In October 2023, I provided expert testimony to a European court investigating surveillance technology used to facilitate human rights abuses across North Africa. For hours, I walked the judges through the mechanics of these digital tools, and how they directly enable security forces to abduct, forcibly disappear, and torture people. This investigation, which is still ongoing, is not an isolated event but the result of sustained collective efforts by human rights organizations and activists. Two years earlier, in a landmark decision by authorities in Paris, the French firm Nexa Technologies (formerly Amesys) was indicted for complicity in acts of torture and enforced disappearance. The case centered on the company’s sale of the “Cerebro” system to the Egyptian government.
Cerebro functioned as a mass surveillance net, allowing security services to monitor electronic communications, track individual targets, and harvest private messages in real time. This digital intrusion served as the critical first link in a chain of violence: authorities used the intercepted data to locate and arbitrarily arrest people and subject them to brutal interrogations about their online activities while holding them in secret detention. Privacy violations directly enabled physical torture, demonstrating that while these European tools are digital, the harm they cause is very real.
Despite these high-profile legal proceedings, EU member states remain a primary source for the commercial surveillance tools used to target critical voices across North Africa and the Levant. This trade thrives within a profound regulatory void. On the one hand, importing MENA regimes operate without independent judicial oversight, privacy laws, or safeguards against state abuse. On the other, exporting European governments consistently fail to conduct meaningful human rights due diligence before issuing export licenses. Without these European tools, the physical reach and operational capacity of autocratic security apparatuses would be severely constrained.
Systems sold under the banner of national security […] are systematically repurposed for political espionage against nonviolent activists, journalists, and queer communities
This is why MENA governments are among the top clients in the global digital surveillance market. Systems sold under the banner of national security—such as counter-terrorism equipment, lawful wiretaps, and criminal investigation software—are systematically repurposed for political espionage against nonviolent activists, journalists, and queer communities. Responding to this growing global threat, the United Nations called for “urgent steps… to address the spread of spyware” and a pause on the sale of hacking tools until strict human rights safeguards are put in place. Its report concludes that spyware and digital surveillance pose a severe, growing threat to human rights and right to privacy.
The silent partner: Why EU technology reigns supreme
Before examining why European firms dominate this trade, it is essential to understand the spectrum of digital censorship and surveillance technologies they manufacture and export. These tools include internet censorship software that allows state actors to block nationwide content (such as news websites) or apps (for example, Egypt continuously tried to block The Tor Project, a privacy preserving web browser, and Signal, a secure messaging app).
Other categories include internet surveillance platforms that index online traffic, invasive intrusion software designed to hack personal devices covertly, forensic tools that extract raw data directly from physical phones, and mass telecommunications interception systems that capture communication metadata—the unique set of data that describes the occurring communication such as timestamps, and location of sender and recipient, among other things, essentially properties of a communication rather than the actual content itself.
To acquire these capabilities, repressive regimes prefer European software over alternatives from elsewhere. European technology represents the “gold standard” of effectiveness and operational reliability, offering cost-effective packages that allow autocrats to paralyze opposition movements and shrink civic space. EU companies sell high-end, fully integrated software suites that come with long-term relationships of training, software updates, and on-site maintenance.
For example, spyware such as Gamma International’s FinFisher and Intellexa’s Predator covertly infect mobile phones and computers to harvest text messages, record voice calls, extract stored photos, and remotely activate microphones. Similarly, software from Bulgaria-based Circles exploits fundamental flaws in global mobile and telecommunications protocols to track a target’s physical location anywhere in the world and eavesdrop on calls without needing to trick the user into clicking a link.
When governments in Cairo, Rabat, or Amman purchase technology under an official European export license, the transaction lends the equipment a veneer of legal legitimacy and official police branding. These commercial contracts rarely involve a simple software delivery; they are bundled with multi-year technical support, software updates, and hands-on operational training for local police and intelligence officers. This deep operational integration embeds European corporate interests and engineering teams directly into the daily functioning of autocratic security apparatuses.
EU transparency black hole: A manufactured loophole
In 2021, the EU overhauled its export controls with the Dual-Use Regulation, commonly known as the Recast, which requires member states to evaluate the human rights records of destination countries before approving surveillance exports. However, the European Commission’s implementation guidelines for the Recast severely hollowed out its rights-protective promise. The guidelines permitted EU member states to report export licensing data in aggregate. In practice, this created a “transparency black hole” by publishing the total volume of technology categories and destination countries in separate, disconnected lists. This makes it impossible to connect a specific sale—such as phone-hacking spyware—to a specific receiving country, shielding both companies and governments from public oversight.
because the system relies entirely on profit-driven companies to voluntarily self-report these risks, it creates a structure where passivity is the profitable default.
A particularly glaring failure of the guidelines involves the handling of “unlisted tech”—cutting-edge surveillance tools that are not yet explicitly named on official multilateral export control lists. To prevent dangerous oversight gaps, Article 5 of the Recast included a “catch-all” clause that requires companies to apply for an export license if they know or suspect that their unlisted technology could be used to facilitate internal repression or human rights violations. But because the system relies entirely on profit-driven companies to voluntarily self-report these risks, it creates a structure where passivity is the profitable default. And while Germany’s Federal Office for Economic Affairs and Export Control has explicitly warned in its guidance that “passivity does not protect” exporters or absolve them of responsibility, voluntary self-reporting remains ineffective across the bloc.
Mapping the digital siege
Technology export data, compiled through freedom of information requests submitted to EU member states by Human Rights Watch, exposes a clear regional pattern of government-approved technology exports facilitating internal repression.
Egypt stands as one of the main beneficiaries of this trade. Official licensing data reveals that between 2022 and 2024, Finland processed export applications to Egypt for telecommunications interception systems, specifically International Mobile Subscriber Identity (IMSI) catchers, which act as fake cell towers to grab unique mobile identities and intercept cellular traffic in crowded public spaces. Over the same period, the Czech Republic processed export applications for forensic investigative tools which allow security forces to break into seized phones, bypass passcodes and device encryption, and scrape private messages, photos, and contact lists.
Bulgaria granted export licenses to Circles, a surveillance firm registered inside the country, for sales to countries such as Jordan and Morocco. Circles is affiliated with NSO Group, the Israeli cyber arms manufacturer infamous for its Pegasus spyware, which has been used to facilitate human rights violations worldwide, including the targeting of Egyptian dissidents. It is also used by Morocco’s intelligence service. Circles’ exported software includes “Landmark,” which tracks the real-time physical location of mobile users without their knowledge, and “VOLE,” a system that exploits mobile network protocol vulnerabilities to remotely intercept incoming and outgoing voice calls. Moroccan authorities have documented histories of using similar interception technology to target civil society members and suppress critical reporting.
European companies exploit specialized regulatory loopholes. For example, Swedish firm MSAB exports universal forensic extraction devices that bypass phone lock screens to harvest raw internal data. When Swedish export authorities were questioned by Human Rights Watch about these transfers, they explained that forensic extraction devices fall outside dual-use surveillance controls because of an exception in the European Commission’s guidelines. Under these guidelines, tools that are not designed exclusively for covert spying are not classified as cyber-surveillance items. Consequently, even though forensic extraction tools are functionally deployed by security forces to breach seized phones and crush political dissent, their marketing as standard law enforcement equipment allows them to bypass export scrutiny entirely.
Policy recommendations and their real-world limitations
To close these structural loopholes and prevent European technology from driving further repression across the MENA region, immediate regulatory reforms are required at both the state and corporate levels.
EU institutions and member states must immediately reform their export licensing frameworks. First, the European Commission must update its transparency guidelines to end aggregated reporting, mandating public, disaggregated data for every license application. This data must explicitly identify the exporter’s name, the specific end-user agency, the destination country, and the precise legal justification for approving or denying the license. Second, national licensing authorities must move beyond merely “considering” human rights records; they must establish mandatory license denials whenever an assessment indicates a clear risk that the technology will be used for internal repression. Third, the EU and its member states must establish accessible judicial remedy mechanisms within European courts, ensuring that MENA-based victims of European surveillance technology have clear legal channels to seek redress and hold manufacturing firms accountable.
Policymakers must also acknowledge the real-world limitations of these reforms, as technology firms actively seek ways to circumvent export restrictions
Concurrently, exporting corporations must fulfill their independent human rights responsibilities. Companies must fully integrate Human Rights Due Diligence (HRDD) into their operations in accordance with the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises. In plain terms, HRDD is not a one-time box-ticking exercise, but an ongoing, comprehensive risk-management process, in which a company actively identifies, prevents, and mitigates the potential human rights harms of its products—evaluating risks from initial software design through market entry, end-user verification, and post-deployment audits. If an internal audit uncovers evidence of misuse or red flags regarding an end-user, companies must proactively notify national licensing authorities and immediately cease sales and technical support to abusive entities in countries such as Egypt, Morocco, and Sudan.
Policymakers must also acknowledge the real-world limitations of these reforms, as technology firms actively seek ways to circumvent export restrictions. A common tactic is re-labeling specialized surveillance equipment as “general-purpose IT tools” (everyday administrative software or standard commercial hardware) to argue that the shipment falls outside strategic export controls. Companies also evade European jurisdiction by routing sales through non-EU subsidiaries or invoking “commercial secrecy” and “national security” to block public document requests. Unless future regulations mandate strict, end-to-end corporate supply chain oversight, restriction efforts will remain incomplete.
Closing the gap between policy, tech, and transnational repression
Regulatory frameworks must urgently adapt to fast-paced technological developments that threaten democratic values across borders. A recent study commissioned by the European Parliament highlights the dangerous expansion of transnational repression—the digital surveillance, intimidation, and coercion of exiled journalists, activists, and human rights defenders by autocratic regimes operating beyond their borders.
Surveillance companies operating in the shadows undermine individual rights, public trust, and democratic institutions worldwide. European export policy and legal reforms cannot continue prioritizing corporate secrecy over human lives. EU institutions must center human rights investigations and the voices of targeted victims, ensuring that European technology ceases to be a silent partner in autocratic repression across the Middle East and North Africa.
Ramy Raoof Halim is a Nonresident Fellow at TIMEP focusing on surveillance and technology in Egypt and the MENA region.