Spyware can easily fall into the wrong hands – investors should take note | Letter

The targeting of Serbian activists with advanced spyware (Report, 4 September) is the latest warning in a mounting record of abuse that makes the systemic and foreseeable risks of the commercial spyware industry increasingly impossible to ignore. Investors who aren’t paying attention are leaving their portfolios exposed to growing financial, reputational and human rights risks.

Despite industry assurances that its technology is intended only for investigating terrorists and criminals, spyware has repeatedly been linked to the targeting of journalists, activists, elected officials, opposition leaders, lawyers, judges, academics and civil society. The fallout for the companies involved has been serious: costly litigation, criminal complaints, crippling sanctions, judicial investigations, tightening export restrictions, executives being convicted, severe reputational damage and, in some cases, financial collapse.

That’s before accounting for the damage spyware can inflict elsewhere in an investor’s portfolio. Companies more profitable than spyware firms are forced to defend against attacks, respond to breaches and protect their users and commercially sensitive information. Funding spyware often means funding an attack on their far more valuable portfolio companies.

Investors shouldn’t wait for the next scandal to discover their exposure. They should screen commercial spyware companies from their investment universe, require fund managers to identify and prevent exposure across investment chains, and urge portfolio companies to take action to prevent spyware proliferation.

This is particularly important for development finance institutions, pension funds and other responsible investors whose mandates and reputations rest on creating long-term social value. Financing companies whose products can be used to silence journalists, intimidate civil society and undermine democratic institutions creates risks that extend far beyond any single investment.

The Serbian case should prompt investors to question whether their firm is exposed to commercial spyware. And citizens should be asking, are my tax dollars or pension savings funding this?
Meredith Veit
Technology and human rights researcher, Business and Human Rights Centre