A United Nations expert on freedom of expression this week has brought international attention to the need for individuals to be able to share completely encrypted, anonymous communications on the internet in order to preserve rights related to freedom of expression and opinion worldwide.
“I must emphasise my concern at the deep and broad threats to freedom of opinion and expression around the world,” David Kaye (US), special rapporteur on the protection and promotion of the right to freedom of opinion and expression, said in his statement to the Human Rights Council, meeting this week in Geneva.
The 29th session of the Human Rights Council is addressing Kaye’s report, A/HRC/29/32 (choose language, E for English) dated 22 May, which was circulated ahead of the meeting. The discussion is scheduled to continue today, 18 June, and can be followed here.
Kaye, who is a law professor at the University of California, Irvine, listed his activities since taking the post in August 2014, including the identification of goals for the mandate and building capacity to achieve them, and meeting with numerous organisations.
He also issued numerous requests for invitations for country visits and received positive responses from Turkey, Tajikistan, Jordan, Rwanda and Kenya. He has not yet made a visit but expects to in the coming months.
Kaye also has “sent or joined 164 allegation letters, urgent appeals or other communications” to governments, and has issued or joined 33 press releases on “matters of urgent concern.”
He said his next report will be on protection of sources and whistleblowers.
He had some strong reactions after his initial months in the role. “Throughout this initial period of my mandate, communications have highlighted some of the greatest threats to freedom of opinion and expression lie,” Kaye said in his statement. “These threats include attacks on free and independent media, including journalists and bloggers; attacks on political dissent and unpopular opinion; repression of civil society; attacks on the expression of members of vulnerable groups, especially religious and ethnic minorities and persons who identify as lesbian, gay, bisexual or transgender (or LGBT); and widespread undermining of the right to seek, receive, and impart information online, regardless of frontiers. I expect to intensify my attention to these attacks in communications, public statements, and thematic work.”
Regarding his report, he made three main points in remarks to the Council. He said encryption and online anonymity are critical because “we live in a world in which mass and targeted surveillance, digital attacks on individuals and civil society, harassment of members of vulnerable groups, and a wide variety of digital opinion and expression result in serious repercussions, including detention, physical attacks, and even killings. We also live in a world of massive blocking, throttling, and filtering of the internet, denying individuals the right to access information” going against the UN human rights agreement.
“[S]o much of our expression today is in digital space,” he said, “these security tools must be seen as being at the heart of opinion and expression in a digital age.”
His second point was that he has learned how critical these tools are for those who need them, like journalists, activists, artists, and academics, and many people will over time come to understand their importance. Governments should be doing all they can to promote individual digital security, he said.
Third, he highlighted government concerns that they must not be put at a disadvantage in fighting terrorism or other security threats. But Kaye said the concerns of those who need protection come first.
“[L]aws, practices and policies that ban, restrict, or otherwise undermine encryption and anonymity – all in the name of public order or counter-terrorism – do significant, and I would say disproportionate, damage to the rights at the heart of my mandate.”
He argued that we are in “an age of vast, previously unimaginable powers of surveillance, data and metadata collection, geolocation, and other tools that have expanded the capacities of governmental security apparatuses everywhere.” In light of that reality, he said, “the necessity and proportionality of restrictions on encryption and anonymity must be considered.”
In his 22-page report, Kaye gives a description of encryption and anonymity with an academic’s reasoned style. He defines different types of encryption, and then explains in detail why it is not technically possible for governments to have special access to communications and keep others from finding a way to access the communications as well.
“It is a seemingly universal position among technologists,” he wrote, “that there is no special access that can be made available only to government authorities, even ones that, in principle, have the public interest in mind.”
He explains in the report that encryption protects the content of communications but not the identifying factors such as the internet protocol, the distinct address of each computer. He described the problem that people online under pseudonyms or otherwise believing themselves to be anonymous in fact are not, and may endanger themselves by expressing themselves too freely.
“[I]n the absence of combinations of encryption and anonymizing tools, the digital traces that users leave behind render their identities easily discoverable,” Hayes said.
Overall, Hayes said, “Within a brief period, [the internet] has become the central global public forum. As such, an open and secure Internet should be counted among the leading prerequisites for the enjoyment of the freedom of expression today. But it is constantly under threat, a space — not unlike the physical world — in which criminal enterprise, targeted repression and mass data collection also exist.”
“Encryption and anonymity, separately or together, create a zone of privacy to protect opinion and belief,” he said, which is essential in hostile environments.
Hayes walks through how UN rules and conventions protect rights that encryption and anonymity help sustain. He also explores the importance of the right to hold opinions without interference, noting, “today, holding opinions in digital space is under attack.”
He further discusses “the freedom to seek, receive, and impart information and ideas.” This includes the fact that “human rights law also protects the right to seek, receive and impart scientific information and ideas.”
There is also a short discussion of the role of corporations, and separately, there is a lengthy analysis of the legal framework supporting encryption and anonymity, among other things as enablers of freedom of expression.
‘Worrying Trend Lines’
Importantly, Hayes raises the red flag around state practices toward online communication. “The trend lines regarding security and privacy online are deeply worrying,” he said. “States often fail to provide public justification to support restrictions. Encrypted and anonymous communications may frustrate law enforcement and counter-terrorism officials, and they complicate surveillance, but State authorities have not generally identified situations — even in general terms, given the potential need for confidentiality — where a restriction has been necessary to achieve a legitimate goal.”
He also raised concern about the security of communications at the United Nations. “It also bears noting that the United Nations itself has not provided strong communication security tools to its staff or to those who would visit United Nations websites, making it difficult for those under threat to securely reach the United Nations, human rights mechanisms online.”
Hayes gave some specific examples of government treatment of encryption and anonymity, for instance praising Brazil for passing the Marco Civil in 2014 that “guarantees the inviolability and secrecy of user communications online, permitting exceptions only by court order.” He also mentioned Austria, Greece, Germany, Ireland and Norway, among others as having some laws on this.
Meanwhile, other countries have taken contrary steps, even banning or putting conditions on individual encryption, such as in India, Pakistan, Cuba, Ethiopia, and possibly China.
The report identifies several encryption and anonymity technologies, such as the Tor browser, but notes that the principles go beyond any particular technology of today. It concludes with a set of recommendations on all of the issues raised.
Governments Welcoming, yet Disgruntled
Human Rights Council member governments were given the opportunity to respond and ask questions of Kaye, and countries of all levels of development predictably spoke on their need to spy on citizens and non-citizens in order to preserve order and security.
Many, especially nations ascribing to democracy, also strongly emphasised the need for online protection for human rights defenders and journalists, who are at most risk. They raised strong concern that personal data is divulged as a way to identify such people. Questions were raised as to how technology can protect them, but at the same time not take away governments’ ability to track bad actors intent on doing harm. This includes not only cyber-criminals but also activities like cyber-bullying.
Several countries criticised the fact that the report does not speak out against mass surveillance, which has been revealed in recent years to be taking place in the United States and elsewhere.
Some countries suggested that the report went beyond its mandate, with Saudi Arabia even calling it “unacceptable meddling.” Concerns were particularly targeted at the notion of disproportionality of governments and corporations versus individuals.
Many countries in conflict used the meeting as a platform for bigger issues. For instance, Russia said encryption and anonymity were not linked to the mandate, and that instead of “invented questions” it should deal with “real problems”, like Ukraine censorship, finding it “strange” that Kaye did not mention Ukraine in his report.
China meanwhile asserted that the internet in China remains “free, open and orderly,” and that it did not accept some of the claims in the report.
It was unclear at press time whether an action would be forthcoming at national or intergovernmental level as a result of Kayes’ report.
Kaye Responds
In his response, Kaye pointed to the section in the report that gives examples of government policies that place legal restrictions on proportionality, such as Brazil’s Marco Civil.
On mass surveillance, he said he recognises that it is a strong concern for many delegations, and that there is both mass and targeted surveillance.
On the balance between rights and state obligations, he restated that the report and his statement recognised that access to encryption and anonymity is critical for a variety of groups, but that “just as the pen or telephone” can be used to communicate, it can be used for malicious purposes. Governments must determine their balance.
In a press briefing today, Kaye re-emphasised his message: “There are deeply worrying trends that highlight how states are either banning encryption and anonymity, or restricting encryption to the extent that it is virtually useless and undermines the security and the privacy of all individuals to express themselves and exercise their right to the freedom of opinion and expression.”
He was asked whether private parties might pressure governments to get access to private information for corporate purposes such as copyright infringement.
The report does not deal with that issue, he said. However, “apart from expression and opinion, it is clear that these tools protect businesses and their proprietary information.”
“It is also pretty clear that there are some governments that are engaging in essentially corporate espionage in order to gain access to competitors, and corporate actors are doing that too,” Kaye said.
He said the issue of corporate responsibility is open to more work: “Corporate actors today are also retaining quite a bit of data. Most of the business models for search engines, internet service providers, social media, and other platforms are basically designed around their ability to track us and collect information about us.”
“So what is their responsibility in this field and what is their responsibility to ensure freedom of opinion and expression given that today I don’t just read a newspaper but the newspaper reads me?” he asked. “We will be focusing on that.”
Support from Human Rights Groups
Several human and civil rights groups weighed in to offer strong support to Kaye’s report and the need to protect encryption and anonymity.
Among these were: Human Rights Watch release here and statement here; Press Emblem Campaign release here; La Quadrature du Net release here; and Access release here.
Catherine Saez contributed to this report.
[…] como esta puede ser explotada por acosadores y Estados represores. El anonimato en Internet es una condición necesaria para que exista libertad de […]