The following report was released in June by the U.N. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression.  For more information on the report, see Privacy International’s analysis of the document.

Promotion and protection of all human rights, civil, political, economic, social and cultural rights, including the right to development

• 23 pages
• April 17, 2013

1. The present report analyses the implications of States’ surveillance of communications for the exercise of the human rights to privacy and to freedom of opinion and expression. While considering the impact of significant technological advances in communications, the report underlines the urgent need to further study new modalities of surveillance and to revise national laws regulating these practices in line with human rights standards.

2. Innovations in technology have increased the possibilities for communication and protections of free expression and opinion, enabling anonymity, rapid information-sharing and cross-cultural dialogues. Technological changes have concurrently increased opportunities for State surveillance and interventions into individuals’ private communications.

3. Concerns about national security and criminal activity may justify the exceptional use of communications surveillance technologies. However, national laws regulating what would constitute the necessary, legitimate and proportional State involvement in communications surveillance are often inadequate or non-existent. Inadequate national legal frameworks create a fertile ground for arbitrary and unlawful infringements of the right to privacy in communications and, consequently, also threaten the protection of the right to freedom of opinion and expression.

4. In previous reports (A/HRC/17/27 and A/66/290), the Special Rapporteur has analysed the unprecedented impact of the Internet on expanding the possibilities of individuals to exercise their right to freedom of opinion and expression. He expressed concerns at the multiple measures taken by States to prevent or restrict the flow of information online, and highlighted the inadequate protection of the right to privacy in the Internet.

5. Building on his previous analysis, the aim of this report is to identify the risks that the new means and modalities of communications surveillance pose to human rights, including the right to privacy and the freedom of opinion and expression.

6. The following terms are used in this report to describe the most common modalities of surveillance of communications:

(a) Communications surveillance: the monitoring, interception, collection, preservation and retention of information that has been communicated, relayed or generated over communications networks;

(b) Communications data: information about an individual’s communications (e-mails, phone calls and text messages sent and received, social networking messages and posts), identity, network accounts, addresses, websites visited, books and other materials read, watched or listened to, searches conducted, resources used, interactions (origins and destinations of communications, people interacted with, friends, family, acquaintances), and times and locations of an individual, including proximity to others);

(c) Internet filtering: automated or manual monitoring of Internet content (including websites, blogs and online media sources, as well as e-mail) to restrict or suppress particular text, images, websites, networks, protocols, services or activities.

…

V. Modalities of communications surveillance

33. Modern surveillance technologies and arrangements that enable States to intrude into an individual’s private life threaten to blur the divide between the private and the public spheres. They facilitate invasive and arbitrary monitoring of individuals, who may not be able to even know they have been subjected to such surveillance, let alone challenge it. Technological advancements mean that the State’s effectiveness in conducting surveillance is no longer limited by scale or duration. Declining costs of technology and data storage have eradicated financial or practical disincentives to conducting surveillance. As such, the State now has a greater capability to conduct simultaneous, invasive, targeted and broad-scale surveillance than ever before.

A. Targeted communications surveillance

34. States have access to a number of different techniques and technologies to conduct communications surveillance of a targeted individual’s private communications. Real-time interception capabilities allow States to listen to and record the phone calls of any individual using a fixed line or mobile telephone, through the use of interception capabilities for State surveillance that all communications networks are required to build into their systems. An individual’s location can be ascertained, and their text messages read and recorded. By placing a tap on an Internet cable relating to a certain location or person, State authorities can also monitor an individual’s online activity, including the websites he or she visits.

35. Access to the stored content of an individual’s e-mails and messages, in addition to other related communications data, can be obtained through Internet companies and service providers. The initiative of the European standards-setting authority, the European Telecommunications Standards Institute, to compel cloud providers to build “lawful interception capabilities” into cloud technology to enable State authorities to have direct access to content stored by these providers, including e-mails, messages and voicemails, raises concerns.

36. States can track the movements of specific mobile phones, identify all individuals with a mobile phone within a designated area, and intercept calls and text messages, through various methods. Some States use off-the-air mobile monitoring devices called International Mobile Subscriber Identity (IMSI) catchers, which can be installed in a location temporarily (such as at a protest or march) or permanently (such as at an airport or other border crossings). These catchers imitate a mobile phone tower by sending and responding to mobile phone signals in order to extract the unique subscriber identification module (SIM) card number of all mobile phones within a certain territory.

37. States are also increasingly acquiring software that can be used to infiltrate an individual’s computer, mobile phone or other digital device. Offensive intrusion software, including so-called “Trojans” (also known as spyware or malware), can be used to turn on the microphone or camera of a device, to track the activity conducted on the device, and to access, alter or delete any information stored on the device. Such software enables a State to have complete control of the device infiltrated, and is virtually undetectable.

B. Mass communications surveillance

38. Costs and logistical hurdles to conduct surveillance on a mass scale continue to decline rapidly, as technologies allowing for broad interception, monitoring and analysis of communications proliferate. Today, some States have the capability to track and record Internet and telephone communications on a national scale. By placing taps on the fibre-optic cables, through which the majority of digital communication information flows, and applying word, voice and speech recognition, States can achieve almost complete control of tele- and online communications. Such systems were reportedly adopted, for example, by the Egyptian and Libyan Governments in the lead-up to the Arab Spring.

39. In many States, mandatory data retention is facilitating massive collection of communications data that can later be filtered and analysed. Technologies enable the State to scan phone calls and text messages to identify the use of certain words, voices or phrases, or filter Internet activity to determine when an individual visits certain websites or accesses particular online resources. “Black boxes” can be designed to inspect the data flowing through the Internet in order to filter through and deconstruct all information about online activity. This method, called “deep-packet inspection”, allows the State to go beyond gaining simple knowledge about the sites that individuals visit, and instead analyse the content of websites visited. Deep-packed inspection, for example, has been reportedly employed by States confronted with recent popular uprisings in the Middle East and North Africa region.

40. Another tool used regularly by States today is social media monitoring. States have the capacity physically to monitor activities on social networking sites, blogs and media outlets to map connections and relationships, opinions and associations, and even locations. States can also apply highly sophisticated data mining technologies to publicly available information or to communications data provided by third party service providers. At a more basic level, States have also acquired technical means to obtain usernames and passwords from social networking sites such as Facebook.

C. Access to communications data

41. In addition to intercepting and tracking the content of individuals’ communications, States may also seek access to communications data held by third party service providers and Internet companies. As the private sector collects progressively larger amounts of  varied data that reveal sensitive information about peoples’ daily lives, and individuals and businesses choose to store the content of their communications, such as voicemails, e-mails and documents, with third party service providers, access to communications data is an increasingly valuable surveillance technique employed by States.

42. The communications data collected by third party service providers, including large Internet companies, can be used by the State to compose an extensive profile of concerned individuals. When accessed and analysed, even seemingly innocuous transactional records about communications can collectively create a profile of individual’s private life, including medical conditions, political and religious viewpoints and/or affiliation, interactions and interests, disclosing as much detail as, or even greater detail than would be discernible from the content of communications alone. By combining information about relationships, location, identity and activity, States are able to track the movement of individuals and their activities across a range of different areas, from where they travel to where they study, what they read or whom they interact with.

43. Instances of access to communications data by States are growing rapidly. In the three years that Google has been reporting the numbers of requests for communications data it receives, such requests have almost doubled, from 12,539 in the last six months of 2009, to 21,389 in the last six months of 2012. In the United Kingdom, where law enforcement authorities are empowered to self-authorize their own requests for communications information, approximately 500,000 such requests were reported every year. In the Republic of Korea, a country of nearly 50 million people, there are approximately 37 million requests for communications data reported every year.

D. Internet filtering and censorship

44. Advances in technology have not only facilitated interception of and access to communications in specific cases, but have also enabled States to conduct widespread, even nationwide, filtering of online activity. In many countries, Internet filtering is conducted under the guise of maintaining social harmony or eradicating hate speech, but is in fact used to eradicate dissent, criticism or activism.

45. Filtering technologies mentioned above also facilitate the monitoring of web activity in order to enable the State to detect forbidden images, words, site addresses or other content, and censor or alter it. States can use such technologies to detect the use of specific words and phrases, in order to censor or regulate their use, or identify the individuals using them. In countries with high levels of Internet penetration, Internet filtering reportedly enables the censorship of website content and communications and facilitates the surveillance of human rights defenders and activists.

46. In addition to technologies that facilitate filtering and censorship, many States are conducting manual Internet filtering, by creating online police forces and inspectors in order to physically monitor the content of websites, social networks, blogs and other forms of media. In some States, “cyber police forces” are tasked with inspecting and controlling the Internet, searching websites and critical nodes within websites (particularly online discussion forums) with a view to block or shut down websites whenever they contain content the Government disapproves of, including or criticism of the country’s leadership. The burden of such policing is transferred to private intermediaries, such as search engines and social network platforms, through laws that widen liability for proscribed content from the original speaker to all intermediaries.

E. Restrictions on anonymity

47. One of the most important advances facilitated by the advent of the Internet was the ability to anonymously access and impart information, and to communicate securely without having to be identified. Initially, this was possible given that there was no “identity layer” to the Internet; originally, it was not possible to know who was behind a specific communication, e-mail address, or even a given computer. However, in the name of security and law enforcement, gradually States have been eradicating the opportunities for anonymous communication. In many States, individuals must identify themselves at cybercafés and have their transactions on public computers recorded. Increasingly, identification and registration are also required when buying a SIM card or mobile telephone device, for visiting certain major websites, or for making comments on media sites or blogs.

48. Restrictions on anonymity facilitate State communications surveillance by simplifying the identification of individuals accessing or disseminating prohibited content, making such individuals more vulnerable to other forms of State surveillance.

49. In this sense, restrictions on anonymity have a chilling effect, dissuading the free expression of information and ideas. They can also result in individuals’ de facto exclusion from vital social spheres, undermining their rights to expression and information, and exacerbating social inequalities. Furthermore, restrictions on anonymity allow for the collection and compilation of large amounts of data by the private sector, placing a significant burden and responsibility on corporate actors to protect the privacy and security of such data.

Share this: