A number of MEPs are proposing to create a European organization to monitor and regulate the use of spyware in the EU. This new body would operate under the name Tech Lab.

Earlier this week, the report was released by the European PEGA Commission, charged with investigating the abuse of Pegasus and other spyware within the European Union. After more than a year of research, MEPs are now proposing a series of measures; The most notable of these is the creation of the Tech Lab: a task force to monitor spyware within the Union and curb its abuse.

The biggest pain points

The committee was named after Pegasus, a notorious Israeli-made spyware (specifically by the tech company NSO Group). The software has been around for almost a decade and is popular with many governments because it allows stealthy surveillance of mobile devices such as smartphones. Pegasus is also widely used by a number of EU Member States, leading to the creation of the relevant committee.

Two examples specifically mentioned in the report are Hungary and Poland. Both Eastern European countries have gradually reduced critical voices and opposition in recent years. Spyware plays an important role in this: journalists, politicians, activists and anyone else who disagrees with those in power can easily be monitored via Pegasus.

Eastern and Southern Europe

Hungary is criticized in the report for a calculated and strategic government campaign to systematically restrict freedom of the press and freedom of expression. Poland is similarly accused of using Pegasus primarily to monitor the opposition and any critics, with the sole aim of keeping the current government in power.

In southern Europe, Greece and Spain get a less honorable mention. Among the Hellenes there is less systematic abuse, but spyware is used ad hoc for both political and financial purposes. Basically, Greece has a fairly adequate legal framework for such things, but according to PEGA, certain changes have severely weakened those legal protections, so that not only has spyware been used against journalists, businessmen and politicians, but the software has already been exported to countries with dubious human rights records.

The latter is something neighboring Cyprus is even more guilty of, according to the report. The committee therefore calls on Greece to strengthen its legal safeguards and Cyprus to revoke all export licenses that do not comply with European rules.

Spain is a much better student in this class, but PEGA is still concerned about nearly 50 cases where it’s unclear who authorized the use of spyware. The committee urges the Spanish government to investigate this fully, honestly and efficiently every time. The same government is also mentioned positively in the report for its independent judicial system.

actions and suggestions

For this reason, the committee proposes the creation of Tech Lab: an independent institute with the power to verify surveillance and provide legal and technical support (e.g. equipment verification and forensic investigation).

In addition to setting up the Tech Lab, PEGA plans a number of other measures. The Commission is calling for new laws to detect, share, use and exploit digital vulnerabilities across the EU. In addition, PEGA is calling for a general definition of what exactly constitutes a national security case and for stricter regulations on the use of spyware.

In addition to the examples within our own ranks, there are of course also many cases outside the EU. In today’s globalized world, they also have an impact within the Union. PEGA therefore calls for an in-depth investigation of the export licenses for spyware and a tightening of the applicable European rules on export controls. In addition, the Commission is also proposing a joint EU-US strategy. Discussions are also to be held with Israel and other relevant countries about the marketing and export of spyware. One of the aims of these talks is to ensure that no European development aid is used to develop spyware.

All of this has yet to go through the European Parliament, so nothing is set in stone yet. In addition, it is questionable whether all member states will then comply with the rules at all. Especially those who are already playing tricks on the current European rules.