Special Report – Encryption and Anonymity | On the Line

Special Feature | The use of encryption tools and the protection of anonymity online…

… as safeguards for freedom of the press

 

David Kaye

UN Special Rapporteur on freedom of expression and freedom of opinion

David Kaye is the UN Special Rapporteur on the promotion and protection of the right to freedom of expression. In his latest report, he stressed that governments are obligated to protect encryption tools and guarantee the anonymity and privacy of users so as to safeguard the right to freedom of expression online.

Kaye’s reports states that the ban imposed by some governments on anonymity online, such as Brazil, Venezuela and Vietnam, interferes with the  right to freedom of expression. It also highlights that other countries have imposed a slightly subtler ban on anonymity by establishing a real-name registration scheme on bloggers (Russia) or on all internet users (China).

Kaye concludes that  because of the importance of encryption and anonymity to the protection of free speech, any state restrictions on these practices should be subject to the principles of “legality, necessity, proportionality and legitimacy in objective”.

IPI’s Javier Luque Martínez spoke with Kaye about encryption and press freedom during an expert consultation on the protection of sources and whistleblowers in June 2015 in Vienna.

Why is the use of encryption tools and the protection of anonymity so important for investigative journalists in terms of shielding their communications and sources of information?
Restrictions on encryption should be provided by law and subject to the principles of necessity and proportionality. How can we tackle the diversity of legislation regulating encryption?
The report highlights a few countries implementing legislation to protect anonymity and encryption following the International Covenant on Civil and Political Rights, Austria among them.
Looking ahead, what are the main challenges that governments face when developing regulatory frameworks to foster the use of encryption to secure anonymity and privacy in their countries?
Paul Radu

Investigative journalist, founder of the Organized Crime and Corruption Reporting Project, Romania

Can you give us an example in which encryption or anonymity has been crucial to your investigative work?

Well, we have been working on many high profile money-laundering cases over the past two years. For instance, in the Magnitsky case we investigated money that was stolen from the Russian budget and ended up in the possession of other companies and people connected to the Kremlin.

Another example of such an investigation is what we released last year. It’s called the Laundromat We investigated and exposed an operation in which $US 20 billion was laundered through one bank in Moldova. A Russian bank and a Latvian bank were also involved. This investigation exposed the involvement of very high-profile people like Igor Putin, the cousin of Vladimir Putin, former (FSB) agents and very important bankers in Russia, Moldova and Latvia. So this would be some examples of our investigative reporting.

What encryption tools do you use (Email, instant messaging apps, encrypted cloud services, etc.)?

Of course, this sort of work involves working with journalists from several countries and they all need to use encryption. We mostly use PGP in order to encrypt our e-mail and in order to encrypt our documents.

When we communicate, in some cases we use cryptophones for voice encryption.

It’s secured voice and messaging. This is a bit of an expensive solution, but when you’re confronted with serious organised crime and powerful fraudsters connected to governments, then you need to employ as secure of methods as possible. So there is PGP or GPG. Some of us are using the free GPG, and cryptophones.

How does encryption help you in your investigative work?

In this case, it’s mostly about communication between journalists, between reporters that gather data in a country and need to pass that information onto the network in a secure way. This is not about the source. This is mostly about the original work of the journalist who gathers the information and needs to send it away.

For instance, if I were to gather information from Romania or from Serbia or from Ukraine and I needed to send this information for further checks to other journalists in the network in other countries, I would always encrypt the information so that the people we are investigating who have lots of resources don’t get wind of it.

Should encryption and anonymity be limited by a regulatory framework?

I think [having such a framework] would greatly affect press freedom. We need encryption to protect against not only state actors but also organised crime groups that are very, very powerful and sometimes have more resources than the state.

And such groups never will abide by state regulations, that’s why they engage in cross-border crime. So if state like the UK or another state prevents us from using encryption, that will affect our work a great deal and it can mean ultimately even loss of life. If you’re exposed against the kinds of guys we’re working against, it’s really dangerous.

Sebastian Mondial

Investigative journalist, research and digital security specialist, Die Zeit, Germany

Can you give us an example in which encryption or anonymity has been crucial to your investigative work?

There’s no case in which we don’t use encryption. If it’s just a public affair, let’s say we use only the internal mail server. If you start e-mailing people in other companies, then you use a form of encryption that protects the content. Once we establish contact with someone who has sensitive information, we never deviate from the path of encryption.

What encryption tools do you use (Email, instant messaging apps, encrypted cloud services, etc.)?

Wickr. It’s the tool of choice for a lot of people. You can set how long the message can be viewed. The maximum is six days. It only stays visible for a limited time across devices – if you don’t read it in the time the source wants it to be read, it self-destructs. After a week, the information is no longer stored; the connection between us disappears. There is more privacy and security over time. And because it’s a zero knowledge system, it can’t be surveilled unless someone is physically tapping your device. The communication between me and my source is completely secret. It’s really cool stuff. I think zero knowledge is the future of communication.

There is Silent Circle and Signal/Red Phone, voice communication that doesn’t reveal the content. No chance of interception, except hacking the phones. You can make sure nobody’s in between. Then we use OTR (off-the-record messaging), with TAILS, which is also used for research.

How does encryption help you in your investigative work?

It helps in a strange way to establish trust. You can’t see who’s trying to access your system. The attacker is always trying to hit you at your weakest spot. But if you establish more trust [with sources] at the beginning, they clearly say what’s up. And if it’s more sensitive, you can make an appointment, walk in a park or meet in a crowded restaurant or something. It’s helping us not to be exposed to risking the identity of sources or leaking out information to others. For communication with sources, it’s important.

Should encryption and anonymity be limited by a regulatory framework?

The thing about encryption and anonymity is that they are connected. You need to use encryption to achieve anonymity. Anonymity is essential. It allows people to come forward without fear of being exposed, and that is important.

Yolanda Jinxin Ma

Investigative journalist, expert on data journalism, co-editor and founder of Data Journalism China

Can you give us an example in which encryption or anonymity has been crucial to your investigative work?

Two years ago, I was a managing editor of the Connected China project, a data-driven visualisation application about Chinese leaders and political institutions. It looks at power in China, explaining how it flows, presenting the key players and institutions as well as their relationships.

What encryption tools do you use (Email, instant messaging apps, encrypted cloud services, etc.)?

We used an encrypted email service for internal communications for people who were in China. It’s one of the top three choices. I have also used an instant messaging app to sms some sources, and I have a virtual system installed on my computer that I use for very extreme cases.

How does encryption help you in your investigative work?

We’re not sure that it did help, but it made us feel safer. Some of the team members were followed by national security – foreign media are closely monitored [in China]. There’s a mentality that everything you do is under surveillance. The encrypted email service made people feel more reassured, but you can never prove that it works.

You need a comprehensive security plan, not just one tool. But most tools are in English, so there’s a language barrier, and they can be difficult to set up.

Should encryption and anonymity be limited by a regulatory framework?

I don’t think there are laws in China claiming encryption to be a crime, at least not yet. [Authorities] are trying to push for having an ID connected to you on the internet, but it’s hard to control because there are so many people in China.

Strengthening Online Security: Resources and guidelines for journalists and human rights defenders 

Special report on encryption and anonymity by:

Cora Henry

IPI Contributor, @coraghenry

Natalie Rowthorn

IPI Contributor, @nrowthornIU

Javier Luque

IPI Digital Media Coordinator, @javierluquem