affected individuals cannot directly observe.

The European Media Freedom Act introduces a more specific protection within EU law. Regulation (EU) 2024/1083 restricts the deployment of intrusive surveillance software against media service providers, editorial staff, and persons whose professional relationships may expose journalistic sources or confidential communications. Article 4 establishes qualified exceptions subject to strict conditions. The relevant provisions have applied since August 2025 and constitute binding EU law rather than a universal international standard.

Under Article 4(5), spyware deployment must satisfy the safeguards established in Article 4(4), including a legal basis, proportionality, an overriding public-interest justification, and authorization by a judicial or independent authority. The measure must also concern specified categories of criminal investigation. For offenses listed in Article 2(2) of Framework Decision 2002/584/JHA, the applicable maximum custodial penalty must be at least three years. For other serious crimes, the relevant maximum penalty must be at least five years under the law of the Member State concerned.

The regulation additionally requires that less restrictive measures would not adequately obtain the information sought and provides for regular independent review. Its protections are particularly relevant to the confidentiality of journalistic sources, although the legislation permits narrowly defined exceptions rather than imposing an absolute prohibition on spyware use.

3. Cross-Border Operations and State Responsibility

Commercial spyware frequently operates across national boundaries. A government may purchase software from a company established abroad, deploy it against an individual in another state, and rely on servers or technical services located in additional jurisdictions. The resulting legal questions cannot be answered solely by identifying the country in which the purchaser is established.

Three distinctions are necessary. Human rights jurisdiction concerns whether a particular state's treaty obligations extend to the affected individual or conduct. Territorial sovereignty concerns the legal interests of the state in whose territory a device or relevant infrastructure is located. State responsibility concerns whether conduct attributable to a state breaches an international obligation binding on that state.

The private character of a supplier does not remove governmental conduct from international legal scrutiny. Equally, commercial involvement cannot by itself establish that the supplier's home state is responsible for an operation conducted by a foreign customer. Attribution and breach require separate legal analysis.

3.1 Human Rights Jurisdiction and Territorial Sovereignty

The ICCPR requires states parties to respect and ensure Covenant rights within the jurisdictional scope of Article 2(1). In General Comment No. 31, the Human Rights Committee interpreted the Covenant as applying to persons within a state's power or effective control, including in certain situations outside its territory (Human Rights Committee, 2004, para. 10).

Remote digital surveillance presents difficulties for applying traditional jurisdictional concepts. A state may obtain intimate information about an individual abroad without physically controlling that person or occupying territory. Whether such conduct independently establishes the jurisdictional connection required by a particular human rights treaty remains contested.

The European Convention on Human Rights presents a related but distinct question. Article 1 requires contracting states to secure Convention rights to persons within their jurisdiction. European Court jurisprudence recognizes extraterritorial jurisdiction in particular circumstances, but it does not establish that every remote intelligence operation against a person abroad automatically falls within the Convention's jurisdictional reach.

Cross-border spyware may also implicate territorial sovereignty. A foreign intelligence service could remotely access a device located within another state's territory, extract information, or alter its operation without authorization from the territorial state. Whether a particular unauthorized cyber intrusion constitutes a breach of sovereignty as an independent rule remains an area of disagreement among states and commentators.

The prohibition of intervention raises a different threshold. Under customary international law, prohibited intervention involves coercive interference in matters within another state's protected sphere of decision-making. Surveillance that gathers confidential information does not necessarily satisfy that requirement. An operation designed to coerce another government in its political choices may require a different analysis.

These distinctions are central to the international law governing cyber espionage. International law does not contain a comprehensive general prohibition on espionage as such, but particular methods, targets, and consequences may violate independently applicable obligations. Diplomatic communications may receive additional protection under diplomatic law, although those protections cannot be assumed to prohibit every intelligence activity involving diplomatic personnel.

3.2 Attribution, Outsourcing, and Protection Duties

The International Law Commission's Articles on Responsibility of States for Internationally Wrongful Acts provide the principal framework for determining when conduct engages international responsibility. Adopted in 2001 and annexed to United Nations General Assembly Resolution 56/83, the Articles are not a treaty. Many provisions reflect customary international law, although the authority of individual rules must be assessed according to their legal basis.

Article 4 attributes the conduct of state organs to the state. Surveillance conducted by an intelligence agency or police authority acting in an official capacity is ordinarily attributable to that state. Under Article 7, conduct may remain attributable even when officials exceed their authority or disobey instructions, provided they act in the relevant official capacity.

Private involvement requires further analysis. Article 5 addresses entities empowered by domestic law to exercise governmental authority when acting in that capacity. Article 8 concerns conduct carried out under a state's instructions, direction, or control. A private contractor operating spyware under governmental direction may consequently engage state responsibility, but the legal connection must be established through evidence.

Attribution is only the first stage. Article 2 requires both conduct attributable to a state and breach of an applicable international obligation. A government may be responsible for an intrusive operation carried out by its agents without the commercial manufacturer itself becoming a state organ.

A separate issue arises when one state supplies technology or operational assistance to another. Article 16 addresses responsibility for aiding or assisting another state's internationally wrongful act. Its conditions include knowledge of the circumstances of the wrongful act and the requirement that the conduct would also be internationally wrongful if committed by the assisting state.

The International Law Commission's commentary further treats the connection between assistance and the wrongful conduct as legally significant. Assistance directed toward facilitating a particular wrongful act differs from ordinary commercial contact with a state that subsequently commits violations. An export authorization alone does not establish the knowledge, purpose, or contribution required for responsibility under Article 16.

The distinction becomes clearer when considering different forms of governmental involvement. A state that merely licenses a commercial transfer is not automatically responsible for the purchaser's later surveillance. A state that knowingly provides operational intelligence or technical assistance facilitating an unlawful operation presents a different legal question. Where a government directly orders and controls the intrusion, attribution may arise under the rules governing its own conduct rather than under Article 16.

Continued technical assistance may also be relevant when supplied by a private manufacturer. Such conduct cannot automatically be attributed to the manufacturer's home state. Responsibility depends on the relationship between the company and public authorities, the applicable primary obligations, and the evidence supporting attribution or another recognized basis of responsibility.

These questions follow the general principles of state responsibility in international law. Responsibility for an internationally wrongful act differs from a state's positive human rights obligations to protect individuals against certain abuses by private actors. Those duties may require appropriate legislation, regulatory supervision, investigation, and effective remedies.

The United Nations Guiding Principles on Business and Human Rights identify a corporate responsibility to respect human rights and conduct human rights due diligence. They are not themselves a binding treaty imposing identical obligations on every surveillance company. Binding corporate duties arise through applicable domestic legislation and other relevant legal rules. The Guiding Principles nevertheless provide a framework for assessing whether vendors identify, prevent, and address foreseeable human rights risks associated with their products and customers.

4. The Wassenaar Arrangement and Export Controls

The Wassenaar Arrangement is an international export-control arrangement established in 1996 to promote transparency and responsibility in transfers of conventional arms and dual-use goods and technologies. Its participating states coordinate control lists and exchange information concerning sensitive exports. The arrangement does not operate as a universal treaty directly prohibiting the international sale of commercial spyware.

The incorporation of surveillance-related technologies into Wassenaar controls followed concerns about the use of commercially supplied monitoring systems by governments engaging in repression. In 2013, participating states agreed to add controls concerning certain internet surveillance systems and technologies associated with intrusion software. These measures represented an important attempt to address the proliferation of capabilities that could facilitate covert surveillance.

The controls depend on technical classifications. The Wassenaar dual-use list includes Category 4.A.5, covering specified systems, equipment, and components designed or modified for the generation, command and control, or delivery of intrusion software. Related provisions address software and technology associated with intrusion capabilities. The classification does not mean that every computer program capable of unauthorized access is automatically prohibited.

A distinction is necessary between intrusion software itself and the equipment, software, or technology covered by particular entries. The Wassenaar framework contains technical definitions, control notes, and exclusions intended to distinguish sensitive capabilities from other cybersecurity activities. Changes to these provisions have reflected concerns about both proliferation and the unintended consequences of broad controls.

Implementation occurs through national or regional export-control systems. Participating states translate agreed classifications into their own applicable legal requirements, and implementation dates or licensing practices may differ. The Wassenaar control lists published in December 2025 incorporate the amendments agreed at that year's plenary meeting. The arrangement expressly recognizes that national implementation and entry into effect may vary (Wassenaar Arrangement, 2025).

One difficulty concerns the relationship between software and the broader supply chain. Commercial intrusion capabilities can involve exploit development, vulnerability research, command infrastructure, technical support, and remote services. Some transactions may transfer controlled software or technology, while others provide services whose treatment depends on different legal provisions. A regulatory approach designed primarily around identifiable items may struggle to capture the operational relationship between a vendor and its customer.

The original intrusion-software controls generated concerns among cybersecurity researchers and industry representatives. Broad technical definitions could potentially affect legitimate vulnerability research, incident response, and defensive testing. Subsequent refinements introduced exclusions and clarifications for certain activities, including vulnerability disclosure and cyber incident response. The precise effect depends on the relevant control entry and implementing law.

Commercial spyware also illustrates the limitations of a voluntary multilateral arrangement with incomplete international participation. Not every major supplier jurisdiction participates in Wassenaar, and nationally implemented controls do not necessarily apply to transactions originating elsewhere. Even among participating states, licensing decisions involve national security, commercial, human rights, and cybersecurity considerations.

Israel illustrates the importance of national export-control systems outside the arrangement's membership. The Israeli Ministry of Defense regulates defense exports through the Defense Export Controls Agency under the Defense Export Control Law of 2007 and associated regulations. The framework covers specified defense equipment, knowledge, and services and incorporates considerations involving national security, foreign policy, international commitments, and human rights (Israel Ministry of Defense, 2026).

Israeli authorities also impose licensing requirements on relevant cyber and intelligence exports. The existence of such controls does not establish that every product is licensed under identical conditions or that a foreign purchaser's conduct is attributable to Israel. The distinction between authorizing a transfer and directing a surveillance operation remains essential.

Export controls can restrict access to sensitive capabilities, establish licensing conditions, and provide a basis for enforcement against unauthorized transfers. They cannot independently determine whether every recipient will use the technology lawfully. Their effectiveness depends on accurate technical classification, knowledge of customers and intended uses, consistent implementation, and the ability to respond when circumstances change after export.

5. EU Surveillance Export Controls Under Regulation 2021/821

The European Union has established a binding regulatory framework for dual-use exports through Regulation (EU) 2021/821. The regulation governs exports and specified other activities involving goods, software, and technology capable of civilian and military applications. Its provisions include measures addressing cyber-surveillance items and the risk that exported technologies may facilitate internal repression or serious violations of human rights or international humanitarian law.

The regulation establishes common EU requirements while leaving important licensing and enforcement functions to competent Member State authorities. A company exporting from the Union must determine whether the technology falls within a controlled classification and whether additional authorization requirements apply. The legal position depends on the item, the transaction, the destination, and the circumstances identified by the relevant provisions.

The consolidated version of Regulation 2021/821 dated September 21, 2026, provides the operative framework for the present analysis. The European Commission also adopted a delegated regulation updating Annex I on September 14, 2026. That measure was subject to the applicable scrutiny procedure and would enter into force following its publication in the Official Journal. Its adoption did not itself make the updated list immediately applicable.

EU export authorization is not a certificate of compliance with international human rights law. A licensed transfer may still result in surveillance that violates the recipient state's obligations. Conversely, an export restriction may apply because a transaction satisfies a regulatory classification even where no subsequent human rights violation has yet occurred.

5.1 Annex I Controls and Article 5 Authorization

Article 3 of Regulation 2021/821 establishes an authorization requirement for exports of dual-use items listed in Annex I. The control list includes specified technologies relevant to cyber-surveillance, such as certain telecommunications interception systems, internet surveillance systems, and items associated with intrusion software. Classification depends on the technical wording and applicable control notes rather than on a product's marketing description.

Relevant EU control entries include 4A005 for specified systems and equipment associated with intrusion software, 4D004 for software designed or modified for its generation, command and control, or delivery, and related technology controls under 4E001. Category 5 includes controls concerning specified telecommunications interception and internet surveillance systems. These entries address different technical capabilities and should not be treated as interchangeable classifications.

Article 5 addresses non-listed cyber-surveillance items. Article 2(20) defines such items by reference to their special design for covert surveillance of natural persons through monitoring, extracting, collecting, or analyzing data from information and telecommunications systems. This definition is narrower than the ordinary use of the term surveillance technology.

Under Article 5(1), authorization is required when the competent authority informs the exporter that non-listed cyber-surveillance items are or may be intended for use in connection with internal repression or the commission of serious violations of human rights or international humanitarian law.

Article 5(2) addresses a different circumstance. Where an exporter becomes aware, according to its due diligence findings, that relevant non-listed items are intended for such uses, the exporter must notify the competent authority. The authority then decides whether the proposed export should be made subject to authorization. The notification obligation must not be confused with an automatic prohibition triggered by every identified risk.

Article 5(3) also permits Member States to adopt or maintain relevant national authorization requirements under the conditions provided by the regulation. The resulting system combines EU-wide rules with specified national mechanisms and administrative decisions.

These provisions demonstrate the difference between controlling a technology because of its technical capabilities and restricting a particular transaction because of its foreseeable use. Annex I controls may apply independently of evidence that a named purchaser intends repression. Article 5 introduces an additional mechanism directed at risks associated with certain non-listed cyber-surveillance items.

The reference to international humanitarian law requires separate attention. International humanitarian law governs conduct connected with armed conflict under its applicable rules. Its inclusion in export-control legislation does not make every spyware operation an armed-conflict activity or establish that the same legal standards govern ordinary domestic law enforcement and military operations.

5.2 Due Diligence and Post-Export Accountability

Effective export regulation requires information about the supplier, technology, purchaser, end user, and likely application of the exported capability. These questions are particularly difficult in the commercial spyware sector because intermediaries, corporate structures, and government confidentiality can obscure the identity of the final operator.

Commission Recommendation (EU) 2024/2659 provides guidance concerning the application of Article 5. It addresses technical classification, relevant human rights risks, transaction screening, and circumstances that may require notification to competent authorities. As a recommendation, it assists interpretation and implementation but does not possess the same legal status as the regulation itself.

A meaningful assessment cannot rely exclusively on declarations supplied by the customer. Relevant considerations include the recipient's human rights record, the proposed operational purpose, the existence of independent judicial oversight, previous allegations of surveillance abuse, and the availability of safeguards limiting collection and access.

Such assessments also encounter evidentiary limits. A government may provide assurances that spyware will be used only for serious crimes or national security investigations. Those assurances do not establish whether the country's legal system permits independent review or whether surveillance powers are applied consistently with human rights obligations.

Research published by the Stockholm International Peace Research Institute in September 2025 identified transparency, oversight, and implementation difficulties affecting the international trade in commercial spyware. The analysis emphasized the limitations of export controls and sanctions when applied to a technically complex market with multiple jurisdictions and evolving delivery models (Bromley and Maletta, 2025).

A separate 2025 study by the Centre for Democracy and Technology Europe examined implementation of the EU Dual-Use Regulation in France, Germany, Italy, and the Netherlands. It identified differences in national procedures, limited transparency regarding licensing decisions, insufficient practical guidance for exporters, and weaknesses in monitoring the ultimate use of exported technologies (Tricoli, 2025).

In March 2026, SIPRI published Good Practice Guide on Applying Export Controls to Transfers of Commercial Cyber Intrusion Capabilities. The guide, prepared by Mark Bromley and Kolja Brockmann, addresses practical measures for improving export-control implementation, including identifying companies involved in the market, informing exporters of licensing obligations, clarifying technical classifications, and publishing information about enforcement actions.

The guide recommends greater consistency in the application of relevant control-list categories and clearer public guidance concerning controlled technologies and transactions. It also identifies the importance of information-sharing and risk assessments that account for possible misuse by the intended recipient (Bromley and Brockmann, 2026).

Post-export control is particularly difficult when the supplier continues to maintain the product. Software updates, technical support, and changes to operating infrastructure may affect the capabilities available to a purchaser after the original authorization. The absence of systematic end-use monitoring can prevent regulators from identifying whether the technology is being employed for purposes inconsistent with the assumptions underlying the initial licensing decision.

Data infrastructure creates an additional difficulty. Surveillance material may be collected in one jurisdiction and transmitted through systems operated or managed elsewhere. The international handling of personal information raises questions related to cross-border data flows in international law, although rules governing data processing and rules controlling software exports remain legally distinct.

No export-control system can guarantee lawful surveillance solely through pre-transfer licensing. Effective regulation requires continuing attention to the actual technology supplied, changes in the relationship between vendor and customer, enforcement against unauthorized conduct, and mechanisms capable of responding to evidence of misuse.

6. U.S. Controls, Sanctions, and Vendor Liability

The United States has addressed commercial spyware through export-control restrictions, sanctions, and measures regulating federal government procurement. These mechanisms differ in their legal operation. Some restrict transactions involving specified companies, others target designated persons or assets, while procurement measures concern the circumstances in which government agencies may acquire or use commercial surveillance products.

In November 2021, the Department of Commerce's Bureau of Industry and Security added NSO Group and Candiru to the Entity List. The decision followed findings concerning the development and supply of spyware used by foreign governments to target officials, journalists, activists, academics, and other individuals. Entity List restrictions impose licensing requirements on specified exports, reexports, and transfers of items subject to the Export Administration Regulations. They do not constitute a universal prohibition on every commercial relationship involving the designated companies (US Department of Commerce, 2021).

Executive Order 14093, issued on March 27, 2023, established restrictions on the operational use by US government agencies of commercial spyware presenting specified counterintelligence, security, or improper-use risks. The order addresses concerns that the acquisition and deployment of such products can expose government personnel and institutions to security threats or support surveillance inconsistent with protected rights.

The order's significance extends beyond the protection of particular individuals. Government procurement can sustain commercial suppliers through financial support, operational legitimacy, and continuing demand. Restrictions on acquisition and use consequently provide a regulatory mechanism distinct from export licensing. Their application depends on the order's specified standards and exceptions rather than a general rule that every commercial spyware product is prohibited.

The Treasury Department adopted additional measures against actors associated with the Intellexa consortium. In March 2024, the Office of Foreign Assets Control designated individuals and entities involved in the development, operation, and distribution of commercial spyware. Further designations followed in September 2024. These measures addressed both national security concerns and the misuse of surveillance capabilities against individuals, including journalists and government personnel (US Department of the Treasury, 2024).

A subsequent change affected the scope of those restrictions. On December 30, 2025, OFAC removed Sara Hamou, Andrea Gambazzi, and Merom Harpaz from its sanctions list. The removals followed an administrative reconsideration process, according to contemporaneous reporting. They did not terminate all restrictions associated with Intellexa, and founder Tal Dilian remained designated.

The partial reversal demonstrates that sanctions status must be distinguished from the historical reasons for imposing restrictions. A designation reflects an administrative decision under a particular legal authority; removal changes the legal restrictions applicable to the designated person without necessarily resolving every allegation concerning earlier conduct.

Sanctions operate differently from export controls. A designation under an applicable sanctions program can restrict dealings involving designated persons and property within the relevant jurisdiction. Export controls, by contrast, regulate particular transfers of specified items or technology. Their requirements may overlap, but the legal consequences cannot be assumed to be identical.

Civil litigation provides another accountability mechanism. In WhatsApp LLC and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited, the United States District Court for the Northern District of California found liability under federal and California computer-access legislation and for breach of contract. The litigation concerned unauthorized activities involving WhatsApp's systems and the deployment of surveillance software.

The court granted summary judgment on liability on December 20, 2024. A jury subsequently awarded $167,698,719 in May 2025, comprising $444,719 in compensatory damages and $167,254,000 in punitive damages. The court reduced the punitive damages award to $4,002,471, and the plaintiffs accepted that reduction.

On November 12, 2025, the district court entered final judgment in the amount of $4,447,190, consisting of $444,719 in compensatory damages and $4,002,471 in punitive damages. The judgment also incorporated a permanent injunction restricting specified conduct involving WhatsApp's systems (US District Court, Northern District of California, 2025).

The defendants pursued appellate proceedings before the United States Court of Appeals for the Ninth Circuit. On January 28, 2026, the appellate court denied a request to stay the permanent injunction pending appeal. The district court subsequently continued to address post-judgment matters, including an October 16, 2026 order denying a contempt motion.

The district court's final judgment should not be confused with a final disposition of the appellate proceedings. The available record establishes the judgment, injunction, and subsequent procedural developments, but does not establish that all appellate challenges had been finally resolved by November 2026.

The litigation demonstrates that surveillance companies may face legal consequences under domestic computer-access and contract law even when their customers are governments. It does not establish that NSO Group itself violated the ICCPR, nor does it determine the international responsibility of every state using Pegasus.

These different American measures reveal the limits of treating commercial spyware as a single regulatory category. Export licensing, sanctions, government procurement restrictions, and civil liability address different activities and legal relationships. Their effectiveness depends on the conduct regulated, the persons subject to jurisdiction, and the ability to obtain evidence concerning transactions and operations.

7. Enforcement Evidence and International Regulatory Reform

The practical weaknesses of commercial spyware regulation become particularly clear when investigations examine how surveillance systems operate rather than merely how they are licensed. Technical evidence may establish the capabilities of a product, weaknesses in governmental control, and the movement of surveillance data. It does not necessarily identify every person responsible for a particular operation or establish that a manufacturer accessed information collected by a government.

On October 12, 2026, Poland's National Prosecutor's Office published findings from experts of the Internal Security Agency concerning the functionality and security of the Pegasus system used by the Central Anti-Corruption Bureau. The findings indicated that Pegasus could obtain extensive information from mobile devices without users' knowledge or consent. They also identified significant limitations in the Polish authorities' control over the system (Polish National Prosecutor's Office, 2026).

According to the published findings, the Central Anti-Corruption Bureau lacked access credentials for some administrative accounts, while certain system components remained under manufacturer control. The server module responsible for infecting mobile devices was controlled exclusively by the manufacturer. These arrangements prevented the authorities from independently verifying the operation of important components.

The experts also found that data transmitted through the Pegasus system left Polish territory through an anonymizing network involving servers in several countries. The network was managed by the manufacturer and operated outside the bureau's control. The findings identified a technical possibility for the manufacturer to access material obtained through operational surveillance.

Technical support and software updates involved remote connections during which surveillance operations were not necessarily suspended. According to the published expert findings, this arrangement created opportunities for changes to system configuration and access to operational infrastructure beyond the purchasing authority's independent control.

The distinction between capability and actual conduct is essential. The Polish experts did not establish that the manufacturer had accessed materials from particular surveillance operations. A technical possibility may demonstrate a security risk or deficiency in oversight without proving that the possibility was exercised. The public prosecutorial statement also summarized expert opinions rather than reproducing the complete classified technical examinations.

The findings illustrate a problem that cannot be resolved through export controls alone. A state purchasing commercial spyware may acquire a powerful surveillance capability without obtaining complete control over the infrastructure that supports it. That dependence can affect confidentiality, data protection, operational accountability, and the government's ability to demonstrate compliance with legal restrictions.

Developments in Serbia provide further evidence of the need to distinguish forensic findings from allegations concerning responsibility. On September 2, 2026, the Citizen Lab reported that forensic examination of a Serbian student activist's iPhone confirmed infection with Pegasus spyware. The investigation identified high-confidence indicators associated with December 2025 and January 2026, including use of a zero-click exploit involving iMessage (Citizen Lab, 2026a).

A further Citizen Lab investigation, published on October 19, 2026, reported high-confidence findings that Vladan Đokić, Rector of the University of Belgrade, had been infected with Pegasus during 2026. The investigation also identified a threat notification received by former prosecutorial associate Rade Bajić. The latter notification was evidence of suspected targeting with mercenary spyware, not confirmation that his device had been infected with Pegasus (Citizen Lab, 2026b).

These distinctions have legal consequences. Confirmed infection identifies the presence of spyware on a device. Attribution of an operation to a particular government requires additional evidence connecting that government to the intrusion. Establishing an internationally wrongful act requires further analysis of jurisdiction, applicable obligations, attribution, and breach.

Judicial proceedings may address some of these questions, but their procedural status must be preserved. Litigation concerning spyware can involve challenges to surveillance legislation, claims against public authorities, and proceedings against commercial suppliers. An application communicated to a court, an investigation in progress, and a final judgment are not equivalent determinations of responsibility.

In Greece, criminal proceedings concerning the Predator spyware scandal resulted in first-instance convictions on February 26, 2026. An Athens misdemeanor court found Intellexa founder Tal Dilian and three other individuals—Sara Hamou, Felix Bitzios, and Yiannis Lavranos—guilty of offenses involving unlawful access to information and communications confidentiality.

Each defendant received a sentence of 126 years and eight months, with the enforceable imprisonment period limited to eight years. The sentences were suspended pending appeal. The defendants denied wrongdoing, and the convictions should not be treated as final determinations following appellate review (Reuters, 2026b).

The Greek proceedings demonstrate the possibility of criminal accountability for individuals connected with commercial spyware operations. They do not independently establish that every surveillance operation involving Predator was ordered by the Greek government. The distinction between private criminal responsibility and the international responsibility of state authorities remains legally significant.

Spain illustrates a different enforcement difficulty. On January 22, 2026, investigating judge José Luis Calama closed an investigation into alleged Pegasus surveillance of senior Spanish government officials. The proceedings concerned suspected intrusions affecting figures including Prime Minister Pedro Sánchez and other members of the government.

The investigation had originally been opened in 2022, closed in 2023, and reopened in 2024 following information received from France. The January 2026 closure followed unsuccessful requests for judicial cooperation from Israel, which prevented investigators from identifying the suspected perpetrators and advancing the proceedings (Reuters, 2026a).

The Spanish case illustrates how cross-border investigations may fail to establish individual responsibility even where suspicious surveillance activity has been identified. Access to technical records, cooperation from foreign authorities, and the ability to connect commercial infrastructure to particular operators can determine whether criminal proceedings advance.

International institutions have increasingly examined whether existing legal safeguards are sufficient for highly intrusive surveillance technologies. The Venice Commission's December 2024 Report on a Rule of Law and Human Rights Compliant Regulation of Spyware considered the need for precise legislation, independent authorization, effective supervision, restrictions on access to collected material, and remedies against unlawful surveillance (Venice Commission, 2024).

The report's legal significance lies in its examination of the particular characteristics of spyware. A device-intrusion system may obtain information far beyond a conventional interception order. Effective regulation must account for the possibility that surveillance technology can collect, retain, and expose material unrelated to the authorized investigation. The Venice Commission is an advisory body, however, and its recommendations are not judgments of the European Court of Human Rights.

The European Parliament's Committee of Inquiry into the use of Pegasus and equivalent surveillance spyware examined alleged misuse, inadequate oversight, and shortcomings in EU and national regulation. Parliament's June 2023 recommendation called for measures addressing abuse and deficiencies in accountability. The inquiry contributed an institutional assessment of surveillance practices but did not itself establish criminal liability or amend the binding legal standards of the ICCPR or ECHR.

United Nations experts have advocated restrictions extending beyond conventional export licensing. In 2019, Special Rapporteur David Kaye recommended a moratorium on the sale and transfer of surveillance tools until appropriate human rights safeguards were established. The Office of the High Commissioner for Human Rights expressed related concerns in 2022, emphasizing the difficulty of controlling particularly intrusive spyware capabilities (United Nations Human Rights Council, 2019; OHCHR, 2022).

The April 2026 thematic report of Special Rapporteur Gina Romero, submitted as UN document A/HRC/62/45, examined the effects of digital surveillance on peaceful assembly and association. Entitled Unmasking the Chilling Effects of the Digital Surveillance Ecosystem: The Erosion of Assembly and Association Rights, the report addressed the ways surveillance can discourage participation in political and civic activities, including where individuals cannot establish whether they have been directly monitored (United Nations Human Rights Council, 2026).

The report advocated stronger legal restrictions and independent scrutiny of surveillance systems. Its recommendations included prohibiting highly invasive spyware whose functionality cannot be sufficiently limited or whose operation cannot be independently audited. This position reflects an assessment that certain technical capabilities may be incompatible with effective human rights safeguards. It remains a recommendation by a United Nations Special Rapporteur rather than a binding universal prohibition adopted by states.

The Pall Mall Process represents a different approach based on voluntary international cooperation. Launched by the United Kingdom and France in February 2024, it addresses the proliferation and irresponsible use of commercial cyber-intrusion capabilities. The Code of Practice for States, launched in April 2025 and updated in October 2025, establishes voluntary commitments concerning accountability, precision, oversight, and transparency (UK Foreign, Commonwealth & Development Office, 2025).

The Code encourages stronger governmental scrutiny of procurement, transfers, and operational use. It also promotes mechanisms for assessing suppliers, customers, technical vulnerabilities, and the risks associated with commercial cyber-intrusion capabilities. Its recommendations recognize that governments participate in this market as regulators, purchasers, and users.

These approaches involve different judgments about regulation. Stronger licensing, independent authorization, technical auditing, and post-export oversight may reduce certain risks while preserving the possibility of lawful investigative use. Calls for moratoriums or prohibitions reflect concern that some spyware products are too intrusive, opaque, or technically difficult to constrain through ordinary safeguards.

Legitimate criminal investigations and national security operations remain relevant considerations. Governments may require confidential methods to investigate serious threats, and technical restrictions drafted too broadly may interfere with defensive cybersecurity research. These concerns require careful legal assessment, but they do not establish a general exemption from human rights obligations.

The difficulty is particularly pronounced when vendors retain operational access after purchase. A state may formally authorize a surveillance operation while lacking sufficient knowledge of the technology's collection functions or the manufacturer's ability to interact with collected material. Effective accountability depends on whether authorities can independently examine and control those functions, rather than accepting contractual assurances as proof of compliance.

International export coordination also remains incomplete. Different licensing standards, uneven enforcement capacity, and supplier jurisdictions outside major control arrangements create opportunities for regulatory avoidance. Restrictions applied by one state may reduce transactions within its jurisdiction without eliminating demand or preventing suppliers elsewhere from providing similar capabilities.

The central challenge is not simply the absence of a new international agreement. Existing human rights obligations already restrict arbitrary surveillance. The unresolved issue is whether legal and technical controls can consistently limit the operation of commercial spyware, establish responsibility when abuses occur, and ensure that affected individuals have meaningful access to independent review.

Conclusion

Commercial spyware operates within an existing body of international law, even without a comprehensive universal treaty specifically governing the industry. States conducting surveillance must comply with their applicable human rights obligations, including protection against arbitrary or unlawful interference with privacy. These duties are not displaced because a product was developed by a private company or purchased for intelligence and law enforcement purposes.

States that manufacture, export, authorize, or regulate commercial surveillance technologies occupy different legal positions. Export controls under the Wassenaar Arrangement's implementing systems, EU Regulation 2021/821, and relevant national legislation restrict certain transactions and impose regulatory requirements. They do not automatically determine the legality of surveillance subsequently conducted by a purchaser. International responsibility for another state's wrongful conduct requires the applicable legal conditions to be established, including attribution or the distinct requirements governing aid or assistance.

The evidence from commercial spyware investigations identifies a persistent difficulty in applying these principles. Highly intrusive technical capabilities, continuing vendor involvement, transnational infrastructure, and operational secrecy can obstruct independent supervision and access to remedies. The effectiveness of regulation consequently depends on more than the existence of export licenses or formal authorization procedures. It requires legal restrictions capable of controlling how surveillance technology is actually deployed, together with institutions able to investigate unlawful conduct and hold responsible actors accountable.

References

Bromley, M. and Brockmann, K. (2026) Good Practice Guide on Applying Export Controls to Transfers of Commercial Cyber Intrusion Capabilities. Stockholm: Stockholm International Peace Research Institute. Available at: https://doi.org/10.55163/ESHD4578 (Accessed: 7 November 2026).

Bromley, M. and Maletta, G. (2025) Export Controls and Spyware: Enhancing Oversight, Transparency and Restraint. Stockholm: Stockholm International Peace Research Institute. Available at: https://doi.org/10.55163/GVXO6716 (Accessed: 7 November 2026).

Citizen Lab (2026a) Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist [online]. University of Toronto, 2 September. Available at: https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/ (Accessed: 7 November 2026).

Citizen Lab (2026b) Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures [online]. University of Toronto, 19 October. Available at: https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/ (Accessed: 7 November 2026).

Convention for the Protection of Human Rights and Fundamental Freedoms (1950) Adopted 4 November 1950, entered into force 3 September 1953, ETS No. 005. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=005 (Accessed: 7 November 2026).

Council of the European Union (2002) Council Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant and the Surrender Procedures between Member States. Official Journal of the European Communities, L 190, 18 July, pp. 1–20. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002F0584 (Accessed: 7 November 2026).

European Commission (2024) Commission Recommendation (EU) 2024/2659 of 11 October 2024 on Guidelines on the Export of Cyber-Surveillance Items under Article 5 of Regulation (EU) 2021/821. Official Journal of the European Union, L 2024/2659, 16 October. Available at: https://eur-lex.europa.eu/eli/reco/2024/2659/oj/eng (Accessed: 7 November 2026).

European Commission (2026) 2026 Update of the EU Control List of Dual-Use Items [online]. Directorate-General for Trade and Economic Security, 14 September. Available at: https://policy.trade.ec.europa.eu/news/2026-update-eu-control-list-dual-use-items-2026-09-14_en (Accessed: 7 November 2026).

European Court of Human Rights (2015) Roman Zakharov v. Russia, Grand Chamber judgment, Application No. 47143/06, 4 December. Available at: https://hudoc.echr.coe.int/eng?i=001-159324 (Accessed: 7 November 2026).

European Court of Human Rights (2016) Szabó and Vissy v. Hungary, judgment, Application No. 37138/14, 12 January. Available at: https://hudoc.echr.coe.int/eng?i=001-160020 (Accessed: 7 November 2026).

European Court of Human Rights (2024) Pietrzak and Bychawska-Siniarska and Others v. Poland, judgment, Applications Nos. 72038/17 and 25237/18, 28 May. Available at: https://hudoc.echr.coe.int/eng?i=002-14333 (Accessed: 7 November 2026).

European Parliament (2023) Recommendation of 15 June 2023 to the Council and the Commission Following the Investigation of Alleged Contraventions and Maladministration in the Application of Union Law in Relation to the Use of Pegasus and Equivalent Surveillance Spyware. P9_TA(2023)0244, 2023/2500(RSP). Official Journal of the European Union, C/2024/494, 23 January 2024. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C_202400494 (Accessed: 7 November 2026).

European Union (2021) Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 Setting Up a Union Regime for the Control of Exports, Brokering, Technical Assistance, Transit and Transfer of Dual-Use Items (Recast). Official Journal of the European Union, L 206, 11 June, pp. 1–461. Available at: https://eur-lex.europa.eu/eli/reg/2021/821/oj/eng (Accessed: 7 November 2026).

European Union (2024) Regulation (EU) 2024/1083 of the European Parliament and of the Council of 11 April 2024 Establishing a Common Framework for Media Services in the Internal Market and Amending Directive 2010/13/EU (European Media Freedom Act). Official Journal of the European Union, L 2024/1083, 17 April. Available at: https://eur-lex.europa.eu/eli/reg/2024/1083/oj/eng (Accessed: 7 November 2026).

Human Rights Committee (1988) General Comment No. 16: Article 17 (Right to Privacy). Adopted 8 April 1988, HRI/GEN/1/Rev.9 (Vol. I), pp. 191–193. Available at: https://digitallibrary.un.org/record/629675/files/HRI_GEN_1_Rev.9%28Vol.I%29-EN.pdf (Accessed: 7 November 2026).

Human Rights Committee (2004) General Comment No. 31: The Nature of the General Legal Obligation Imposed on States Parties to the Covenant. CCPR/C/21/Rev.1/Add.13, adopted 29 March 2004, published 26 May 2004. Available at: https://digitallibrary.un.org/record/533996 (Accessed: 7 November 2026).

International Covenant on Civil and Political Rights (1966) Adopted 16 December 1966, entered into force 23 March 1976, 999 UNTS 171. Available at: https://treaties.un.org/pages/ViewDetails.aspx?chapter=4&mtdsg_no=IV-4&src=TREATY (Accessed: 7 November 2026).

International Law Commission (2001) Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries. Report of the International Law Commission on the Work of Its Fifty-Third Session, A/56/10, Chapter IV. Yearbook of the International Law Commission, 2001, Vol. II, Part Two. Available at: https://legal.un.org/ilc/reports/2001/ (Accessed: 7 November 2026).

Israel Ministry of Defense (n.d.) Defense Exports Control Agency (DECA) [online]. Available at: https://mod.gov.il/en/departments/defense-exports-control-agency-deca (Accessed: 7 November 2026).

Office of the United Nations High Commissioner for Human Rights (2011) Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework. HR/PUB/11/04. New York and Geneva: United Nations. Available at: https://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdf (Accessed: 7 November 2026).

Office of the United Nations High Commissioner for Human Rights (2022) The Right to Privacy in the Digital Age. Report of the Office of the United Nations High Commissioner for Human Rights, A/HRC/51/17, 4 August. Available at: https://digitallibrary.un.org/record/3985679 (Accessed: 7 November 2026).

Polish National Prosecutor's Office (2026) Opinie biegłych ABW dotyczące bezpieczeństwa i funkcjonowania systemu Pegasus [online]. 12 October. Available at: https://www.gov.pl/web/prokuratura-krajowa/pegasus-opinia (Accessed: 7 November 2026).

Reuters (2026a) ‘Spain closes Pegasus spyware probe again, saying Israel has not responded’, 22 January [online]. Available at: https://www.reuters.com/technology/spain-closes-pegasus-spyware-probe-again-saying-israel-has-not-responded-2026-01-22/ (Accessed: 7 November 2026).

Reuters (2026b) ‘Greek court finds four guilty of prying on private data in wiretapping scandal’, 26 February [online]. Available at: https://www.reuters.com/business/finance/greek-court-finds-four-guilty-prying-private-data-wiretapping-scandal-2026-02-26/ (Accessed: 7 November 2026).

Tricoli, J. (2025) From Export Control to Unknown Exports: How the EU's Dual-Use Regime Falls Short on Tackling Spyware. Brussels: Centre for Democracy & Technology Europe. Available at: https://cdt.org/wp-content/uploads/2026/05/CDT-Europe-Report-on-the-Dual-Use-Regulation-1.pdf (Accessed: 7 November 2026).

UK Foreign, Commonwealth & Development Office (2025) The Pall Mall Process Code of Practice for States [online]. Published 4 April, updated 23 October. Available at: https://www.gov.uk/government/publications/the-pall-mall-process-code-of-practice-for-states/the-pall-mall-process-code-of-practice-for-states (Accessed: 7 November 2026).

United Nations Human Rights Council (2019) Surveillance and Human Rights: Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression. A/HRC/41/35, 28 May. Available at: https://digitallibrary.un.org/record/3814512 (Accessed: 7 November 2026).

United Nations Human Rights Council (2026) Unmasking the Chilling Effects of the Digital Surveillance Ecosystem: The Erosion of Assembly and Association Rights. Report of the Special Rapporteur on the Rights to Freedom of Peaceful Assembly and of Association, Gina Romero, A/HRC/62/45, 21 April. Available at: https://digitallibrary.un.org/record/4113878 (Accessed: 7 November 2026).

United States Department of Commerce, Bureau of Industry and Security (2021) Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities [online]. 4 November. Available at: https://www.bis.gov/press-release/commerce-adds-nso-group-other-foreign-companies-entity-list-malicious-cyber-activities (Accessed: 7 November 2026).

United States Department of the Treasury (2024a) Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium [online]. 5 March. Available at: https://home.treasury.gov/news/press-releases/jy2155 (Accessed: 7 November 2026).

United States Department of the Treasury (2024b) Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium [online]. 16 September. Available at: https://home.treasury.gov/news/press-releases/jy2581 (Accessed: 7 November 2026).

United States Department of the Treasury, Office of Foreign Assets Control (2025) Non-Proliferation and Iran-Related Designations; Cyber-Related and Russia-Related Designations Removals [online]. 30 December. Available at: https://ofac.treasury.gov/recent-actions/20251230 (Accessed: 7 November 2026).

United States District Court for the Northern District of California (2024) WhatsApp LLC and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited, Order on Motions for Summary Judgment and Sanctions, Case No. 4:19-cv-07123-PJH, Document 494, 20 December. Available at: https://www.govinfo.gov/app/details/USCOURTS-cand-4_19-cv-07123/USCOURTS-cand-4_19-cv-07123-24 (Accessed: 7 November 2026).

United States District Court for the Northern District of California (2025) WhatsApp LLC and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited, Final Judgment, Case No. 4:19-cv-07123-PJH, Document 810, 12 November. Available at: https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-44.pdf (Accessed: 7 November 2026).

United States District Court for the Northern District of California (2026) WhatsApp LLC and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited, Order Denying Motion for Contempt, Case No. 4:19-cv-07123-PJH, Document 884, 16 October. Available at: https://www.govinfo.gov/app/details/USCOURTS-cand-4_19-cv-07123/USCOURTS-cand-4_19-cv-07123-49 (Accessed: 7 November 2026).

United States President (2023) Executive Order 14093: Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security. 27 March, Federal Register, 88 FR 18957, 30 March. Available at: https://www.govinfo.gov/app/details/DCPD-202300235 (Accessed: 7 November 2026).

Venice Commission (2024) Report on a Rule of Law and Human Rights Compliant Regulation of Spyware. CDL-AD(2024)043, adopted at the 141st Plenary Session, 6–7 December. Strasbourg: Council of Europe. Available at: https://www.coe.int/en/web/venice-commission/-/cdl-ad-2024-043-e (Accessed: 7 November 2026).

Wassenaar Arrangement (2025) List of Dual-Use Goods and Technologies and Munitions List. WA-LIST (25) 1 Corr., December. Vienna: Wassenaar Arrangement Secretariat. Available at: https://www.wassenaar.org/control-lists/ (Accessed: 7 November 2026).