Rule of Law on the Internet and in the Wider Digital World Law on the Internet and the Wider Digital Environment
Total Page:16
File Type:pdf, Size:1020Kb
The rule of We exercise a significant part of our human rights today using the and in the wider digital world on the Internet rule of law The law on the Internet and the wider digital environment. But our human rights can also be breached using these very same means. Internet and There is general agreement that human rights should be enjoyed online as they are offline. In practice, however, the actors who can ensure that we enjoy human rights are not exactly the same in the in the wider two environments. In particular, the disproportionate influence and control that certain states and certain private companies exercise on the Internet and its physical infrastructure at the global level, are two digital world essential elements of this difference. This issue paper looks at how the rule of law can be maintained in an environment characterised by these specific governance issues, focusing on some policy areas of particular human rights relevance: freedom of expression, data protection and privacy, cybercrime and national security. It suggests possible ways forward to ensure that we can trust the rule of law to apply to our online activities. www.commissioner.coe.int 70114 ENG PREMS ENG The Council of Europe is the continent’s leading Issue paper human rights organisation. It comprises 47 member states, 28 of which are members of the European Union. All Council of Europe member states have signed up to the European Convention on Human Rights, a treaty designed to protect human rights, democracy and the rule of law. The European Court of Human Rights oversees the implementation of the Convention in the member states. The rule of law on the Internet and in the wider digital world Issue paper published by the Council of Europe Commissioner for Human Rights Council of Europe The opinions expressed in this work are the responsibility of the author and do not necessarily reflect the official policy of the Council of Europe. All requests concerning the reproduction or translation of all or part of this document should be addressed to the Directorate of Communication (F-67075 Strasbourg Cedex or [email protected]). All other correspondence concerning this document should be addressed to the Office of the Commissioner for Human Rights. Issue papers are published by the Commissioner for Human Rights to contribute to debate and reflection on important current human rights issues. Many of them also include recommendations by the Commissioner for addressing the concerns identified. The opinions expressed in these expert papers do not necessarily reflect the Commissioner’s position. Acknowledgements: Issue papers are available This issue paper was prepared by on the Commissioner’s website: Professor Douwe Korff, Visiting Fellow, www.commissioner.coe.int Yale University (Information Society Project), and Oxford Martin Associate, Cover photo: © Shutterstock Oxford Martin School, University of Cover: Documents and Publications Oxford, UK. He and the Commissioner Production Department (SPDP) are also grateful to Joe McNamee of Council of Europe European Digital Rights, EDRi, for the Layout: Jouve, Paris very useful comments and additions he provided to the draft version of this © Council of Europe, December 2014 issue paper, in particular on privatised Printed at the Council of Europe law enforcement. Contents ABBREVIATIONS 5 EXECUTIVE SUMMARY 7 A new environment for human activities 7 The nature of the digital environment 8 The rule of law in the digital environment 10 The issues, and the balance between them 15 THE COMMISSIONER’S RECOMMENDATIONS 21 I. On the universality of human rights, and their equal application online and offline 21 II. On data protection 22 III. On Cybercrime 22 IV. On jurisdiction 23 V. On human rights and private entities 23 VI. On blocking and filtering 24 VII. On national security activities 24 INTRODUCTION 25 1. A NEW ENVIRONMENT FOR HUMAN ACTIVITIES 27 1.1. Political, social, cultural and human rights activities 27 1.2. Cybercrime, cybersecurity, terrorism and national security 28 2. THE NATURE OF THE DIGITAL ENVIRONMENT 31 2.1. Dangerous data 31 2.2. Global and private, but not in the sky 33 2.3. Who is in control? 36 3. THE RULE OF LAW IN THE DIGITAL ENVIRONMENT 43 3.1. The rule of law 43 3.2. The basic “rule of law” tests developed by the European Court of Human Rights 45 3.3. “Everyone”, without discrimination 48 3.4. “Within [a contracting state’s] [territory and] jurisdiction” 50 3.5. Human rights and private entities 63 3.6. Exercise of extraterritorial jurisdiction by states 76 4. THE ISSUES, AND THE BALANCE BETWEEN THEM 81 4.1. The issues 81 4.2. Freedom of expression 82 4.3. Privatised law enforcement 85 4.4. Data protection 87 4.5. Cybercrime 93 4.6. National security 107 4.7. The delicate (and unresolved) balances 111 Page 3 All the judgments and decisions of the European Court of Human Rights cited in this issue paper are available from the Court’s case law database, HUDOC: http://hudoc.echr.coe.int/sites/eng/Pages/search.aspx# Abbreviations 5EYES The intelligence partnership between the USA, the UK, Australia, Canada and New Zealand CCTV closed-circuit television CFR Charter of Fundamental Rights of the European Union CJEU Court of Justice of the European Union DMCA US Digital Millennium Copyright Act DNS SEC Domain Name System Security Extensions DP data protection DPA data protection authority DP Convention Council of Europe Data Protection Convention (Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS No. 108) DPI deep packet inspection ECHR European Convention on Human Rights EDRi European Digital Rights EFF Electronic Frontier Foundation EU European Union FISA US Foreign Intelligence Surveillance Act GCHQ UK Government Communications Headquarters HUMINT human intelligence I-ACHR Inter-American Convention on Human Rights ICANN Internet Corporation for Assigned Names and Numbers ICCPR International Covenant on Civil and Political Rights ICJ International Court of Justice IGF Internet Governance Forum IP Internet Protocol Page 5 ISP Internet service provider ITU International Telecommunication Union IWF Internet Watch Foundation MLATs mutual legal assistance treaties MNO mobile network operator NGO non-governmental organisation NSA (US) National Security Agency PII personally identifiable information PNR passenger name record RPKI Resource Public Key Infrastructure SEA-ME-WE-4 South East Asia–Middle East–West Europe 4project SIGINT signals intelligence T-CY Cybercrime Convention Committee UDHR Universal Declaration of Human Rights UNODC United Nations Office on Drugs and Crime The rule of law on the Internet Page 6 Executive summary his issue paper addresses a pressing question: how can we ensure that the rule of law is established and maintained on the Internet and in the wider digital T world? Section 1 describes the range of online activities and the threats to this environment; section 2 discusses the emerging “Internet governance” principles, and notes the special control exercised over the digital world by the USA (and the UK, in respect of Europe), which could lead to fragmentation of the Internet in response. Section 3 sketches the international standards of the rule of law, and some problems in the application of law in this new environment. Section 4 looks in some more detail at the main issues emerging from the earlier sections – freedom of expression, privatised law enforcement, data protection, cybercrime and national security – and discusses the delicate balances that need to be struck. The Council of Europe Commissioner for Human Rights has formulated a number of recommendations on the basis of the issues raised by this issue paper; these are set out after this executive summary. A new environment for human activities We live in a global digital environment that has created new means for local, regional and global activities, including new types of political activism, cultural exchanges and the exercise of human rights. These activities are not virtual in the sense of “not truly real”. On the contrary, they are an essential part of real citizens’ lives. Restrictions on access to the Internet and digital media, and attempts to monitor our online activities or e-communications, interfere with our fundamental rights to freedom of expression and information, freedom of association, privacy and private life (and possibly other rights such as freedom of religion and belief, or the right to a fair trial). The new global digital environment of course also creates a new space for unlawful behaviour: for the dissemination of hate speech or child pornography, incitement to violence, breaches of copyright (“piracy”), fraud, identity theft, money laundering and attacks on the e-communications infrastructure itself through malware (such as Trojans and worms) or “denial of service” attacks. Cybercrime and cybersecurity have become major concerns. These threats are increasingly transnational, and there is a broad international con- sensus on the need to deal with cybercrime, cybersecurity and terrorism, but there is much less agreement on specifics – or even what constitutes a threat. Page 7 Four issues stand out. First, state actions aiming to counter cybercrime, threats to cybersecurity and threats to national security are increasingly intertwined; the boundaries between such activities are blurred, and the institutions and agencies dealing with them work more closely together. Second, states are now co-ordinating their actions in all these