EU proposes new regulation for limiting exports of cyber-surveillance technology to oppressive regimes

Oct 3, 2016 21:10 GMT  ·  By

The European Commission (EC) proposed last week an amendment to Regulation (EC) No 428/2009, which is a law that governs the export of dual-use technology, that can be used for both civil and military purposes.

The changes proposed by the EC are meant to make it harder and time-consuming for European companies to export dual-use technologies outside the EU, to countries that have a history of human rights abuses.

Dual-use technology, especially cyber-surveillance hardware and software, was regularly abused by governments around the world to spy on their citizens, protesters, journalists, and dissidents.

Naturally, lobby groups representing these companies opposed, arguing that increased regulation and a more sinuous bureaucratic process will affect their profits, putting them at a disadvantage to other businesses located in Asia or North America.

Tech companies oppose the new law

Euractiv says that diplomats from countries such as Austria, Finland, France, Germany, Poland, Slovenia, Spain, Sweden and the UK, will be mounting an opposition to the proposed regulation changes.

Their efforts already paid off. A leak of the proposed law changes from July included a list of nine product categories that were included on the list of dual-use technologies, and would have required companies to seek special export licenses from their local national governments.

According to the same publication, the latest version of this list includes only five product categories: mobile telecommunication interception equipment, intrusion software, monitoring centers, data retention systems and digital forensics.

The list previously included: biometrics, location tracking devices, probes and deep package inspection systems.

Tech companies have solid arguments

While the new law only limits exports to certain countries and not all, tech companies say the law is too broad in its categorization of dual-use items.

One of the reasons why location tracking devices were removed from the list of regulated dual-use technologies was because this could have included any device with a GPS tracker inside it, even a smartphone.

Requiring tech companies to get special export licenses to sell smartphones to citizens living under an oppressive regime defeats the purpose of the law, and does damage European businesses.

Nevertheless, there are companies, such as Hacking Team, that do create, advertise, and sell dangerous software to oppressive regimes, and these type of actors is who the EC is trying to target through its new regulation.

The new law changes must be approved by the EU Parliament, and then implemented at the state-level by each EU member.