We have drawn up the following risk scenarios in consultation with stakeholder groups, including such high-risk users. We hope these scenarios will help illustrate the type of harms that people can experience and that we seek to prevent when we ask companies to respect users’ rights to freedom of expression and privacy. Download PDF Navigate this document: February 2015 The Risk ScenariosNote: “Key questions” listed below highlighted with a grey background were incorporated into the RDR Phase 1 methodology. Questions not highlighted were discussed during the course of methodology development, but were not directly used. For further information about how we worked with these scenarios during the methodology development process, please see the second part of this document titled “How we used the risk scenarios in the methodology”. Freedom of expression Scenario #1: Authorities in one jurisdiction demand to censor specific content, but when the company takes down the content, it is censored globally. Scenario #2: Authorities demand to censor specific content, but instead of disabling access to that specific content, the company blocks access to an entire website or domain. Scenario #3: Government authorities demand a company remove or filter content. The demand may not be legal in that jurisdiction, and the company fails to challenge the demand. Scenario #4: The company removes content and fails to inform users that content was removed, why it was removed, and under whose authority (e.g., national law, the company’s terms of service) it was removed. KEY QUESTIONS (applicable to all of the above scenarios):
Scenario #5: Network shutdown – The government demands that the company shut down all service to a specified area – a city district, a particular city or province, or even an entire country. KEY QUESTIONS:
Scenario #6: A government’s filtering policy requires the company to block specific websites or applications, and the company fails to inform users of this policy when they try to access the blocked websites or applications. (This notification is usually done by displaying a customized “block page” or “error page” indicating that the content has been blocked. It typically identifies who required the block and under what authority.) KEY QUESTIONS:
top of section PrivacyScenario #1: The company receives a legally binding order to give police private content or data pertaining to a political activist, journalist, or persecuted religious minority, and it complies. Scenario #2: The company fails to challenge government requests for user information that are over broad and/or of questionable legality in that government’s jurisdiction. KEY QUESTIONS:
Scenario #3: Users’ private contacts and/or private communications are suddenly revealed publicly (hence to authorities and other adversaries) without adequate user notice or knowledge. KEY QUESTIONS:
Scenario #4: The company fails to notify users user or obtain consent to share user information with authorities in situations where the company is within legal rights to notify users or obtain their consent. KEY QUESTIONS: (In addition to above)
Scenario #5: Real time interception – Authorities intercept text messages sent to arrange an opposition meeting, journalist interview with whistleblower lead, or banned religious meeting, and arrest, detain, or threaten participants. Scenario #6: Due to easy access to commercial network traffic, police are able to compile comprehensive archives of every user’s emails, chats, general online activity in a country, violating individuals’ privacy and posing risks to vulnerable users such as activists, investigative journalists, and leaders of religious minorities. KEY QUESTIONS (in addition to above):
Scenario #7: A legal jurisdiction requires the company to retain data about its users’ online behavior for a limited period of time. After the time period elapses, the company retains this data, due to neglect, commercial purposes, or other reasons. When a security breach occurs (either during or after the data retention period), the users’ personal data (IP addresses, websites visited, possibly messages sent) are made publicly available. KEY QUESTIONS:
Scenario #8: A user’s computer is infected with malware after the user opened a malicious file that they received through a cloud-based file sharing service. KEY QUESTIONS:
Scenario #9: Lack of encryption and proper security mechanisms enable (government or non-government) intruders real time or historical access to user messages on a mobile messaging platform. KEY QUESTIONS:
Scenario #10: A web platform is hacked due to the platform’s inadequate security practices. The website had required users to register in order to access basic content. As a consequence of the intrusion, hackers obtain a list of users’ e-mail addresses and unhashed passwords. The hackers sell this information to spammers and to an authoritarian government. Like many Internet users, a human rights defender in the authoritarian country is using the same password on multiple websites, including this platform and their e-mail account. As a consequence, security services in the authoritarian country access the user’s e-mail account, her list of contacts, and e-mail history. The user is arrested for state undermining activities, and so are several of her e-mail contacts. KEY QUESTIONS:
Scenario #11: A social network requires users to use their real names and to make their profiles public (and searchable by search engines). As a consequence, the online and offline identities of high-risk users are automatically connected, which can expose them and the people to whom they are connected. KEY QUESTIONS:
Scenario #12: A user who is logged in to a company’s website for one service is automatically signed into other online services of the company without explicitly intending to do so. For example, when the user is logged in to the company’s e-mail service, the user is automatically also logged in to its search engine, document sharing platform, etc. When an intruder gains access to this account (for example as a consequence of the user’s or company’s lax security practice), a web of personal data is exposed. KEY QUESTIONS:
top of section How we used the risk scenarios in the methodologyAs part of the methodology development for Ranking Digital Rights, we identified specific “human rights risk scenarios” for users of Internet and telecommunications platforms and services worldwide. The section below highlights a few key questions that were drawn from the scenarios and that were integrated as indicators in the ranking methodology. Rather than giving an exhaustive list of questions or elements included in the methodology, this section explains how we used the risk scenarios to develop those indicators. For a more comprehensive overview, elements that have in some manner been incorporated into the methodology have been highlighted in the risk scenarios above. It is important to note that several questions that stakeholders and members of the project team found important were nonetheless left out of the ranking methodology due to the decision to include only publicly available information. (Please see the paper summarizing the case study research process for more information about how the methodology was developed.) During our methodological research and development phase, we found that some of the questions listed in the risk scenarios would be impossible to answer without active company participation in the ranking or technical investigations beyond the scope of this project’s resources. Other questions arising from the risk scenarios did not make it into the ranking methodology for various reasons: their inclusion seemed less critical for protecting users’ rights; they were specific to particular companies and not applicable to many of the companies we will include in the ranking; or because we had to prioritize and limit the methodology to a manageable scope. The risk scenarios fell into two major categories: freedom of expression and privacy. The bullet points below include relevant questions from the human rights risk scenarios, and, in parenthesis, the related indicator in the Phase 1 Pilot methodology. top of section Freedom of ExpressionOne human rights risk scenario describes a situation where a company fails to challenge legally dubious demands from government officials to block or filter content. In other scenarios, a company removes content (either at the request of a government or through the enforcement of its own terms of service), but does not inform users that it removed the content, why it did so, and/or under whose authority it happened. Several questions that came out of these scenarios were incorporated as indicators in the pilot ranking methodology, including:
top of section PrivacyStakeholders we consulted tended to focus primarily on human rights threats posed by governments. Several risk scenarios described situations whereby a company hands over the private data of a human rights defender, journalist or other targeted individual to government authorities upon receipt of legally binding order. Four questions came from such scenarios and later helped us to formulate indicators:
Other risk scenarios dealt with the question of whether companies make any effort to protect users against surveillance (by any party with the technical means) undertaken without lawful requests or formal due process. One indicator that came out of such scenarios deals with the company’s security practices:
As mentioned above, some other relevant questions were not incorporated, as they were impossible to research based on publicly information. This was especially the case when we learned that companies would rarely be able to divulge certain information, often due to legal constraints. One such example dealt with operating licenses:
The risk scenarios also described situations where companies can help users protect themselves, for example, when a user’s computer is infected with malware or when a user’s e-mail account is hacked. High-risk users are often the target of such digital attacks not only by criminals but also by governments. Such attacks can expose users’ professional and personal information and pose danger to users’ networks of contacts. From such scenarios we derived questions looking at the security features and education that companies offer their users, including:
Questions highlighted in this paper have helped us think through how particular company policies and practices affect the freedom of expression and privacy of high-risk users, and what the best practices for limiting negative impact should be. top of section |