Netizen Report: You Can’t Encrypt, But We Can Spy

Photo by Jeroen Bennink and reused here with Creative Commons license.

Global Voices Advocacy’s Netizen Report offers an international snapshot of challenges, victories and emerging trends in Internet rights around the world.

The massive hack of Milan-based surveillance software firm Hacking Team has sent security researchers and tech journalists on what is starting to feel like a never-ending fact-finding mission through the over 400GB of leaked data. From Ecuador to Ethiopia to Mexico to Morocco, the documents confirm what journalists, human rights advocates and political opposition groups in these and many countries had suspected for a long time: Their governments were spying on them using techniques that, among other things, don’t quite seem legal.

In a recent discussion among digital privacy advocates, Professor Kyung Sin Park of Korea University Law School raised the question of whether government agencies had pursued and obtained warrants before employing Hacking Team’s “Remote Control System” (RCS) software:

“I am sure that some use of RCS was done according to warrants issued by domestic courts….However, RCS operates by sending ordinary-looking emails and luring the target to open and click on a file attachment which, on activation…[takes] control of the target’s personal communication device, making available for the controller indiscriminate amounts of information going through the device. Because of these special features, some federal magistrates in US have denied warrants for these types of surveillance techniques, and others have granted them.”

This conversation is ongoing, and while highly relevant in countries where rule of law is strong, it is less salient in other parts of the world.

Image courtesy of Flickr user r. nial bradshaw and used here under Creative Commons license.

In Ethiopia and Morocco, the revelations have touched a nerve with Global Voices community members who are now virtually certain that their own communications devices were infected and monitored using Hacking Team spyware. Despite the questionable legality of using Hacking Team products, the Zone9 bloggers in Ethiopia and Global Voices’ former advocacy director Hisham Almiraat in Morocco face direct legal threats from the government because of their efforts to report on and circumvent government surveillance.

Although he was well aware of it at the time, the Hacking Team leaks confirm that the Moroccan government infected the devices of the citizen team behind Mamfakinch, a blogging and digital activism group led by Almiraat that came together to report on Morocco’s 2011-12 protest movement. The latest chapter in this saga unfolded in May 2015, when the Association for Digital Rights, a new group also founded by Almiraat, was served with a lawsuit filed by the Ministry of Interior shortly after the group published a report on government surveillance of journalists in Morocco. Although the language in the filing did not mention the report by name, it specified “a report which includes serious accusations of spying by its services.” No further proceedings have taken place in the case thus far.

Meanwhile in Ethiopia, the now well-known case of the Zone9 bloggers continues, with four bloggers still in prison on charges that focus on the group’s use of popular human rights defender encryption guides, such as Tactical Technology Collective’s Security-in-a-Box. Although five bloggers and journalists originally arrested in this group were released in early July, a new group of digital activists has since been jailed in Ethiopia on very similar charges. Yonatan Wolde, Abraham Solomon, Bahiru Degu and Zelalem Workagenhu are facing charges for applying to attend an Internet security and social media training session abroad, and on suspicion that they have links to the diaspora-based opposition group Ginbot 7.

In short, the leaks show us a trend of governments quietly using all the technical tools they can to spy on their political and civic opponents — and all the legal tools at their disposal to fight their efforts in public.

In Argentina, comment is not free

Argentina’s Chamber of Deputies is considering a bill that would render many types of online comments “discriminatory” and thus subject to criminal penalties. The bill would encourage a wide range of intermediaries, including blogs, news sites, social networks and other digital media to get rid of commenting features and place responsibility for “discriminatory” comments on users. It also creates a new criminal offense for discrimination punishable by one month to three years in prison. It has been broadly criticized as an inappropriate response to the issue of online hate speech and a clear threat to free expression.

Telegram App is under attack in East Asia. Time to hire a carrier pigeon?

Messaging app Telegram underwent a massive DDoS attack on its Asia-Pacific servers on July 10, and was then blocked in China on July 13. As is typically the case in these scenarios, the source and impetus behind the attack is difficult to verify. However, various reports have pointed to Chinese state-run media coverage, asserting that human rights lawyers and advocates have been using the app’s Secret Chat mode to stage “attacks on the [Communist] Party and government.”

Photo by Yuri Samoilov and reused here with Creative Commons license.

Bahrain’s latest move in its ‘game of chess’ with human rights advocates

Bahraini human rights activist Nabeel Rajab was freed from prison and received a royal pardon on the same day Ibrahim Sharif, secretary general of the leftist National Democratic Action Society political party, was sent to jail pending investigation. News of Rajab’s release was welcomed with caution by netizens, who commented the government appeared to be “playing chess” with its political dissidents, according to Global Voices’ Amira Al Hussaini.

Russians now have the right to be forgotten

Russian President Vladimir Putin signed the country’s version of a “right to be forgotten” bill into law, making it possible for individuals to require Internet search engines remove links that contain purportedly false or outdated information. The final text of the law, which went through various iterations in the Duma, has some provisions that make it less far-reaching than the EU version of the law. For example, it includes a requirement that the user prove that information has become outdated. It also requires search engines to review removal requests within 10 days, or face court proceedings and fines.

Ethiopia’s Zone9 bloggers are still waiting for a verdict

The verdict in the Zone9 bloggers case was delayed until July 29 after the court adjourned a planned hearing on July 20. Although five bloggers and journalists associated with the group were released in early July, four of the bloggers remain in prison and face charges. If found guilty, the bloggers could receive a mandatory minimum of eight years in prison — but there is hope the court will exonerate them of their charges, particularly given the lack of substantive evidence. In addition, the court will hear another set of cases on July 22, including those of four men charged with applying to attend a digital security training event. Yonatan Wolde, Abraham Solomon, Bahiru Dego and Zelalem Workagenhu were arrested on July 8, the same day several Zone 9 bloggers were released.

UK court rules that you can’t copy digital media for any reason ever

A High Court ruling in the UK will make it illegal to copy CDs, DVDs, MP3s or E-books holding media under copyright onto computers or other devices, even as a backup for personal use. The ruling overturns the Copyright and Rights in Performances (Personal Copies for Private Use) Regulations 2014, in response to a challenge from music industry groups. As BBC put it, “It means consumers can’t technically copy a CD they own and use one version in the car and another at home.” The law will also apply to artists, teachers and other professionals who use music and other digital media in order to do their jobs. It is unclear how the law will be enforced.

MediaShift