WIREDGOV

Read techUK's Export Guidance to prevent abuses and avoid resulting reputational damage.

Hacking Team, a specialist surveillance tech and spyware supplier headquartered in Italy, has found itself victim to its own hack. 400gb of documents and email exchanges publicised by hackers confirmed that it has conducted export deals with governments who have controversial human rights records.

The hack revealed that the company's offering has been pushed out to governments across the world, enabling them to infect computers and mobile phones with covert spyware to harvest data and record correspondence. Customers have included the likes of Russia, Sudan, Bahrain and Egypt. The documents also evidence talks with Syria prior to unrest against Bashar Al-Assad in 2011 in addition to a policy of leaving legal considerations to the discretion of the government client.

The story has received extensive media attention both within the technology and national press. It has not yet been established what the repercussions will be for Hacking Team but one only has to look to the similar case of Gamma International and its export of the FinFisher spyware product. Following a similar media furore, Privacy International filed complaints against the company with various national authorities in the UK for the abuses committed by the Bahraini regime it helped facilitate.

It is vital that companies implement human rights due diligence upon their customers when biding for contracts, even for products that do not fall under dual-use nor export controls. techUK believes that respecting human rights is not only an end in itself but is in line with greater expectations on companies to answer to their boards, shareholders, investors, and consumers and the media as to how they are assessing and monitoring associated risks. In response to the Hacking Team developments, techUK and CGI's Andrew Rogoyski told SC Magazine: "A supply chain assessment should be made every time you put a contract out to a third party and take a view of the risk involved, and the level of protection they have in place."

This can prove a difficult undertaking for companies, in particular for SME's who may not have the resources to implement due diligence. With this in mind and at the request of the Cyber Growth Parnership (CGP), techUK, in association with the Foreign and Commonwealth Office and the Institute for Human Rights and Business published guidance for the cyber security sector advising on human rights risks involved in the export of their products and services.

'Assessing Cyber Security Export Risks' is the first tech sector guidance of its kind. It provides cyber security companies of all sizes with actionable advice to help identify and manage the risks of exporting their products and services. It gives detailed background information and a framework to help companies develop their due diligence processes, manage human rights risks and identify national security risks. This reduces the likelihood of a buyer being able to use your technology to help perpetrate human rights abuses. It also reduces the likelihood of reputational damage to British companies.

The guidance outlines a risk assessment process that helps companies to:

• Look at the capabilities of the product or service they want to export and how it could be used by purchasers
• Examine the places where they are exporting to including their political and legal frameworks, the state's respect for human rights and potentially vulnerable people
• Assess who the end purchaser of the product is and how they intend to use it
• Evaluate potential business partners and re-sellers
• It also provides advice on how to mitigate and build risk management clauses into the contract

The Cyber Growth Partnership is a forum made up of members from government, industry and academia that works to help UK cyber security companies increase their access to overseas and domestic markets and to increase the talent pool available to them in the UK. It is co-chaired by the CEO of BT, Gavin Patterson, and the Minister of State for the Digital Industries, Ed Vaizey MP.

You can download the guidance via the link above.