In his landmark report to the 23rd session of the Human Rights Council, Frank La Rue, the U.N's free speech watchdog, makes clear that anonymous expression and secure communication are critical for an open society. We gave you a quick look at that report yesterday. Now we want to take a deep dive into his support for your rights to anonymity and encryption, and what countries need to do to reflect his conclusions.

La Rue’s official title is “Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression”. In 2011, he called upon states to ensure that individuals have the right to express themselves anonymously online. In this year’s report, La Rue highlights how restrictions on anonymity chill free speech. La Rue urges states that they should generously err on the side of protecting freedom of expression rather than restricting it, and concludes:

Anonymity of communications allows individuals to express themselves freely without fear of retribution or condemnation. ... Restrictions of anonymity in communication, for example, have an evident chilling effect on victims of all forms of violence and abuse, who may be reluctant to report for fear of double victimization. ...

States should refrain from compelling the identification of users as a precondition for access to communications, including online services, cybercafés or mobile telephony.

In many nations, individuals must identify themselves by presenting government-issued photo IDs at cybercafés and have their transactions on public computers recorded. Increasingly, identification and registration are also required when buying a SIM card or cell phone, for performing important transactions online, or even for posting comments on media sites or blogs, La Rue notes.

Individuals are now also required to use their real names online in many states, the UN envoy explains:

China recently adopted the Decision to Strengthen the Protection of Online Information, requiring Internet and telecommunications providers to collect personal information about users when they sign up for Internet access, landline, or mobile phone service. Service providers allowing users to publish online are required to be able to link screen names and real identities. These real name registration requirements allow authorities to more easily identify online commentators or tie mobile use to specific individuals, eradicating anonymous expression.

While users can enjoy relative anonymity on the Internet, La Rue explained that states and private actors have access to technology to monitor and collect information about individuals’ communications and activities on the Internet.  The U.N envoy concludes:

“Without adequate protection to privacy, security and anonymity of communications, no one can be sure that his or her private communications are not under states’ scrutiny”.

EFF has always argued that encryption is crucial to create that security. In the absence of encryption, online communications can easily be intercepted by anyone, not just the police. Individuals and government agencies should all use strong encryption routinely. The report warns that the security and anonymity of communications can be undermined by laws that limit the use of privacy-enhancing tools. La Rue insists:

[i]ndividuals should be free to use whatever technology they choose to secure their communications, and that states should not interfere with the use of encryption technologies, nor compel the provision of encryption keys. States should not retain or require the retention of particular information purely for surveillance purposes.

La Rue’s comments on encryption could not come at a better time.  Today, governments all around the world are seeking to ban, block, or redesign personal communications technologies based on a misguided notion that these technologies are too secure. The United States has recently considered increasing law enforcement agencies’ ability to spy on people’s privacy by mandating "back doors" in communications systems. This mandate seeks to deliberately weaken encryption or other security measures to give other parties access to the users’ communications.  The FBI's dream of an Internet where it can listen to anything is wrong and inconsistent with human rights principles. One should be able to have a private conversation online, just as one can have a private conversation in person. The White House is currently debating whether or not to introduce legislation to turn the FBI’s dream into reality. Mandatory backdoors take away developers' right to innovate and users' right to protect their privacy and anonymity of speech using the technologies of their choice.

The South African Regulation of Interception of Communications and Provisions of Communication- Related Information Act of 2002 also requires decryption assistance from any person who possesses the decryption key. Similar laws exist in Finland (Section 4(4)(a) Coercive Measures Act 1987/450), Belgium (Art. 9, Law on computer crime of 28 November 2000), and Australia (Sections 12 and 28 Cybercrime Act 2001), the report notes.

A similar proposal is being hatched at the European Telecommunications Standards Institute. In his report, La Rue raises his concern about proposed ETSI standards on building “lawful interception capabilities” into cloud technology to enable state authorities to have direct access to content stored by these providers, including e-mails, messages and voicemails.

Surveillance infrastructure is on governmental wish lists around the world. Several governments in the Middle East and South Asia have threatened to ban or block Blackberry Messenger and other communications tools they regarded as too secure, unless they were redesigned to remove security features and facilitate government spying. And just last year, Colombia adopted a new decree that compels ISPs to create infrastructure that would make it easier for law enforcement to spy on Colombians. The law also forces ISPs and telecom providers to continuously collect and store for five years the location and subscriber information of millions of ordinary Colombian users.  

La Rue also provided a larger context for the role of anonymous communications:

...[r]estrictions on anonymity facilitate State communications surveillance by simplifying the identification of individuals accessing or disseminating prohibited content, making such individuals more vulnerable to other forms of State surveillance. In this sense, restrictions on anonymity have a chilling effect, dissuading the free expression of information and ideas. They can also result in individuals’ de facto exclusion from vital social spheres, undermining their rights to expression and information, and exacerbating social inequalities.

In 2011, EFF submitted comments to the Special Rapporteur suggesting a set of best practices for promoting free expression, privacy, and anonymity on the Internet.  In our comments, we recommended that the Special Rapporteur recognize the aforementioned rights—to use encryption technology and communicate anonymously—and push Internet intermediaries not to block encrypted communications, but rather to design systems for end-to-end privacy.  Our recommendations also included due process steps which governments must take before disclosing the identity of an anonymous speaker.

These are practical moves that every nation can take now: to defend their own society’s values, as well as live up to the requirements of international human rights law. Lawmakers and the courts should protect their citizens’ right to anonymity and communication security as sacrosanct, even as they consider laws to fight cyber-crime or protect intellectual property.  

If they do not, the Internet will become a universal tool of oppression instead of a tool of empowerment.