How Investigative Journalists Can Fight Back Against New, Enhanced Surveillance Threats

In the past few years, numerous scandals have revealed that journalists across the world have been the target of surveillance, often through spyware. But journalists need to be vigilant about other forms of surveillance that are becoming more prevalent in society — often boosted by technology introduced in the name of public health during the COVID-19 pandemic.

Authorities have been deploying new digital surveillance, including location tracking and biometric surveillance, in more areas and for more purposes. At the same time, legislative efforts to weaken end-to-end encryption in the name of online safety are ongoing around the world.

“What’s really concerning is that it’s established democracies leading this charge,” noted Callum Voge, director of government affairs and advocacy at the Internet Society. He spoke on a panel about the “brave new world” of surveillance at the 2023 International Press Institute (IPI) World Congress in Vienna. He cautioned that some of the most problematic and expansive laws about online safety are being proposed by the US, UK, and the EU — providing a playbook for authoritarian governments who could misuse the same powers to crack down on journalists and dissidents. 

But there have been some success stories in fighting back against efforts to water down encryption and to carry out increased surveillance in public spaces. The IPI panel — moderated by Scott Griffen, deputy director of the IPI and including AP investigative reporter Garance Burke, Serbian lawyer Nevena Krivokapić Martinović of the NGO SHARE Foundation, and investigative reporter Eliza Triantafillou of Greece’s Inside Story — discussed new and enhanced surveillance threats, but also shared case studies of how investigations and campaigns have been able to push back on potentially harmful laws and practices. 

Pandemic Tools

AP investigative reporter Garance Burke led a global investigation, Tracked, into the impact of new biometric and AI-supported surveillance tools, many put into place during the COVID-19 pandemic, along with the “firehose of information” to which governments gained access — private health details, photos for facial recognition, and home addresses. “We saw that these tools were later repurposed for aims completely unrelated to the pandemic,” said Burke.

Working with staff in Australia, China, India, Israel, and elsewhere, the AP team found cases of authorities using COVID-era data and technology to curtail travel for activists and ordinary people, harass marginalized groups, and connect health information to other surveillance and law enforcement tools in ways that no one had anticipated. In some cases, data was shared with spy agencies. 

Tracked is a special project from the AP reporting on global cases of increased surveillance tools and methods. Image: Screenshot, AP

Burke offered up some alternative ways to investigate these new forms of technology, given the challenges of covering them, which include decentralized purchasing and implementation and the lack of disclosure of AI use. She recommended reporting on who designed, built, and deployed the tools; researching the relevant laws, regulations, and contracts related to their use; focusing on who they are harming or could potentially harm; and examining any disparate impact these tools have within communities. (For example, the Tracked investigation looked into how facial recognition cameras are being deployed in Muslim communities in Hyderabad.)

Serbia: Pushing Back

Nevena Krivokapić Martinović of the SHARE Foundation recounted that group’s recent fight against biometric surveillance and facial recognition technology in public places in Serbia. Her team discovered a study on the Chinese tech giant Huawei’s site discussing a plan for Belgrade, Serbia’s capital, to be blanketed with 1,000 Huawei-made cameras with enhanced facial and license recognition software. “Once we analyzed it and published it, the [original] document disappeared from the Huawei site within a couple of hours,” Martinović noted.

“The most problematic thing was that there is no basis in our laws to implement biometric surveillance and facial recognition in public spaces. So that’s how our fight started,” she added.

The “Brave New World” panel at the 2023 IPI World Congress discussed new digital surveillance threats against journalists and how to combat them. Image: Ronja Koskinen, International Press Institute

Using information from the Huawei document, and with help from citizens, SHARE created an open map of the thousands of current and proposed cameras all over the city of Belgrade. The resulting nationwide media coverage made the general public aware of the issue. In summer 2021, the group also uncovered a proposed law that would legalize biometric surveillance in public places. Various civil society groups and activists in Serbia and Europe were able to campaign and fight it, and that version of the law was withdrawn. “That was a small win,” said Martinović. 

After SHARE was invited to have conversations with interior ministry and police officials, it became clear the authorities were unaware of the full implications of the technology. The conversation — and the fight — over the contents of the law is ongoing. “I am definitely sure that [increased surveillance] is an ongoing trend, but I think we should push hard every time, even on the smallest things,” Martinović said. 

‘Predatorgate’

Eliza Triantafillou recounted Greece’s own, recent spyware scandal. An 2023 investigation by Inside Story revealed that Greece was among the countries using a new form of spyware called Predator, which infects a mobile phone when the user clicks on a link. Phones from several journalists — including Thanasis Koukakis, the first confirmed case of Predator use against an EU citizen — and opposition politicians were infected. Before this incident, Koukakis had also been under legal surveillance through a telecoms provider on national security grounds, but the government has denied official involvement with Predator. 

Eighteen months after Inside Story’s initial investigation, Triantafillou summarized where things stand now: The Greek government has confirmed that there had been misuse by Greek intelligence services of the legal procedure to wiretap, but still denies any involvement with Predator. The government did introduce harder criminal penalties for individuals who might use spyware — but in the same provision made it legal for the state to use this kind of software.

“The good thing is that there is an ongoing investigation by the prosecutor’s office in Athens on the misuse of illegal wiretapping, jointly with the use of spyware,” she said, but overall, “so-called Predatorgate was underreported.” Triantafillou added that even with the established media and the government suppressing the story, there was evidence of growing awareness: Based on a recent poll, 5% of respondents said that the wiretapping scandal was a crucial factor in deciding their vote in recent legislative elections. 

Encryption

Encryption — the process of scrambling information to protect it — is essential to privacy online, such as for banking or health data, but is especially important for journalists who seek to shield the identity of sources and for data and website integrity.

“When we lose encryption… it allows for abuse on a mass scale that many of us can’t imagine,” said Voge. When encrypted providers such as WhatsApp were forced out of the Syrian market due to sanctions, journalists had to use the local telecoms provider, which Syria’s secret police were able to monitor — resulting in arrests and killings. Thanks to advocacy around this issue, sanctions exceptions were made for these kinds of providers.

Voge noted several ongoing legislative efforts around the world — mainly coming from law enforcement agencies seeking to address illegal activity such as child sexual abuse material, terrorist activity, and disinformation — are being led by democratic governments. 

“The difficulty with all of these laws is that [the word] ‘encryption’ is almost never mentioned in the proposals,” Voge noted. “Instead, the way encryption is threatened is that the proposals put the onus on providers to find solutions and to hand over de-crypted data to law enforcement when they demand it.” 

The problem is that right now no solutions exist, he adds, so providers would be pressured to get rid of encryption entirely, or weaken it. End-to-end encrypted messaging services WhatsApp and Signal have threatened to leave the UK market should it pass the Online Safety Bill, in order to avoid compromising their product.

But there are things that we can do, Voge said: Journalists should report on these bills, making sure to include comment from experts who can explain their actual technological impact, and interrogate government claims about proposed laws, because they are often not accurate.

“The call is for all of us to work together,” said Voge.

Watch the panel at the IPI World Congress below. For more on security, privacy, and protection from digital surveillance, check out GIJN’s Reporting Guide to Investigating Digital Threats. The new surveillance will also be a theme of this September’s Global Investigative Journalism Conference.

Additional Resources

Investigating the Digital Threat Landscape

How to Protect Yourself from Metadata

How Journalists Are Coping with a Heightened Surveillance Threat

Alexa van Sickle is an associate editor at GIJN. She was previously a senior editor for the foreign correspondence magazine Roads and Kingdoms. She has also been an editor at the International Institute for Strategic Studies and a publisher at an international law non-profit in London. She lives in Vienna, Austria.