OECD complaint filed by human rights groups against British surveillance company moves forward

A complaint filed with the Organisation for Economic Cooperation and Development (OECD) against Gamma International, a UK-based company accused of selling surveillance spyware for governments, will proceed and has been accepted for consideration, the UK National Contact Point (NCP) for the OECD announced.

The decision by the NCP is instrumental in the ongoing campaign to hold surveillance companies accountable for their products and the potential enabling of governments to commit human rights abuses. Privacy International, with the European Center for Constitutional and Human Rights, the Bahrain Center for Human Rights, Bahrain Watch and Reporters without Borders, filed formal complaints in February against Gamma International in the UK and Trovicor in Germany, arguing that Gamma and Trovicor breached a nearly a dozen recommendations from the OECD Guidelines, all of which concern human rights.

The statement by the UK NCP said:

• "[Gamma] has been considering publishing a civil rights policy but is not yet certain that it could successfully implement such a policy."
• "[Gamma] considers that a wider policy preventing sales to any country whose human rights record has been criticised would not be practicable"; and
• "Gamma also says that it would not be practical to enable a surveillance system to be remotely and unilaterally closed down by the supplier should human rights concerns arise, as no customer would purchase a system so enabled.“

Despite this, Gamma continues to claim that they "would not supply the product identified in the complaint in a situation where it believed it would be used for the purpose of repressing civil rights". However, after weighing the complaints against Gamma's responses, the National Contact Point determined to move the case forward.

Eric King, Head of Research said:

We are pleased to have the NCP recognise what we have said for some time:  There is evidence suggesting FinFisher has been used to target activists, and we need Gamma to step up and address the impacts their products have had in Bahrain and possibly other countries. As the appropriate next steps are taken during the OECD process, we sincerely hope that companies like Gamma begin to closely evaluate their policies and to whom they sell their products. Without such evaluation, we are concerned the proliferation of these technologies, and their use to suppress pro-democracy voices, will only continue".

Christian Mihr, Executive Director of Reporters Without Borders Germany stated:

The complaint being accepted is an important step forward to secure journalists around the world from intrusive surveillance through advanced spyware. The German NCP is now pressed to act, and should not try to further delay the process. We are looking forward to enter the mediation.”

Dr. Miriam Saage-Maaß, Vice-Legal Director of ECCHR stated: 

We very much welcome the decision of the UK NCP as first steps towards accountability of surveillance technology companies. This also sets a precedent for the German NCP dealing with a similar case, which has not yet been accepted.”

Maryam Al-Khawaja, Acting President for the Bahrain Center for Human Rights, said:

As human rights groups we have time and time again pointed out that the lack of accountability is one of the main reasons for the continuation of human rights violations. This includes the lack of accountability for companies that enable human rights violations in countries like Bahrain. Holding these companies responsible for selling software to governments who commit human rights violations will be a huge step forward for accountability not only for Bahrain; but internationally."

Dr Ala'a Shehabi, of Bahrain Watch, said:

It should never be "business as usual" with repressive states like Bahrain. This case, the first of its kind, and based on solid evidence provided by the complainants, will bring to question important matters, not just of trade itself, but of the nature of trading which can amount to complicity when it is used directly against pro-democracy activists struggling for equal rights. The NCP response from Gamma, by their own admission, clearly places profit before consideration of human rights. This is the wrong approach to European trade with authoritarian regimes.”

With the NCP in the UK considering the complaint, the complainants and Gamma will be asked to engage in mediation to reach a settlement. If no agreement is reached, the NCP will conduct a separate examination into the complaint and issue a final statement on whether the guidelines have been breached.

While the National Contact Point in the UK has responded, the complainants still await a decision by the German National Contact Point regarding the complaint against Trovicor.

For more information, please contact:
Mike Rispoli, Privacy International
mike@privacy.org

BACKGROUND

Gamma, a UK-based company, sells the intrusive surveillance software FinFisher, a product that covertly installs malicious software onto a target's computer and mobile phones. FinFisher, without the knowledge of the user, tracks a targets locations, logs keystrokes, can remotely switch on cameras and microphones, and monitors emails, instant messengers, and voice calls. Thus far, the spyware has been found to be used in at least 35 countries. These types of technologies have been found to be used against human rights defenders, journalists, and political activists, leading to arrests and tortuous interrogations.

The OECD Guidelines is a key international instrument for promoting corporate social responsibility. If the allegations are upheld, the companies are likely to be found to be in breach of OECD Guidelines for Multinational Enterprises, recommendations addressed by governments to multinational enterprises that set out principles and standards for responsible business conduct.

The OECD complaint is separate from Privacy International's filing for a judicial review of HM Revenue and Customs (HMRC) decision to refuse to release information about the potentially unlawful export of FinFisher. In that case, Privacy International is seeking to discover any investigation HMRC, the body responsible for enforcing export regulations, has initiated into Gamma. Thus far, Privacy International has been turned away by HMRC, who say they have no legal obligation to inform victims of surveillance or the public of any details regarding any investigation into Gamma's export practices.