Commercial cyber-intrusion capabilities can expose journalists, human rights defenders, civil society organisations, and humanitarian actors to intrusive surveillance and serious harm. Yet preventing their misuse remains a challenge for export-control frameworks, even where the risks are documented.
The European Union’s Dual-Use Regulation (EU) 2021/821 was designed to strengthen the link between export controls, human rights, and security. Its Article 5 introduced a ‘’catch-all’’ mechanism allowing controls on unlisted cyber-surveillance items that may be intended for internal repression or serious violations of human rights or international humanitarian law.
As the European Commission evaluates the Regulation, the central question is whether these safeguards work in practice. At Protect.ngo, we believe the answer depends in part on whether licensing authorities have reliable, independent evidence of how commercial cyber-intrusion capabilities are actually deployed.
From regulatory commitments to operational evidence
Since the Regulation entered into force, the use of the ‘’catch-all’’ clause of article 5 appears to be limited and undocumented. In fact, ‘’the proactive authority-led mechanism under Article 5(1) remains insufficiently operationalized and its use is not transparent’’ as highlighted by Human Rights Watch in a joint letter published on October 26th.
The European Commission’s 2024 recommendations on reporting and due diligence provide a framework for implementation, but they are non-binding. In its May 2026 report, Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators, Human Rights Watch identified significant shortcomings in the current system, including concerns that reporting guidance obscures information about which technologies are exported and where they are sent.
These gaps matter. Without sufficiently detailed and comparable information, it is difficult to assess whether the Regulation is achieving its objectives, identify patterns of potential misuse, or understand whether licensing decisions adequately account for the risks faced by people targeted by surveillance.
Our experience at Protect.ngo reinforces a simple point: effective export controls require an evidence base that reflects how technologies are used, who is affected, and what harm follows.
Bringing the harm into view
Protect.ngo documents the human, institutional, and economic harm caused by cyberattacks and information manipulation targeting civil society. Our Cyber Tracer platform provides an evidence-led repository of commercial cyber-intrusion incidents, drawing on multiple trusted sources rather than relying on any single account.
We structure, corroborate, and analyse information from open-source intelligence, independent analysis of victim reporting, investigative journalism and, where partners are able to share it, technical telemetry. We record the provenance of data points and distinguish between different levels of evidentiary certainty.
No single source provides a complete picture. Technical indicators can identify an intrusion; victim reporting and investigative journalism can help establish its context, identify affected communities, and document its consequences. Combining these sources can provide a more robust account of how commercial capabilities are deployed and the risks associated with their transfer. A new version of Cyber Tracer, due in November 2026, will include a dedicated vertical focused on commercial cyber-intrusion targeting civil society.
Our role is not to decide whether an export licence should be granted. It is to help ensure those decisions rest on credible evidence of real-world deployment and harm.
Three priorities for a more effective EU framework
The Commission’s evaluation provides an opportunity to move from general commitments towards a more transparent, consistent, and evidence-led system. We see three priorities.
1. Make safeguards effective for high-risk cyber-surveillance capabilities
For a defined category of high-risk cyber-surveillance capabilities, the EU should consider a binding authorisation requirement and stronger safeguards against exports where there is a clear risk of internal repression or serious human rights violations.
This would build on proposals already discussed at EU level, including the European Parliament’s work on strengthening the human rights safeguards in the Dual-Use Regulation. The precise legal threshold and scope would need careful definition, but the underlying principle is clear: decisions should not depend solely on whether an exporter identifies and reports a risk.
Authorities need access to credible information about the intended end user, the proposed deployment, the supplier’s previous activities and any documented history of misuse. Independent incident evidence can help inform that assessment, particularly where public claims of responsible use conflict with documented deployment.
2. Require consistent and meaningful reporting by all Member States
The EU needs comprehensive, harmonised and sufficiently disaggregated reporting on the licensing of cyber-surveillance items. Reporting should allow meaningful analysis of the technologies involved, destination countries, licensing outcomes and the human rights risks considered, while respecting legitimate confidentiality requirements.
Partial reporting and broad categories limit the ability of the Commission, researchers and civil society to identify trends or assess whether controls are applied consistently across the Union. The Commission should therefore strengthen common reporting requirements and improve the transparency and comparability of published data.
Cyber Tracer’s evidence structure is designed to connect information about vendors, countries, types of harm and sources of evidence. We would welcome the opportunity to share methodological insights with the Commission and Member State authorities developing a common reporting approach.
3. Establish a formal channel for independent civil-society evidence
Export-control authorities should have a clear, practical way to receive and assess independent evidence of potential misuse. Civil society organisations can contribute information that may not otherwise reach licensing authorities, including documented incidents, patterns of deployment and evidence that raises questions about an exporter’s compliance claims.
A formal channel could allow authorities to request relevant evidence in relation to a proposed export, receive documented incident records, and incorporate reliable information into licensing assessments and oversight. Appropriate safeguards would be needed to protect victims, confidential sources and sensitive technical information, while ensuring that evidence is assessed fairly and its limitations are made clear.
This approach is consistent with the direction of recent policy work, including the Stockholm International Peace Research Institute’s March 2026 Good Practice Guide on Applying Export Controls to Transfers of Commercial Cyber Intrusion Capabilities, which examines how information-sharing and transparency can support the implementation of export controls.
Putting victims at the centre
Across the UN Cybercrime Convention negotiations, the UN Global Mechanism on ICT and the Internet Governance Forum, and in our analysis, including Centring Victims in Global Cyber Norms and Ransomware — Follow the Threat Actor, our principle is the same: effective governance must account for the people and organisations affected by cyber operations, not only the technologies or geopolitical interests involved.
Export controls cannot address every dimension of the commercial cyber-intrusion market. But when they are supported by reliable evidence, transparent reporting and effective safeguards, they can become a more meaningful part of the response. Protect.ngo stands ready to contribute the Cyber Tracer’s evidence base and methodology to the Commission’s evaluation and to future information-sharing arrangements.