As there are several international aspects to the abuses—the spyware was produced by an Israeli company and an EU citizen living in Hungary was targeted with it—we are also launching international proceedings.
1. Complaint to the European Commission
One of our clients, Adrien Beauduin, a student involved in the CEU protests, is a Belgian citizen and therefore the European Union may have jurisdiction over his attempted surveillance. On his behalf, we lodged a complaint with the Commission and asked it to investigate whether his rights to freedom of residence and employment guaranteed by the Treaty on the Functioning of the European Union had been violated (university education is also considered to be a form of employment according to the interpretation of the Court of Justice of the European Union).
It is easily conceivable that foreigners are more likely to attract the attention of the secret services and to be subject to politically motivated surveillance than Hungarian citizens—it is therefore reasonable to assume that there may be discrimination against citizens of other Member States. People in professions that require strict confidentiality (such as journalists or lawyers) may be deterred from working in Hungary because of the risk of surveillance. This could violate the free movement of labour and services and thus EU law.
Hungarian national security legislation falls short of the fundamental rights standards of other EU countries, which in itself may act as a deterrent to other EU citizens from residing in Hungary, as they may have a more well-founded fear of surveillance than elsewhere in the EU. The mere fact that it is impossible to prove discrimination because of the covert nature of the surveillance should not in itself lead to the erosion of rights guaranteed to EU citizens. We therefore take the view that the right to the free movement of persons and the free movement of labour of an EU citizen who is deterred from residing or working in Hungary by a rule that discriminates against foreigners is infringed.
Our client's right to privacy under the Charter of Fundamental Rights of the European Union may also have been infringed where the case has a European Union relevance.
Update:
17.08.2022 Unfortunately, the European Commission rejected our client's complaint and did not even consider our arguments.
In its reply (which can be downloaded here), it only provided information on which EU legislation is available to those whose data protection rights have been infringed. However, none of these apply in the case of surveillance by national security services. The Commission did not take into account that the complaint was not about a specific breach of our client's personal data, but about a systemic problem of abuse of the security services.
We regret that the Commission refused to examine whether it is compatible with European Union law for a Member State not to have effective control over surveillance for national security purposes.
2. Investigation by the Attorney General of Israel
Because of the difficulties of Hungarian law enforcement, we would have liked to ensure that the Hungarian authorities were not the only ones to act in investigating abuses. This is why we contacted Israeli human rights lawyer Eitay Mack, who has been fighting Israeli arms exports to autocracies for more than a decade. With his help, we were able to file a complaint with the Israeli Attorney General on behalf of three of our clients. We asked him to investigate whether a criminal offence had been committed when the NSO Group obtained a state export licence for Pegasus knowing that such a spy weapon could be more easily misused by the government in Hungary than in other countries.
3. Mass litigation before the European Court of Human Rights (ECtHR)
The ECtHR already ruled in 2016, in the case Szabó and Vissy v Hungary, that the authorisation procedure for secret surveillance is unlawful because it is unclear under what conditions this tool can be used, the authorisation is granted by the Minister of Justice, not by a body independent of the government, and the conduct of the surveillance is not controlled by an independent body. In the more than six years since then, the government has amended the National Security Act nearly 20 times (!), but has done nothing to remedy the shortcomings—which it justifies to the Council of Europe by claiming that the analysis required for the amendments is time-consuming. The unsustainability of the government's position was also explained in our letter to the Council of Europe's Committee of Ministers.
Anyone can claim before the ECtHR that their fundamental rights are being violated simply because of poorly regulated surveillance powers of secret services in their country. A finding of a violation is not automatic: the applicant must allege a likelihood of being subjected to surveillance. Since it is impossible to obtain direct evidence of this, they can do so by showing that there are inadequate safeguards over surveillance in the country concerned and that they have a high-risk status for surveillance. This could be journalists, civil society workers or anyone else who might fear that if confronted by their government, it might try to take action against them by illegal means. Ultimately, the Court will consider each case on its own merits, taking into account the applicant's status and the national security arrangements in the country concerned, to determine whether the applicant's fear of surveillance is well founded.
In the case of Hungary, the ECtHR has already ruled that there are inadequate safeguards when it comes to surveillance; meanwhile, the situation of civil society and the independent press has deteriorated, as the government openly treats them as a national security risk. As an example, in 2016/17, three senior government politicians, including the Prime Minister, argued that NGOs labelled as members of the “Soros network” should be dealt with by the secret services. It is also worth remembering that in 2020, the Ministry of Foreign Affairs ordered reports from Hungarian embassies in the European Union on journalists visiting those countries for training in order to counter “attempts to interfere” by the “Soros organisations”. Since then, quite a few journalists have indeed been found to have been attacked by Pegasus software—although not members of the civil society (yet).
In this environment, all Hungarian CSOs and the independent journalistic sector can justifiably claim that the government could use secret service tools against them. We are therefore planning a mass action before the ECtHR with human rights lawyer Balázs Tóth on behalf of the people concerned.