U.N. Special Rapporteur: Governments Must Not “Backdoor” Encryption for Spying

A landmark new United Nations report is “the first attempt to create a legal framework for digital security,” David Kaye, the U.N.’s special rapporteur on freedom of expression, told The Intercept in an interview Thursday.

The report is urging governments not to ban or mandate surveillance “backdoors” in encryption and anonymity tools that are used to protect the privacy of communications.

The 18-page document, published Thursday, was authored by Kaye and comes amid efforts to crack down on encryption technology in the United States, with federal agencies claiming that encryption is hampering their ability to investigate criminals and terrorists.

“It’s about the legal framework that human rights law establishes for freedom of expression,” Kaye said. “Hopefully advocates will make use of it when cases around privacy and freedom of expression get litigated.”

His report says that “discussions of encryption and anonymity have all too often focused only on their potential use for criminal purposes in times of terrorism. But emergency situations do not relieve States of the obligation to ensure respect for international human rights law.”

It recommends that:

States should promote strong encryption and anonymity. National laws should recognize that individuals are free to protect the privacy of their digital communications by using encryption technology and tools that allow anonymity online. Legislation and regulations protecting human rights defenders and journalists should also include provisions enabling access and providing support to use the technologies to secure their communications.

States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows.

Human rights group Access said in a statement that it welcomed the report, calling it a “landmark” piece of work that showed encryption was “fundamental” for exercising freedom of expression. “It’s a sober rebuke of baseless fear-mongering from those who say encryption only helps criminals and terrorists,” said Access’s senior policy counsel Peter Micek.

Encryption works by scrambling communications so that if they are intercepted, they cannot be read or listened to, unless the encryption is broken or circumvented. It is routinely used to secure online banking and shopping transactions and increasingly to protect the privacy of instant messages, emails and phone calls. Tools used to browse the Internet anonymously — such as Tor or Virtual Private Networks — mask your computer’s unique IP address, making it harder for law enforcement, intelligence agencies, advertisers and Internet service providers to track your online activity.

Since the first surveillance revelations from National Security Agency whistleblower Edward Snowden in 2013, more companies have adopted encryption to secure their customers’ data and communications. Last year, for instance, the messaging app WhatsApp announced that it was implementing strong encryption for its more than 600 million users. Moreover, in the aftermath of the Snowden leaks, more people reportedly started using anonymity tools like Tor to browse the Web.

The boom in encryption has sparked a panicked response from governments and law enforcement agencies. The FBI has attacked companies for beefing up their usage of encryption because “bad guys” can use it to conceal their nefarious activities. And the U.K. prime minister has appeared to agree, suggesting he would be open to some sort of encryption ban.

But Kaye, the U.N. free expression rapporteur, told The Intercept that he wants to see more encryption, not less. He says he would like to see a transition towards an “encrypted Internet,” with encryption built into websites, email providers and other communication providers by default. He says governments should only be allowed to decrypt communications on a “targeted, case-by-case basis” when approved by a court, subject to domestic and international law.

Encryption is “not about hiding, it’s about exercising the right that you have under human rights law,” said Kaye, who is also the director of the International Justice Clinic at the University of California, Irvine. “If you create an Internet that is encrypted and is secure, you are giving people a default setting of privacy which advances their ability to do research, to exchange information, to do all the things that they are guaranteed under human rights law. That move is critical.”

Kaye says he solicited contributions to his report from all 193 U.N. member states, including from governments in the the Five Eyes surveillance alliance — the United States, United Kingdom, Canada, Australia and New Zealand. Documents from Snowden have previously shown how spy agencies in Five Eyes countries have worked in secret to circumvent and attack widely used encryption and anonymity tools.

About a dozen government representatives sent replies to Kaye, including U.S. Ambassador to the U.N. Pamela Hamamoto, who asserted that the United States was committed to firmly supporting “the development and robust adoption of strong encryption.” Other Five Eyes countries did not respond.

Kaye is due to formally present his report to the U.N.’s human rights council (pictured above) on June 17.

Photo: Valentin Flauraud/Keystone/AP