UN report promotes encryption as fundamental and protected right

A meeting of the UN Human Rights Council in Geneva. Special Rapporteur on freedom of opinion and expression David Kaye is due to present his report on encryption there on June 17. (Reuters/Denis Balibouse)

On Wednesday, Special Rapporteur on freedom of opinion and expression David Kaye will present his report on international legal protection for encryption and anonymity to the United Nations Human Rights Council. The report is an important contribution to the security conversation at a time when some Western leaders are calling for ill-informed and impossible loopholes in technology--a trend that facilitates surveillance and tends to enable states that openly seek to repress journalists.

Ethiopia, which aggressively prosecuted a group known as the "Zone 9" bloggers for participating in email encryption training, is one such state. Authorities there jail more journalists than any other country in Africa, other than Eritrea, and it is the fourth most censored country in the world, according to CPJ research. The Ethiopian government is suspected of conducting widespread surveillance inside the county and of hacking the computers of journalists living overseas.

"In a country like Ethiopia where journalists are consistently watched, [we] need to protect their communications and their data to do reports on sensitive issues," Endalkachew H/Michael, one of the co-founders of Zone 9, told CPJ by email. "If a journalist cannot protect her communication with her sources, she cannot practice journalism."

Michael, who left Ethiopia to study for his doctorate in media studies at the University of Oregon, added: "I believe encryption is a lifeblood for freedom of expression."

In his report, Kaye urged states to promote strong encryption and anonymity through legislation and regulation. The report recommended eschewing restrictions on encryption and anonymity "which facilitate and often enable the rights to freedom of opinion and expression." Kaye said measures by states that weaken security online posed a "serious threat" to freedom of expression, and suggested that some common state practices and proposals were in violation of international law. The report described blanket measures such as encryption backdoors, weak encryption standards, and the holding of encryption keys inescrow as deeply problematic, and concluded that "measures that impose generally applicable restrictions on massive numbers of persons, without a case-by-case assessment," are almost certainly illegal.

In order to satisfy international proportionality principles, the report said, forced decryption by governments must be made on a case-by-case basis, constrained by law, and subject to judicial warrant.

The report went further, acknowledging that state regulation of encryption can be "tantamount to a ban[.]" It condemned the regulatory practices of countries including Pakistan, Cuba, and Ethiopia, noting that they interfered with the right of individuals to encrypt communication. The report supported anonymous and pseudonymous speech, and denounced rules that require users to identify themselves as a precondition to communication. Finally, it urged privately owned companies to refrain from blocking or limiting encrypted communication and topermit anonymous communication.

Why encryption by default is necessary

Kaye's recommendations get to the core of why encryption by default is so necessary. He has brushed aside technically impossible rhetoric and dismissed false legal narratives that serve to reinforce the power of states to censor, surveil and harass journalists.

Under international law, state action that restricts freedom of expression must meet an exacting legal test. First, any limitations must be provided for by law. Second, they must be imposed on legitimate grounds. Third, they must be necessary and proportionate. As enablers of the right to freedom of expression, any restrictions on encryption or anonymity must conform to the same standards, Kaye argues in his report. And that means restrictions on encryption or anonymity are especially likely to fail the third prong because "blanket prohibitions fail to be necessary and proportionate."

Like the right to freedom of expression, encryption and anonymity also enable individuals to form and hold opinions. Unlike freedom of expression the right to hold opinions is absolute--a key distinction Kaye identified as an independent but related basis for protecting privacy-enhancing tools.

Kaye told CPJ that technology was generating new threats to which existing legal principles must apply, adding, "How can a person develop opinions about the world without access to receive information, especially online?"

An attorney, Kaye is realistic about the limits of law for regulating government behavior. As he notes in his report, many states have explicit protection for journalist-source communication. Nonetheless, "States often breach source anonymity in practice, even where it is provided for in law." His report emphasized the need for journalists and others to have the freedom to protect themselves, an astute argument given the borderless nature of the Internet.

For Ali Nikouei, an Iranian blogger who said he was forced to flee, the need for protection is a stark reality. "A journalist [or] an activist who wants to, for example, organize a protest, who wants to have a connection with a news agency outside of Iran ... they have problems," Nikouei told CPJ at the Circumvention Tech Festival in Valencia, Spain, in March. Nikouei, who said he was arrested and held for three months in Iran in 2009, added: "The government is listening to their conversations. The government does everything it can."

Kaye's report gives further momentum to CPJ's vital work. We are engaged with the U.N., the American government, companies, and newsrooms to help make encryption by default a reality in 2015-- a shift that would protect journalists, sources, readers, and other end-users automatically. CPJ converted its site to HTTPs-only earlier this year, which helped us successfully advocate for security improvements at institutions such as Knight Media Lab at Northwestern University and investigative journalism nonprofit ProPublica. Additionally, CPJ will host a technology summit in San Francisco this week to press for the uniform adoption of security best practices in newsrooms.

The momentum for enhanced security is building. The Let's Encrypt project aims to provide free, automated, and open HTTPS certificates to the public within several months. On June 12, Wikipedia announced that its site would convert to HTTPS by default, a process in which the international blogging network Global Voices is also engaged, and which The New York Times is exploring. And, at the same time that it was pressuring Apple and other tech companies to build backdoors into their devices, the U.S. government announced on June 8 that it would move to HTTPS-only for all publicly accessible federal websites and Web services.

To Kaye, the link between press freedom and technology is clear. "[G]overnments are using a variety of technologies and approaches either for mass surveillance or for targeted attacks on and surveillance of activists, journalists, civil society organizations, and others, and some [governments] use technology to block access to information," Kaye told CPJ by email. "Individuals use tools like encryption and anonymizing platforms to protect themselves and their privacy or legitimately gain access to information."

He added: "Those tools need to be protected to allow exercise of fundamental rights to opinion and expression. Restricting these tools restricts exercise of the rights."

Kaye's report drew on submissions from states and civil society organizations -- including a joint letter submitted by CPJ and the Reporters Committee for Freedom of the Press, which can be read here.

Source: https://www.cpj.

Eritrea and Ethiopia named most censored countries in Africa

Kenyan journalists demonstrate for press freedom. Eritrea ranked number one while Ethiopia came in fourth in the list of 10 most censored countries in the world.

Eritrea and Ethiopia have been named as the most censored African countries in a report compiled by the Committee to Protect Journalists (CPJ).

According to the CPJ release, the list is “based on research into the use of tactics ranging from imprisonment and repressive laws in the harassment of journalists and restrictions on Internet access.”

Eritrea ranked number one while Ethiopia came in fourth in the list of 10 most censored countries in the world. The eight other countries on the list are North Korea, Ethiopia, Azerbaijan, Vietnam, Iran, China, Myanmar, and Cuba.

CPJ says Eritrea’s president Isaias Afewerki “has succeeded in his campaign to crush independent journalism, creating a media climate so oppressive that even reporters for state-run news outlets live in constant fear of arrest.”

The tactics used by Eritrea and North Korea – second on the list – mirror each other to a large extent. These regimes use “a combination of media monopoly, harassment, spying, threats of journalist imprisonment, and restriction of journalists' entry into or movements within their countries” to keep their grip on power.

The last accredited international reporter was kicked out of Eritrea in 2007, while those invited occasionally to just interview the president are closely monitored by state security.

“Imprisonment is the most effective form of intimidation and harassment used against journalists,” CPJ adds.

The country is Africa's worst jailer of journalists, and with at least 23 behind bars it ranks third in the world just after Iran, which has jailed 30, and China 44.

Additionally, President Afewerki’s government has deliberately limited internet access through slow dial up connections such that less than one per cent of the population goes online.

Eritrea also has the lowest figure globally of cell phone users, with just 5.6 per cent of the population owning one, making the country the least connected place on earth.

“Fearing the spread of the Arab Spring in 2011, the government scrapped plans to provide mobile Internet for its citizens,” the CPJ report says.

This limited the possibility of accessing information to the point where most Eritreans had no idea that the regimes in countries nearby in Egypt, Tunisia and Libya were being swept out of power.

In Ethiopia, the watchdog says the threat of imprisonment has forced a majority of journalists to seek asylum abroad for fear of persecution.

A crackdown on bloggers and independent publications in 2014 forced over 30 journalists to flee the country, and ahead of the May 2015 elections, authorities have stepped up the campaign to close down the country’s last remaining independent publications through a wave of arrests of journalists and publishers.

“Filing lawsuits against editors and forcing publishers to cease production have left only a handful of independent publications in a country of more than 90 million people,” CPJ says.

Last year, 10 independent bloggers were imprisoned while authorities charged six publications in court for “encouraging terrorism”, forcing at least 16 journalists to flee the country.

Ethiopia has also been accused of using surveillance technology to spy of dissidents at home and abroad.

A report released last year by Citizen Lab, a non-profit research lab that investigates surveillance technology across the world, says Ethiopia has been using a sophisticated malware to spy on Ethiopian journalists based in the US and Western Europe.

Source;theeastafrican

Ethiopian Government Uses Cyber-Attacks to Restrict Media Houses

Thehill.com reported during second week of March 2015 stating that the Ethiopian government is using cyber attacks to try to stop news from reaching to its citizens.

Researchers of the University of Toronto discovered attempts by the Ethiopian government to hack the computers of journalists based at US who are working with Ethiopian Satellite Television (ESAT).

Ethiopian journalists who left their home country after being subjected to criminal charges and government threats are running an independent news outlet.

During November and December of 2014, researchers say that digital attackers tried to place spyware on the computers of two employees of ESAT in Washington, D.C. The software would have allowed the hackers to steal files and passwords and also capture all calls in Skype and instant messages.

The cyberattackers tried to penetrate the computers with a fake email with an enclosed Microsoft Word Document containing the malicious spyware.

Citizen Lab analysed the attacks thoroughly and suggested that attacks were conducted with a spyware known as Remote Control System (RCS) sold by an Italian Hacking Team which sells hacking and surveillance technology.

This spyware was supposedly used in December 2013 in trying to infect systems of ESAT employees. If the spyware is installed successfully on the computer of the target, it would allow the government to control the software access to activity on the PC or phone including files, email, typed passwords on the device, contact lists, audio and video from the gadget's microphone and camera.

Citizen Lab also discovered that the spyware which was used in attacking ESAT seems to have been updated recently in December 2014.

The Ethiopian government did not directly answer questions about usage of products of Hacking Team for the purpose of spying.

Washingtonpost.com published news during second week of March 2015 quoting a statement of Tesfaye Wolde Ambassador of Ethiopia in Washington as "Ethiopia acts according to its own laws and with the laws of nations."

Washingtonpost.com published news during second week of March 2015 quoting Eric Rabe, Spokesperson of the company, as saying "Hacking Team investigates the allegations of the abuse. If we find that an agency is misusing our technology, we can take many actions and even withdraw our support from the system."

» SPAMfighter News - 01-04-2015

Source: www.spamfighter.com