15. The Assembly asks the Venice Commission to assess the legislative framework and practice ontargeted surveillance of all member States (in priority Poland, Hungary, Greece, Spain and Azerbaijan; andthen Germany, Belgium, Luxembourg, the Netherlands and all the other member States), in order to assess ifsuch framework contains adequate and effective guarantees against any possible abuse of spyware, havingregard to the Convention and other Council of Europe standards. Given the level of intrusiveness of Pegasusand similar spyware, clear and precise legislation, robust oversight mechanisms, procedural guarantees andeffective remedies must be in place before member States can continue using those tools.

16. The Assembly trusts that the evaluation and review mechanism foreseen in amending Protocol CETSNo. 223 will ensure the monitoring of the implementation of the relevant provisions of Convention 108+ in thearea of targeted surveillance for national security and law enforcement purposes, including the use ofspyware.

17. The Assembly calls on:

17.1. Israel, which enjoys observer status with the Assembly, to:

17.1.1. strengthen its export control mechanisms to ensure that export licenses are denied or revoked with respect to spyware technologies where there is a substantial risk that those technologies could be used for internal or transnational repression and/or to commit human rights violations;

17.1.2. fully co-operate with investigations conducted by Council of Europe member States regarding the use of Pegasus and other spyware exported from Israel or sold by Israeli-based companies;

17.1.3. publish its framework on export control and inform the Assembly about it within six months;

17.2. Morocco, which enjoys partner for democracy status with the Assembly, to:

17.2.1. inform the Assembly within three months on whether it has used Pegasus or similar spyware at home and abroad;

17.2.2. launch within three months a fully independent investigation into the alleged use of Pegasus by State authorities against targets in Morocco and targets within the jurisdiction of Council of Europe member States.

18. The Assembly also calls on spyware and surveillance companies domiciled in Council of Europemember States or conducting substantial activities within their jurisdiction to apply human rights due diligencethroughout their operations or in respect of such activities and improve transparency, in line with the CM/Rec(2016)3 of Committee of Ministers and the United Nations Guiding Principles on Business and HumanRights;

19. The Assembly invites the European Union to sign and ratify Convention 108+, make use of the Councilof Europe’s expertise in this field, and engage with its relevant bodies in areas such as data protection,targeted surveillance and spyware, for the purposes of standard-setting, monitoring and co-operation.

II SÉRIE-D — NÚMERO 18 ____________________________________________________________________________________________________________

128