62023TJ0201_RES
Case T‑201/23
Communications Regulatory Authority (CRA)
v
Council of the European Union
Judgment of the General Court (Sixth Chamber) of 16 October 2024
(Common foreign and security policy – Restrictive measures taken in view of the situation in Iran – Freezing of funds – List of persons, entities and bodies subject to the freezing of funds and economic resources – Inclusion of the applicant s name on the list – Obligation to state reasons – Rights of the defence – Right to effective judicial protection – Proportionality – Misuse of powers)
Acts of the institutions – Statement of reasons – Obligation – Scope – Restrictive measures against Iran – Freezing of funds of certain persons and entities in view of the situation in Iran – Obligation to identify in the statement of reasons the specific and concrete elements justifying the said measure – Decision falling within a context known to the person concerned, enabling him or her to understand the scope of the measure taken against him or her – Whether summary statement of reasons sufficient
(Art. 296 TFEU; Council Regulations No 359/2011 and 2023/152)
(see paragraphs 25-28, 30-34)
EU law – Principles – Rights of the defence – Restrictive measures against Iran – Freezing of funds of persons responsible for serious human rights violations and of persons, entities or bodies associated with them – Right of access to documents – Right subject to request for access being made to the Council
(Council Regulations No 359/2011 and 2023/152)
(see paragraph 38)
European Union – Judicial review of the legality of the acts of the institutions – Restrictive measures against Iran – Scope of the review – Proof that the measure is well founded – Obligation on the competent EU authority to establish, in the event of challenge, that the reasons relied on against the persons or entities concerned are well founded – Evidence referring to documents not added to the case file – Infringement of the rights of the defence – None
(Charter of Fundamental Rights of the European Union, Art. 47; Council Regulations No 359/2011 and 2023/152)
(see paragraphs 55, 61-64)
EU law – Principles – Fundamental rights – Presumption of innocence – Freezing of funds of certain persons and entities in view of the situation in Iran – Compatibility with that principle – Conditions
(Charter of Fundamental Rights of the European Union, Art. 48(1); Council Regulations No 359/2011 and 2023/152)
(see paragraphs 66-69)
European Union – Judicial review of the legality of the acts of the institutions – Restrictive measures against Iran – Scope of the review – Inclusion of the applicant on the list annexed to the contested regulation on account of facilitating acts amounting to serious human rights violations – Documents available to the public – Probative value
(Council Regulations No 359/2011 and 2023/152)
(see paragraphs 75-79, 86, 88-90)
Common foreign and security policy – Restrictive measures against Iran – Freezing of funds of persons responsible for serious human rights violations and of persons, entities or bodies associated with them – Judicial review of legality – Scope – Assessment of the facts and verification of the evidence – Error of assessment by the Council as to the adoption of restrictive measures – None
(Council Regulations No 359/2011 and 2023/152)
(see paragraphs 92, 93, 98, 107, 109-112, 117)
Common foreign and security policy – Restrictive measures against Iran – Freezing of funds of persons responsible for serious human rights violations and of persons, entities or bodies associated with them – Judicial review of legality – Appropriateness of the restrictive measures – Restrictive measures pursuing a legitimate aim of the common foreign and security policy
(Council Regulations No 359/2011 and 2023/152)
(see paragraphs 127-130)
Résumé
By its judgment, the General Court dismisses the action for annulment brought by the Communications Regulatory Authority (CRA) against Regulation 2023/152 (
1
) by which that institution was included in 2023 by the Council of the European Union on the list of persons and entities subject to restrictive measures in view of the situation in Iran. The Court finds that the Council did not make an error of assessment in the light of the evidence provided, as regards the applicant’s use of spyware against the Iranian population.
The applicant is a governmental institution affiliated with the Iranian Ministry of Communications and Information Technology. It has had its funds frozen because it is considered responsible for serious human rights violations in Iran for having enforced the Iranian government’s requirements to filter internet content through a spyware called SIAM and, during the 2022 protests which followed the death of Mahsa Amini, used its control of internet access and mobile phones to track protesters and their activities. According to the Council, the applicant thus supported those authorities’ repression of protesters who spoke up in defence of their legitimate rights.
Findings of the Court
In the first place, the Court rejects the applicant’s complaints alleging infringement of Articles 47 and 48 of the Charter of Fundamental Rights of the European Union. The Court recalls in that regard that, in the event of challenge, it is the task of the competent European Union authority to establish that the reasons relied on against the person or entity concerned are well founded. However, it does not follow that the alleged inability of the Council to produce evidence to show that the reasons relied on to justify the applicant’s listing in Annex I to Regulation No 359/2011, (
2
) if it were established, would undermine the applicant’s rights of defence. It is quite the contrary since safeguarding the effectiveness of Article 47 of the Charter of Fundamental Rights requires that the Courts of the European Union be obliged to verify, in the context of reviewing the legality of restrictive measures, the merits of the reasons underlying those measures and, therefore, the evidential value of the documents produced by the Council.
In the second place, the Court recalls that press articles may be used in order to corroborate the existence of certain facts where they come from several different sources and they are sufficiently specific, precise and consistent as regards the facts there described.
In the present case, the Council based the adoption of the restrictive measures at issue against the applicant on various documents of that nature. As regards an article published on the website of The Intercept, (
3
) the Court considers that that article supports the Council’s claims by providing access to the English-language SIAM software user manual and to a second manual written in Farsi which bore the applicant’s logo. Those allegations are supported by other evidence. Thus, an article from the website Commsrisk (
4
) reports on its meeting with the representative of a technology company which tried to sell to Iran software with ‘disturbingly similar’ functions to those of the SIAM software and who had volunteered information about that sale to the author of that article.
Last, it is apparent from an article of the ARTICLE 19 organisation (
5
) that it has monitored the extent of internet controls in Iran for several years. That association discovered, inter alia, that the applicant, operating under the control of the Ministry of Communications and Information Technology, which is in actual fact controlled by Iran’s intelligence services, enforced the use of surveillance and censorship equipment at internet service provider level and ordered shutdowns and other disruptions of internet access acting on behalf of the Iranian Supreme National Security Council.
Accordingly, given the consistency of the various items of evidence and the circumstances in which they came into being, the Court considers that those allegations could legitimately be taken into account.
In the third place, the Court considers that the Council has produced before it a body of sufficiently specific, precise and consistent evidence to establish that there is a sufficient link between the applicant and the situation being combated in the present case, namely the repression by the Iranian authorities of peaceful demonstrators, journalists, human rights defenders, students and others speaking up in defence of their legitimate rights.
First, the Court rejects the applicant’s argument that it does not have the legal capacity to perform the acts alleged against it. The Court finds that, while the interception of communications is in principle prohibited under Iranian law, it remains possible as a matter of law in certain situations which are defined very broadly.
Second, the Court rejects the applicant’s argument based on its technical inability to monitor or control the users of Iranian mobile networks. It finds that the SIAM software commands are addressed to all Iranian mobile operators and that those operators are required to respond to them at any time.
Moreover, first of all, contrary to what the applicant claims, the use of those commands produces the effect described by the Council and does not serve a legitimate objective. Thus, the ‘LocationCustomerList’ command allows all users of a mobile network in a particular geographic area – albeit an approximate one – to be identified. Next, the ‘Force2GNumber’ command, the purpose of which is to force a mobile telephone to use the 2G network instead of the newer 3G and 4G networks has the effect of making it impossible to view or share videos using that telephone. The Court also notes that the applicant does not provide any evidence to show that the ‘GetCDR’ and ‘GetIPDR’ commands, which serve, in the case of the former, to consult a telephone’s call history and, in the case of the latter, to obtain the IP address of the devices in which a particular SIM card has been activated, can be used only to respond to legitimate requests made by Iranian courts and police authorities.
Last, the Court points out that the situation in Iran is marked by regular challenges to the regime by the civilian population, challenges which are systematically repressed by the Iranian authorities using, inter alia, internet surveillance methods. In those circumstances, it cannot be ruled out that commands originally designed for ‘legal’ purposes – such as ‘ApplySusp’ and ‘ApplySusplp’, which allow SIM cards reported lost or stolen by users, or belonging to persons who have been declared dead, to be disabled – may be misused and used by the Iranian authorities for law enforcement purposes.
(
1
)	Council Implementing Regulation (EU) 2023/152 of 23 January 2023 implementing Regulation (EU) No 359/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Iran (OJ 2023 L 20 I, p. 1).
(
2
)	Council Regulation (EU) No 359/2011 of 12 April 2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Iran (OJ 2011 L 100, p. 1).
(
3
)	Article entitled ‘Hacked documents: How Iran can track and control protesters’ phones’, published on 28 October 2022.
(
4
)	Article entitled ‘Hacker Leaks Manuals Showing How Iran Uses Mobile Networks to Track Protesters’, published on 31 October 2022.
(
5
)	Article entitled ‘Iran: New tactics for digital repression as protests continue’, published on 17 November 2022.