The European Commission has set out new measures to stop European companies exporting surveillance gear to despotic regimes. The proposal would also partially relax the rules on exporting cryptography tools.

The proposal to overhaul the EU’s export controls on dual-use products—powerful technologies such as crypto software or rocket engines that can be used for good or evil—was presented on Wednesday (PDF) and includes a new human rights dimension.

“It’s not a revolution. It’s an evolution of our current structure,” a commission source told Ars. “The foundation that is already there, is fairly solid, but this new proposal is more efficient, and will reduce the cost of the control, both for authorities at national level and also for the industries that have to apply for licenses.”

“This new human security dimension comes from a conviction that our export controls should also enable us to prevent the misuse of items that are used to violate human rights. The types of technologies we are talking about, surveillance, etc., do not fit clearly within the current military regulation,” the source continued.

The EU’s “strategic export controls regime” has initially enacted in the early 2000s to dampen the proliferation of weapons of mass destruction. The current 2009 regulation sets out basic principles and common rules for the control of the export, brokering, transit, and transfer of items that have both military and civilian use such as nuclear reactors, cryogenic refrigeration units, explosives, surveillance systems and equipment, and chemicals that can be used as precursors for toxic chemical agents. Earlier this year the US announced it too, would update its regime.

Alongside tougher controls on surveillance tech, the proposal would partially relax rules on encryption tools. It also envisions a “general export licence” for companies rather than individual licences for every order, provided they carry out appropriate auditing and reporting.

Sanctions for breaking the rules are at the discretion of member states, but must be “effective and persuasive.” Last year, Italian spyware company Hacking Team had its licence revoked after it emerged it had sold products to Bahrain, Morocco, and Uzbekistan, where they were allegedly used to spy on journalists and human rights activists.

Dutch MEP Marietje Schaake welcomed the plan to include systems designed to exfiltrate information from people’s mobile phones and computers: “In the past, we have too often seen how intrusive exfiltration technologies were exported to countries with a proven track record of human rights violations. National export control authorities must do serious assessments and not rubber stamp applications for a licence.”

“The fast-paced changes in technology require modernised policies. However, we need to make sure that we do not target any activities that are done for legitimate research purposes or that enable activists and journalists to defend themselves against cyber-attacks. While the Commission had made positive efforts to further facilitate the export of encryption items, we can do more. It is time to ask ourselves whether products that contain cryptography still have a legitimate place on the export control list. For me, the answer is a resounding no,” she said.

“We don’t want to contribute in any way to helping dictators control and harass their own people. Information and communication technology, as well as surveillance software must be brought under controls. We know that in the past software has been used to tap phone conversations, to monitor the activities and communications of human-rights activists and trace their locations. We don’t want European products and services to contribute to this in any way," added British Labour MEP David Martin.

The draft proposal must be approved by the European Parliament and national ministers before it can enter into law.