Hiperderecho

We campaign for solutions

Change

Content

ryul-davidson-PcyrQsX5f4w-unsplash.jpg

Summary

Privacy International is part of a 60+ coalition calling on Facebook and Google to provide equal and better transparency regarding political advertising on their platforms globally.

Media

Key points

We believe it is necessary for both Google and Facebook to:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

This letter is also available in Spanish.

Dear Mr. Zuckerberg and Mr. Pichai,

In the past few years, you have pioneered important transparency tools to help your platform users understand, learn about and contextualise the political advertising they see. We agree that advertiser verification processes and ad repositories are key safeguards against online manipulation and misinformation. However, we are saddened to observe that these benefits have not been equally distributed among your global user base.
Each platform operates fluctuating and often widely differing transparency standards for different countries. While some users benefit from seeing political advertising in an ad repository, others do not. Where some users are offered detailed information about a political ad, others are not. There are no legitimate or otherwise publicly disclosed reasons justifying this difference in treatment.
The combined effect of these inconsistent policies is to create a two-tiered user base within each platform, with a wide regulatory gap separating the transparency haves and have-nots. We first highlighted these problems in 2019. While some progress has been made since, we are disappointed to conclude that the transparency divide persists.
Online transparency should not be a privilege of the few, but the right of all. To that end, the changes we believe are necessary are as follows:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

The above changes, which we believe to be fair and reasonable, are only a starting point to begin to correct the current platform-created inequality between users. By contrast, the benefits are conclusive: heightened transparency standards for millions of users worldwide, and increased legitimacy of online political advertising for the sake of fair and informed decision-making by voters.
We urge you to take responsibility as two of the most influential platforms in online political campaigning, and empower users and voters with heightened ads transparency.

Yours sincerely,

Access Now
Africa Freedom of Information Centre (AFIC)
Aliansi Jurnalis Independen/Alliance of Independent Journalists (AJI)
Amnesty International
ApTI
Article 19
Artículo 19 México y Centroamérica
Asociación por los Derechos Civiles
Asociación para una Ciudadanía Participativa, ACI Participa
Associação Data Privacy Brasil de Pesquisa
Asociación para el Progreso de las Comunicaciones (APC)
Association for International Affairs (AMO) in Prague
Association pour le Developpement Integré et la Solidarité Interactive (ADISI-C)
Citizen D
Centre for Independent Journalism Malaysia (CIJ-M)
Collaboration on International ICT Policy for East and Southern Africa (CIPESA)
Civil Liberties Union for Europe
Bytes for All (B4A)
Datos Protegidos
Defend Democracy
Dejusticia
Democracy Reporting International (DRI)
Derechos Digitales
Digital Rights Foundation
ELSAM
Electronic Frontier Finland
Electronic Frontier Norway
epicenter.works
EU Disinfo Lab
Fundación Acceso
Fundación Huaira de Quito-Ecuador
Fundación Internet Bolivia
Fundación Karisma
Freedom Forum
Free Media Movement (FMM)
Global Forum for Media Development
Global Witness
Hiperderecho
Homo Digitalis
Instituto Brasileiro de Defesa do Consumidor
InternetLab
Intervozes - Coletivo Brasil de Comunicação Social
IPANDETEC Centroamérica
Irish Council for Civil Liberties (ICCL)
Laboratorio de Datos y Sociedad (DATYSOC)
Media Foundation for West Africa (MFWA)
Media Institute of Southern Africa MISA- Zimbabwe
Media Matters for Democracy
Merit Legal Advocacy & Human Rights Initiative (MELAHRI)
OBSERVACOM
Paradigm Initiative (PIN)
Privacy International
R3D: Red en Defensa de los Derechos Digitales
SFLC.in
Stiftung Neue Verantwortung (SNV)
Sursiendo, Comunicación y Cultura Digital AC
TEDIC
The Tor Project
Unwanted Witness
Usuarios Digitales
Venezuela Inteligente
Who Targets Me
World Wide Web Foundation
Xnet

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

The Association for Civil Rights (ADC) is a non-governmental organisation based in Buenos Aires that promotes civil and social rights in Argentina and other Latin American countries. It was founded in 1995 with the aim of fostering a legal and institutional culture to guarantee fundamental rights, based on respect for the constitution and democratic values.

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Dejusticia

The Center for Law, Justice and Society (Dejusticia) is a Colombia-based NGO that works to strengthen the rule of law and promote human rights in Colombia and across the developing world. It produces research to contribute to action for social change, and carries out advocacy through campaigns, litigation, education and capacity-building.

Country of Operation

Region of Operation

Website

Dejusticia

Derechos Digitales

Founded in 2005, Derechos Digitales is a non-profit organisation based in Chile that works across Latin America. Its main objective is the development, defense and promotion of human rights in the digital environment. Its work focuses on issues around freedom of expression, privacy and personal data, and copyright and access to knowledge.

Country of Operation

Chile

Region of Operation

Website

Derechos Digitales

Digital Rights Foundation

Digital Rights Foundation (DRF) is a research and advocacy NGO based in Pakistan that focuses on how Information and Communication Technologies (ICTs) can support human rights, democratic processes and digital governance. It works towards a world where all people, and especially women, are able to safely exercise their right of expression.

Country of Operation

Pakistan

Region of Operation

Website

DRF

Fundación Karisma

Founded in 2003, Fundación Karisma is a civil society organisation dedicated to supporting and disseminating the good use of technologies in digital environments, social processes and public policies in Colombia and the region, with a human rights focus. It also undertakes legal and technological activism in coalitionwith local, regional and international partners.

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Hiperderecho is a non-profit Peruvian organisation dedicated to facilitating public understanding and promoting respect for rights and freedoms in digital environments. It seeks to spread the liberating capacity of technology to develop or enhance digital spaces so that all Peruvians can exercise their rights and strengthen their citizenship.

Country of Operation

Region of Operation

Website

InternetLab

InternetLab is an independent research center that aims to foster academic debate around issues involving law and technology, especially internet policy. Our goal is to conduct interdisciplinary impactful research and promote dialogue among academics, professionals and policymakers. We follow an entrepreneurial nonprofit model, which embraces our pursuit of producing scholarly research in the manner and spirit of an academic think tank. As a nexus of expertise in technology, public policy and social sciences, our research agenda covers a wide range of topics, including privacy, freedom of speech, gender and technology.

Country of Operation

Brazil

Region of Operation

Website

InternetLab

Red en Defensa de los Derechos Digitales

The Red en Defensa de los Derechos Digitales (R3D) is a Mexican organisation dedicated to the defence of human rights in the digital environment. It uses various legal and communication tools for policy research, strategic litigation, and advocacy and campaigns, with particular attention to freedom of expression, privacy, and access to knowledge.

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC) is a Paraguayan non-governmental organisation that develops open civic technology, supported by its work in communications and alternative advocacy. It also promotes and defends digital rights in favour of a free Internet culture, with the aim of establishing a collaborative society where digital rights are exercised and respected.

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

The Institute for Policy Research and Advocacy (ELSAM) is a civil society organisation that works to enhance the democratic political order in Indonesia by empowering civil society. Founded in 1993, it actively participates in efforts to promote human rights through policy and legal research, advocacy, and training.

Country of Operation

Indonesia

Region of Operation

Public-Private surveillance partnerships

Website

ELSAM

Unwanted Witness

Founded in 2012, Unwanted Witness is a Ugandan-based civil society organisation that seeks to create secure, uncensored online platforms for human rights activists. It aims to contribute to good governance through effective online activism, networking and capacity-building. It also advocates for the strengthening of mechanisms related to freedom of expression and accountability.

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

The role of social media and search platforms in political campaigning and elections has come under scrutiny. Concerns range from the spread of disinformation, to profiling of users without their knowledge, to micro-targeting of users with tailored messages, to interference by foreign entities, and more. Significant attention has been paid to the transparency of political ads, and more broadly to the transparency of online ads.

Notably, in the lead up to the 2019 EU Parliamentary elections Facebook, Google, and Twitter, as well as the Interactive Advertising Bureau and others, agreed to take a series of steps to prevent online disinformation on their respective platforms. These measures are reflected in a self-regulatory Code of Practice on Disinformation and the companies provided the European Commission with monthly updates on their progress.

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

Learn more

Democratic engagement is increasingly mediated by digital technology, from campaigning to election results transmission. These technologies rely on collecting, storing, and analysing personal information to operate. They raise novel issues and challenges for all electoral stakeholders on how to protect our data from exploitation.

Podcast: Data exploitation in reproductive healthcare in Peru

caitlinb — Sat, 28 Nov 2020 14:58:38 +0000

Podcast: Data exploitation in reproductive healthcare in Peru

Public-Private Partnerships on Technology in Peru: A Government without horizon

caitlinb — Thu, 17 Sep 2020 11:06:04 +0000

Public-Private Partnerships on Technology in Peru: A Government without horizon caitlinb Thursday, September 17, 2020

The Peruvian government has a history of collaboration with the private sector in developing technology with the alleged purpose of providing greater security to citizens. The most recent example, the smartphone application "Peru En Tus Manos" launched in the context of the Covid-19 crisis, has been developed in a similar fashion and currently collects geolocation data on more than a million users. Although Peru has a proper legal framework for public private partnerships, developments are usually done outside of this system with little transparency, public scrutiny, and accountability.

Peru has a legal framework for public-private partnerships, but does not use it for technology

In Peru, for several years now, we have a legal framework for public-private partnerships. The most important is the Act that regulates the Promotion of Private Investment through Public-Private Partnerships and Active Projects (Legislative Decree No. 1362). Although this legal framework was initially thought for the development of large infrastructure projects, the possibility of applying it for the development of apps or other technological solutions is not excluded.

The Law itself establishes that Public-Private Partnerships projects can be centered on ”technological innovation". This regulatory environment, inspired by public procurement mechanisms, guarantees transparency, results-focused projects, planning, and competition among providers (through public tenders). However, the Peruvian government hasn’t used this legal framework in recent high-profile technology projects. As a consequence, those efforts were riddled with secrecy, subpar development and, ultimately, forgetfulness and disinterest in the long run.

If this legal framework exists, why is it not being used by the Peruvian government? We do not have the answer, but it may revolve around the little importance and the absence of a strategic and comprehensive plan that addresses the development of apps to face issues or situations of public interest. A road is assumed to be a major project, with stakeholders and planning, but an application that collects data on millions is still treated as a government freebie to the citizens that you should take without asking questions.

We focus here on three recent cases where the Government relied on intermediaries for projects that exploited large amounts of personally identifiable information but lacked control of it or didn’t set proper rules to prevent misuse.

Public security when hailing a ride: Wachitaxi

In May 2017, the Peruvian government held a press conference for an app that was meant to bring security to taxi passengers in the country. As context, in Peru taxi services run largely unsupervised: even though permits exist, almost anyone with a car can pick up passengers. Even before the arrival of ride-hailing apps, this was already a concern in terms of passenger safety: a passenger doesn't know the driver’s name, if the taxi plate is real, or even if the driver owns a license. Taking a taxi on the streets of Peru is a lottery: you don’t know if the driver is going to assault you or not. As some of the most famous technology platforms began their operations in Peru, the cases where a taxi passenger was robbed or injured got more visible.

In this scenario, the Ministry of Interior presented “Wachitaxi,” a smartphone application that allowed users to “track” their trips through surveillance. Users of this app could save pictures of the driver and the license plate of the vehicle, as well as manually entering their route, and everything through the application to a trusted contact. The trip would be also monitored in real time via GPS and, if the users sent an alert or didn’t reach their destination, all this information would be shared with the police.

Something that the government toned down in their press releases, but was evident in the Terms of Service of the application, was its provenance. Wachitaxi was totally developed and hosted by a private company called For Innovation Technology Big Data S.A. (FIT), whose other project is a “financial score” monitor. Although this was not stated in the agreement signed between the Ministry and the company, according to its Privacy Policy the application collected a large amount of personal data from users and produced statistical reports that the company could later sell to third parties. Thus, the data generated from the use of Wachitaxi remained the company's property and there are no guarantees that the same data will not be used in different projects.

However, due to the poor quality of the app, the lack of dissemination and, mainly, due to the absence of a comprehensive plan that addresses the problem of citizen security in the use of street taxis, the project was canceled silently a few months later.

Non-profit private development against novel coronavirus

In April, the Peruvian government presented "Peru En Tus Manos," a smartphone application to collaborate in the fight against the novel coronavirus through different methods of contact tracing. Despite such an important mission, it wasn’t the result of a government plan but the donation of a wide array of third parties like universities and private companies.

However, what Hiperderecho was able to discover about its development was the complete nonexistence of a framework of collaboration in this regard. Following several requests for access to public information, we discovered was no agreement, covenant or public contract covering the development of this app with any vendor. On the contrary, the only thing that formally existed were the proposals made by the companies. This lack of leadership and presence of the Peruvian government in the development of Peru En Tus Manos, as a public-private alliance, is extremely worrying giving the amount of data it collects.

As a consequence of this lack of strategy, the application’s purpose and efficacy is still hard to measure after three months. The app was presented on April 3, but it was only on May 23 that a favorable report regarding the development of ”Peru En Tus Manos” was issued by the corresponding body of the Peruvian government. In other words, the Peruvian government was encouraging the use of an app that did not have its own internal approval or a plan of continuity.

A similar situation happened with the release of the automated chatbot called BotPe. This tool, which was a public-private alliance with one of the largest insurance companies in the country, provided information about the novel coronavirus through a chat that any citizen could use on the official website of the Government. Once again, when requesting more information about this collaboration, the Peruvian government informed us that there were no agreements or contracts regarding its development. After local journalists started to question the involvement of an insurance company, the lack of transparency regarding whether it collects personal data and what it does with it, the tool was removed from the page of the Peruvian government.

In all of these cases the Government seems to end up having access to the data being generated. In some of these cases, such as the Wachitaxi case, the data still belongs to the company, and in the others, the data belongs to the Government but with some unspecified degree of access from the private companies. This extremely unclear level of unregulated data sharing is deeply concerning. The Government having access to, for example, information about your taxi trips gives them a back door to access your movements. The government needs to be absolutely clear about what data goes where and who has access.

Collaborations between the government and private companies can be powerful mechanisms to tackle complex public challenges. However, appropriate and transparent agreements are necessary to prevent putting citizens’ privacy at risk and foster trust in the projects.

Article written by Miguel Morachimo and Dilmar Villena from Hiperderecho, a non-profit Peruvian civil association dedicated to investigating, facilitating public understanding, and promoting respect for rights and freedoms in digital environment.

Learn more

Data Protection

Our fight

Expose Public-Private surveillance partnerships

Location

More about our partner

dan-gold-4YAhiaZkUfs-unsplash.jpg

Content

Stories

Media

Summary

The Peruvian Government has repeatedly collaborated with the private sector in developing technology. In many cases who has access to the data is unclear, and - although Peru has a legal framework for public-private partnerships - it does not use it for technology.

Key findings

Peru has a legal framework for public-private partnerships, but does not use it for technology
The government has set up private-partnerships that exploited large amounts of personally identifiable information but lacked control of it or didn’t set proper rules to prevent misuse.
It is often extremely unclear what level of access the government has to the data generated in these public-private partnerships.

PI’s and Hiperderecho’s joint submission to the UN Committee on the Elimination of all Forms of Discrimination Against Women (CEDAW) on the examination of Peru

staff — Wed, 08 Jul 2020 11:21:51 +0000

Audiences and Purpose

We demand change and litigate

Change

Content

Summary

Our submission highlights the intersection between reproductive rights, privacy, and tech.

Media

First page cover .jpg

Key points

The combination of poor quality of sexual health education in schools and dependence on Internet creates fertile ground for misinformation on sexual and reproductive rights
Data exploitation strategies obstruct women's unencumbered access to reproductive health information
Enforcement of data protection law is needed to protect women's privacy when browsing online

Privacy International and Hiperderecho made a joint submission to the UN Committee on the Elimination of all Forms of Discrimination Against Women (CEDAW) ahead of the Committee finalising the list of issues for the examination of Peru.

The submission builds on research commissioned by Privacy International and carried out by Hiperderecho on the state of reproductive rights in Peru, and how their exercise intersects with privacy and tech.

The submission is available in both English and Spanish.

Repeating Image and Text

More about our partner

Hiperderecho

Country of Operation

Region of Operation

Website

Link: https://hiperderecho.org/2020/04/quince-propuestas-para-mejorar-la-aplicacion-del-gobierno-del-covid-19/

Target Stakeholders

Our campaign

We work with others to ensure protection of and stop the exploitation of patient data because accessing reproductive healthcare should not require giving up your human rights, including privacy.

As access to reproductive healthcare becomes increasingly digitalised, companies and governments must ensure that the digital systems are built with people's human rights considered and protected.

There has been a notable increase in the digitalisation of health initiatives across the world. Accessing reproductive healthcare oftentimes requires interacting with a digitalised system that in some way collects vast amounts of personal information. For example, digital initiatives such as SMS appointment scheduling, remote access to care and counselling, health workers using a mobile phone to track an individual pregnant mother over the cycle of pregnancy, or a child over his/her cycle of immunization, and the use of mobile applications, sensors, wearable devices and others, all collect personal information.

But those developing these systems do not always consider the impact they will have on those who will use the systems, and how best to protect the information once it's collected.

The absence of human rights considerations, including privacy, in the implementation of these types of services can cause short- and long-term harm to the people trying to access the services.

This campaign aims to bring attention to digital health initiatives that have failed to consider the impact of these systems, and how to ensure they protect and respect the rights of those they serve.

We advocate for changes to be made to those systems and for the development of future systems to take a human rights-based approach. Like in many other sectors, technology can help and contribute to improving the rights of people. But with it also come risks, especially if a system is poorly designed, whether intentionally or not.

Learn more

Surveillance and data exploitation affect us all, but by learning about the unique experiences and challenges faced by women, trans and gender diverse people, we can better understand how patriarchy and systems of oppression function.

Reproductive rights are necessary for bodily autonomy. Bodily autonomy is necessary for equality.

Our fight

Realise Our Rights to Live with Dignity

Governments are embracing systems that would enable them to progressively realise social, economic and cultural rights; many of these systems interfere with individuals’ privacy.

Hiperderecho - 15 proposals to improve the COVID-19 app of the Peruvian Government

staff — Wed, 20 May 2020 10:45:34 +0000

Hiperderecho - 15 proposals to improve the COVID-19 app of the Peruvian Government staff Wednesday, May 20, 2020

Our partners from Hiperderecho in Peru proposed 15 measures to improve the COVID-19 app that the Peruvian Government is rolling out in the country (in Spanish).

Location

More about our partner

Tracking the Global Response to COVID-19

See more examples

Contact tracing

Apps and Covid-19

Civil society's Covid response

Date

Tuesday, April 14, 2020

Content

Educational

Stories

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

We campaign for solutions

Change

Content

Pi-Android-mock-up-3-1-photo correct.png

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Region of Operation

Website

Red en Defensa de los Derechos Digitales

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Indonesia

Region of Operation

Website

ELSAM

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

We campaign for solutions

Change

Content

Pi-Android-mock-up-1-1-photo.png

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Region of Operation

Website

Red en Defensa de los Derechos Digitales

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Indonesia

Region of Operation

Promote Strong Cyber Security and Protections for People

Website

ELSAM

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Privacy is Security: an op-ed from Peru

caitlinb — Wed, 13 Nov 2019 17:09:24 +0000

Privacy is Security: an op-ed from Peru caitlinb Wednesday, November 13, 2019

Miguel Morachimo, Executive Director of Hiperderecho. Hiperderecho is a non-profit Peruvian organisation dedicated to facilitating public understanding and promoting respect for rights and freedoms in digital environments.

The original version of this article was published in Spanish on Hiperderecho's website.

Where does our feeling of insecurity come from? As we walk around our cities, we are being observed by security cameras most of the time. Our daily movement, call logs, and internet browsing data are being recorded and stored by telecommunication companies. In Peru and elsewhere, many daily tasks, such as making a bank deposit or getting a new phone line, require our fingerprint and ID. All of those measures, those additional steps that have become more and more burdensome, have been instituted to make us feel more secure and comfortable on our own homes and businesses. In some cases on our own volition, in some others by Law, we have been giving away small bits of our privacy without asking why or for what. And we are becoming used to the idea that the price of security is renouncing our right to privacy.

During the last ten years, several public safety policies have consisted of sacrificing the privacy of Peruvians. It sounds like a fantasy but not so long ago communications interception was the exception, applicable only to serious crimes, and sensitive information was almost inaccessible to third parties. Like an unstoppable wave, these policies have systematically erased the differences between what we consider private and what we consider public. A major example of this shift is the emergence of the concept of ‘smart cities’, in which everything that happens is registered and measured, and ‘smart services’ become filters designed to exclude and segregate people based on their data.

Today we are more observed than ever before. And we risk getting used to a state of continuously giving away our privacy.

Despite all we have had to renounce, the results have been meager. There is no clear evidence about whether increased government surveillance has helped to improve our security in any substantial way. Nor are there any oversight or control mechanisms to assess how they impact our daily lives. Alongside that, there is a narrative looking to delegitimize any questioning of the system, considering any critical voice as quasi-criminal. As far as we know, the biggest consequences of public policies that threaten privacy in the name of security is that, somehow, we always end up needing new ones.

This is not surprising if we think that we have reached the point in which citizens that still have any expectation of privacy are those who are at the margins of the system: people who are undocumented, illiterate, without access to mobile communications or a credit score, amongst others. And the price for them to access any of those ‘perks’? Renouncing that privacy.

Despite claims from governments in Peru and elsewhere, privacy is an excellent security policy. Only with clear rules and limits to governmental access to our communications, and with strict necessity and proportionality criteria for their data processing activities, will we be truly secure - secure from our data being used to extort us, secure from our personal habits and preferences being in a state database, and free to think, do and say what we really want.

The national debate on how we draw a line on privacy is urgent and much needed. Every month foreign technology providers arrive in Peru, bringing with them newer surveillance technologies and methods that are at odds with our fundamental rights. We keep importing controversial policies and technologies, like the filtering of internet content, cameras able to perform biometric recognition, smart id cards, amongst others. In neighboring countries like Ecuador, Venezuela or Mexico these policies are already being implemented, and unless we do something Peru will likely follow the same path, and keep sacrificing our privacy at the security altar until there is nothing left.

A recent police case in Peru gave us a scary example of the kind of risks we could be facing in the near future. The National Police dismantled a criminal organization that impersonated their victims to buy expensive cellphones on credit. To accomplish their crimes, they first obtained a list of people with good credit scores by querying publicly available databases from credit reporting agencies, then made counterfeited IDs with those names but different photos, and finally printed silicon 3D-copies of the fingerprints of their victims to wear as finger gloves and fool biometric scans. According to press reports, they obtained the original fingerprint and signature images from the National Registry of Identity, a mandatory registry for every Peruvian citizen that lists both birth and biometric information. Their whole criminal scheme was facilitated by the surveillance and mandatory registering policies enacted precisely to keep Peruvians safe.

At Hiperderecho, we believe it is necessary to appreciate the evolution of the regulations that have been undermining our privacy in the name of security. It is time to analyze them from a critical perspective and inquire how they affect our daily lives. That is why we have created a series called ‘Privacidad es Seguridad’ (‘Privacy is security’, available in Spanish) with a series of detailed analyses of those policies.

It is not too late for our policymakers and the population at large to react. Security should not come at the expense of our privacy, but the opposite: privacy is security, and if we lose the first we cannot have the second.

Learn more

Data Intensive Systems

SIM Card Registration

Protecting Civic Spaces

What PI is fighting for

Our fight

Defending Democracy and Dissent

Location

More about our partner

Security should protect people, not exploit them

Our campaign

Content

News and Analysis

Reports

Filling the gaps on the understanding of cybersecurity and human rights across the world

caitlinb — Tue, 22 Oct 2019 12:17:56 +0000

Filling the gaps on the understanding of cybersecurity and human rights across the world caitlinb Tuesday, October 22, 2019

The pressing need to fix our cybersecurity (mis)understandings

Despite all the efforts made so far by different, cybersecurity remains a disputed concept. Some states are still approving cybersecurity laws as an excuse to increase their surveillance powers. Despite cybersecurity and cybercrime being different concepts, the confusion between them and the broad application of criminal statutes is still leading to the criminalise legitimate behaviour.

All of this represents a sizable challenge for experts, human rights defenders and other stakeholders around the world. Some of these challenges have to do with the interaction between security and privacy, with decision makers willing to sacrifice our fundamental freedoms in the name of a vague idea of security. Closely related is the question of who or what are we protecting: Is it the state? The economy? The reputation of the powerful?

Filling the gaps around the world

In Privacy International, for a long time we have been documenting cases and advocating on these issues.

A particular concern from our side is what and who should be protected, and how to reduce our attack surface, especially for those at risk, such migrants or LGBTQ+ persons, who are being put at risk through the use of surveillance techniques and deficient privacy and security practices in apps targeting those audiences.

Strong principles and safeguards should always apply when governments intend to affect our right to privacy. As we have said before, cybersecurity means protecting individuals, networks and devices, where privacy and security should go together, not choosing one over the other.

This has also been an important challenge for our international partners. The Privacy International Network has been working to frame cybersecurity and human rights as a ‘perfect match’ in Latin America, countering dangerous government narratives on cybersecurity in Africa.

And this work is still ongoing. This year, our partners’ work has been focused on the relation between security and privacy, and on improving policy makers’ ability to work on privacy and cybersecurity issues.

In Peru, our partners from Hiperderecho published a series of articles called “Seguridad es Privacidad” (Security is privacy), analysing how Peruvian laws have been constantly undermining the right to privacy in favour of security, including a timeline of developments that started almost 25 years ago, in 1995.

Beyond its thorough revision of the Peruvian surveillance framework across multiple domains, Hiperderecho’s approach is clear and direct: We don’t need to ‘balance’ privacy and security, we need to understand that actually in most contexts Privacy is indeed the best public policy to achieve Security. Just as Miguel Morachimo, Hiperderecho’s executive director, said in his article: “Privacy for all is an excellent public policy to achieve security. Only with secure and tamper-proof technologies, clear rules and limits and strict necessity and proportionality criteria we can be truly secure.”

In Kenya, our partners from the Centre for Intellectual Property and Information Technology Law (CIPIT) of the Strathmore University decided to take a practical approach and aim directly at policy makers with a checklist for legislative drafting & interpretation in Kenya. The guide aims to address the ongoing trend of quick and reactionary legislative processes that are happening around the world, equipping decision makers with up-to-date knowledge on international standards on privacy and security in the digital world.

An interesting aspect of CIPIT’s guide is that it offers specific ways to address different interests and rights at stake, to reconcile and maximise them instead of adopting a zero-sum game where one issue (security, in this case) has to prevail over other rights. This usually happens almost by default, sometimes without identifying legitimate interests, alternative means to achieve the stated goals, or safeguards to prevent from misuse, among other necessary elements to develop regulations on this area.

In Indonesia, our partners from ELSAM developed a guide to map and identify issues related with cybersecurity and human rights, to help the development of cybersecurity regulations in the country, from both a legal and a technical perspective.

After analysing the current national framework on the issue, and comparative policies, legislations and best practices, ELSAM highlighted a number of necessary elements that the Government needs to keep in mind when designing a national cybersecurity framework, including: regulating and setting a vision for policy development, identifying and prioritising critical infrastructure, forming a team dedicated to incident response, and conducting a threat assessment and developing a recovery plan.

ELSAM’s report also confirms two things: first of all, that in some countries like Uganda, Thailand, Pakistan, Vietnam and Egypt, cybercrime laws have been misused by governments against activists, journalists and other human rights defenders. Secondly, it helps highlighting that presently there is not an internationally agreed concept of cybersecurity, confirming something we stated at the beginning of this article: that cybersecurity remains a disputed concept.

What next?

If we want to move the conversation forward, we need to seriously address the role of human rights in this process, not as an afterthought, but as an essential element in cybersecurity policy. Beyond generic claims for human rights protections, there is a pressing need to elaborate on how those protections should look like and how to embed them by default and by design in all the regulations and practices that they generate.

In relation with cybercrime, beyond avoiding its use to expand surveillance powers, there are important challenges to address: How to interpret them? What type of crimes should they cover? How to implement the Budapest Convention in a manner consistent with human rights?

In general, the global discussion is very far from over. There are diverse debates and forums around cybersecurity in different venues, including international organisations, high corporate levels, standards bodies, and national governments, among others. Different groups of experts, high-level commissions, forums and events are dealing with cybersecurity discussions, and the scenario is only getting more complex.

For example, the role of disinformation and the weaponization of data wasn’t present in the cybersecurity agenda 5 years ago, and now many cybersecurity policies and laws are increasingly covering related issues, in many cases with disastrous effects for our fundamental rights.

We need to understand and prevent real threats to cybersecurity instead of criminalising technical research or independent journalism. We need to develop law policies and technologies that enable people instead of repressing them. Instead of vague national security concerns, what we need to do is to put people and their rights at the centre of these debates.

Learn more

Cyber Security

More about our partner

The Institute for Policy Research and Advocacy (ELSAM)

Audiences and Purpose

Helping partners and other NGOs know our stance

What Pi is calling for

Technologies, laws, and policies contain modern safeguards to protect people from exploitation.

People and communities empowered to protect their data and rights, resist and object to exploitation by governments and industry.

Data should be protected

Responsible security

Hacking Safeguard 2 Security and Integrity of Systems

Change