Credit: OHCHR
On May 22, 2015, David Kaye, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression (Special Rapporteur), submitted his annual report to the Human Rights Council. His report evaluates whether the rights to privacy and freedom of opinion and expression protect secure online communication by methods including encryption and anonymity. Secondly, his report analyzes whether States may impose restrictions on encryption and anonymity in accordance with their human rights obligations. See UN Human Rights Council, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression (David Kaye (Special Rapporteur), A/HRC/29/32 (2015).
Methodology
To prepare his report, the Special Rapporteur distributed a questionnaire to Member States about their respective domestic laws, policies, and regulations: 16 states responded to the questionnaire as of April 1, 2015. The Special Rapporteur also received submissions from 26 civil society groups which contributed to the preparation of the report. The Special Rapporteur prepared an additional companion document providing additional sources for the report’s conclusions.
Secure and Private Communication in the Digital Age
Contemporary encryption and anonymity
The Special Rapporteur begins his report by discussing different methods that are used to protect data, particularly electronic data, and to maintain online security without the risk of repercussions or surveillance. He explains that while encryption techniques mathematically “convert messages, information, or data into a form unreadable by anyone except the intended recipient” and thus protect the content that is transmitted, these techniques do not protect the identities of users from being discovered. Therefore, some users employ anonymity, for example by using pseudonyms, to avoid being identified. However, the privacy that is afforded by these methods is limited. Those who seek to be fully anonymous or hide their identities against State interference or to engage in criminal activity use methods such as “anonymizing” programs, peer-to-peer networks, and proxy services. See id. at 4-5.
Uses of the technologies
The report maintains that it is crucial that methods exist to protect individual online security and that both States and corporations take responsibility for putting into place necessary protections to achieve this goal. The Special Rapporteur notes several advantages provided by encryption and anonymity: these methods play an integral role in protecting digital communication within hostile political, social, religious, and legal arenas; in situations where States unlawfully censor the internet, these methods allow individuals to gain access to information; and journalists, civil society, and others can use these methods to protect themselves against being subjected to surveillance and harassment. The report also notes the negative and potentially dangerous aspects of encryption and anonymity, such as their use by terrorists and criminals, or for purposes of harassing and bullying members of vulnerable groups. Finally, with respect to technologies, the report notes that while criminal organizations might benefit from encryption techniques and anonymity, governments can use other tools to locate them as well as to engage in counterterrorism efforts, including wiretapping, tracking and data-mining. See id. at 5-6.
Encryption, Anonymity, and the Rights to Freedom of Opinion and Expression and Privacy
The report notes that the right to privacy has been codified in several human rights instruments, including Article 12 of the Universal Declaration of Human Rights (UDHR), Article 17 of the International Covenant on Civil and Political Rights (ICCPR), Article 16 of the Convention on the Rights of the Child, Article 22 of the Convention on the Rights of Persons with Disabilities, Article 14 of the Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families, Article 8 of the European Convention on Human Rights (ECHR), and Article 11 of the American Convention on Human Rights (ACHR). See id. at 6.
Similarly, the right to freedom of opinion and expression has been codified in international as well as regional human rights instruments, including Article 19 of the UDHR and the ICCPR, Article 9 of the African Charter on Human and Peoples’ Rights, Article 13 of the ACHR, and Article 10 of the ECHR. See id.
Privacy as a gateway for freedom of opinion and expression
The report highlights Article 12 of the UDHR and Article 17 of the ICCPR, both of which protect the individual against “arbitrary or unlawful interference with his or her privacy, family, home or correspondence” and “unlawful attacks on his or her honour and reputation,” and provide for protection against such interferences or attacks. See id. Given the affirmative obligations that these treaties impose on States, the report emphasizes the importance of domestic legislation that prohibits unlawful and arbitrary interference and provides remedies for these violations. Finally, the Rapporteur notes that the UN General Assembly, the United Nations High Commissioner for Human Rights, and special procedure mandate holders have recognized that the right to privacy furthers the protection of other rights, particularly the freedom of opinion and expression. See UN General Assembly, Resolution 68/167, The Right to Privacy in the Digital Age, UN Doc. A/RES/68/167, 13 December 2013. See also UN Human Rights Council, Resolution 20/8, The Promotion, Protection and Enjoyment of Human Rights on the Internet, UN Doc. A/HRC/20/L.13, 29 June 2012.
Right to hold opinions without interference
The report notes that the freedom to hold an opinion is a “fundamental element of human dignity and democratic self-governance,” a right with which the ICCPR does not allow any interference. See Report at 8. On the other hand, freedom of expression is subject to limitations in Article 19(3) of the ICCPR. While courts have not devoted as much attention to the right to hold opinions, as compared to the right to freedom of expression, the Special Rapporteur notes that in the digital age, where individuals and civil society groups store their opinions digitally, including on cloud drives, social media sites, and in browser histories, the right to hold an opinion without interference is critical and it is therefore important that increased attention be paid to this issue. The Special Rapporteur states that this right includes the right to form opinions, a right which can be undermined by surveillance systems which might deter individuals and civil society groups from accessing information, particularly when this surveillance results in repressive measures. The Rapporteur concludes that a determination must be made as to whether restrictions on encryption and anonymity impermissibly interfere with the right to hold an opinion. See id.
Right to freedom of expression
The report states that the right to freedom of expression under Article 19 (2) of the ICCPR protects the “freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.” See id. at 9. The Special Rapporteur notes that when State censorship is prevalent and criminalization of online expression is content-based and discriminatory, individuals and civil society groups have to safeguard themselves using encryption and anonymity tools, such as proxy servers. Also with respect to the right to freedom of expression, the report notes the “transboundary” scope of this right, which means that it extends across borders. When States filter or block exchanges, encryption enables individuals to avoid this filtering and to exchange information across borders. Finally, the report explains that the protection of the right to freedom of expression extends to all media, including those types of media that were not yet envisioned when the UDHR and ICCPR were drafted, including encryption and anonymity technologies. See id. at 9-10.
Role of corporations
The report notes that corporations play a role in advancing or interfering with the rights to privacy and freedom of opinion and expression, including the use of encryption and anonymity, given that they own and operate the networks used for online communication and that they develop surveillance, spyware, and online storage programs. The report emphasizes that “the responsibility to respect human rights applies throughout a company’s global operations regardless of where its users are located, and exists independently of whether the State meets its own human rights obligations.” See id. at 10 (citing UN Human Rights Council, Report of the Office of the United Nations High Commissioner for Human Rights: The Right to Privacy in the Digital Age, UN Doc. A/HRC/27/37, 30 June 2014). The report encourages corporations to follow those principles set forth in the Guiding Principles on Business and Human Rights, the Global Network Initiative’s Principles on Freedom of Expression and Privacy, the European Commission’s ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights, and the Telecommunications Industry Dialogue Guiding Principles, which encourage corporations to commit to protecting human rights. See id.
Evaluating Restrictions on Encryption and Anonymity
Legal framework
The report emphasizes that limitations on the right to privacy should be strictly construed and conform to the strict tests of necessity and proportionality. Any restrictions that limit the freedom of opinion and expression must not interfere with the right to hold an opinion. The Special Rapporteur reiterates a three-part test to determine whether restrictions on encryption and anonymity are permissible: any limitation on expression must (1) be provided for by law, (2) only be imposed for legitimate grounds in accordance with Article 19 (3) of the ICCPR, and (3) conform to the strict tests of necessity and proportionality. See id. at 11-12.
“Provided for by law”
For a restriction to be “provided for by law,” it must be precise, transparent, and not allow State authorities complete discretion to apply the limitation. The Special Rapporteur advises that proposals to impose restrictions on encryption or anonymity should be subject to public comment and adopted during regular legislative sessions. Additionally, robust procedural and judicial safeguards should be established to protect users’ due process rights. See id.
Protect specified interest
The report notes that for a limitation to be allowed, it must be shown to protect specified interests, such as the rights or reputations of others, national security, public order, public health, or morals. Any restrictions on expression must be consistent with Article 19(3) of the ICCPR; no other grounds may justify restrictions on the freedom of expression. See id at 11-12.
“Necessary” to achieve legitimate objective
The report notes that the State must prove that any limitation on encryption and anonymity is “necessary” to achieve a legitimate objective, which the European Court of Human Rights has interpreted to mean “more than” what is considered “useful,” “reasonable,” or “desirable.” Additionally, the Special Rapporteur states that “necessary” also implies that any restriction on freedom of expression must be proportional and “the least intrusive instrument amongst those which might achieve the desired result.” Further, the restriction must be directed at achieving a specific objective, not intrude upon other rights, and any interference with third parties’ rights must be limited. See id at 11-12.
State practice: examples and concerns
The Rapporteur goes on to express concern about the fact that States have often failed to engage in this analysis when imposing restrictions on encryption and anonymity. On the other hand, the report notes that some States have taken positive steps to protect encryption and anonymity in order to promote the freedom of expression. For example, Canada, the Netherlands, Sweden, the United Kingdom of Great Britain and Northern Ireland, and the United States fund the training of individuals to use encryption and anonymity tools to evade censorship and protect their online security. Additionally, Brazil adopted the Marco Civil da Internet law in 2014 which ensures the secrecy of user communications online and only grants exceptions pursuant to a court order. The E-Commerce Act and Telecommunications Act of Austria do not restrict encryption and the Austrian government is involved in public awareness campaigns on digital security. See id. at 12-13.
However, the Special Rapporteur emphasizes that many States fail to provide justifications for restrictions on encryption and anonymity tools. For example, regulations often fail to meet the standards of necessity and proportionality, thereby limiting individuals’ rights to freedom of expression and opinion. States enforce bans on encryption for individual use, intentionally weaken encryption tools, and criminalize the mere use of encryption technologies. Some States ban user anonymity in online communications, prohibit user anonymity during times of public unrest, impose intermediary liability upon internet service providers and media platforms to regulate users’ comments, and enact broad data retention policies. See id. at 13-19.
Conclusions and Recommendations
The report concludes that the rights to privacy and the freedom of opinion and expression in the digital age are advanced by encryption and anonymity. Additionally, encryption and anonymity may be essential to exercising other rights, including economic rights, due process, and the freedom of peaceful assembly and association. Therefore, restrictions on encryption and anonymity should be strictly limited according to the principles of legality, necessity, proportionality, and legitimacy. See id. at 19.
Recommendation to States
The Rapporteur’s recommendations to States include the following: revise or establish national laws and regulations to promote and protect the rights to privacy and freedom of opinion and expression; if necessary, impose restrictions on encryption and anonymity on a case-by-case basis in accordance with the requirements of legality, necessity, proportionality, and legitimacy; refrain from making the identification of users a condition of accessing digital communications and online services; and only allow court-ordered decryption on a case-by-case basis in accordance with domestic and international law. See id. at 19-20.
Recommendations to International Organizations, the Private Sector, and Civil Society
The Special Rapporteur urges UN entities to support the use of communication security tools for encryption and anonymity and advises human rights protection bodies to be more attentive to security concerns when requesting information from witnesses and victims about human rights violations. The report recommends that the private sector follow internationally and regionally accepted principles for conducting business in accordance with human rights law. Specifically, companies should not block or limit the transmission of encrypted communications and should permit anonymous communication. Finally, companies should support secure technologies for websites and develop widespread end-to-end encryption. See id. at 20.
The report concludes by urging civil society groups to promote the use of encryption and anonymity tools and to encourage digital literacy. See id. at 21.
Additional Information
The mandate of the UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression is to gather all relevant information relating to violations of the right to freedom of opinion and expression, seek and respond to reliable information from governments and NGOs, make recommendations about protecting the freedom of expression, and contribute technical assistance to the Office of the United Nations High Commissioner for Human Rights. To carry out that mandate, the Special Rapporteur performs a range of tasks, including sending urgent appeals and letters of allegation to States on violations of the freedom of opinion and expression, undertaking fact-finding country visits, and submitting annual reports. David Kaye, a clinical professor of law and director of the International Justice Clinic at the University of California, Irvine School of Law, currently serves as Special Rapporteur for Freedom of Opinion and Expression.
For more information on the Special Rapporteur for Freedom of Opinion and Expression, please visit IJRC’s Online Resource Hub.