Government working on tightening software licences used for spyware

The Deputy Ministry of Research is working on tightening the framework for dual-use software licensing related to tracking people, the permanent secretary of the ministry Stelios Himonas told the House legal affairs committee on Wednesday.

The committee examined for a second session the involvement of Cyprus in the production and distribution of software that may be used for illegal surveillance.

Himonas told the committee that the authorities are coordinating in tightening the framework.

He noted that two separate registers will be created for this purpose, one for manufacturers of such devices for which a first draft of legislation was created, while a second equipment register will also be created. He also noted that there will be provisions for market surveillance in the legislation.

Commenting on the existing legislation, he said that due to the single market of the EU, export of software within the EU is not controlled, but only transactions with third countries and expressed the intention to have a regulation both inside and outside the EU.

Regarding the finding on the spy van in 2019 and the calls for its disclosure, the representative from the attorney-general’s office stated that as any police material that is not witness testimony is handled, it is not disclosed, and to judge whether the authorities will disclose it or not certain criteria are considered.

Police chief Stelios Papatheodorou expressed the police’s support for the bill being promoted to tighten the framework on dual-use surveillance software.

He then referred to the police’s history of purchasing surveillance software services to assist in the investigation of cases.

In this context, he said in 2011 the police bought a device from a company that had been presented to them at an exhibition in Germany for the extraction of data from tablets and mobile phones according to the provisions of legislation and only with relevant decrees from the court.

The German company also proceeded, he said, in training five members of the police. In 2014, he said, a second device was purchased from the same company, but in terms of payment, they were referred to the company NCIS Intelligence and Security Services, after informing them that they were their authorised representative in Cyprus.

In 2016, they were referred to another official representative in Cyprus with whom there is cooperation to this day. He also noted that the licence for NCIS Intelligence and Security Services was issued in 2013 and expired in 2020 and was not renewed after the events with the spy van.

He also noted that the police work with many private companies from which they buy equipment, and it does not mean that if someone commits a crime they will not be held accountable.

The European Parliament’s inquiry committee (Pega) established to investigate the use of surveillance software among EU member states made recommendations to Cyprus for a better assessment of the licences issued for spyware interception software.