Between 2018 and 2023, Bulgaria licensed the export of advanced surveillance equipment to over a dozen countries, including Azerbaijan, Bahrain, and the United Arab Emirates, according to Human Rights Watch and Novinite. These destinations have documented human rights concerns.
While governments increasingly acknowledge the national security and human rights risks of sensitive technology exports, the global market for surveillance tools continues to thrive, often with official licenses. This tension presents a significant challenge in regulating dual-use technologies.
Without significant international cooperation and stricter enforcement mechanisms, the proliferation of sophisticated surveillance technology will continue to undermine human rights and global security, making effective regulation an increasingly distant prospect.
Governments in at least 49 countries were suspected of having access to sophisticated spyware or data extraction technologies, according to Freedom House. A 2024 report by Google’s Threat Analysis Group identified all but two commercial surveillance companies as based in the EU, according to Human Rights Watch. Widespread access, particularly to tools from EU-based firms, underscores Europe's central role in the global surveillance market.
Failed Controls and Emerging Threats
- Germany-based spyware maker FinFisher ceased operations in 2022 following an investigation into allegations of selling spyware to Turkey without an export license, according to TechCrunch. The FinFisher case demonstrates how companies circumvent regulations, often leading to their collapse.
- Tal Dillian, co-founder of Circles, was found guilty by an Athens court for his spyware company's use in surveilling Greek citizens and was sanctioned by the US government in 2024, according to Human Rights Watch. Tal Dillian's conviction and sanction show individual accountability for illicit surveillance activities.
- The U.S. government investigated PGP's creator, Phil Zimmermann, for allegedly violating arms export controls in the early to mid-1990s, according to TechCrunch. The PGP investigation illustrates the long-standing challenge of controlling encryption technology, a precursor to modern surveillance tools.
- The White House ordered Anthropic to restrict the export of its AI models Fable and Mythos to foreign nationals, citing national security concerns, according to TechCrunch. The White House order on Anthropic highlights the persistent struggle to control emerging dual-use technologies, from early encryption to advanced AI, and the consistent failure of governments to regulate them effectively.
Why EU Export Controls Are Ineffective
The EU's export control framework, exemplified by Bulgaria's licensed exports (2018-2023), actively facilitates the global spread of surveillance technology to repressive regimes, according to Human Rights Watch and Novinite.com. Policy divergence creates significant loopholes: while the US restricts AI exports for national security, EU member states actively license advanced surveillance technology, even as 95% of commercial surveillance firms are EU-based, according to Human Rights Watch.
Official licenses from EU countries, rather than just illegal trade, indicate a systemic oversight failure. Official licenses from EU countries disproportionately fuel the global proliferation of sophisticated spyware, making the EU a central hub for technology often used for internal repression, according to Freedom House and Human Rights Watch. While individual companies like FinFisher and Tal Dillian's Circles face sanctions for illicit sales, the systemic issue of licensed exports from EU nations to human rights abusers reveals a profound hypocrisy. National economic interests consistently trump stated human rights commitments, a trend continuing through 2023.
Without a fundamental shift in policy and enforcement, the EU's role as a primary source of surveillance technology for repressive regimes appears likely to continue, further eroding human rights globally.
