New Report Analyzes How Crypto Backdoors, Interference with Crypto, and Compelled Disclosure of Encryption Keys All Impact Free Expression and Privacy
Defending encryption is a human rights issue, according to a new Amnesty International report. The report calls on nation-states to promote the use of encryption tools as part of their international human rights obligations to protect the privacy of their populations.
Amnesty particularly notes the role of encryption in promoting free expression:
In the digital age, access to and use of encryption is an enabler of the right to privacy. Because encryption can protect communications from spying, it can help people share their opinion with others without reprisals, access information on the web and organize with others against injustice. Encryption is therefore also an enabler of the rights to freedom of expression, information and opinion, and also has an impact on the rights to freedom of peaceful assembly, association and other human rights. Encryption is a particularly critical tool for human rights defenders, activists and journalists, all of whom rely on it with increasing frequency to protect their security and that of others against unlawful surveillance.
The Amnesty report cautioned that attempts to force companies to create backdoors to their services would constitute "a significant interference with users’ right to privacy and free expression" and would be "impermissible under international human rights law."
The report examines the encryption policies and approaches taken by a number of countries, including Russia, Morocco, Pakistan and the United States. The report analyzed problems with several methods for restricting encryption, including:
- General measures banning or restricting encryption
- Requiring companies to backdoor encryption
- Mandatory disclosure of encryption keys
- Targeted decryption orders
Amnesty sums up its views of such proposals by stating:
Because of the critical role played by encryption in enabling the enjoyment of, among others, the rights to privacy and freedom of expression, restrictions on access to and use of encryption, constitute an interference with the enjoyment of human rights. As such, any restrictions on encryption must be contained in laws that are precise and transparent, must be used only when necessary to achieve a legitimate aim and must not discriminate against specific individuals or groups. Critically, any measure interfering with encryption must be proportionate to achieving the legitimate aim for which it is imposed, and the benefits gained through the adoption of such measure must not be outweighed by the harm caused, including to individuals and network infrastructure and security.
Amnesty International believes that laws and policies that prohibit the use of particular encryption services or tools as such, prohibit the deployment of encryption outside of government-sanctioned specifications, or which require individuals to seek government licences prior to using encryption, amount to a disproportionate interference with the enjoyment of the rights to privacy and freedom of expression. Such measures not only deprive all individuals in a particular jurisdiction of the ability to effectively secure their communications, they also prevent individuals from freely and confidently accessing the internet and other digital technologies, and can have a “chilling effect” on freedom of expression and access to information.
Measures to oblige corporations to backdoor the encryption used in their products or services (affecting all users) constitute a significant interference with users’ rights to privacy and freedom of expression. Given that such measures indiscriminately affect all users’ online privacy by undermining the security of their electronic communications and private data, Amnesty International believes they are inherently disproportionate, and thus impermissible under international human rights law.