A/HRC/39/29 sufficiently targeted.45 The law must strictly assign the competences to conduct surveillance and access the product of surveillance to specified authorities. 36. In terms of its scope, the legal framework for surveillance should cover State requests to business enterprises. It should also cover access to information held extraterritorially or information-sharing with other States. A structure to ensure accountability and transparency within governmental organizations carrying out surveillance needs to be clearly established in the law. 37. Powers of secret surveillance can only be justified as far as they are strictly necessary for achieving a legitimate aim and meet the proportionality requirement (see A/HRC/23/40, para. 83 (b)).46 Secret surveillance measures must be limited to preventing or investigating the most serious crimes or threats. The duration of the surveillance should be limited to the strict minimum necessary for achieving the specified goal. There must be rigorous rules for using and storing the data obtained and the circumstances in which the data collected and stored must be erased need to be clearly defined, based on strict necessity and proportionality. 47 Intelligence-sharing must be subject to the same principles of legality, strict necessity and proportionality. 38. Where Governments consider targeted hacking measures, they should take an extremely cautious approach, resorting to such measures only in exceptional circumstances for the investigation or prevention of the most serious crimes or threats and with the involvement of the judiciary (see CCPR/C/ITA/CO/6, para. 37). 48 Hacking operations should be narrowly designed, limiting access to information to specific targets and types of information. States should refrain from compelling private entities to assist in hacking operations, thereby impacting the security of their own products and services. Compelled decryption may only be permissible on a targeted, case-by-case basis and subject to judicial warrant and the protection of due process rights (see A/HRC/29/32, para. 60). Independent authorization and oversight49 39. Surveillance measures, including communications data requests to business enterprises and intelligence-sharing, should be authorized, reviewed and supervised by independent bodies at all stages, including when they are first ordered, while they are being carried out and after they have been terminated (see CCPR/C/FRA/CO/5, para. 5). 50 The independent body authorizing particular surveillance measures, preferably a judicial authority, needs to make sure that there is clear evidence of a sufficient threat and that the surveillance proposed is targeted, strictly necessary and proportionate and authorize (or reject) ex ante the surveillance measures. 40. Oversight frameworks may integrate a combination of administrative, judicial and/or parliamentary oversight.51 Oversight bodies should be independent of the authorities carrying out the surveillance and equipped with appropriate and adequate expertise, competencies and resources. Authorization and oversight should be institutionally separated. Independent oversight bodies should proactively investigate and monitor the activities of those who conduct surveillance and have access to the products of surveillance, and carry out periodic reviews of surveillance capabilities and technological developments. The agencies carrying out surveillance should be required to provide all the information necessary for effective oversight upon request and regularly report to the oversight bodies, 45 46 47 48 49 50 51 Ibid., paras. 248 and 260. See also Szabo and Vissy v. Hungary, para. 73. See Roman Zakharov v. Russia, para. 231. See also Access Now, “A human rights response to government hacking” (September 2016) and Privacy International, “Government hacking and surveillance: 10 necessary safeguards”. See A/HRC/34/60 and European Agency for Fundamental Rights, Surveillance by Intelligence Services: Fundamental Rights Safeguards and Remedies in the EU. Volume II: Field Perspectives and Legal Update, (Luxembourg, Publications Office of the European Union, 2017). See also Roman Zakharov v. Russia, para. 233. See General Assembly resolution 71/199, para. 5 (d). 11