Anonymity and Encryption in Digital Communications, February 2015
Total Page:16
File Type:pdf, Size:1020Kb
Submission to the UN Special Rapporteur on freedom of expression – anonymity and encryption in digital communications, February 201 1! Introduction Privacy International submits this information for the Special Rapporteur's report on the use of encryption and anonymity in digital communications. Anonymity and the use of encryption in digital communications engage both the right to freedom of expression and right to privacy very closely: anonymity and encryption protects privacy, and ithout effective protection of the right to privacy, the right of individuals to communicate anonymously and ithout fear of their communications being unla fully detected cannot be guaranteed. As noted by the previous mandate holder, !rank #aRue, $the right to privacy is essential for individuals to express themselves freely. Indeed, throughout history, people%s illingness to engage in debate on controversial sub&ects in the public sphere has al ays been linked to possibilities for doing so anonymously.'( Individuals' right to privacy extends to their digital communications.) As much as they offer ne opportunities to freely communicate, the proliferation of digital communications have signi*cantly increased the capacity of states, companies and other non+state actors to interfere ith individual's privacy and free expression. Such interference ranges from mass surveillance of communications by state intelligence agencies, to systematic collection and storage of private information by internet and telecommunication companies, to cybercrime. Anonymity and encryption are essential tools available to individuals to mitigate or avert interferences ith their rights to privacy and free expression. In this ay, they are means of individuals exercising to the fullest degree their rights hen engaging in digital communications. Anonymity has long been a means by hich individuals could freely en&oy their right to impart and receive information, free from State control. ,he use of pseudonyms, nom de plumes and pen names to conceal an author's identity has been common 1 -. /oc. A01R20(30)3, (4 5ay )6((. 2 7oth the -. 8eneral Assembly and the -. 1uman Rights 2ouncil have consistently af*rmed that the same rights that people have 'of9ine' must also be protected 'online', including the right to privacy :-. 8eneral Assembly resolution on the right to privacy in the digital age, (; /ecember )6(<= resolution 4;0(43 of (; /ecember )6(>= and 1uman Rights 2ouncil resolution )40(> on the promotion, protection and en&oyment of human rights on the Internet, of )4 ?une )6(<.@ throughout history, and essential to the publication of orks that critiAue governments or po erful actors, or expose rongdoings. Indeed, the name of that famous author of dystopian *ction, George Br ell, as in fact a nom de plume. Pen names have also been an effective means by hich omen authors have been able to have their orks published and given eAual and unbiased attention. Anonymity can protect histleblo ers, sources and dissidents from exposure, and thus ensure they're able to communicate freely and in private. #ncryption tools and services are a means by hich individuals can protect their anonymity, as ell as the security and privacy of their communications. Cncryption, too, has long played a role in security the en&oyment of human rights. In fact, one of the earliest uses of encryption as by ?ulius Caesar, ho used a $cipher' to protect the transmission of information of military signi*cance. ,oday, encryption is used by every person ho uses a cell phone or a computer, and protect their personal details and communications from interference by cyber criminals, identity thieves, hackers, and States. ,he use of encryption is the only ay to ensure digital communications – ranging from online *nancial transactions to cell phone calls to emails + are protected from interference. ,he availability of anonymity and encryption must be seen as essential preconditions to the exercise of privacy and free expression. 1o ever, the right to privacy and to freedom of expression are not absolute rights. ,here are legitimate grounds under hich these rights can be limited. Restriction of these rights by States must be &usti*ed as a permissible limitation under international human rights legal standards, by reference to the overarching principles of legality, necessity and proportionality. ,his submission ill address the types of measures that restrict or eradicate the availability of anonymity and encryption, and the conditions that must exist for them to constitute permissible limitations of the rights. -nderpinning our submissions and reiterated throughout is the important reality that digital communications are inherently universal, and measures hich restrict their free, secure and private use ill have universal impacts. 7ecause of the ay that digital communications 9o across borders and around the orld, measures hich restrict the use of anonymity in one State cannot but impact the rights of individuals in another. CAually, the existence of targeted po ers to remove or defeat encryption in one State has implications for all individuals, and creates a chilling effect for people around the orld that is far greater than the sum of isolated instances in hich such po ers might be deployed. 2! General measures that limit or eradicate anonymity #a s that restrict anonymity of users on the internet or hen communicating through mobile phones are on the rise. According to the )6(< !reedom of the Internet report by !reedom 1ouse, (E out of the 4F countries studies passed ne legislation that increased surveillance or restricted internet anonymity in )6(<.> State measures to restrict anonymity are both in9uenced by and have a 9o on effect on the actions of private companies, hich are also increasingly limiting the use of anonymity or pseudonymity, and reAuiring the use of real names as a precondition to the use of particular services. Anecdotal evidence sho s that often the actions of private companies are a result of pressure from States to ensure companies are able to facilitate State surveillance of their users. 5andatory SI5 card registration States are increasingly passing la s hich reAuire telecommunications companies to reAuire the provision of State+issued identi*cation as a prereAuisite for the obtaining of SI5 cards, and thus accessing mobile communications. SI5 card registration la s are particularly prominent in Africa, here <E of the FF countries reAuire the mandatory registration of SI5 cards.< SI5 registration, in effect, eradicates the ability of mobile phone users to communicate anonymously and facilities mass surveillance, making tracking and monitoring of all users easier for la enforcement and security agencies. SI5 users' information can be shared ith government departments and matched ith other private and public databases, enabling the State to create comprehensive pro*les of individual citiGens. An individual's phone number could potentially be matched ith their voting preferences or health data, enabling governments to identify and target political opposition, for example, or people living ith 1IH0AI/s. ,he potential for misuse of such information, particularly in countries ith traditions of ethnic con9ict and in situations of political instability and unrest, is enormous. SI5 registration can also have discriminatory effects + the poorest individuals :many of hom already *nd themselves disadvantaged by or excluded from the spread of mobile technology) are often unable to buy or register SI5 cards because they do not have identi*cation documents. -ndocumented migrants are similarly disadvantaged. ,his could result in exclusion from numerous public services. In addition, given the additional burdens that SI5 registration places on telecommunication companies, this may result in additional costs being passed on to a customer. Importantly, the &usti*cations commonly given for SI5 registration – that it ill assist in reducing the abuse of telecommunications services for the purpose of criminal and fraudulent activity – are unfounded. SI5 registration has not been effective in curbing crime, and instead has fueled it: States hich have adopted SI5 card registration have seen the gro th of identity-related crime, and have itnessed black markets Auickly pop up to service those ishing to remain anonymous :for example, in Saudi Arabia@. SI5s can be illicitly cloned, or criminals can use foreign SI5s on roaming mode, or internet and satellite telephony, to circumvent SI5 registration reAuirements. 3 https://freedomhouse.org/sites/default0*les/FB,.I)6(<I!ull_Report_compressedv2I6.pdf 4 http:00*rstmonday.org/o&s/index.php/fm/article/vie 0<>F(0>;)6 7ecause of its ineffectiveness and exclusionary impacts, SI5 registration has been re&ected after consultation in Canada, 2Gech Republic, Greece, Ireland, the .etherlands and Poland. Real name registration In some States, the ability of individuals to communicate anonymously is undermined by real name registration la s, hich reAuire internet users to register ith their real name :often using a government+issued I/@ hen using certain internet services. Real name registration is an incredibly invasive policy as it is designed to facilitate the identi*cation of users and the policing of content for critical, libelous, defamatory or dissenting opinions and ideas. !or example, in the last fe eeks China has implemented real name registration policies that ill reAuire users of blogs, microblogs, instant+messaging services, online discussion forums and ne s services to register