Toward a Social Compact for Digital Privacy and Security – STMT from Global Commission on Internet Governance

We noted in January of 2014 that Chatham House, the international famous UK think-tank, had assembled a Global Commission on Internet Governance.  On April 14, 2015, the Commission released a statement entitled: “Toward a Social Compact for Digital Privacy and Security.”  From the Chatham House website:

The Commission considers that, for the internet to remain a global engine of social and economic progress that reflects the world’s cultural diversity, confidence must be restored in the internet because trust is eroding. The internet should be open, freely available to all, secure and safe. The Commission thus agrees that all stakeholders must collaborate together to adopt norms for responsible behaviour on the internet.

On the occasion of the April 2015 Global Conference on Cyberspace meeting in The Hague, the Commission calls on the global community to build a new social compact between citizens and their elected representatives, the judiciary, law enforcement and intelligence agencies, business, civil society and the internet technical community, with the goal of restoring trust and enhancing confidence in the internet.

It is now essential that governments, collaborating with all other stakeholders, take steps to build confidence that the right to privacy of all people is respected on the internet. It is essential at the same time to ensure the rule of law is upheld. The two goals are not exclusive; indeed, they are mutually reinforcing. Individuals and businesses must be protected both from the misuse of the internet by terrorists, cyber criminal groups and the overreach of governments and businesses that collect and use private data.

A social compact must be built on a shared commitment by all stakeholders in developed and less developed countries to take concrete action in their own jurisdictions to build trust and confidence in the internet. A commitment to the concept of collaborative security and to privacy must replace lengthy and over-politicized negotiations and conferences.

The following are the core elements that the Commission advocates in building the new social compact:

1. Privacy and Personal Data Protection as a Fundamental Human Right
   Fundamental human rights, including privacy and personal data protection, must be protected online. Threats to these core human rights should be addressed by governments and other stakeholders acting both within their own jurisdiction and in cooperation.
2. The Necessity and Proportionality of Surveillance
   Interception of communications, collection, analysis and use of data over the internet by law enforcement and government intelligence agencies should be for purposes that are openly specified in advance, authorized by law (including international human rights law) and consistent with the principles of necessity and proportionality. Purposes such as gaining political advantage or exercising repression are not legitimate.
3. Legal Transparency and Redress for Unlawful Surveillance
   In particular, laws should be publicly accessible, clear, precise, comprehensive and nondiscriminatory, openly arrived at and transparent to individuals and businesses. Robust, independent mechanisms should be in place to ensure accountability and respect for rights. Abuses should be amenable to appropriate redress, with access to an effective remedy provided to individuals whose right to privacy has been violated by unlawful or arbitrary surveillance.
4. Safeguarding Online Data and Consumer Awareness
   Businesses or other organizations that transmit and store data using the internet must assume greater responsibility to safeguard that data from illegal intrusion, damage or destruction. Users of paid or so-called ‘free services’ provided on the internet should know about, and have some choice over, the full range of commercial use on how their data will be deployed, without being excluded from the use of software or services customary for participation in the information age. Such businesses should also demonstrate accountability and provide redress in the case of a security breach.
5. Big Data and Trust
   There is a need to reverse the erosion of trust in the internet brought about by the nontransparent market in collecting, centralizing, integrating and analyzing enormous quantities of private information about individuals and enterprises — a kind of private surveillance in the service of ‘big data’, often under the guise of offering a free service.
6. Strengthening Private Communications
   Consistent with the United Nations Universal Declaration of Human Rights, communications should be inherently considered private between the intended parties, regardless of communications technology. The role of government should be to strengthen the technology upon which the internet depends and its use, not to weaken it.
7. No Back Doors to Private Data
   Governments should not create or require third parties to create ‘back doors’ to access data that would have the effect of weakening the security of the internet. Efforts by the internet technical community to incorporate privacy-enhancing solutions in the standards and protocols of the internet, including end-to-end encryption of data in transit and at rest, should be encouraged.
8. Public Awareness of Good Cyber-Security Practices
   Governments, working in collaboration with technologists, businesses and civil society, must help educate their publics in good cyber-security practices. They must also collaborate to enhance the training and development of the software workforce globally, to encourage creation of more secure and stable networks around the world.
9. Mutual Assistance to Curtail Transborder Cyber Threats
   The transborder nature of many significant forms of cyber intrusion curtails the ability of the target state to interdict, investigate and prosecute the individuals or organizations responsible for that intrusion. States should coordinate responses and provide mutual assistance in order to curtail threats, to limit damage and to deter future attacks.

The full statement provides the Commission’s view of the issues at stake and describes in greater detail the core elements that are essential to achieving a social compact for digital privacy and security.  It can be downloaded form Chatham House at this link, or by clicking on the cover image of the report, above.