On November 21, President Ilham Aliyev signed a decree establishing a new centralized digital platform that dramatically expends state surveillance powers. The system, known as the Centralized Information and Digital Analytics System (MİRAS), will be controlled by the State Security Service and fully operational by May 2026.
MİRAS is designed to consolidate public data from multiple state bodies— including the Special State Service for communications and information security, and the Interior Ministry—centralize its processing and storage, and provide security services with potentially unfettered access to this information. An explanatory document describing the system’s scope was briefly posted online and then removed, raising concerns about transparency and the breadth of data to be captured.
This new regulation authorizes MİRAS to collect and analyze a wide range of personal data, including identity documents, migration history, family information, health records, property and financial data, criminal and administrative records, and certain communications metadata. It allows the State Security Service to integrate these data sources and generate forecasts, risk assessments, and analytical reports.
Azerbaijan is a highly authoritarian state with a well-documented history of unlawful digital surveillance of journalists, human rights defenders, and activists. Past investigations have shown authorities’ use of internet traffic monitoring tools and spyware to monitor and intimidate critics. Against this backdrop, a centralized system that consolidates sensitive personal data across sectors and institutions—without strong, independent oversight—poses serious risks of arbitrary or disproportionate surveillance.
As a member of the Council of Europe, Azerbaijan is bound by the European Convention on Human Rights, including Article 8 on the right to privacy. The European Court of Human Rights has repeatedly held that surveillance measures must meet strict standards of legality, necessity, and proportionality, and include independent oversight, transparent rules, and effective remedies.
The MİRAS regulation lacks these safeguards. It does not specify when or how personal data may be accessed, requires no judicial or independent authorization, and provides no retention limits, minimization standards, or external audit mechanisms. It centralizes control entirely within the State Security Service and includes no public reporting or procedures for individuals to access or correct their data.
Azerbaijan should suspend implementation of MİRAS and adopt robust privacy protections. International partners, including the Council of Europe, should press the authorities to ensure that supposed digital governance reforms do not entrench unchecked surveillance powers.
