Stalking the Messenger: Ending Impunity for Illegal Surveillance

Opinion |

We know that the issues around digital surveillance are complicated. The tech side of the tools used and the means to circumvent them are complicated. Drawing a hard line between what may be acceptable to help ensure our personal security and what pushes our societies into Orwellian territory is also complicated.

As the revelations of the Pegasus Project show us, illegal surveillance is the latest weapon in the ever-growing arsenal used against journalists and human rights defenders. In effect, surveillance in this context is equivalent to stalking. A pernicious activity that can easily cross from online harassment to physical attacks. It’s illegal. It disproportionately affects those who are among the most vulnerable, whether because of their gender, sexual orientation, race, or ethnicity. And if people are permitted to stalk with impunity, the problem will not stop.

Increasingly used as a laser-focused tactic, a weapon to intimidate, instil fear, and paralyse the work of journalists, this kind of surveillance puts sources at risk and impedes journalists from providing us with information to expose crime and corruption, and to speak the truth about power.

“I don’t think it’s journalists as individuals that the government has a problem with. The government has a problem with the people […] It wants to continue committing crimes in the shadows so that no one will uncover those facts or ask questions about it. And journalists are the ones who spoil this plan.” — Azerbaijani journalist Sevinj Vaqifqizi.

On this International Day to End Impunity for Crimes Against Journalists, a day advocated for by IFEX, we need to bring surveillance to the fore as a tactic that is threatening journalists’ safety, and draw attention to how impunity creates the conditions under which it will continue to thrive.

IFEX members have long warned of the dangers of malware like Pegasus. A product of the Israeli NSO Group, it infects targets’ phones, exposes data, and even gains access to cameras and microphones. Despite the company’s claim that it vets clients based on their human rights records, it sold Pegasus to authoritarian regimes – as well as to countries like Mexico, where targets included media figures, a government scientist, and international human rights investigators – united by having publicly posed challenging questions to the government.

The personal impact of such surveillance can be devastating.

“When you are speaking, watching, or doing something with someone in your house or in a cafe or wherever you may be, they are there listening to you, watching everything that you do. Everything that you do in your bedroom, the shower, in your kitchen, in your office with your friends, or whoever.” — Mexican journalist Carmen Aristegui: profiled here

“My family members are also victimized. The sources are victimized, people I’ve been working with, people who told me their private secrets are victimized.” — Azerbaijani journalist Khadija Ismayilova: profiled here

Globally, at least 180 journalists were selected as Pegasus targets.

The decades our network has put into promoting journalists’ safety confirm that it cannot be fully achieved in a climate where individuals – or states – can intimidate, threaten, and harm them, and not be held accountable. Year-round, IFEX members work to bring perpetrators to justice, and to establish conditions that will make it harder for them to commit such crimes in the first place.

We know that it is a massive undertaking. In spite of being illegal under international human rights law, actors involved in illegal surveillance are almost never held accountable.

The challenge is to identify where to intervene, where to spend our energy, where we can have the biggest impact in stemming this predatory practice – including, but not limited to, confronting corporations and governments that enable and participate in the illegal surveillance of journalists.

It’s a many-headed beast, surveillance. There are multiple entry points to effect change, from policy work to set boundaries on what is considered ‘necessary and proportionate’ surveillance, to pressuring states to adopt international standards, to controls on the exports of spyware, to supporting preventive measures like strengthening and normalizing encryption.

Ending impunity for illegal surveillance has to be part of this work. It’s a long game, not for the weak-of-heart, and this is even more true when the perpetrators of the crimes are states. But we know from our experience seeking accountability for physical attacks on journalists that this type of sustained work does pay off. Just over a week ago, two decades of advocacy – by IFEX member FLIP, by Jineth Bedoya Lima herself, and by so many others – led to the groundbreaking Inter-American Court of Human Rights ruling in her case that there was “serious, precise and consistent evidence of State involvement in the acts of physical, sexual and psychological torture against the journalist.” This ruling sets an important precedent for the entire region.

The other good news is that we have a lot to draw on, on our side. There is a massive, global network of people – working in different fields, perhaps, or focusing on different issues – but with the combined skills, expertise, and clout needed to ensure that illegal surveillance does not go unchallenged, that those found culpable pay a price, and that this price effectively deters others.

As long as we keep leveraging opportunities like IDEI to come together, collaborate, learn from and support each other, raise our voices and find strategic pressure points where we can have a real impact, we can, and will, counter the scourge of illegal surveillance of journalists.

Annie Game is the Executive Director of IFEX, the global network that promotes and defends freedom of expression and information as a fundamental human right.

Assessing the Effects of Covid-19 Misinformation Laws on Freedom of Expression

By Nashilongo Gervasius | 

As Africa’s most sought after digital rights conference dawned on its last day of bringing multitudes together, five panelists (an academic, a researcher, program managers and a digital rights specialist) converged and reflected on the effect that Covid-19 misinformation laws have had in Sub-Saharan Africa. The laws and regulations which were introduced as measures to contain the spread of the coronavirus, are generally viewed by scholars and activists as serving  to curtail freedom of expression. 

At the peak of the pandemic, 110 countries around the world were reported by the International Center for Not-for -Profit Law (ICNL) to have adopted emergency declarations or laws that carried fines as heavy as USD 46,000 (Kenya), USD 10,000 (Zimbabwe), and 10 years in prison (Burkina Faso) for contravening their provisions. Closely related to digital rights, such laws also applied to social media engagement and communications, with some prohibiting publication of “any statement through any medium including social media, with the intent to deceive,” in South Africa.

The notoriety of such laws made them the focus of the State of Internet Freedom in Africa 2020 Report. Similarly, a report by the Media Institute of Southern Africa (MISA) on the State of Press Freedom in Southern Africa 2019-2020 also highlighted the challenges posed by these laws on top of the burden brought about by the pandemic itself. The MISA report indicated that the “landscape and operational environment for the media in Southern Africa has been  characterised  by  upheavals,  accentuated  by the Covid-19 pandemic and the advent of the digital  age,  which  have  threatened  the  viability  and sustainability of the media”. The report goes on to highlight attacks,  harassment  and  assault  of  journalists  and  in  some  cases  raiding  of  media  houses in the region. 

Why focus on the laws and regulations two years later? 

The Covid-19 misinformation laws are still in place even when other Covid-19 related restrictions have been eased in some countries. Worryingly, governments in the region have not opened any discussion regarding the timeframes around repealing the laws. 

Accordingly, panelists at the Forum on Internet Freedom in Africa (FIFAfrica) 2021 session on Covid-19 Misinformation Legislation in Southern Africa vs Freedom of Expression, deliberated on  the danger that these laws continue to pose to access to information and freedom of expression. Panelists demanded an urgent need for the Covid-19 misinformation laws to be repealed, arguing that the likelihood that governments will use them to stifle citizens rights and public participation, especially during election periods, is very high.  

Further, the panel noted the limited documentation of cases of violation of rights in the countries where these laws are effected, while agreeing that, in some instances, restrictions have affected media coverage of cases.

What effects do these laws have?

The Covid-19 misinformation laws are a danger to democracy and they contravene the right to access information. Using Tanzania as an example, the panel reflected on the chaos that ensued in that country due to Covid-19 denialism that saw the government stop publishing data on coronavirus diseases cases.

In other countries like Zimbabwe, where the Criminal Law Codification and Reform Act already criminalised the publication of false statements, it was unclear why the government introduced additional restrictions on false information related to Covid-19 lockdown enforcement, making the move appear to be part of a sinister agenda. Indeed, the media fell victim to the regulations, with an estimated 52 cases of violations against practitioners reported during 2020. As one of the panelists noted, “Many people were arrested without a clear cause, because people did not understand these laws well.”

In regards to the extent of the negative effects of the Covid-19 laws on freedom of expression, it was noted that the media in some countries was no longer asking government uncomfortable questions, especially those seeking accountability for expenditure on containing the pandemic. This demonstrated  that these laws are not helping journalists to do their job fairly and independently; instead, in some cases they have restricted themselves to report on mundane issues such as numbers of Covid-19 cases and vaccination figures.

The panel discussion reiterated that, in such instances, journalists were no longer performing their role of a watchdog, but had turned into “mere megaphones that repeated what government officials said”. This had undermined investigative journalism and denied citizens access to balanced and diverse information.  As a panelist aptly observed: “These laws have disorganised journalism, which is double negative given that traditional media are competing with digital platforms that are destroying newspapers and television.” 

Can such laws deter misinformation?

There seems to be  general consensus that these laws are not enough in dealing with the spread of misinformation. This calls for revisiting these laws and taking other measures, such as engaging  digital platforms to do more in combating misinformation. Further, the panel agreed that there is a need to educate the public to strengthen their digital literacy skills so that they can question the information they receive rather than consuming and sharing whatever information comes their way. 

The urgency of getting the misinformation legislation repealed was illuminated by the realisation that, in several cases where individuals have been arrested under these laws, the adverse effect  of the false information could not be demonstrated, and it was often not possible to verify who produced the information in question. The discussion recommended a coordinated regional approach to advocate for the repeal of these laws.

Combating Disinformation in Africa: Challenges and Prospects

By CIPESA Staff Writer |

As disinformation grows in form and prevalence in many African countries, the challenges to combating it are equally increasing yet measures to combat it remain inadequate and often inappropriate. This has got disinformation researchers concerned that, if more robust measures are not adopted, disinformation could become pervasive, harder to fight, and with broad social and political ramifications.

While disinformation is not a new phenomenon, a number of factors have spurred it to unprecedented levels. These include the rapid growth of social media usage, emerging media viability challenges, politicians’ increasing influence on the media, the outbreak of the Covid-19 pandemic, and the involvement of mainstream media in spreading disinformation.

Few actors are conducting fact-checking and contributing to fighting disinformation in the region, which is partly due to a shortage of expertise. That requires building a bigger cohort of fact-checkers and arming them with the skills to match the evolving disinformation challenges.  “We need to make fact-checking sexy,” says Rosemary Ajayi, the lead researcher at Digital Africa Research Lab. “We need to learn from the disinformation spreaders. We need to find the motivation behind the disinformation.”

Also crucial to combating disinformation is generating evidence of the form and prevalence of  disinformation, and how it originates and spreads between different mediums and communities. In this regard, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) in conjunction with partners in five countries (Cameroon, Ethiopia, Kenya, Nigeria, and Uganda), is conducting a study to understand the nature, perpetrators, strategies and pathways of disinformation, and its effects on democracy actors including civil society, bloggers, government critics, and activists.

At a related workshop conducted as part of the eighth Forum on Internet Freedom in Africa (FIFAfrica), held in September 2021, experts discussed the factors fuelling disinformation, efforts to contain the problem, and  how disinformation is affecting democracy in African countries.  

Morgan Wack, a PhD Candidate at the University of Washington, said the fracturing of online media and rise of social media has broken up the consolidated media that previously existed. “This is good but it also leaves the media vulnerable and also takes resources away from entities that could have done better fact-checking,” he said.

According to various speakers at the workshop, mainstream media across the continent has increasingly become a key disinformation pathway contrary to the known pillars of traditional media as purveyors of factual and reliable information. As observed by Tessa Knight, a Research Assistant at the Digital Research Forensic Lab, many countries do not have free and independent media and so their stories are often biased. Given the difficulties in fact-checking in such countries, the information remains one-sided. 

With growing media viability concerns, newsrooms are narrowing the choice of issues to cover in order to cut costs. As Knight pointed out, given what is online, there may not be many people interested in what newsrooms are reporting. “We need to acknowledge the financial squeeze on the industry. Also, the fact that people consider other issues more important than say hospital deaths,” she added.

Nonetheless, Ajayi argued that the business model of several media organisations in countries such as Nigeria enables the propagation of disinformation, as some mainstream media were also doing the opposite of what is expected. “All I need to have a story published is to accompany it with an envelope [bribe] and this cuts across all media platforms,” she said. “There is also a close relationship between the government and newsrooms. Government spokespeople have come from the media so if they want to silence a story they know who to contact.” 

Ownership of news organisations by political actors, including individuals holding senior positions in government, also undermines media independence and often renders such media houses sources of disinformation.

There are also concerns about governments using public media platforms and manipulating private media to spread disinformation. “In Ethiopia, the media is largely funded by the government so their news is one-sided, noted Abel Wabella, Executive Director of Inform Africa’s HaqCheck

Yet Ethiopia presents a vivid example of how different political actors are using disinformation to push their agenda, including to destabilise the country. “Now people are suffering a humanitarian crisis because each side is providing contradictory information about the crisis in Ethiopia with a view of pushing their agenda,” said Wabella. He added that it is crucial to counter this disinformation to provide the opportunity for sanitised political conversations and to aid the country’s democratisation process.

Meanwhile, it was reported that during elections in Nigeria and Ghana, politicians assemble armies of commercial influencers to push their agendas that include disinformation. “In Nigeria we call them influenza because their goal is to make their content trend. They use all sorts of tactics, compromised accounts, fake celebrity accounts, fake accounts and also attaching fake giveaways to this content. They manipulate us by making us turn a non-story into a key topic of the day,” Ajayi said. She called for a multi-sectoral and multidisciplinary approach to digital literacy because fact-checking on its own does not work because “fact-checked information is not sexy like disinformation”.

Simone Tousi, a CIPESA Programme Officer for Francophone Africa, said governments in west and central Africa were also heavily relying on mainstream media to spread disinformation. This was undermining the power of mainstream media to deter the spread of disinformation.

The inadequacy of government responses to disinformation was also reflected in their legislative decisions. According to Tousi, disinformation laws and policies have had the net effect of undermining freedom of expression. Accordingly, there is an urgent need to repeal and replace these harmful laws with more progressive legislation.

Policy Brief: How African States Are Undermining the Use of Encryption

By Lillian Nalwoga |

Encryption enables internet users to protect their data and communications from unauthorised access. Accordingly, anonymity and the use of encryption in digital communications are key enablers of citizens’ enjoyment of the right to privacy.

Worryingly, many African countries have passed legislation that limits anonymity and the use of encryption, purportedly to aid governments’ efforts to combat terrorism and crime. Other governments in the region limit the use of encryption to enable them to monitor the communications of critical journalists, human rights defenders, and opposition politicians.

In commemoration of the inaugural Global Encryption Day, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has published a policy brief that highlights restrictions to encryption and what needs to be done by governments in Africa to promote the use of encryption. The brief shows that encryption laws and government practices in several countries undermine the privacy rights of citizens, which in turn hampers their right to free expression and to secure use of digital technologies.

The importance of the right to anonymity in the digital era has been recognised in the Declaration of Principles on Freedom of Expression and Access to Information in Africa of the African Commission on Human and Peoples’ Rights. Principle 40(3) provides that: “States shall not adopt laws or other measures prohibiting or weakening encryption, including backdoors, key escrows, and data localisation requirements unless such measures are justifiable and compatible with international human rights law and standards.”

However, encryption is under threat from governments in Africa, as indeed in other parts of the world. Among the concerns cited by the brief are legislation and regulations that require registration and licensing of encryption service providers before they can offer cryptographic services. This is the case in Benin, Chad,  Cameroon, Congo Brazzaville, Democratic Republic of Congo (DR Congo), Ethiopia, Guinea, Ivory Coast, Malawi, Mali, Morocco, Senegal, South Africa, Tanzania, Tunisia and Zambia, among others. Offering encryption services without a license attracts penalties, as does failure to hand over secret encryption codes to state authorities, or using prohibited encryption tools.

Encryption in Africa

The requirement for registration of encryption services providers makes it easy for regulators and other government agencies to access information held by these service providers, including decryption keys and encrypted data. This undermines best practices which require governments to reject laws, policies, and practices that limit access to or undermine encryption and other secure communications tools and technologies. 

Further, the brief points to how governments in Africa prohibit the use of some types of encryption and require disclosure to regulators of the characteristics of cryptology. Crucially, governments should not prohibit the use of encryption by grade or type. Further, governments should not mandate insecure encryption algorithms, standards, tools, or technologies. 

Meanwhile, laws on interception of communications across the continent including in Benin, Cameroon, Chad, Ivory Coast, Malawi, Mali, Niger, Nigeria, Rwanda, Senegal, Tanzania, Togo, Tunisia, Uganda, Zambia and Zimbabwe require communication service providers to put in place mechanisms, including the installation of software, which facilitates access and interception of communications by state agencies. Indeed, state agencies in several countries can request for decryption of data held by service providers, which poses a big concern. 

For instance, Zimbabwe’s Interception of Communications Act requires cryptography services providers to decrypt data at judicial authorities’ request or provide them with the codes allowing the decryption of data they have encrypted (article 78). Section 11(1)(d) permits security agents to demand that information is decrypted before it is handed to them, where the disclosure is necessary for national security, to prevent or detect a severe criminal offense, or in the interests of the country’s economic well being. Failure to comply is punishable with up to five years’ imprisonment, a fine not exceeding USD 373, or both. Similar provisions are found in the laws of several other countries.

Such compelled assistance from service providers has been reinforced with mandatory SIM card registration of phone users around the continent, as well as data localisation requirements amidst ineffective safeguards.

 In some countries, if the private communications of human rights defenders and opposition politicians fall into the hands of state agencies, the consequences can be dire. The brief cites Rwanda, where the private communications of musician Kizito Mihigo, opposition leader Diane Rwigara, and two former army officers were used in their separate prosecutions. In Ethiopia, the Zone 9 bloggers were detained and prosecuted, among others, for using encrypted communications.

Meanwhile, Uganda instituted a ban on use of Virtual Partial Networks (VPNs) in the face of internet taxes and network disruptions. For its part, Zimbabwe barred telecom operator Econet Wireless from introducing the Blackberry Messenger service, which provided encrypted messaging, arguing that it contravened the southern African country’s interception of communications law which bars provision of services which the communications regulator can not intercept. Another example cited is Mauritius, which this year attempted to introduce a controversial lawful interception mechanism that would decrypt and re-encrypt all social media traffic. 

In light of the above concerns, the CIPESA brief is urging governments to repeal or amend provisions that place undue restrictions on the use of encryption tools; cease blanket compelled service providers and intermediary assistance to state agents and instead provide for clear and activity-bound assistance; and enact data protection and privacy laws that robustly promote the use of strong encryption. 

The full brief can be accessed here.

CIPESA Submits Comments on Tanzania’s Proposed Amendment to The Online Content Regulations 2021

By Edrine Wanyama |

The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has made a submission on the proposed amendments to Tanzania’s controversial Electronic and Postal Communications (Online Content) Regulations, 2020 that regulate online content service providers, internet service providers, application services licensees, and online content users.

On August 24, 2021, the government made a public call for comments on proposals to amend the 2020 Regulations, which entrenched the licencing and taxation of bloggers, online discussion forums, radio and television webcasters, and repressed online speech, privacy and access to information. The move towards amending the Regulations follows a series of concerns expressed in 2017, 2018 and 2020 over the regressive and repressive nature of online content regulation in the country, and its detrimental effect on freedom of expression, access to information, and the right of establishment of media.  

The proposed 2021 regulations largely reflect the previously issued regulations. While they have  some positive elements, they largely fail to address the threats posed to human rights defenders, political dissidents, journalists, academics, civil society organisations and actors.

On a positive note, the proposed regulations reduce licence application fees, as well as annual and renewal fees charged for online media content services and online content aggregators. Thus, online media content service providers will pay application fees of TZS 50,000 (USD 22) down from TZS 100,000 (USD43), initial licence fees of USD 217 from USD 433, annual licence fees of USD 217   from USD 433 and renewal fees of USD 43 from USD217.

The regulations also remove some ambiguous specification of obligations of service providers, such as the proposed deletion of the current regulation  9 (d) which potentially censors a broad variety of content by imposing on service providers the obligation to filter what is considered “prohibited content.” Regulation  9 (d) of the EPOCA Regulations of 2020 requires online content service providers to, “use moderating tools to filter prohibited content.” 

Furthermore, under regulation 3, some level of certainty in the scope of definitions is provided especially for “online media content services” and “online content aggregators”, which are lacking in the current regulations. The proposed regulations also make attempts to define and narrow the scope of categories of licences by removing all fees that were earlier imposed on online content relating to education and religion, and fees chargeable for the provision of Online Content Service Licence Category B (Simulcasting radio and television). 

However, the proposed regulation maintains broad and vague definitions, such as of “hate speech”, which could potentially be misused against individuals, media and private sector players.

Moreover, the licensing requirements under Part II of the EPOCA regulations of 2020, which have not been proposed for amendment, are still prohibitive with very heavy penalties of not less than five million shillings (USD 2,157) or  12 months imprisonment, or both, for operating without a license from the Tanzania Communications Regulatory Authority (TCRA). 

Further, the process of applying for a licence under regulation 6 remains tedious, requiring the applicant to furnish TCRA with extensive information including personal information. This comprises certified copies of certificate of incorporation or certificate of registration, tax identification number, tax clearance certificate, national identity cards, and list of owners and management teams, curriculum vitae of staff, editorial policy guidelines and any other documents required by the authority. 

The proposed amendments do not make any attempt to address the wanton restrictions laid down in the Third Schedule to regulation 16 on prohibited content.  This  includes content in paragraph 1 on sexuality and decency, content on personal privacy and respect for human dignity which extends to insults, slander and defamation or exposes news related to a person’s privacy under Paragraph 2(b)

Further, there are restrictions on content  on public security, violence and national security (Paragraph 3), content that is considered to be disrespectful of religion and personal beliefs (paragraph 7), public information that may cause public havoc and disorder (paragraph 8), use of bad languages and disparaging words (paragraph 9) and false, untrue and misleading content (paragraph 10). 

The scope of prohibited content under the Third Schedule is wide and ambiguous, and the provisions facilitate curtailment of freedom of expression and access to information. 

Additionally, the schedule prohibits publication of “content with information with regards to the outbreak of a deadly or contagious disease in the country or elsewhere without the approval of the respective authorities.” The penalty for breach of regulations is a fine of not less than five million Tanzanian shillings (USD 2,174), imprisonment for not less than 12 months, or both. This prohibition undermines freedom of expression and access to health information as it provides room for suspension of content.

Regulation 9(g) maintains  the status quo of the obligations of online content service providers to ensure that prohibited content  is removed immediately upon being ordered by TCRA. This ultimately means the sweeping powers of the authority to determine what content is available for public consumption are still on the statute books. Such powers are also a potential tool for censorship of content and hinder free expression and access to information.

The proposed amendments to the regulations come a few months after the death of Tanzania’s former president, John Magufuli. His reign was characterised by systematic clampdown and curtailment of freedoms including of expression, access to information, assembly and associations. The period before Magufuli’s death was also  characterised  by a lacklustre response to the Covid-19 pandemic.  

The analysis concludes that the proposed amendments provide some ray of hope especially in providing some degree of certainty in definition of key terms and reduction of application and licensing fees. However, the proposals are not sufficient to tackle the deep concerns in the 2020 regulations. 

You can read the full submission here.