Outsourcing surveillance: The technological side of border externalisation

In recent decades, the governance of international migration has increasingly moved beyond the direct control of individual nation-states, giving rise to a global trend of externalisation.

Border externalisation involves the outsourcing of migration management to third countries and private actors. Through bilateral agreements, informal partnerships and multilateral frameworks, countries, particularly in the Global North, seek to control and deter migration by extending their influence into the territories and institutions of partner countries, often in the Global South. In particular, this has become a core tenet of the strategy that the European Union has adopted to deal with migration flows, especially those coming from the African continent and through the Mediterranean or the Balkan Route.

One of the latest iterations of this strategy includes the export of surveillance technologies and border control infrastructure. These tools – ranging from biometric databases and drone systems to border monitoring software – are used not only to track and intercept migrants but also to expand control within partner states. The provision of technology is frequently accompanied by training programs, financial aid and capacity-building initiatives, effectively transforming non-EU countries into enforcers of the European Union’s migration policies.

According to global human rights organisation Privacy International, the creation of biometric identity systems[i] (including providing equipment, training officials in their use, and influencing laws in beneficiary countries) can also be used to share people’s data and assist in deportations.

It is important to remember that these policies are also implemented with the support of technology and security companies. The heavy involvement of the private sector represents another big concern: companies are sometimes in charge of the deployment of the technology in these countries, effectively contributing to authoritarian practices of human rights violations. Their private nature and the lack of strong safeguards and oversight help both them and EU institutions to deflect accountability.

These outsourcing and technological exports raise significant questions about sovereignty, accountability, human rights and the reshaping of global migration governance. This strategy is de facto shifting responsibility away from the European Union into third countries to avoid legal, political and moral obligations.

The infrastructure of deterrence and the impact on people

The rhetoric of security and fighting against smuggling is often being used to justify investments in surveillance infrastructure that have broader implications. Alternatively, these policies might be enacted in the name of cooperation and development.

In practice, they contribute to a broader infrastructure of deterrence that distances states from direct responsibility while reinforcing unequal geopolitical power dynamics. The deployment of these tools threatens the right to asylum, the right to leave one’s country, the principle of non-refoulement and the rights to privacy and liberty, as well as their freedom of movement and access to safe and legal pathways for migration.[ii]

While earmarked for migration control and border management, or sometimes even as development aid, these funds are also contributing to building government authorities’ capacity (especially that of law enforcement) by outsourcing surveillance tools, techniques and training to non-EU countries. The tech tools have reportedly been used to quash popular movements and spy on journalists and human rights defenders,[iii] and are actively contributing to the instability of the origin and transit countries.

In February 2024, Al-Jazeera reported[iv] that the Senegalese government had deployed a special security unit to violently suppress protests. The unit was meant to be based in Senegal’s border areas with Mali to fight cross-border crime. The unit had been created, equipped and trained thanks to a 74 million euros Sahel-focused project from the EU’s Emergency Trust Fund for Africa (EUTF for Africa.)

In May 2024, a group of international media reported[v] that in Morocco, Mauritania and Tunisia, Black people from Sub-Saharan countries were rounded up and expelled in the desert to prevent them from migrating towards Europe (kidnapping also included people who had legal status and lived in those countries.) The journalists proved that the EU was directly funding the Moroccan paramilitary auxiliary forces and were able “to match vehicles used during the round-up and expulsions to vehicles provided by European countries by identifying tenders and carrying out visual analyses.”[vi]

The logic of conditionality: people on the move are used as “pawns” in political and financial negotiations

In recent years, the use of development budgets for border control-related projects has marked the approach of the European Union to cooperation with African countries and enlargement with the Balkan countries.

The EU is proactively seeking agreements with non-EU countries either to stop people from arriving at the EU’s border or to take back their nationals, recently even moving to send rejected asylum seekers to countries they have no connection with. The securitarian logic brings focus to border externalisation. For many states, especially in the MENA and in the Sahel region, EU support for migration control becomes a major part of security cooperation, at the expense of other priorities.

Western Balkan countries seeking EU membership are expected to align their migration and asylum policies to EU norms. Cooperation on migration management is built into pre‑accession instruments and failure to cooperate can complicate the accession process. Researchers in this space have raised concerns about this strategy: “The EU’s externalisation of migration and border management to the Western Balkans stands in sharp contrast with its long-standing goal of a stabilisation of the region pursued in the framework of the EU’s enlargement process.”[vii]

In turn, migration is used by governments in third countries to instrumentalise EU Member States’ foreign policies. As explained by EuroMed Rights: “This ‘blackmailing’ approach to bilateral and multilateral cooperation on migration results from externalisation policies and the conditionality approach implemented by the EU and Member States.”[viii]

This logic of conditionality is shaped through bilateral budget agreements structured around the external dimension of migration. Some of the funding comes from the EU Emergency Trust Fund (EUTF) launched in 2015 with resources amounting to 5 billion euros,[ix] and from a variety of funding instruments that today form part of the Neighbourhood, Development and International Cooperation Instrument (NDICI-Global Europe) that started in 2021.[x] The total allocation for NDICI – Global Europe is EUR 79.5 billion.

Additionally, Frontex, the European Border and Coast Guard Agency, has seen its budget skyrocketing from EUR 142 million in 2015 to a whopping 922 million euros in 2024. The budget is set to go over a billion in 2026. In 2022, the agency announced the expansion of its footprint in third countries, including by opening risk analysis cells, tasked to collect and analyse data on cross-border crime and support authorities involved in border management, and that it will be involved in deportation flights.

People on the move are used as “tools” of political pressure, with origin and transit countries negotiating economic and geopolitical benefits with EU and Member States without concerns about the consequences for people, from fundamental rights violations to loss of life.

The lack of Human Rights Impact Assessment and Data Protection Impact Assessments

Human rights organisations have expressed concerns over how these EU-funded projects are implemented. In particular, they have focused on the lack of Human Rights Impact Assessments (HRIA) or Data Protection Impact Assessments (DPIA), or on some of those assessments being conducted as compliance checkbox rather than decision tools.

A Human Rights Impact Assessment (HRIA) is a tool used to identify, evaluate, and address the potential human rights impacts of a policy, project, or initiative. HRIAs follow a human rights-based approach, which integrates human rights principles into the assessment process. This includes both actual impacts occurring in the present and potential impacts that could occur in the future. The process typically includes stakeholder consultations, risk analysis and recommendations to mitigate harm. HRIAs are not required, but rather highly recommended.

A Data Protection Impact Assessment (DPIA) is a legal requirement under the EU’s General Data Protection Regulation (GDPR) for projects that are likely to pose high risks to individuals’ personal data. It evaluates how personal data is collected, processed, stored and shared, and assesses risks to data subjects’ privacy and rights.

DPIAs are crucial when implementing the use of technologies involving sensitive information. According to article 35 of the GDPR, a DPIA is required in the case of:

• a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
• a large scale processing of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or
• a large scale systematic monitoring of a publicly accessible area.

In 2021, five human rights organisation filed a complaint[xi] against the European Commission outlining how EU bodies and agencies were cooperating with governments in the transfer of surveillance technologies and that in most of these cases no human rights risk and impact assessments seemed to have been carried out prior to the engagement with authorities of third countries.

In December 2022, the European Ombudsman found[xii] that the European Commission had not taken the necessary measures to ensure “a coherent and structured approach to assessing the human rights impacts” in the transfers of technology with potential surveillance capacity to non-EU countries supported by the EU Trust Fund for Africa (EUTF for Africa.)

From the MENA region to the Western Balkans, externalisation of tech builds security capacity

According to human rights organisation Privacy International, the EU institutional support through funding, including development aid, to third countries comes in five main forms: “direct equipping of foreign intelligence and security forces; training of foreign intelligence and security forces; financing of their operations and procurement; facilitating exports of surveillance equipment by industry, and promoting legislation which enables surveillance.”[xiii]

In 2017, more than EUR 42 million was allocated from the EUTF for Africa for a border control project called “Support to Integrated border and migration management in Libya”.[xiv] The project included the provision of patrol boats, radio-satellite communication devices and other equipment to authorities in Libya. The programme was led by the Italian government and included the training and equipping of Libyan authorities in ways that raise human rights concerns around, for instance, the misuse of data and possible privacy infringements. In 2022, media reports[xv] pointed to Italy’s commitment to spend almost one billion euro to equip Libya’s maritime forces to discourage departures in yet another attempt to push Europe’s border further south.

EUTF funding has also been used to provide IMSI catchers to Niger's security authorities,[xvi] with a specific project involving the procurement of these devices for security agencies in the region. IMSI catchers are extremely intrusive surveillance devices: they masquerade as cellphone towers and trick phones in their vicinity into connecting to it: this allows them to locate and track mobile phones that are switched on in a certain area, and are often used to track protesters.[xvii]

Additionally, in Algeria, CEPOL, the EU law enforcement training agency, facilitated training in open-source intelligence gathering[xviii] to the National Gendarmerie, a rural police force. Their analysis of documents[xix] mentions the use of specialised surveillance tools available to law enforcement agencies, including software used to track the location of devices.

Since 2021, the EU has supported the Western Balkans with more than €350 million to improve migration management in the region”.[xx] Part of that includes support for border management: training for border officials, equipment like surveillance systems, strengthening return management systems, fighting smuggling, judicial cooperation. The European Commission’s page for the Eastern Neighbourhood states: “This package covers €47 million of support to further strengthen the migration governance and fight against organised crime and a €13 million programme to operationalise effective return management systems in the Western Balkans, in line with EU standards.”

The Instrument for Pre-accession Assistance (IPA) is a financial instrument used to provide technical assistance to countries which are potential future members and provides them with technical assistance, amounting[xxi] to €12.8 billion for the period 2014-2020. This funding supported the upgrade of the Bosnia and Herzegovina’s (BiH) Migration Information System “to more effectively counter future trends and challenges of irregular migration, which would result in a more efficient contribution to the security system of BiH”,[xxii] as well as training courses provided to law enforcement agencies across Bosnia, aimed at “dealing with electronic devices and devices for recognition which may contain evidence of crime; search of computers and other electronic equipment; analysis of digital evidence and its presentation; use of the Internet as a tool in investigation; interception of electronic messages”.[xxiii]

The Border Violence Monitoring Network reports that in December 2024, “Bosnia’s EU Special Representative, Luigi Soreca, delivered an EU donation of €1.1 million worth of surveillance and border infrastructure equipment to the BiH Border Police. [...] The same securitizing view of migration is being pedalled in Bosnia-Herzegovina by the UK. On the same day that Soreca handed over the EU’s million-euro donation, Julian Reilly, the British Ambassador to Bosnia-Herzegovina, donated a DJI Matrice 350 RTK drone to the BiH Border Police on behalf of the UK’s National Crime Agency. Such advanced aerial surveillance technology is used to detect, intercept and control people at Europe’s borders.”[xxiv]