Human Rights Reporting

Spring 2004 Student Work

The Internet Arms Race: A Fight for Privacy

By Jennifer Esty

With ever increasing internet penetration in countries with human rights problems, individuals and human rights organizations find themselves in open technological arms race with governments intent on blocking access or restricting speech.

Robert Guerra, managing director of Privaterra, an organization that provides technological consulting to NGOs, says the ongoing battle between individuals and organizations trying to protect their privacy and governments or surveillance groups "becomes like an arms race" with each side trying to develop and use the latest technology.

Patrick Ball, the director of Human Rights Programs at the nonprofit group Benetech, however, calls this a "false analogy" because the two sides are so unequal-particularly when some privacy technology is hard to procure or to use and when individuals or organizations don't have the same resources that governments like China or Saudi Arabia have.

The issues at stake may not have the immediacy or horror of tragedies such as genocide or ethnic cleansing. They involve something that most Americans take for granted: the ability to send and receive information electronically without fear of reprisal. Alistair Hodgett, an Amnesty spokesman, says: "It's harder for people to see how a software package or a server can be an instrument of oppression that is as effective as a set of leg irons."

The issues are also more ambiguous. Bobson Wong, an independent internet researcher on issues related to access, censorship and governance, says "People can understand if people are being arrested for publishing something or for running off a newsletter, but if you're talking about restricting access to computers it's a tricky thing because first of all there are some things that authoritarian governments ban that some people would like to see banned anyway." Wong refers to content such as pornography, spam, or viruses.

Wong says "The problem is of course that a lot of more restrictive governments try to block other stuff and that's where it becomes a freedom of expression issue." He adds, "When you talk about press freedom it's generally about pro-democracy, not about Playboy's right to publish in Saudi Arabia."

Techno-literacy, both by the public and the human rights organizations being targeted for surveillance or website blocking, is another challenge. Wong says "a lot of the larger human rights organizations just don't have the technical expertise to deal with these issues and convey them properly to the general public."

Even if the organization could get the message out, the American public itself may not understand the technology well enough to understand the impact on human rights. Guerra says, "A lot of people are a little naïve, and that's probably an understatement, about how email works." He adds that it is "far easier to intercept than regular mail" because postal mail has federal legal protections, at least in the United States.

Ball, who has provided technical assistance to human rights commissions all over the world, says, "I don't think Americans understand how much information they move around electronically." He also believes "most people value their privacy so little they won't do anything that requires work to protect it."

So what can be done to safeguard against prying eyes?

According to Guerra, protection can be as simple as awareness or as complicated as encryption. His organization, Privaterra, works with human rights organizations and NGOs to evaluate their use of technology and provide strategic training and awareness. He says the first step he takes when working with a new group is to "understand what technologies are being used, more and more are using computers for their work."

He calls many NGOs "late adopters" of technology. For many the computer is nothing more than a glorified typewriter is "because they don't have strategic technology advice or technology officers" to understand its potential and its hazards. He says "if they can just analyze the risks, they can have a better understanding" of what protections are available. The second step he takes is to actually do a risk analysis. He differentiates between security (data backup, virus protection) and privacy (protecting against surveillance).

Guerra says there are technological and non-technological solutions for these organizations, including simple steps such as backing up data and storing it safely off premises. In terms of privacy, encryption is one technological solution but he says it's "not as easy as people think" and points out that many NGOs "don't have good internet connections; their computers are slow, are being shared." He says for these organizations "using these tools proves a challenge."

Cindy Cohn, legal director for the Electronic Frontier Foundation, also knows this from experience. She says, "There's a whole kind of psychological denial going on." She recalls one example: "I tried to get Nigerian human rights workers to use some basic encryption and I couldn't make it happen."

Encryption is a process whereby electronic communicated are encoded so that only someone with a "key" can decode the message. Phil Zimmerman, the creator of Pretty Good Privacy (PGP), one of the first widely available encryption programs, says PGP was "originally developed as a human rights project, that was its primary purpose, I didn't really think about its commercial use."

Although encryption is a very secure way to avoid surveillance, it has its own drawbacks. Jagdish Parikh, online content coordinator for Human Rights Watch, says encryption is a powerful tool but it "also makes it visible that you're encrypting." He says "you can become a target for more surveillance" and points out that encryption is illegal in many countries.

Groups like Anonymizer or the Martus Project (led by Benetech's Patrick Ball) offer individuals and organizations alternatives for securing their data and protecting their privacy.

According to its website, the Martus Human Rights Bulletin System is "a free software technology tool designed to assist human rights organizations in collecting, safeguarding, organizing and disseminating information about human rights abuses." It provides encryption and storing data safely on remote servers, reducing the changes of seizure, loss or file corruption.

Anonymizer provides a range of personal and business products. Their products provide services, such as detecting the presence of spyware, erasing cookies, encryption, and virus detection. Anonymizer is not a free service, prices start at approximately $30 for an annual subscription.

On the other side of the "arms race" are governments with access to personnel with the ability to infiltrate chatrooms or message boards and control technological resources such as routers with built-in surveillance capabilities to monitor email activity. In the case of China, they also control other information media outlets, including television and radio. Minky Worden, the electronic media director for Human Rights Watch, says ""China makes better use of the technology tools" than countries like Vietnam, which tend to rely on "old fashion brutality."

In the U.S., "nannyware," or software used to filter and block specified Internet content, is the subject of continued debate, particularly in public libraries where it can block information on breast cancer or AIDS in an attempt to deny access to pornography. Governments, such as China-which as Guerra points out "owns the infrastructure"-have the upper hand when they can use nannyware as the default in the provision of internet service.

According to a report released in January by Amnesty international, "all communication on the Internet in China passes through government-controlled routers." The government does not provide a list of which sites are blocked or filtered, but a study by Harvard Law School in 2002 found that approximately 25 percent of the web sites they tested were inaccessible from at least one location in China.

Faced with this level of sophistication and resources from tech-savvy governments, human rights organizations need to protect their technological resources as much as their physical resources. Cohn says when most Internet surveillance goes undetected by the end user it's harder to make the case to prioritize basic privacy protections. She says, "When they break down your door and they take all your stuff, you know it's happened." She adds that most organizations choose to "prioritize the thing that you can see."

The key challenge of the arms race, however, is not the technology. Wong says "it's not just about the technology; part of it is just that these people are being watched." He points out that the real question is "the more fundamental issue of why are these people being monitored in the first place."