Ireland to legalize spyware and expand state surveillance powers

The Irish government has approved the drafting of a sweeping new surveillance law, the Communications Bill, which expands the State’s capabilities to lawfully intercept all forms of digital communication, including encrypted messaging, IoT data, and emails, and sets the legal ground for the deployment of spyware.

Led by Minister for Justice, Home Affairs and Migration Jim O’Callaghan, the proposal introduces a legal basis for covert surveillance software and mobile device scanning, citing the need to respond to modern criminal threats.

According to an announcement by the Department of Justice, the updated framework aims to align interception powers with technological realities and security threats of the 21st century, replacing the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993, which was designed for landlines and postal communications.

Work on the General Scheme of the Bill will now begin in cooperation with the Attorney General’s Office, relevant departments, and state agencies. Public consultation is also planned during its drafting.

The proposed bill introduces several new capabilities and regulatory principles:

• A general legal principle that interception powers apply to all forms of communications, including content and metadata, regardless of encryption status. This includes data from emails, messaging apps, smart devices, and parcel services.
• Legalization of covert surveillance software, spyware deployed on targeted devices to access data, record communications, or disrupt networks, as an alternative to traditional interception techniques.
• Use of mobile device scanning tools that can identify IMSI and IMEI data in specific areas to assist in identifying suspects and associates in criminal investigations.
• Judicial authorization will be added as a safeguard, replacing the current system where interception requests are authorized solely by the Minister. Judges will also review requests involving potentially privileged material.

A key point of controversy in similar laws across Europe and beyond has been the deployment of spyware. The Minister referenced the 2024 Venice Commission report titled “Report on a Rule of Law and Human Rights Compliant Regulation of Spyware”, indicating that privacy, digital security, and legal proportionality will be central considerations in Ireland’s implementation of this technology. While specifics are still being worked out, O’Callaghan emphasized that the bill will strike a balance between effective intelligence gathering and privacy protections, stressing that all interception must be “necessary and proportionate” and subject to independent oversight.

Meanwhile, civil society is already reacting to legislative trends like Ireland’s. Earlier today, European Digital Rights (EDRi) launched a dedicated document pool to track spyware abuse and support calls for a full EU-wide ban. The initiative comes amid mounting concern over the normalization of commercial spyware across at least 14 EU member states, often used against journalists, activists, and political opponents.