Encryption and Anonymity create “a zone of privacy online”, says UN Special Rapporteur

A groundbreaking report released today by the UN Special Rapporteur on freedom of expression, David Kaye, calls on states to ensure security and privacy online by providing “comprehensive protection” through encryption and anonymity tools, warning that blanket measures to restrict online privacy fail to comply with human rights norms.

To support the findings contained in the Special Rapporteur's report, Privacy International, the Harvard Law School's International Human Rights Law Clinic and ARTICLE 19 have published an accompanying booklet, Securing Safe Spaces Online: Encryption, online anonymity and human rights which explores the impact of measures to restrict online encryption and anonymity in four particular countries – the United Kingdom, Morocco, Pakistan and South Korea.

The Special Rapporteur's report represents a landmark step forward for the UN Human Rights Council, from which substantive issues of human rights and technology were absent until just two years ago, and which will shortly appoint a dedicated Special Rapporteur on the right to privacy. For the first time, the Council has been asked to consider how the use of increasingly popular encryption and anonymity tools and services can protect and promote human rights online, particularly the rights to freedom of expression and privacy.

Bringing human rights into the digital age

The report notes that “discussions of encryption and anonymity have all too often focused only on their potential use for criminal purposes in times of terrorism”, rather than their role in promoting secure, private and free communications, facilitating the realisation of rights to expression, opinion and privacy. Mr Kaye observes that encryption and anonymity, separately or together, assist in shielding opinions from outside scrutiny(particularly important in hostile environments), empower individuals to circumvent censorship and other unlawful barriers to the free flow of information, and shield journalists, researchers, lawyers and civil society from unlawful surveillance and harassment. In this regard, “encryption and anonymity provide individuals and groups with a zone of privacy online to hold opinions and exercise freedom of expression without arbitrary and unlawful interference or attacks,” Mr Kaye concludes.

Affirming an important application of the right to freedom of expression and opinion to modern-day realities, the report notes that the right to form and hold opinions, unlike the rights to privacy and freedom of expression, is an absolute right that cannot be limited in any circumstances. Whereas the right to an opinion may traditionally have been construed as an abstract right that occurs only within one's mind, the report observes, “the mechanics of holding opinions have evolved in the digital age”, with individuals both holding opinions digitally – saving their views and their search and browse histories, for instance, on hard drives, in the cloud, and in e-mail archives – and forming opinions online, through search and browsing activities.

The report recommends, inter alia, that

• States should not restrict encryption and anonymity, and blanket prohibitions fail to be necessary and proportionate and thus cannot comply with human rights law;

• States should avoid all measures that weaken the security that individuals' privacy may enjoy online, such as backdoors, weak encryption standards and key escrows;

• States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users;

• Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms);

• Entities of the United Nations system, especially those involved in human rights and humanitarian protection, must urgently alter their systems to support the use of communication security tools in order to ensure that those who interact with them may do so securely;

• Companies, like states, should refrain from blocking or limiting the transmission of encrypted communications and permit anonymous communication. Attention should be given to efforts to expand the availability of encrypted data-centre links, support secure technologies for websites and develop widespread default end-to-end encryption.

A global battle

The Special Rapporteur's report comes at a crucial time; in recent months, countries such as the United States and United Kingdom have suggested that the state should have more power to override encrypted communications in order to intercept communications for the purpose of combatting terrorism. In his review of British investigatory powers released last week, independent reviewer David Anderson QC argued that there is “a compelling public interest in being able to penetrate any channel of communication”, and that governments should have the “ability to patrol [the dark spaces of the internet] in tightly defined circumstances” [at 13.14]. While the report does not go so far as to recommend the adoption of the restrictive measures Mr Kaye criticises in his report, such as backdoors, weak encryption standards and key escrows, it nevertheless leaves the door open for the UK to legislate such measures as it reviews its surveillance laws in the coming months. A recent surveillance law adopted in France provided for exceptionally lengthy retention measures for intercepted encrypted communications.

Meanwhile other countries such as Pakistan, Morocco and South Korea have all adopted policies and practices restricting the use of encryption and anonymity online. These policies are detailed in Securing Safe Spaces Online: Encryption, online anonymity and human rights, published today by Privacy International, the Harvard Law School's International Human Rights Law Clinic and ARTICLE 19, with a foreward by cryptography expert Bruce Schneier. The booklet highlights a variety of legal restrictions on and informal obstacles to personal use of encryption for communication and the exercise of anonymous speech online in four countries with diverse geographic, political, and socioeconomic backgrounds. The publication emphasises the opportunities for governments, the corporate sector, and civil society to eliminate or minimise obstacles to personal use of encryption and online anonymity.