Last Thursday, David Kaye, the U.N's newest free speech watchdog, released a groundbreaking report calling upon states to promote strong encryption and anonymity. Kaye assumed the role of Special Rapporteur for Freedom of Expression in August 2014, and this, his first report, will be presented at the 29th regular session of the United Nations Human Rights Council in Geneva mid-June.

His analysis comes at a key moment.  The ability to communicate anonymously and to use encryption is more important than ever and the Rapporteur rightly notes that privacy is a gateway for freedom of opinion and expression, saying:

“Encryption and anonymity, today’s leading vehicles for online security, provide individuals with a means to protect their privacy, empowering them to browse, read, develop and share opinions and information without interference and enabling journalists, civil society organizations, members of ethnic or religious groups, those persecuted because of their sexual orientation or gender identity, activists, scholars, artist and others to exercise the rights to freedom of expression and opinion.”  

We strongly agree.

Moreover, these critical tools are increasingly under attack by states around the world, with little understanding of the human rights consequences. We’ve learned from Edward Snowden about the NSA’s long-standing systematic effort to sabotage the encryption used by individuals and businesses around the  world. At the same time, several governments are seeking new powers (or threatening) to force companies to provide government access to encrypted communications in their products or services (United Kingdom, United States).

Some states forbid anonymity in their constitutions (Brazil, Venezuela); others have attempted to outlaw the use of pseudonyms (Vietnam), block the use of anonymity tools (Belarus), require mandatory registration for blogging (Russia), or compel SIM card and device registration. Yet more have proposed or have implemented compulsory data retention regimes that can strip anonymity from most users (Paraguay, Colombia, Mexico, Australia, and some European countries).

While anonymity and encryption have both been misrepresented solely as a tool for criminal behavior, the report helps clarify the broad range of essential functions encryption and anonymity play in a free and democratic society.  The report emphasizes the role they play in a lesser noticed “right to hold opinions without interference,” noting that this right is absolute, unlike other rights that may be restricted by law or other power. The Rapporteur notes, rightly, that people hold their opinions digitally, saving their views and their search and browse histories, making the link between the absolutely right to hold opinions and the need to secure the media that hold them. Kaye also notes the other rights implicated by encryption and anonymity:   

“Encryption and anonymity, and the security concepts behind them, provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age. Such security may be essential for the exercise of other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity.”

Kaye’s report recommends that member states:

• Promote strong encryption and anonymity. National laws should recognize that individuals are free to protect the privacy of their digital communications by using encryption technology and tools that allow anonymity online.

• Include provisions (legislation and regulations) enabling access and support to use technologies to secure human rights defenders and journalist communications.

• Prohibit restrictions on encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate.

• Avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. On backdoors he echoes the points raised by the security community noting that: “a backdoor, even if intended solely for government access, can be accessed by unauthorized entities, including other States or non-State actors. Given its widespread and indiscriminate impact, back-door access would affect, disproportionately, all online users.”

• Refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users.

• Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (i.e., not to a mass of people) and subject to judicial warrant and the protection of due process rights of individuals.

Kaye also rejects data retention mandates, embraces the Manila Principles on intermediary liability and the 13 Necessary and Proportionate Principles that EFF helped draft. The report also call upon companies to:

• Review their own corporate policies that restrict encryption and anonymity (including through the use of pseudonyms).

This is a great list.  With this powerful first report, Special Rapporteur David Kaye builds upon the legacy of Frank La Rue, the previous rapporteur whose work on the intersection between privacy and freedom of expression provided important context to the Snowden leaks in the international human rights community. We hope countries and companies will adopt Kayes’ recommendations, taking a stand for strong encryption and anonymous speech instead of constantly working to undermine them.