British-German surveillance company Gamma has been condemned by a human rights watchdog for its failure to adhere to human rights and due diligence standards that would protect against the abusive use of its products in Bahrain.
This statement was originally published on privacyinternational.org on 26 February 2015.
British-German surveillance company Gamma has been condemned by a human rights watchdog for its failure to adhere to human rights and due diligence standards, after a two year investigation into the company’s sale of surveillance technology to Bahrain.
The Organisation for Economic Cooperation and Development’s UK National Contact Point (“NCP”) concluded today that Gamma International should make changes to its business practices in order to ensure that in the future it respects the human rights of those affected by the surveillance technologies it sells.
The decision was in response to a complaint brought by Privacy International, the European Centre for Constitutional and Human Rights, Reporters Without Borders, the Bahrain Centre for Human Rights, and Bahrain Watch, and concerned Gamma’s human rights and responsible business conduct obligations under the OECD Guidelines for Multinational Enterprises.
The complaint alleged that Gamma sold its notorious FinFisher intrusion software product to Bahrain as early as 2009, after which time it was used by the Bahraini government to violate the human rights of three Bahraini nationals and human rights activists, Ala’a Shehabi, Husain Abdulla and Shehab Hashem.
Today’s decision is the first time that the OECD has found a company selling surveillance technologies to be in violation of human rights guidelines, and one of the most critical decisions ever issued by the OECD. In it, the NCP sets out in strong terms that Gamma has no human rights policies and due diligence processes that would protect against the abusive use of its products. Its products are considered some of the most invasive surveillance tools available on the secretive surveillance market.
Command and Control servers of Gamma’s flagship product, FinFisher, have been identified by the Citizen Lab in 36 countries,including Bahrain, Ethiopia, and Turkmenistan, as well as in the United Kingdom and Germany.
The decision concludes a complaint process which began more than two years ago. Gamma was a reluctant participant in the proceedings, refusing to productively engage in a September 2013 mediation, employi stalling efforts that were ultimately rejected by the NCP, and refusing to confirm the sale of FinFisher to Bahrain, despite the overwhelming evidence in the public domain, for which Gamma is criticised by the OECD. The NCP found that Gamma’s engagement with the NCP process was unsatisfactory, particularly in view of the serious issues raised. Gamma failed to comply with its human rights obligations in this regard, the NCP found, by not providing for or cooperating in legitimate remedy processes.
Despite extensive evidence supporting the claimants’ allegations, the NCP failed to conclusively determine that Gamma had in fact supplied Bahrain with the invasive tools, and thus refrained from condemning Gamma for its failure to take sufficient steps to avoid, prevent or mitigate adverse human rights impacts. We are disappointed the NCP has not been able to undertake a more pro-active investigatory role which we believe would have quickly confirmed the transaction.
The NCP recommends that Gamma International and the wider Gamma Group follows international evidence and UK government advice when confuting due diligence about where to send its products and under what circumstances. The NCP also called on Gamma to improve the transparency and consistency of its engagement, and cooperate with official remedy processes used by victims of misuse.
Eric King, Deputy Director of Privacy International, said:
“Today’s judgement is a watershed moment recognising that surveillance companies such as Gamma cannot shirk their human rights obligations. This decision reaffirms that supplying sophisticated intrusive surveillance tools to th the world’s most repressive regimes is not only irresponsible business conduct, but violates corporate human rights obligations, and the companies that engage in such behaviour must bear the responsibility for how their products are ultimately used.
From its failure to have any human rights and due diligence policies in place, to its complete reluctance to engage in good faith in the OECD complaint process, Gamma has proven itself to be irresponsible corporate actor that is indifferent to the human rights impacts of its activities.
The OECD has today confirmed that Gamma, and companies like it, can no longer trade with impunity. The surveillance industry – an industry which makes its money by suppling human rights abusing regimes with the tools to repress people – must improve its practices, and cease operating in the shadows.”
Bahrain Watch said: “The destructive powers of this kind of surveillance technology in the hands of unaccountable governments cannot be underestimated. In Bahrain, we now know that activists, journalists and lawyers have all been targets, as is the case in many other countries in evidence that was obtained after the conclusion of this particular case. This achievement will also push governments to better regulate such technology in the future.”
Miriam Saage-Maaß, Vice Legal Director at ECCHR, said: “The decision of the UK NCP is essential! Its findings also apply to Gamma’s German subsidiary FinFisher Labs in Munich.”
