Governments around the world have been adopting surveillance measures for decades. But with the development of new technologies, including artificial intelligence (AI), they can deploy surveillance at unprecedented scale and speed, as well as gain easy access to new sources of information, such as vast amounts of data collected by online platforms and services.
By the end of this learning package, you will:
- Be introduced to the intersection between technology and surveillance (with a special focus on counter-terrorism);
- Have a better understanding of the types of surveillance technologies that exist, and examples of their use;
- Expand your knowledge of the impact of surveillance technology on civic freedoms and human rights.
The increased ability of authorities to monitor people’s behaviour, including in public spaces, online and offline, has severe impacts on the right to privacy and non-discrimination, and can cause chilling effects for freedom of expression, assembly, and association. In this learning package, we will explore how different forms of surveillance technologies are used and what impacts they have on civic space.
Link between surveillance and technology
Since the 9/11 terrorist attacks in the US, we have seen the expansion of state surveillance powers and the normalisation of using new technologies in the name of security and counter-terrorism. Often, surveillance tools are hastily implemented under emergency legislation (such as during the COVID-19 pandemic) and without appropriate legal safeguards.
Accountability and scrutiny rarely goes hand in hand with expanding powers of government agencies. In addition to the rushed way in which these technologies are implemented, there is in fact very little evidence showing the effectiveness of surveillance technology for counter-terrorism. However, the harm and human rights abuses caused by these technologies are real and widely documented.
More surveillance, less scrutiny
- The United Nations Security Council, in resolution 2396, instructed governments to collect more biometric data for counter-terrorism purposes, but did not envision any specific safeguards against abuse.
- In the European Union (EU), many governments propose to exempt all uses of AI for the purposes of national security from basic requirements and fundamental rights guarantees of the draft EU AI Act.
- In the Philippines, Thailand, Cambodia and Myanmar, COVID 19-related emergency powers allow social media surveillance and criminalise the spread of “fake news” without effective redress mechanisms.
The lack of transparency that surrounds surveillance and counter-terrorism policies impedes public debate on whether governments should use intrusive technologies in the first place. Additionally, the opacity obstructs discussions around what safeguards should be in place to guarantee the protection of human rights.
When technology is used for counter-terrorism or in response to emergencies, the impact on human rights and civic space can arise from the rushed way in which surveillance tools are deployed. Dangerous or quickly implemented policies can be exacerbated by a common “move fast, break things” approach of tech companies, as they race for innovation while disregarding their impact on human rights. In addition, lack of consultation with civil society and affected communities in the design and development of technology makes it even harder to prevent or mitigate human rights risks.
In other contexts, however, technology originally developed for security purposes is used to deliberately target, surveil, and suppress CSOs. On this matter, the UN Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism concluded that the scale of attacks on activists globally suggests “the hard-wiring of misuse into counter-terrorism measures”.
Biometric surveillance
What is it?
Measurement and recording of biometric data – physical properties of the body and/or behavioural traits such as fingerprints, iris, retina, face, voice, gait – for the purposes of identification.
Examples:
- Inclusion of biometric data in national identity databases: for example, the Aadhaar database in India which in 2018 contained the fingerprints, iris scans and facial photos of over 1.1 billion people.
- Facial recognition technologies (FRT) can identify an individual based on their faceprint. They can be used to surveil public spaces, including during protests, in many countries worldwide. The Reclaim Your Face campaign gathers evidence from the EU, while media and CSO reports have highlighted the use of FRT in countries like Israel, India, Uganda, Mexico or Turkey.
- The US created biometric databases in Afghanistan and Iraq by indiscriminately collecting biometric data of local populations. Biometric systems and identification devices have been seized by the Taliban, putting thousands of Afghans at risk.
Concerns and impact on civic space:
Biometric data collection and use in the name of countering terrorism, has been accelerating around the globe. This happens often abusively, without being effectively regulated or subject to accountability mechanisms.
Biometric data is inherently difficult to hide and impossible to change or reset. This poses a threat to the right to privacy, especially when biometric surveillance is used in public spaces. The mere existence of indiscriminate biometric surveillance in publicly accessible areas can have a chilling effect on the freedom of assembly and expression. It stifles the reasonable expectation of anonymity in public spaces and reduces will and ability to take part in demonstrations and express views, for fear of being identified, profiled or even wrongly persecuted. Facial recognition systems have also been seen to make more mistakes when recognising faces of Black or Brown people, leading to discrimination and the risk of violating the right to a fair trial.
Furthermore, databases in which biometric data is captured may be used for other purposes than those for which they were created, without the person’s awareness or consent. For example, national identity systems can be connected to terrorist watchlists. This phenomenon is known as function creep and is particularly concerning in authoritarian regimes, where human rights defenders and activists are more often subjected to surveillance and targeted by counter-terrorism measures.
Want to learn more about the impacts of surveillance technologies used for security and counter-terrorism? Watch the video.
When watching the video consider the following questions...
- Do you know of cases where protesters, activists and political dissidents have been tracked or surveilled using biometric surveillance techniques?
- As the UN Special Rapporteur states, it should be transparent as to what technologies are being deployed, and who is being targeted by states and private actors. In your context is there any clarity on this?
- Do you have any ideas on how civil society and affected communities can be effectively included in the policy-making process regarding the deployment of such technologies?
Content moderation and take downs
What is it?
Governance of content posted to the Internet, particularly on social media platforms such as Facebook, X (formerly Twitter), YouTube or Instagram. It may result from platforms’ autonomous and independent content governance policies and take the form of content removals, content curation via amplification or demotion, deplatforming or shadow banning . Governments also send take-down requests to social media platforms, asking them to remove specific accounts or pieces of content based on the platforms’ terms of service, or removal orders which are based on applicable national or regional laws.
Examples:
- In Turkey, the government issued 658 removal orders related to the content of news outlets between October 2020 and May 2021.
- In Thailand, the government pressured social media platforms to take down content critical of the monarchy, especially during the height of pro-democracy protests calling for monarchy reform in 2020 and sued the platforms for failing to comply with their requests for content removal.
- During hostilities between Israel and Palestine in 2021, Facebook has wrongfully suppressed a large amount of content posted by Palestinians and their supporters, discussing human rights issues or documenting human rights abuses.
Concerns and impact on civic space:
For many CSOs and activists, especially in repressive regimes, social media platforms are a key channel for organising and reaching their supporters. When their accounts are suspended or their content is removed, it may impair their capacity to exercise their mission, leading to infringements of the freedoms of expression, association, and assembly.
Governments can use removal orders or requests to deliberately target civil society actors and their online activity in order to suppress legitimate dissent. If social media platforms do not comply, they can be threatened with fines or a prohibition of operating in the country.
Other alarming impacts to civic freedoms stem from over-broad moderation practices of social media companies. This is further exacerbated by the short deadlines imposed by policymakers, e.g. in the EU, to remove terrorist content, which may not give platforms enough time to discern whether content violates the law or their internal policies. This can inadvertently result in the suppression of legitimate content, including content exposing human rights abuses or criticising powerful actors. This is partly due to social media companies’ lack of contextual understanding and investment when moderating content in non-English speaking countries, especially countries of the Global South, as well as the challenge of adequately enforcing policies at scale.
Internet shutdowns and website blocking
What is it?
Internet shutdowns entail a complete block of Internet connectivity. Website blocking in the context of surveillance measures refers to government agencies instructing companies which provide internet networks to block access to specific websites or apps, or to throttle bandwidth (i.e., significantly limit the speed of the website), making it difficult, for example, to share or view pictures and videos.
Examples:
- In 2021, Access Now and the #KeepItOn coalition documented 182 internet shutdowns in 34 countries, with an overwhelming majority of internet shutdowns – 106 – occurring in India.
- In Jordan, broadcasting on Facebook Live was stopped on many occasions, during protests against austerity measures.
- During protests in Iran following the death of a young woman arrested by the morality police, Iranian authorities blocked access to the Internet and major social media platforms to hamper the organisation of protests online and access to materials documenting manifestations.
Concerns and impact on civic space:
Blocking major communication channels (e.g., a widely used social media platform), let alone shutting down entire internet networks, has massive impact on the capacity of civil society to exchange ideas, participate in the public debate, organise and spread information about protests, or document and disseminate information about human rights abuses in their country. This can result in violations of the freedom of expression, as well as the freedom of association and of assembly.
Internet shutdowns and website blocking are often adopted in the name of ensuring public safety and containing the spread of disinformation or incitement to violence. In reality, these measures are often deliberately used to silence protesters and suppress dissent, leading to the opposite of public safety. As the UN Human Rights Office warns, in the context of armed conflicts, “the fact that people could not communicate and promptly report abuses seems to have contributed to further insecurity and violence, including serious human rights violations”.
Interception of data from online services and telecoms
What is it?
Gaining access to the content of communications hosted by technology and telecommunications companies (such as online communicators or email providers) as well as to metadata.
Examples:
- In 2013, The Guardian published evidence gathered by Edward Snowden, a former contractor for the US National Security Agency, which revealed mass surveillance programmes in the US and UK. These indiscriminately monitored online and phone activity of millions of people under the guise of fighting terrorism.
- In 2020, a Nigerian student who created a parody Twitter account of a former Nigerian president was traced and subsequently detained for 54 days based on call logs obtained by law enforcement authorities from telecommunication service providers.
- Iran imposed a software program on mobile companies, known as SIAM, which allows government authorities to gain access to users’ locations, break encryption of phone calls, and slow down Internet connection to 2G network, making smartphones more susceptible to interception of data.
Concerns and impact on civic space:
Governments’ access to confidential communications and other private information stored by online and telecommunications services, including detailed location or phone call records, enables unprecedented tracking of people’s movements, behaviours and contacts. Yet users are often left in the dark as regards the modalities of private companies disclosing data to law enforcement, and hardly ever have a say in the matter. This poses a serious threat to the right to privacy: without appropriate safeguards and effective oversight, law-abiding individuals and civil society actors may end up caught in the surveillance dragnet.
Uncontrolled interception of data impedes the creation of spaces for participation, criticism and exchange of ideas without the fear of repercussions or retaliation. This can have a chilling effect for civic freedoms, including freedom of expression, assembly and association. Furthermore, data access frameworks originally introduced for national security or counter-terrorism may later be repurposed for domestic surveillance, for example when emergency measures are used to monitor civil society actors.This is another example of function creep.
Government scraping of social media
What is it?
Monitoring and scouring publicly available content uploaded by users of social media platforms.
Examples of use:
- In Minneapolis, US, it is reported that the police used covert, or fake, social media accounts to surveil Black individuals, organisations, and elected officials unrelated to criminal activity, without a public safety objective.
- In the Netherlands, the National Coordinator for Counterterrorism and Security (NCTV) uses fake social media accounts to track Dutch activists working in the social justice or anti-discrimination space and tracks their work, sentiments and movements through their social media accounts.
Concerns and impact on civic space:
Scouring information that people reveal on social media happens without their awareness and beyond their control. The use of fake social media accounts makes it possible for authorities to gain access even to content for which visibility was restricted. This can produce chilling effects for sharing ideas and opinions online, leading to adverse impact on freedom of expression and contributing to the shrinking of digital civic space. Widespread and unaccountable scraping of social media can also deprive activists of an important channel for organising and disseminating information about protests, for fear of surveillance or repercussions, thus affecting their freedoms of association and assembly.
Predictive analytics
What is it?
AI-driven analysis of large datasets focused on detecting patterns, anomalies, and suspicious behaviour, among others, to assess security-related risks, including terrorism.
Examples:
- In the aftermath of 9/11 terrorist attacks, many countries have introduced policies requiring airlines to collect and transmit to government and intelligence agencies detailed data of passengers (Passenger Name Records, PNR). The data is analysed to create risk categories and subsequently identify “suspicious” passengers during border control.
- In the Netherlands, the police implemented a predictive policing tool that analyses large sets of data, including historical crime data, to help decide where to deploy police or to identify individuals who are purportedly more likely to commit or be a victim of a crime.
- COMPAS is a risk assessment tool used by the courts in the United States in the context of pretrial detention, assessing the likelihood of a defendant committing another crime, among other factors. The system was found to be discriminatory towards Black and young people.
Concerns and impact on civic space:
Predictive systems identify patterns in data collected in the past in order to assess future risk or events. These assessments depend on important choices made by developers, such as how the “risk” for national security is defined in the first place or what behaviours or groups are deemed “suspicious”. This can encompass deliberate government policies and institutional practices that disadvantage certain groups, for example, treat members of some groups, such as human rights activists, dissidents, or BIPOC, as “threats”.
Furthermore, past data which predictive systems analyse and learn from can be fundamentally determined by historical practice and socio-economic biases, thereby inherently racialised and classed. The accuracy of technology itself often depends on factors such as skin colour or gender and can have lower accuracy rates for the recognition of BIPOC, gender non-conforming persons and women, thus leading to discriminatory outcomes.
In these circumstances activists, especially those belonging to marginalised groups, might be subjected to a higher level of scrutiny, without any reason to suspect them of wrongdoing. This can make it more difficult and riskier to enjoy their civic freedoms, such as their right to peaceful assembly or expression, and can even result in wrongful arrests and incarceration.
Spyware
What is it?
A type of malicious software that is installed on a device in order to extract information from that device and/or take control thereof, without the end user's knowledge and consent.
Examples:
- Pegasus, a powerful cyberespionage tool, has been used by many governments around the world to spy on human rights defenders, journalists and dissidents;
- Cellebrite Universal Forensic Extraction Device which unlocks mobile phones, extracts and analyses data, has been sold to police, military, law enforcement agencies, and secret services in over 150 countries, including more than a dozen which have been found to persecute journalists, activists, dissidents and minorities;
- Canada’s national police force has admitted to using spyware to infiltrate mobile phones and remotely turn on cameras and microphones.
Concerns and impact on civic space:
Spyware tools create unprecedented risks for human rights and civic freedoms. Mobile phones have become repositories of the most intimate details of a person’s daily life. Gaining access to this information, without the person even noticing, let alone being able to control this interference, is highly intrusive. Modern spyware, such as Pegasus, is extremely difficult to detect and existing technical tools make it impossible to prevent its installation.
This fundamentally violates the right to privacy which is essential for the full enjoyment of other freedoms. Using spyware to deliberately target, intimidate and silence activists, journalists and political opponents undermines the very essence of democracy and is a severe violation of civic freedoms.
The European data protection watchdog concluded that spyware, which grants its operators full and unrestricted access to data, will never meet the requirements of proportionality and should therefore be prohibited.
Conduct evidence-based research to assess whether or not the technologies are indeed fit for purpose and can prevent terrorism or other serious crimes in practice.
Investigate how surveillance technologies introduced in the name of security and counter-terrorism respond to the actual threats and how they will impact human rights and civic freedoms.
Engaging a wide range of individuals, groups and institutions makes assessment sufficiently informed, legitimate, and effective. This begins,and ends,with meaningfully engaging civil society and marginalised groups, as they often are the most immediately and/or severely impacted.
How do current instruments and responses address the threat of terrorism? Are more regulations and action really needed? Importantly, what has been done to address the unintended consequences of surveillance measures to date, and what lessons can be learned in crafting future responses?
Make sure that any restrictions to human rights, including civic freedoms, always meet the three-part test of legality, legitimate aim, and proportionality and necessity. No blanket exemption for the use of technology for counter-terrorism or national security could ever meet that test.
A global coalition of civil society organisations, the UN High Commissioner for Human Rights and EU data protection watchdogs have been pushing for a ban of mass biometric surveillance. Following the Pegasus scandal, regional and international bodies have also called for a ban or a moratorium on the sale of spyware. Impact assessments can be useful in understanding the level of damage of technologies on human rights.
Reflect on what you have learnt:
- What were the examples in the learning package that stood out as alarming to you regarding the impact of surveillance technologies on human rights and civic freedoms?
- What technologies could already be impacting your organisation, or users of your services?
- If the possibility were to arise, would you be interested in engaging in human rights impact assessments of these technologies?
- Framework for Meaningful Engagement. (2023) ECNL
- CT and Tech: Mapping the impact of biometric surveillance and social media platforms on civic space. (2023) ECNL
- Under Surveillance: (Mis)use of technologies in emergency responses. (2022) ECNL, INCLO and Provacy International.
- Use of Biometric Data to Identify Terrorists: Best Practice or Risky Business? Report prepared under the aegis of the Mandate of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism. (2020) Human Rights Center, University of Minnesota.
- Biometrics collection under the pretext of counter-terrorism. Privacy International.
- Security Playbook Of Digital Authoritarianism In Nigeria. (2021) Spaces for Change.
- ECNL submission to facebook oversight board's calls for public comments. (2021) ECNL
