UN Report: Encryption And Anonymity Deserve 'Strong Protection'

from the not-just-a-matter-of-opinion dept

Techdirt has been following for a while a worrying move to demonize strong encryption, amid calls from politicians and senior law enforcement officials for it to be undermined or compromised. That makes a new report affirming the central importance of encryption (doc), from the UN's Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, David Kaye, particularly valuable. His report clearly inhabits a post-Snowden world, since it takes as its starting point the following:

Contemporary digital technologies offer Governments, corporations, criminals and pranksters unprecedented capacity to interfere with the rights to freedom of opinion and expression.

The report looks at ways in which encryption and anonymity can help to protect basic rights to privacy and freedom of opinion and expression, and explores to what extent governments may impose restrictions. In many ways, the most interesting aspect of his analysis concerns the right to hold opinions:

During the negotiations on the drafting of the [International Covenant on Civil and Political Rights], "the freedom to form an opinion and to develop this by way of reasoning was held to be absolute and, in contrast to freedom of expression, not allowed to be restricted by law or other power". The ability to hold an opinion freely was seen to be a fundamental element of human dignity and democratic self-governance, a guarantee so critical that the Covenant would allow no interference, limitation or restriction.

But as Kaye points out, the ability to hold opinions is now intimately bound up with technology:

Individuals regularly hold opinions digitally, saving their views and their search and browse histories, for instance, on hard drives, in the cloud, and in e-mail archives, which private and public authorities often retain for lengthy if not indefinite periods. Civil society organizations likewise prepare and store digitally memoranda, papers and publications, all of which involve the creation and holding of opinions. In other words, holding opinions in the digital age is not an abstract concept limited to what may be in one's mind. And yet, today, holding opinions in digital space is under attack.

Encryption and anonymity, he concludes, are powerful ways to preserve that right to hold opinions in a digital form:

The right to hold opinions without interference also includes the right to form opinions. Surveillance systems, both targeted and mass, may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes. For all these reasons, restrictions on encryption and anonymity must be assessed to determine whether they would amount to an impermissible interference with the right to hold opinions.

In terms of "permissible interference," the following factors are key:

Restrictions on encryption and anonymity, as enablers of the right to freedom of expression, must meet the well-known three-part test: any limitation on expression must be provided for by law; may only be imposed for legitimate grounds (as set out in article 19 (3) of the Covenant); and must conform to the strict tests of necessity and proportionality.

It's the last of those that is increasingly under the spotlight after Snowden's leaks revealed a global system whose underlying principle -- "collect it all" -- is the very antithesis of proportionality:

A high risk of damage to a critical, legitimate State interest may justify limited intrusions on the freedom of expression. Conversely, where a restriction has a broad impact on individuals who pose no threat to a legitimate government interest, the State's burden to justify the restriction will be very high.

Kaye picks up on this theme again in his recommendations, where he notes that encryption and anonymity are not just vital for the right to freedom of opinion and expression in the digital age, but also for other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity. As a result:

States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. In addition, States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (i.e., not to a mass of people) and subject to judicial warrant and the protection of due process rights of individuals.

One issue rather skated over there is what happens when court-ordered decryption is impossible. Kaye rightly notes that it is "a seemingly universal position among technologists that there is no special access that can be made available only to government authorities, even ones that, in principle, have the public interest in mind." Absent such backdoors, you can build systems where even the service providers cannot access messages, which renders court orders moot. Nonetheless, Kaye's report is important, because it offers a counter-argument to repeated assertions by the authorities that encryption is essentially something bad, used by bad people to do bad things. He also has an answer to those who claim that strong crypto will usher in a new Dark Age for law enforcement:

Governments have at their disposal a broad set of alternative tools, such as wiretapping, geo-location and tracking, data-mining, traditional physical surveillance and many others, which strengthen contemporary law enforcement and counter-terrorism.

That's a crucial fact that is almost always overlooked. Its appearance here is another reason why this new UN report is welcome.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: anonymity, encryption, human rights, privacy, un

Over 1000 Japanese Citizens Band Together To Sue Their Government Over Participation In TPP

from the a-bit-late-now? dept

Back in March, we reported on a campaign in Japan seeking to raise awareness about the extreme copyright provisions in TPP. Of course, making copyright even more unbalanced is just one of many problems with TPP, and arguably not even the worst. Now activists in the country have launched a much broader attack on the whole agreement by filing a lawsuit against the Japanese government in an attempt to halt its involvement in the talks. As Mainichi reports:

A total of 1,063 plaintiffs, including eight lawmakers, claimed in the case brought to the Tokyo District Court that the Trans-Pacific Partnership pact would undermine their basic human rights such as the right to live and know that are guaranteed under the Constitution.

The envisaged pact would not only benefit big corporations but jeopardize the country's food safety and medical systems and destroy the domestic farm sector, according to their written complaint.

As well as oft-voiced concerns that Japan's key agricultural sector would be harmed, the plaintiffs are also worried that TPP will push up drug prices -- something that is a big issue for other nations participating in the negotiations. The new group rightly points out that corporate sovereignty jeopardizes the independence of Japan's judicial system, and said that the secrecy surrounding the talks:

violates the people's right to know as the document is confidential and the negotiating process will be kept undisclosed for four years after the agreement takes effect.

Although it is hard to judge how much of a threat this move represents to Japan's continuing participation in TPP, the legal firepower behind it is certainly impressive: according to the Mainichi story, there are 157 people on the legal team. At the very least, it shows that resistance to TPP and its one-sided proposals is growing -- and not just in the US. But you can't help thinking it would have been a good idea for concerned Japanese citizens to have made this move earlier, rather than leaving it to the eleventh hour, with TPP close to the finishing line.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, drugs, human rights, japan, lawsuit, safety, tpp

UN Expert: Secret Trade Negotiations Are A 'Threat To Human Rights'

from the null-and-void dept

Here on Techdirt, we've had plenty of posts looking at the major trade agreements currently being negotiated. As we've noted, criticism of TPP and TAFTA/TTIP has come from many quarters, particularly for the corporate sovereignty provisions, which are seen as problematic both on the left and right wings of the political spectrum. Intellectual Property Watch carries a fascinating statement criticizing key aspects of trade negotiations, which looks at things from quite a different angle. It's written by Alfred de Zayas, who is the "Independent Expert on the promotion of a democratic and equitable international order" -- apparently an honorary and unpaid position. In his statement, he expresses:

his deep concern over the general lack of awareness on the adverse effects that existing, or under negotiations, bilateral and multilateral free trade and investment agreements have on the enjoyment of human rights in many countries, particularly in the developing world.

Specifically, he is concerned about the secrecy of trade talks, and the fact that key stakeholders like trade unions, environmental protection grups and health professionals are excluded -- something that we've commented on many times here on Techdirt. He also thinks that fast-tracking the adoption of treaties -- as is currently being attempted in the US -- has a "detrimental impact on the promotion of a democratic and equitable world order." That's because, as de Zayas puts it:

It is tantamount to disenfranchising the public and constitutes a violation to accepted human rights law, which stipulates that every citizen shall have the right and the opportunity to take part in the conduct of public affairs.

No surprise, then, that de Zayas has particular concerns about an area that is very familiar to Techdirt readers: corporate sovereignty.

I am especially worried about the impact that investor-state-arbitrations (ISDS) have already had and foreseeably will have on human rights, in particular the provision which allows investors to challenge domestic legislation and administrative decisions if these can potentially reduce their profits.

...

The establishment of parallel systems of dispute settlement and their exemption from scrutiny and appeal are incompatible with principles of constitutionality and the rule of law, and as such are harmful to the moral welfare of society ("contra bonos mores").

One intriguing point de Zayas makes is that since all nations are bound by the UN Charter, any treaties they negotiate must also conform to its provisions. Article 103 of that Charter states that if there is any conflict between a treaty and the UN Charter, it is the Charter that prevails. That has interesting implications for corporate sovereignty cases before ISDS tribunals:

Provisions of free trade and investment agreements as well as decisions of ISDS arbitrators must conform with the UN Charter and must not lead to a violation, erosion of or retrogression in human rights protection or compromise State sovereignty and the State’s fundamental obligation to ensure the human rights and well-being of all persons living under its jurisdiction. Agreements or arbitral decisions that violate international human rights law are null and void as incompatible with Article 103 of the UN Charter and contrary to international ordre public.

That's a great point, although it's a little hard to see it having much practical impact on the current negotiations. Unfortunately, the same might be said about the whole of de Zayas's statement, but it's certainly good to have his analysis here.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: alfred de zayas, human rights, secrecy, tpp, trade agreements, transparency, ttip, un

UN Cultural Rights Rapporteur Delivers Report Condemning Prevailing Copyright Laws

from the in-service-to-industries-and-nations,-rather-than-creators dept

The UN Special Rapporteur in the field of cultural rights, Farida Shaheed, has just delivered a less-than-complimentary report on copyright to the UN's Human Rights Council. Shaheed's report actually examines where copyright meshes with arts and science -- the two areas it's supposed to support -- and finds it runs contrary to the rosy image of incentivized creation perpetuated by the MPAAs and RIAAs of the world.

Shaheed said a “widely shared concern stems from the tendency for copyright protection to be strengthened with little consideration to human rights issues.” This is illustrated by trade negotiations conducted in secrecy, and with the participation of corporate entities, she said.

She stressed the fact that one of the key points of her report is that intellectual property rights are not human rights. “This equation is false and misleading,” she said.

The last statement fires shots over the bows of "moral rights" purveyors, as well as those who view infringement as a moral issue, rather than just a legal one.

Shaheed also points out that the protections being installed around the world at the behest of incumbent industries are not necessarily reflective of creators' desires.

The right to protection of authorship remains with the human author(s) whose creative vision gave expression to the work, even when the copyright interest has been sold to a corporate publisher or distributor. We should always keep in mind that copyright regimes may under-protect authors because producers/publishers/distributors and other “subsequent right-holders” typically exercise more influence over law-making than individual creators, and may have divergent and possibly opposing interests to those of the creators.

In addition, the intellectual property standards pushed by the United States and others treat fair use, personal use copying, educational use and other similar aspects as exceptions rather than something inherent to the permissions granted to rights holders by these laws -- a balancing factor between the copyright holders' and the publics' interests.

The main challenge, I believe, is that international copyright treaties generally treat copyright protections as mandatory, while largely treating exceptions and limitations as optional. The standard for judging whether a particular exception or limitation is permissible under international copyright law is not articulated with precision. This is why one of my recommendations is to explore the possibility of establishing a core list of minimum required exceptions and limitations incorporating those currently recognized by most States, and/or an international fair use provision.

Not that any established industry reliant on these expansive protections would ever agree to such a thing. It took a whole lot of public shaming before industry heads agreed to copyright exceptions for the blind. Anything above this level of begrudging "charity" has been forced down the throats of these industries by various governments.

Shaheed suggests one solution to the imbalance of power in the copyright system: a division of rights between creators and their "representative" rights holders.

Creators often need corporate rights holders: to develop innovative ways of delivering cultural works to the public, provide capital to finance high-budget cultural productions, and free artists from many of the burdens of commercializing their work. The human right to protection of authorship requires that copyright policies be carefully designed to ensure that authors (and not only copyright holders) benefit materially. An appropriate balance is crucial, recognizing that creators are both supported and constrained by copyright rules.

She also points out that it's not only incumbent industries standing in the way of better international copyright laws, but also "incumbent" countries.

Several countries, such as Indonesia and Brazil, commented on the issue of the protection of local and indigenous communities, which is mentioned in the report, for which they said “intellectual property historically failed” to take into account the issues of indigenous peoples.

Some developing countries said the current copyright system hinders the right to development by a violation of the right to education, health and progress and many other rights related to affording a basic decent life to millions in developing countries, according to UN sources.

The reaction of the incumbents?

The US said it disagrees with the report, in particular the recommendation related to copyright norm-setting activities at experts’ discussion in other international fora. They also disagreed on the suggestion that individual creators and corporations or businesses should merit different protections.

Portugal said the current copyright framework constitutes an important tool for human development, especially for cultural and scientific advancement.

France wondered why more established countries weren't considered in the report, arguing that cutting out the major players who wield an inordinate amount of power somehow resulted in an "unbalanced outcome."

The UN will take this report under consideration, along with a second report due later this year from Shaheed dealing with the patent system. Unfortunately, this somewhat scathing look at the present copyright system will do little to derail secretive international trade agreements that foist intellectual property "protections" foisted on smaller, less powerful countries.

Filed Under: copyright, culture, farida shaheed, human rights, un

Surveillance Software Company Gamma Found To Have Violated Human Rights; Receives Unprecedented Slap On The Wrist

from the critical-decisions dept

As Techdirt has reported on the increasingly active world of commercial spyware, one name in particular has cropped up several times: Gamma, with its FinFisher suite of spyware products. In October last year, we reported that Privacy International had filed a criminal complaint against the company with the National Cyber Crime Unit of the UK's National Crime Agency. There's no update on that move, but it seems that a parallel action has had more success (pdf):

British-German surveillance company Gamma has been condemned by a human rights watchdog for its failure to adhere to human rights and due diligence standards, after a two year investigation into the company's sale of surveillance technology to Bahrain.

Here's what Privacy International says was happening in Bahrain:

The complaint alleged that Gamma sold its notorious FinFisher intrusion software product to Bahrain as early as 2009, after which time it was used by the Bahraini government to violate the human rights of three Bahraini nationals and human rights activists, Ala'a Shehabi, Husain Abdulla and Shehab Hashem.

You're probably wondering what the penalty is if you are found in breach of human rights in this way -- clearly a serious matter. Well, here it is:

The Organisation for Economic Cooperation and Development’s UK National Contact Point (“"CP") concluded today that Gamma International should make changes to its business practices in order to ensure that in the future it respects the human rights of those affected by the surveillance technologies it sells.

Yes, you are told to do better next time. However, looking at things more positively, Privacy International points out:

Today's decision is the first time that the OECD has found a companies selling surveillance technologies to be in violation of human rights guidelines, and one of the most critical decisions ever issued by the OECD. In it, the NCP sets out in strong terms that Gamma has no human rights policies and due diligence processes that would protect against the abusive use of its products.

In other words, just as with the recent court victories against the UK government over its surveillance activities, what's important here is not so much the punishment -- or lack of it -- as the fact that for the first time a company selling invasive surveillance tools was condemned in this way. At the very least, it puts such companies on notice that they are being watched and will be hauled up before these kind of bodies for public shaming. Well, it's a start.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bahrain, companies, finfisher, human rights, privacy, surveillance
Companies: gamma, privacy international

Humiliating Admission By UK Government That Yet More Of Its Surveillance Was Unlawful

from the well,-not-*completely*-legal dept

A couple of weeks ago, we reported on a small but important defeat for the UK government when the Investigatory Powers Tribunal (IPT) ruled that intelligence sharing between the NSA and GCHQ was unlawful. Now, in a sign that the cracks in the UK's impenetrable silence on its surveillance activities are beginning to spread, the Guardian reports on the following surprising development:

The regime under which UK intelligence agencies, including MI5 and MI6, have been monitoring conversations between lawyers and their clients for the past five years is unlawful, the British government has admitted.

Here's why the UK government has suddenly started owning up to these misdeeds:

The admission that the regime surrounding state snooping on legally privileged communications has also failed to comply with the European convention on human rights comes in advance of a legal challenge, to be heard early next month, in which the security services are alleged to have unlawfully intercepted conversations between lawyers and their clients to provide the government with an advantage in court.

Remarkably, the confession has brought with it an unprecedented explanatory statement:

"In view of recent IPT judgments, we acknowledge that the policies adopted since [January] 2010 have not fully met the requirements of the ECHR, specifically article 8 (right to privacy). This includes a requirement that safeguards are made sufficiently public.

"It does not mean that there was any deliberate wrongdoing on their part of the security and intelligence agencies, which have always taken their obligations to protect legally privileged material extremely seriously. Nor does it mean that any of the agencies' activities have prejudiced or in any way resulted in an abuse of process in any civil or criminal proceedings."

This surprise admission shows once again the value of taking legal action against government surveillance, even when the odds of succeeding seem slim. Twice now the UK has revealed details purely as a result of challenges. Perhaps even more importantly, twice now the UK government's standard response to leaks -- that it wouldn't confirm or deny anything, but the British public could rest assured that whatever may have happened was completely legal -- has been shown to be false.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: abuse, attorney client privilege, gchq, human rights, mi5, mi6, nsa, privacy, surveillance, uk

European Commissioner For Human Rights And Key EU Privacy Committee Strongly Condemn Mass Surveillance And Bulk Data Retention

from the neither-lawful-nor-ethically-acceptable dept

As we wrote recently, the UK's Investigatory Powers Tribunal ruled that GCHQ surveillance doesn't violate human rights. That's hardly surprising, given IPT's track record in approving pretty much everything that GCHQ does. But the global reach of the spying carried out by GCHQ and the NSA means that there are plenty of other bodies that are prepared to condemn what they have been doing. Here, for example, is an important report from the commissioner for human rights at the Council of Europe, entitled "The Rule of Law on the Internet in the Wider Digital World". It's an extremely thorough exploration of this complex area, touching on key issues that have often been discussed here on Techdirt: privatized law enforcement, suspicionless mass data retention, cross-border exchange of data by law enforcement agencies, and global surveillance by national security agencies. The Guardian summarizes the commissioner's views as follows:

The "secret, massive and indiscriminate" surveillance conducted by intelligence services and disclosed by the former US intelligence contractor Edward Snowden cannot be justified by the fight against terrorism, the most senior human rights official in Europe has warned.

In a direct challenge to the United Kingdom and other states, Nils Muižnieks, the commissioner for human rights at the Council of Europe, calls for greater transparency and stronger democratic oversight of the way security agencies monitor the internet. He also said that so-called Five Eyes intelligence-sharing treaty between the UK, US, Australia, New Zealand and Canada should be published.

"Suspicionless mass retention of communications data is fundamentally contrary to the rule of law … and ineffective," the Latvian official argues in a 120-page report, The Rule of Law on the Internet in the Wider Digital World. "Member states should not resort to it or impose compulsory retention of data by third parties."

As the article notes, the commissioner has the power to intervene at the European Court of Human Rights; given the tenor of his report, Muižnieks may well choose to do that in the important case involving GCHQ's spying activities. The commissioner's report is also likely to bolster recent recommendations from the slightly obscure "Article 29 Working Party", an independent advisory body for the European Union on data protection and privacy. The recommendations have been issued in the form of a "joint statement", and, like Muižnieks, the Working Party has no hesitation in criticizing every aspect of the mass surveillance currently being conducted by the UK, US and the other Five Eyes nations, aided and abetted by Internet and telecoms companies. Here are some of its key points:

1. The protection of personal data is a fundamental right. Personal data (which includes metadata) may not be treated solely as an object of trade, an economic asset or a common good.

...

6. Secret, massive and indiscriminate surveillance of individuals in Europe, whether by public or private players acting in an EU Member State or from elsewhere, is neither lawful with regard to the EU Treaties and legislations nor ethically acceptable.

...

8. Unrestricted bulk retention of personal data for security purposes is not acceptable in a democratic society. Retention, access and use of data by national competent authorities should be limited to what is strictly necessary and proportionate in a democratic society, and be subject to effective substantive and procedural safeguards.

...

10. None of the provisions of the European instruments designed to frame international data transfers between private parties provide a legal basis for the transfer of data to a third country authority for the purpose of massive and indiscriminate surveillance (whether Safe Harbor, binding corporate rules or standard contractual clauses).

...

13. The European level of protection of personal data should not be eroded, wholly or in part, by bilateral or international agreements, including agreements on trade in goods or services with third countries.

As those points make clear, the group not only rejects mass surveillance, but also bulk data retention, the Safe Harbor agreement with the US, and the inclusion of chapters harmful to privacy in trade agreements such as TAFTA/TTIP and TISA. Like the commissioner for human rights at the Council of Europe, the Article 29 Working Party has no power to implement any of its recommendations directly, but its strongly-worded condemnation of just about every aspect of the widespread surveillance and data retention in place today adds to growing pressure for both to be drastically reduced.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: human rights, mass surveillance, privacy, surveillance

Secretive UK Court That Approves Of GCHQ Surveillance Says That GCHQ Surveillance Doesn't Violate Human Rights

from the because-to-say-otherwise-would-implicate-itself dept

For a while now, we've been covering various legal challenges in Europe related to the GCHQ's surveillance activities. One of the main cases, brought by Amnesty International and Privacy International, argued that the surveillance violated the European Convention on Human Rights (specifically article 8, on right to privacy, and article 10, on freedom of expression). While it was always expected that the case would eventually go to the European Court of Human Rights, the first step was the Investigatory Powers Tribunal in the UK -- a secretive court that reviews complaints about surveillance, but (as with nearly all "secretive courts" charged with "oversight" on the intelligence community) almost always sides with the intelligence community. Between 2000 and 2012 the IPT only sided against the intelligence community 10 times out of 1468 cases brought (about half of one percent of all cases). In other words, this is a court that (in secret) regularly okays GCHQ's surveillance efforts on UK citizens.

So take a wild guess what happened when it was asked to determine if such surveillance violated human rights? It said of course no human rights were violated when the GCHQ spied on people. This is not a surprise. Anything else would have been a surprise. To put it simply, if the IPT had ruled in favor of these groups, it would have been implicating itself, effectively admitting that its own approvals of GCHQ activity enabled the violation of human rights. And that wasn't going to happen. But that's not how surveillance state defenders are discussing this result:

A government security source told the BBC: "We are delighted that a third independent body has confirmed that GCHQ does not seek to carry out mass surveillance."

Independent body? Right. It's the "independent" body that has a history of saying the very actions now being scrutinized are perfectly fine. It may be "independent" of the GCHQ itself, but it's not "independent" of the surveillance GCHQ carried out.

The groups who brought this case say that they'll appeal to the European Court of Human Rights, which is what everyone expected to happen in the first place. This little rubber stamping by the IPT was just a procedural issue that had to be taken in the first place.

Filed Under: gchq, human rights, investigatory powers tribunal, ipt, surveillance, uk
Companies: amnesty international, privacy international

UN Says Mass Surveillance Violates Human Rights

from the because-it-does dept

Over the summer, the United Nations commissioner for human rights, Navi Pillay, had said that mass surveillance likely violates human rights. At the time, she said:

‟International human rights law provides a clear and universal framework for the promotion and protection of the right to privacy, including in the context of domestic and extraterritorial surveillance, the interception of digital communications and the collection of personal data. Practices in many [s]tates have, however, revealed a lack of adequate national legislation and/or enforcement, weak procedural safeguards, and ineffective oversight. All of these have contributed to a lack of accountability for arbitrary or unlawful interference in the right to privacy.”

Now a new report from a different UN official, issued to the UN General Assembly, backs that up and appears to go further:

International human rights law requires States to provide an articulable and evidence-based justification for any interference with the right to privacy, whether on an individual or mass scale. It is a central axiom of proportionality that the greater the interference with protected human rights, the more compelling the justification must be if it is to meet the requirements of the Covenant. The hard truth is that the use of mass surveillance technology effectively does away with the right to privacy of communications on the Internet altogether. By permitting bulk access to all digital communications traffic, this technology eradicates the possibility of any individualized proportionality analysis. It permits intrusion on private communications without independent (or any) prior authorization based on suspicion directed at a particular individual or organization.

The report is clear that it's not talking about just any surveillance -- but mass surveillance. It notes that preventing terrorism is a legitimate reason for targeted surveillance, but that since there's no proof that mass surveillance actually helps stop terrorism, it's in violation:

Article 17 of the Covenant provides that any interference with private communications must be prescribed by law, and must be a necessary and proportionate means of achieving a legitimate public policy objective. The prevention of terrorism is plainly a legitimate aim for this purpose, but the activities of intelligence and law enforcement agencies in this field must still comply with international human rights law. Merely to assert — without particularization — that mass surveillance technology can contribute to the suppression and prosecution of acts of terrorism does not provide an adequate human rights law justification for its use. The fact that something is technically feasible, and that it may sometimes yield useful intelligence, does not by itself mean that it is either reasonable or lawful (in terms of international or domestic law)

The report also takes on the whole "but it's the internet, you have no privacy anyway" argument pretty clearly:

Some argue that users of the Internet have no reasonable expectation of privacy in the first place, and must assume that their communications are available to be monitored by corporate and State entities alike. The classic analogy drawn by those who support this view is between sending an unencrypted email and sending a postcard. Whatever the merits of this comparison, it does not answer the key questions of legality, necessity and proportionality. The very purpose of the Covenant’s requirement for explicit and publicly accessible legislation governing State interference with communications is to enable individuals to know the extent of the privacy rights they actually enjoy and to foresee the circumstances in which their communications may be subjected to surveillance. Yet the value of this technology as a counter-terrorism and law enforcement tool rests in the fact that users of the Internet assume their communications to be confidential (otherwise there would be no purpose in intruding upon them). This is reflected in the assertions made by members of the intelligence communities of the United States of America and the United Kingdom of Great Britain and Northern Ireland following the disclosure of mass surveillance programmes operated by these two States, in which the disclosures were said to have damaged national security by alerting potential terrorists to the fact that their communications were under surveillance.

[....] The suggestion that users have voluntarily forfeited their right to privacy is plainly unwarranted. It is a general principle of international human rights law that individuals can be regarded as having given up a protected human right only through an express and unequivocal waiver, voluntarily given on an informed basis. In the modern digital world, merely using the Internet as a means of private communication cannot conceivably constitute an informed waiver of the right to privacy under article 17 of the Covenant.

The Internet is not a purely public space. It is composed of many layers of private as well as social and public realms. Those making informed use of social media platforms in which messages are posted in full public view obviously have no reasonable expectation of privacy. The postcard analogy is entirely apposite for the dissemination of information through the public dimensions of Twitter and Facebook, for example, or postings on public websites. But reading a postcard is not an apposite analogy for intercepting private messages sent by e-mail, whether they are encrypted or unencrypted.

From there, the report notes that if states wish to impede on this privacy in the name of preventing terrorism, they must show tangible benefits from such surveillance -- and, so far, no government has done so. Furthermore, the report warns of:

...an ever present danger of “purpose creep”, by which measures justified on counter-terrorism grounds are made available for use by public authorities for much less weighty public interest purposes.

It's good to see such a clear condemnation of the problems of bulk/mass surveillance efforts -- almost always conducted with no evidence of benefit. Of course, the reality is that this report is unlikely to lead the intelligence community to change its stance on these programs, but it further highlights just how out of step with basic human rights these programs remain.

Filed Under: human rights, mass surveillance, nsa, privacy, surveillance, un

Privacy International Files Criminal Complaint Against FinFisher Spyware Company

from the accessories-and-abettors dept

Techdirt has been reporting on the disturbing rise in the use of malware by governments around the world to spy on citizens. One name that keeps cropping up in this context is the FinFisher suite of spyware products from the British company Gamma. Its code was discovered masquerading as a Malay-language version of Mozilla Firefox, and is now at the center of a complaint filed in the UK:

Privacy International today has made a criminal complaint to the National Cyber Crime Unit of the National Crime Agency, urging the immediate investigation of the unlawful surveillance of three Bahraini activists living in the UK by Bahraini authorities using the intrusive malware FinFisher supplied by British company Gamma.

Here's why Privacy International is acting now:

While it's long been known that Gamma has provided surveillance capabilities to Bahrain, amongst other countries, the extent of Gamma's complicity in Bahrain's unlawful surveillance of individuals located abroad has only recently been confirmed. Two months ago, a number of internal Gamma documents were published revealing that Gamma is both aware of, and actively facilitating, the Bahraini regime's surveillance of targets located outside Bahrain through the provision of intrusion technology called FinFisher to the Bahraini authorities.

The analysis by Bahrain Watch clearly shows that, amongst the Gamma documents published online, those targeted by the Bahraini government with FinFisher technology were [the activists] Mohammed, Jaafar, and Saeed, along with prominent Bahraini opposition politicians, democracy activists and human rights lawyers.

Privacy International believes that this alleged surveillance of Bahraini activists while in the UK constitutes an unlawful interception of communications under the UK's Regulation of Investigatory Powers Act 2000 -- the infamous RIPA -- and further argues that Gamma is "liable as an accessory under the Accessories and Abettors Act 1861 and/or encouraged and assisted the offence under the Serious Crime Act 2007." If this reasoning is accepted, it could create an important precedent, at least in the UK.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: activists, bahrain, finfisher, human rights, privacy, surveillance
Companies: gamma, privacy international