Anonymity, Democracy, and Cyberspace

0 downloads 0 Views 171KB Size Report
communications free from government or any other intrusion. Anonymity and the use .... the Internet March 2000, at. .

Anonymity, Democracy, and Cyberspace Cite as: Akdeniz, Y., Anonymity, Democracy, and Cyberspace, Social Research, (2002) 69(1), Spring, pp 180-194. By Yaman Akdeniz



Introduction The Internet is a social, cultural, commercial, educational and entertainment global communications system the legitimate purpose of which is to benefit and empower online users, lowering the barriers to the creation and the distribution of expressions throughout the world. The Internet boom in the 1990s created new opportunities for communications and for discussion. It is not only used for socially useful and commercial purposes by the “consumers” but also used against human rights abuses and for the preservation of freedom of expression. There are major concerns about the vehicle the Internet provides for personal snooping not only by commercial institutions1 but also (and more seriously) by governmental organisations2 and law enforcement bodies all keeping track of individual usage of the Internet for the purposes of marketing, policing or otherwise. With the rapid growth of the Internet as the newest medium for global communications, and for commerce, comes the need to review the interaction of conflicting demands for respect for privacy, freedom of expression and the detection and punishment of crime. Although the advancement of technology means that “privacy rights” are more and more in danger and open to abuse, the Internet does not create new privacy issues. Rather, it makes the existing ones - like confidentiality, authentication and integrity of the personal information and correspondence circulated - difficult to control and secure. Political activists, human rights campaigners and organisations, and dissident movements



1 2

in

repressive

regime

rely

on

anonymous

communications

for

CyberLaw Research Unit, Faculty of Law, University of Leeds, Leeds LS2 9JT. E-mail: [email protected] See also Akdeniz, Y, Walker, C., Wall, D., (eds), Internet, Law, and Society, Addison Wesley Longman, December 2000. Note also the websites and . BBC News, “E-mail: Our right to write?,” 4 May, 2000, at . Campbell, D., “Echelon: Interception Capabilities 2000 Report”, April PE 168.184 / Part 4/41999

2 communicating human rights abuses in their countries or their views on the political state of their governments via the Internet. Furthermore, users can engage in whistle blowing, receive counselling or engage in all forms of discussions. This article will therefore describe anonymity on the Internet, how can it be achieved, and why it is an essential tool for free speech. The article will also describe proposals to outlaw anonymity over the Internet as anonymity has been often tied to criminal activity over the Internet by law enforcement bodies.

Anonymity and the Internet Anonymity is socially useful and has been a vital tool for the preservation of political speech and discourse through-out the history. As a concept anonymity is closely related to free speech and privacy. The Internet technology allows anonymous communications and this can be used for several purposes including for both socially useful purposes and for criminal purposes. There are many organisations dealing with human rights abuses all around the world such as Human Rights Watch and Amnesty International and these organisations do use the Internet to communicate with their members or with dissident groups. Before the governments can suppress the dissemination of critical writings, and reports, the authors can distribute their work through the Internet outside repressive regimes. It is well known that the Burmese dissidents3 or the Mexican Zapatistas4 use the Internet to communicate with the rest of the world. It is critical and vital for human rights activists, political dissidents, and whistle blowers throughout the world to facilitate confidential communications free from government or any other intrusion. Anonymity and the use of strong encryption tools can help to preserve political discourse and dissemination of information related to human rights abuses in the Information Age.

3 4

(STOA publication) at . See . See Akdeniz, Y., “No Chance for Key Recovery: Encryption and International Principles of Human and Political Rights,” (1998) Web Journal of Current Legal Issues 1 at ; Cleaver, H., `The Zapatistas and the Electronic Fabric of Struggle,' at .

3 Tools that provide and maintain anonymity are used by political and some special subject interest groups, such as users of the Critical Path AIDS Project’s Web site, users of Stop Prisoner Rape (“SPR”) in the USA, and Samaritans in the UK. For example, readers of notices from groups which send out electronic alerts, such as Amnesty International, American Civil Liberties Union and the Tibetan Government-in Exile, can ensure that the alerts have not been altered by people wishing to disrupt the group’s activities. On the other hand, many members of SPR’s mailing list have asked to remain anonymous due to the stigma of prisoner rape. It is important for this kind of users who seek to access sensitive information to remain anonymous, and it should be their right to do so in this context. Internet privacy activists have developed experimental anonymous re-mailer programs that address these concerns in respect to free speech and personal liberty. An anonymous re-mailer is simply a computer service that forwards e-mails or files to other addresses over the Internet. But the re-mailer also strips off the “header” part of the messages, which shows where they came from and who sent them. The most untraceable re-mailers (e.g. MixMaster)5 use public key cryptography which allows unprecedented anonymity both to groups who wish to communicate in complete privacy and to “whistle-blowers” who have reason to fear persecution if their identity became known. According to Ball, true anonymous re-mailers maintain no database of addresses: “When messages are resent from a truly anonymous re-mailer, the header information is set either to a deliberately misleading address, or to randomly generated characters. There is no record of the connection between the sending address and the destination address. For greater security, many users program messages to pass through five to twenty re-mailers before the message arrives at its final destination. This technique, known as chaining, assures greater security than sending through a single re-mailer. Even if some re-mailers keep secret records of their transactions, a single honest re-mailing system will protect the user. One disadvantage is that unless the sender has identified herself in the body of the message, the recipient has no way to reply to an anonymously sent message.”6

5 6

Cottrel, L., Mixmaster FAQ, . See Affidavit of Witness Patrick Ball in ACLU v. Miller, January, 1997,

4 One of the best-known anonymous remailers on the Internet, anon.penet.fi, was offered for more than three years by Johann Helsingius. However, the remailing service was closed in August 1996 partly because of allegations by the UK Observer newspaper that anon.penet.fi contributed to the distribution of child pornography.7 Among its users were Amnesty International, the Samaritans, and the West Mercia Police who used it as the basis of their “Crimestoppers” scheme. Furthermore, as one commentator states, “I may have a good idea you will not consider if you know my name. Or I may individually fear retaliation if my identity is revealed. Anonymity is therefore good, because it encourages greater diversity of speech.”8 A good example of this is the Anonymizer.com, an online project founded by Lance Cottrell, the author of world’s most secure anonymous remailer, Mixmaster. Anonymizer.com offers such a forum for anonymous discussions apart from offering the possibility to surf the Internet anonymously. For example, Anonymizer’s Kosovo Project allowed individuals to report on conditions and human rights violations from within the war zone, without fear of government retaliation. Furthermore, Anonymizer launched the Chinese Population Control Survey at the instigation of Lord Alton (member of the British House of Lords). The project will document the Chinese government’s population control policy, utilising an encrypted online Questionnaire.9 Online anonymity is therefore important both to free speech and privacy just as anonymity and anonymous speech have been used for thousands of years in the larger society. It is important for people’s participation in online equivalents of “Alcoholics Anonymous” and similar groups, and individuals have a right to this kind of privacy that should not be abridged for the pursuit of vaguely defined infractions.

Online Anonymity and Cyber-Crimes 7

8

9

Another reason was a Finnish court’s decision in favour of the Scientologists that Helsingius had to provide some of the users’ names. For more information and the full press release, see . Wallace, J., “Mrs. McIntyre in Cyberspace: Some thoughts on anonymity,” The Ethical Spectacle, May 1997 at < http://www.spectacle.org/597/mcintyre.html> and Wallace, J., Nameless in Cyberspace: Anonymity on the Internet, Cato Institute, December 1999, at . See further the Anonymous Communications on the Internet project of the American Association for the Advancement of Science at .

5 “While the Internet and other information technologies are bringing enormous benefits to society, they also provide new opportunities for criminal behaviour.” The former US Attorney General Janet Reno, January 10, 2000. Although anonymity has its extremely important benefits to human rights as described above, anonymity is often tied with cyber-crimes or it is claimed that anonymity would allow criminals to use the Internet for criminal activities10 without the possibility for detection. Such law enforcement fears include the use of anonymous communications for hate mail, child pornography,11 fraud, and for cyber-stalking.12 “By the same token, however, individuals who wish to use a computer as a tool to facilitate unlawful activity may find that the Internet provides a vast, inexpensive, and potentially anonymous way to commit unlawful acts, such as fraud, the sale or distribution of child pornography, the sale of guns or drugs or other regulated substances without regulatory protections, and the unlawful distribution of computer software or other creative material protected by intellectual property rights.”13 According to the above report, “law enforcement agencies are faced with the need to evaluate and to determine the source, typically on very short notice, of anonymous emails that contain bomb threats against a given building or threats to cause serious bodily injury.”14 Although the report recognised the need for anonymity for the legitimate needs described above, described the anonymous e-mail accounts, as “the proverbial doubleedged sword” as “they add new complexities to identifying online lawbreakers” apart from protecting privacy. Similar concerns were raised by the report for anonymous remailers and the report states that “such services can plainly frustrate legitimate law

10

11 12

13

14

See further Denning, D.E., Baugh, W.E. JR, “Hiding crimes in cyberspace,” in eds Thomas, D., Loader, B.D., CyberCrime: Law enforcement, security, and surveillance in the information age, London: Routledge, 2000, pp 105-132. Akdeniz, Y., “Child Pornography,” in Akdeniz, Y., & Walker, C., &, Wall, D., (eds), The Internet, Law and Society, Addison Wesley Longman, 2000, 231-249. Ellison, L., & Akdeniz, Y., “Cyber-stalking: the Regulation of Harassment on the Internet,” [1998] Criminal Law Review, December Special Edition: Crime, Criminal Justice and the Internet, pp 2948 at . The Electronic Frontier: The Challenge of Unlawful Conduct Involving the Use of the Internet A Report of the President’s Working Group on Unlawful Conduct on the Internet March 2000, at . Ibid.

6 enforcement efforts”15 despite providing privacy and encouraging freedom of expression. The report concluded that: “Internet-based activities should be treated consistently with physical world activities and in a technology-neutral way to further important societal goals (such as the deterrence and punishment of those who commit money laundering). National policies concerning anonymity and accountability on the Internet thus need to be developed in a way that takes account of privacy, authentication, and public safety concerns.”16 However, it is not very clear how the US Government plans to address the law enforcement needs while preserving the rights of the individual Internet users. There were attempts to pass legislation that would barr anonymous communications in the past. In fact, the ACLU challenged a Georgia law restricting free speech on the Internet.17 ACLU and others stated that the Georgia law was unconstitutionally vague and overbroad because it barred online users from using pseudonyms or communicating anonymously over the Internet in September 1996. Furthermore, the ACLU responded to the above report by stating that, “anonymity on the Internet is not a thorny issue; it is a Constitutional right. The United States Supreme Court held that the Constitution grants citizens the right to speak anonymously”18 within the context of political speech. Moreover, the ACLU warned that “an end to Internet anonymity would chill free expression in cyberspace and strip away one of the key structural privacy protections enjoyed by Internet users.”19

Anonymity and Freedom of Expression Individual privacy cannot be considered in isolation. It must be weighed alongside freedom of speech and expression.20

15 16 17 18

19 20

Ibid. Ibid. American Civil Liberties Union of Georgia v. Miller, 977 F. Supp. 1228 (N.D. Ga. 1997). See McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995), at . See further Anne Wells Branscomb, Anonymity, Autonomy, and Accountability: Challenges to the First Amendment in Cyberspaces, 104 Yale L.J. 1639 (1995). March 8, 2000, . Report of the Committee on Privacy and Related Matters, Chairman David Calcutt QC, 1990, Cmnd. 1102, London: HMSO,para. 3.12, page 7.

7

“Freedom of speech and privacy are frequently conceived as rights or interests of the individual, and as rights or interests of the community as a whole.”21 Those who call for the prohibition of anonymous re-mailers or other restrictions on online anonymity may, however, fail to recognise the cost of such action to the on-line community in terms of fundamental freedoms. Placing restrictions upon anonymity online would have serious negative repercussions for freedom of expression and privacy on the Internet. As mentioned above, freedom of expression can be facilitated by anonymity on-line. International conventions such as the European Convention on Human Rights (“ECHR”) does recognise freedom of expression as a right and article 10 of the ECHR states that: 1.Everyone has the right to freedom of expression. This right should include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers... 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security,…., for the prevention of disorder or crime, …, for the protection of the reputation or rights of others, …... Though freedom of expression is not an absolute right under the ECHR and it may be restricted under paragraph 2, the importance of anonymity as a facilitator of free speech has been affirmed by the European Court of Human Rights in the case of Goodwin v UK.22 The Court recognised that the press has a vital watchdog role in a healthy democratic society and that this function could be undermined if journalists are not reasonably allowed to keep confidential the sources of their information.23 In this case, the Court concluded that the application of the law of contempt to a recalcitrant journalist was not necessary where the subject of the damaging story had already obtained an injunction against publication. 21 22 23

It is not clear that the same level of

Wacks, R., “Privacy in Cyberspace: Personal Information, Free Speech, and the Internet,” in eds Birks, P., Privacy and Loyalty, Oxford: Clarendon Press, 1997. (1996) 22 EHRR 123. See further the Council of Europe Recommendation No. R (2000) 7 on the right of journalists not to disclose their sources of information, 8 March 2000, at

8 protection of anonymity would be afforded by the European Court to the idle gossip of non-press speakers such as is common on the Internet, but anonymous “political speech” would deserve higher protection like in the above mentioned US Supreme case of McIntyre.24 Moreover, there may also be instances where Internet postings may lead to persecution if the identity of the individual is known. The Supreme Court in NAACP v. Alabama ex rel. Patterson25 stated that “inviolability of privacy in group association may in many circumstances be indispensable to preservation of freedom of association”.26

Anonymity and Privacy The boundaries of privacy have been stated in international law by article 8(1) of the European Convention on Human Rights and Fundamental Freedoms (1950)27 as comprising

a

right

“to

respect

for...private

and

family

life,...home

and

...correspondence”, though subject, under article 8(2), to interferences such as might be necessary in a democratic society: “...in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others” The monitoring of communications can constitute an interference with the right to respect for private life and correspondence in breach of Art. 8(2), unless it is carried out in accordance with a legal provision capable of protecting against arbitrary interference by the state with the rights guaranteed.28 The exceptions provided for in Article 8(2) are to be interpreted narrowly,29 and the need for them in a given case must be convincingly established. Furthermore, the relevant provisions of domestic law must be both accessible and their consequences foreseeable, in that the conditions and circumstances in which the state was empowered to take secret measures such as

24 25 26 27 28 29

. McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995) at . 357 U.S. 449 (1958). Ibid. Council of Europe, 87 UNTS 103, ETS 5, Strasbourg, 1950. Malone v United Kingdom (A/82) (1985) 7 E.H.R.R. 14; Valenzuela Contreras v Spain, Application No. 27671/95, (1999) 28 EHRR 483. See Klass and Others v. Germany (A/28): (1978) 2 E.H.R.R. 214, para. 42.

9 telephone monitoring were clearly indicated as the European Court of Human Rights held.30 In particular, the avoidance of abuse demanded certain minimum safeguards, including the conditions regarding the definition of categories of persons liable to have their telephones tapped, and the nature of offences that could give rise to such an order. One should note the Council of Europe’s CyberCrime Convention, the first coordinated approach at an international level for not only fighting cyber-crimes but also to develop common approaches to law enforcement practices on the Internet.31 The CyberCrime Convention includes provisions related to interception of communications, preservation and disclosure of traffic data, production orders, search and seizure of stored computer data, real-time collection of traffic data, interception of content data, and mutual assistance between the law enforcement agencies of the Convention signing states regarding these measures. However, the provisions of Council of Europe’s CyberCrime Convention32 seems incompatible with article 8(2) and the conditions and safeguards provided within the Convention are not clearly defined. The provisions of the CyberCrime Convention will certainly have a negative impact upon privacy of communications and privacy over the Internet.33

A proportionate and effective response? The new media historically face suspicion and are liable to excessive regulation.34 The implication is that the Internet may be at a similar stage when the natural reaction of the 30

31

32

33

34

Kruslin v France (A/176-B) (1990) 12 E.H.R.R. 547; Huvig v France, A/176-B, (1990) 12 EHHR 528; Halford v. United Kingdom, (Application No. 20605/92), Judgment of June 25, 1997, 24 E.H.R.R. 523; Valenzuela Contreras v Spain, Application No. 27671/95, (1999) 28 EHRR 483. Council of Europe Draft Cyber-Crime Convention, version no 25, at . See also the draft Explanatory Memorandum through , February 2001. Council of Europe Draft Cyber-Crime Convention, version no 25, at . See also the draft Explanatory Memorandum through , February 2001. One could argue that this is already happening within the UK with the Regulation of Investigatory Powers Act 2000. See generally Akdeniz, Y.; Taylor, N.; Walker, C., Regulation of Investigatory Powers Act 2000 (1): Bigbrother.gov.uk: State surveillance in the age of information and rights, (2001) Criminal Law Review, (February), pp. 73-90 at . See e.g. Official Secrets Act 1920, section 4 - power to intercept foreign telegrams despatched to or from any private cable company in the UK and section 5 which compels a person in the business of receiving postal packets, to register his business. See Rosamund Thomas, Espionage and Secrecy, Routledge, 1991, page 17.

10 state is try to regulate, but the possibility of successfully doing so is debatable. The author recognises and supports the need to counter criminal use of the Internet. Moreover, the author also recognises that in countering such use it may sometimes be necessary to infringe the rights of honest Internet users in order to secure the prosecution and conviction of guilty parties. But in considering such action, it is necessary to apply the following tests to any proposals that are made:35 1) That they provide clear net benefit for society. That is, the benefits are clear and are achievable by the measures proposed, with a detrimental impact on the rights of honest citizens that is as small as possible and one that is widely accepted as tolerable in the light of the gains secured. 2) That the measures proposed discriminate effectively between criminals and honest, law abiding citizens. Therefore, they should be balanced and should not, in an impetuous desire to counter crime, expose all honest Internet users to such risks as government access to encryption keys. 3) That of all the options available they are the best in the sense that they are the most effective in countering criminals while having the least impact on honest citizens and the lowest costs for taxpayers and businesses. 4) They should be based on clearly defined policy objectives which citizens understand and which command widespread public support. 5) They should be enforceable, transparent, and accountable. Furthermore, privacy and freedom of expression are fundamental human rights recognised in all major international and regional agreements and treaties such as the Universal Declaration of Human Rights (article 12, article 19); the International Covenant on Civil and Political Rights (article 17, and article 19); and the European Convention on Human Rights (article 8, and article 10) as mentioned above. These important international documents should be taken into account while developing policies against cyber-crimes by governments, regional, and international organisations. 35

See further Cyber-Rights & Cyber-Liberties (UK) statement for the Seminar for the Media on the Convention against Transnational Organized Crime (Palermo, Italy) within the E-media: An avenue for communication or cyber-crime? session, United Nations Convention Against Transnational Organized Crime, Palermo, Italy, 12-15 December, 2000, at ; Cyber-Rights & Cyber-Liberties (UK) Statement for the European Parliament, Temporary Committee on the ECHELON interception system, meeting of Thursday, 22 March, 2001, Brussels, .

11 Any co-ordinated policy initiative at a supranational level (e.g. the European Union or within the Council of Europe in relation to the adoption of the draft Convention on Cyber-crime), or at an international level (e.g. within the OECD, or within G8) should also offer the best protection for individual rights and liberties.

Conclusion Apart from facilitating freedom of expression, anonymity also enables users to prevent surveillance and monitoring of their activities on the Internet not only from commercial companies but also from government intrusion. Total anonymity may be possible by the use of such privacy enhancing technologies as that offered by Anonymizer.com. Another good example is Freenet36 which does not have any form of centralised control or administration over information published on its server. Freenet allows both authors and readers of information stored on this system to remain anonymous if they wish. It is also worth noting the Cyber-Rights.Net project developed by Cyber-Rights & Cyber-Liberties (UK) in conjunction with Hush Communications which offers Internet users free encrypted email solution based upon the Hush Encryption Engine.37 Both the Website and project promote privacy of communications and hopes to raise awareness for security on the Internet,38 especially in the absence of clearly defined conditions and safeguards protecting the privacy of communications in homes and in working environments. Cyber-Rights.Net is an additional tool for concerned Internet users when securing their communications. The development of such tools should be encouraged and future technologies should be privacy friendly for the preservation of basic human rights despite the law enforcement worries. Governments should recognise the value of the global communications networks both at an economic and cultural level and for the benefit of individual freedom and collective democracy. They should co-operate to respect fundamental human rights

36

37 38

See . Note also the Free Haven project at aims to deploy a system for distributed, anonymous, persistent data storage which is robust against attempts by powerful adversaries to find and destroy any stored data and the WannaFree project at . See . See the privacy policy of Cyber-Rights.Net at which states that Cyber-Rights.Net does not collect personal data associated to individuals for the

12 such as freedom of expression and privacy and should encourage rather than limit the peoples’ usage of the Internet through excessive regulation even in the aftermath of such horrific terrorist attacks on America on September 11. The impact of Internet technology has raised many privacy issues, and it will be one of the greatest civil liberty issues of the new millenium. However, whether the importance of anonymity on the Internet both to free speech and to privacy will ultimately be recognised and, in turn, influence the shape of future regulatory initiatives, remains to be seen.

provision of Cyber-Rights.Net accounts.