Tightening the Net: Governments Expand Online Controls

Freedom on the Net 2014
By Sanja Kelly, Madeline Earp, Laura Reed, Adrian Shahbaz, and Mai Truong

Internet freedom around the world has declined for the fourth consecutive year, with a growing number of countries introducing online censorship and monitoring practices that are simultaneously more aggressive and more sophisticated in their targeting of individual users.

In a departure from the past, when most governments preferred a behind-the-scenes approach to internet control, countries are rapidly adopting new laws that legitimize existing repression and effectively criminalize online dissent.

As a result, more people are being arrested for their internet activity than ever before, online media outlets are increasingly pressured to censor themselves or face legal penalties, and private companies are facing new demands to comply with government requests for data or deletions.

Some states are using the revelations of widespread surveillance by the U.S. National Security Agency (NSA) as an excuse to augment their own monitoring capabilities, frequently with little or no oversight, and often aimed at the political opposition and human rights activists.

The growing restrictions at the national level are also changing the nature of the global internet, transforming it from a worldwide network into a fragmented mosaic, with both the rules and the accessible content varying from one country to another.

Blocking and filtering—once the most widespread methods of censorship—are still very common, but many countries now prefer to simply imprison users who post undesirable content, thereby deterring others and encouraging self-censorship. This approach can present the appearance of a technically uncensored internet while effectively limiting certain types of speech. Meanwhile, physical violence against internet users appears to have decreased in scope.

In 2013, Freedom House documented 26 countries where government critics and human rights defenders were subjected to beatings and other types of physical violence in connection with their online activity; that number fell to 22 in 2014.

Key Reasons for Decline in Internet Freedom, 2013–14:

  • Proliferation of repressive laws

  • Increased surveillance

  • New regulatory controls over online media

  • More arrests of social-media users

  • Intensified demands on private sector

  • New threats facing women and LGBTI population

  • More sophisticated and widespread cyberattacks

Tracking the Global Decline

To illuminate the nature of the principal threats in this rapidly changing environment, Freedom House conducted a comprehensive study of internet freedom in 65 countries around the world. This report is the fifth in its series and focuses on developments that occurred between May 2013 and May 2014. The previous edition, covering 60 countries, was published in October 2013. Freedom on the Net 2014 assesses a greater variety of political systems than its predecessors, while tracing improvements and declines in the countries examined in previous editions. Over 70 researchers, nearly all based in the countries they analyzed, contributed to the project by examining laws and practices relevant to the internet, testing the accessibility of select websites, and interviewing a wide range of sources.

Of the 65 countries assessed, 36 have experienced a negative trajectory since May 2013.

Of the 65 countries assessed, 36 have experienced a negative trajectory since May 2013. The most significant declines were in Russia, Turkey, and Ukraine. The Russian government took multiple steps to increase control over the online sphere, particularly in advance of the Sochi Olympic Games and during the ongoing crisis in Ukraine. In Turkey, the blocking of social media, limits on circumvention tools, cyberattacks against opposition news sites, and assaults on online journalists were among the most prominent threats during the year. Ukraine’s standing declined primarily due to violence targeting social-media users and online journalists during the Euromaidan protests, an increase in cyberattacks, and new evidence revealing the extent to which the administration of ousted president Viktor Yanukovych had been conducting online surveillance of activists, journalists, and opposition leaders.

Iran, Syria, and China were the world’s worst abusers of internet freedom overall. Users in China were intimidated and arrested during crackdowns on online “rumors” as President Xi Jinping consolidated control over social media. In September 2014, the same month that students in Hong Kong used the world’s third-fastest internet connection to mobilize profotn demonstrations, mainland courts sentenced prominent Uighur academic and webmaster Ilham Tohti to life imprisonment, the harshest punishment for online dissent in years. Syria was the most dangerous country in the world for citizen journalists, with dozens killed in the past year, while progovernment hackers reportedly infected 10,000 computers with malware disguised as warnings against potential cyberattacks. And despite early enthusiasm over the election of reformist president Hassan Rouhani, Iran maintained its position as the worst country for internet freedom in 2014. Authorities continued to hand down harsh punishments, sentencing people to lengthy prison terms for promoting Sufism online, among other digital activities.

Very few countries registered any gains in internet freedom, and the improvements that were recorded largely reflected less vigorous application of existing internet controls compared with the previous year, rather than genuinely new and positive steps taken by the government. The year’s biggest improvement occurred in India, where authorities relaxed restrictions on access and content that had been imposed in 2013 to help quell rioting in northeastern states.

Another country that registered a notable improvement is Brazil, where after years of debate and revision, lawmakers approved a bill known as the Marco Civil da Internet that contains important provisions governing net neutrality and ensuring strong privacy protections. Freedom House also documented an improvement in Belarus, mainly because the political environment was less volatile and the government eased enforcement of some restrictions, even as citizens increasingly used the internet to voice their views.

Major Trends

New Legal Measures Curb Internet Freedom

In December 2013, as antigovernment protesters flooded the streets in Ukraine, Russian president Vladimir Putin signed a bill authorizing the prosecutor general to block any websites hosting “extremist” content or calls to protest, without judicial oversight. The law took effect on February 1, 2014, and was used immediately to crack down on digital media that carried criticism of the Kremlin’s policy toward Ukraine. Within six weeks, three major independent news sites were blocked. A strikingly similar law was enacted in Kazakhstan in April, signifying both the spreading influence of repressive models for internet control— a so-called snowball effect—and a growing trend in which governments use the legal system to codify and legitimize their restrictions.

Problematic new laws are emerging in democratic and authoritarian countries alike.

While the legal measures adopted in a range of countries were intended to enable the development of information and communication technologies (ICTs) or protect individual rights, they also typically included problematic provisions with explicit restrictions or ambiguous language that could be abusively applied to legitimate online activities. These new rules come at a time when technological innovations are evolving to circumvent older methods of control, such as blocking and filtering.

In late 2013, for example, the research and advocacy group Greatfire.org began hosting content that is banned by the Chinese government on “unblockable” domains owned by Amazon and other major companies, which officials cannot risk censoring because of their large commercial footprint within China. Separately, during the September-October 2014 profotn protests in Hong Kong, concerns that the authorities might shut down telecommunications service led to widespread use of the mobile phone application FireChat, which enabled protesters to communicate through a network of Bluetooth connections.

Unable to keep up with such developments on a purely technical level, authorities are increasingly turning to their legal systems to control online activity. They are moving beyond the online application of existing, generalized tools, such as criminal defamation laws, and crafting new measures that pertain specifically to ICTs.

Problematic new laws are emerging in democratic and authoritarian countries alike. Democratic states have struggled to draft legislation that adequately balances legitimate priorities like counterterrorism with the protection of citizens’ rights online. Nevertheless, countries with effective democratic institutions allow for public consultation and correction when laws infringe on fundamental freedoms. By contrast, the avenues for review of abusive laws are limited in nondemocratic states, compromised by closed political systems and weak rule of law. In the most extreme cases, authoritarian regimes simply issue executive decrees or regulations that bypass any legislative or judicial oversight.

Most of the restrictive new legal measures documented by Freedom on the Net 2014 fall into the following categories.

Bans on online dissent: While some countries opt to create laws with vague language that can be used to stifle dissent when needed, others are much more open about their goal of cracking down on any criticism. In many cases, the penalties for online expression are worse than those for similar actions offline. In July 2013, for example, the Gambian government passed amendments to the Information and Communication Act that specifically criminalized the use of the internet to criticize, impersonate, or spread false news about public officials. Anyone found guilty could face up to 15 years in prison, fines of roughly $100,000, or both—significantly harsher punishments than what the criminal code prescribes for the equivalent offenses offline.

Restrictions targeting expression on social media were particularly draconian in Vietnam. Decree 72, enacted in September 2013, extended prohibitions against political or social commentary from blogs to all social-networking sites. Decree 174, issued that November, introduced fines for spreading antistate propaganda on social media.

Criminalization of online defamation: Measures to criminalize defamation online emerged as a prominent trend. In May 2013, the government of Azerbaijan adopted legal measures that expanded criminal defamation to online content, further constraining criticism of government officials in the run-up to the presidential election in October. Criminal defamation laws are especially problematic given the ease with which casual remarks on social-media platforms can be targeted by officials for reprisal. In January 2014, a Zimbabwean user was arrested for calling President Robert Mugabe “an idiot” on his Facebook page.

Broad national security laws: Several countries used the pretext of national security to enact legal measures that allowed the potential restriction of legitimate speech online. In Ethiopia, a new cybersecurity law states that “social-media outlets, blogs, and other internet-related media have great capabilities to instigate war, to damage the country’s image, and create havoc in the economic atmosphere of the country.” The law empowers the government to investigate computers, networks, internet sites, radio and television stations, and social-media platforms “for any possible damage to the country’s social, economic, political, and psychological well-being.” In the Middle East, Jordan broadened its definition of illegal terrorist activities to include acts that could damage the country’s relations with foreign countries, including the online publication of critical commentary on foreign leaders.

In some countries, the penalties for online expression are worse than those for similar actions offline.

Expanded powers for state regulators: Other legal measures provided government entities with unchecked discretionary authority over online media and speech. In Kenya, a new information and communications law signed in December 2013 gave the government-appointed regulator vaguely defined new powers, including the authority to impose punitive fines on both journalists and media houses for alleged ethical violations. Similarly in Ecuador, the Organic Law on Communications enacted in June 2013 extended the communication regulator’s control over content to “all media with an online presence.” It was immediately applied to target numerous print and online news outlets.

Content blocking without a court order: Measures that empowered government agencies to block content without judicial oversight and with little or no transparency were especially notable in five countries—Turkey, Thailand, Russia, Kazakhstan, and Italy. In the less democratic countries, these laws have coincided with political turmoil and an urgent government desire to suppress dissent.

In Turkey, after audio recordings implicating highlevel officials in a corruption scandal were leaked on YouTube and SoundCloud, new legal measures empowered the state regulator to block websites without a court order in cases that violate privacy or are considered “discriminatory or insulting.” The regulator later blocked YouTube to suppress an unverified recording of a national security meeting. Twitter was also blocked after refusing to suspend user accounts. President Recep Tayyip Erdoğan, who was prime minister at the time, has vowed to “wipe out Twitter” and called social media the “worst menace to society.”

In Thailand, judicial oversight is legally required when web content is blocked, but court orders from the past year undermined that requirement, allowing information officials to block web pages that are “similar” to those specified in the order without seeking separate permission. The situation worsened following the May 2014 coup, as military leaders issued censorship directives under martial law, blocking more than 200 pages in the week after they seized power.

Excessive intermediary liability: Some new laws imposed criminal liability on intermediaries—such as ISPs and content-hosting platforms—for objectionable content posted by others through their services. In Uganda, the controversial Anti-Pornography Act adopted in February 2014 imposed criminal penalties on service and content providers whose systems are used to upload or download broadly defined “pornographic” material. Although the law was annulled in August on a technicality, it was representative of a broader international trend in which companies or individuals face prosecution merely for providing a platform or network to be used by others.

Of the 65 countries studied in Freedom on the Net 2014, 19 passed new legislation that increased surveillance or restricted user anonymity.

Intrusive surveillance: Following the revelations about NSA surveillance practices, some governments have been working to pass legislation that will improve surveillance policies by balancing the needs of intelligence agencies with the protection of users’ rights. However, other states have enacted laws that further restrict individuals’ ability to communicate anonymously, a trend that is particularly concerning in countries where surveillance is regularly used to monitor and punish dissent.

Of the 65 countries studied in Freedom on the Net 2014, 19 passed new legislation that increased surveillance or restricted user anonymity, including authoritarian countries where there is no judicial independence or credible legal recourse for users whose rights have been violated. In April 2014, for example, Turkey passed amendments to the law on the National Intelligence Organization that further insulated the agency’s activities from judicial or media scrutiny. The changes empower the intelligence service to obtain information and electronic data from public bodies, private companies, and individuals without a court order.

The governments of Uzbekistan and Nigeria both passed laws that require cybercafés to keep a log of their customers, and in the case of Uzbekistan, owners must also keep records of customers’ browsing histories for up to three months. In Russia, the so-called “bloggers law,” passed in May 2014, increased government oversight of social-media users by requiring anyone whose sites or pages draw over 3,000 daily viewers to register with the telecommunications regulator.

More democratic countries also drafted, and in some cases passed, potentially harmful surveillance legislation. Despite a significant outcry in France over revelations that the national intelligence agency had been cooperating with the NSA and its British counterpart, in December 2013 the French legislature added an article to an omnibus bill on the military budget that extended the authorities’ legal powers to access or record telephone conversations, e-mail, internet activity, personal location data, and other electronic communications. The legislation provides for no judicial oversight and allows electronic surveillance for a broad range of purposes, including “national security,” the protection of France’s “scientific and economical potential,” and prevention of “terrorism” or “criminality.”

Efforts to reform surveillance legislation in the United States gained momentum in the aftermath of the NSA revelations, though at the end of the period covered by this report, legislative changes were still pending. Notably, some of the bills drafted in Congress would have essentially codified existing surveillance practices. However, by mid-2014 one of the more positive bills, the USA Freedom Act, had garnered significant support from lawmakers, civil society, and the intelligence community.

Arrests and Reprisals Increase for Social-Media Users

In tandem with the growing number of legal measures designed to restrict online speech, more people were detained or prosecuted for their digital activities in the past year than ever before. Since May 2013, arrests for online communications were documented in 38 of the 65 countries studied in Freedom on the Net 2014, with social-media users identified as one of the main targets of government repression.

Nowhere was this more prevalent than in the Middle East and North Africa. Of the 11 countries examined in the region, 10 featured detentions or interrogations of internet users during the coverage period. Dozens of social-media users were arrested in Bahrain, Saudi Arabia, and the United Arab Emirates, with many sentenced to jail terms of up to 10 years. Despite their high levels of access, the countries of the Persian Gulf remain some of the most restrictive for online freedom of expression.

Social-networking sites—the new battleground for governments seeking to quell protests and organized dissent—spurred an unprecedented volume of legal and extralegal detentions. Chinese police detained hundreds of Weibo microblog users, and indicted some of the most prominent, after top legal authorities established 5,000 views or 500 reposts as a new threshold for prosecuting false, defamatory, or “harmful” comments online. China has imprisoned more internet users than any other nation even without this new justification. The change, however, gave authorities an additional tool to punish dissidents, while also serving as a warning to celebrity bloggers with millions of followers, including members of the business elite. Venture capitalist Charles Xue appeared handcuffed on state television in September 2013 to apologize for sharing unverified information online.

Officials in 11 countries took steps to proactively monitor social media for signs of dissent and to crack down on users for political or social commentary. In Ethiopia, where one blogger is serving an 18-year sentence and six more face trial, the government’s Information Network Security Agency began scanning social media for “damage” to the country’s “well-being” under a November 2013 decree. Also that month, Bahrain’s state media announced the establishment of a Cyber Safety Directorate to monitor websites and social media for content that threatens the unity and cohesion of Bahraini society or that incites violence and hatred.

Government attention and reprisals often focused on social-media posts about political leaders. In Bangladesh, supporters of Prime Minister Sheikh Hasina accused their opponents of defaming her on Facebook. In South Korea, where defamation comes with a longer sentence when committed on the internet, at least three people faced trial for online comments about President Park Geun-hye. In some countries, these developments have coincided with the growth of online platforms and their user base.

More people were detained or prosecuted for their digital activities in the past year than ever before.

Internet users were tried not only for what they posted online, but also for content found on their electronic devices. In Thailand, a man was sentenced to seven years in prison after police confiscated his computer and discovered pictures that were deemed insulting to the king. He was convicted of “attempting” to commit lèse-majesté—a charge with no legal basis—as investigators argued that he intended to upload the material to the internet eventually.

Online Journalists and Bloggers Face Greater Pressure

The past year featured increased government pressure on independent news websites, which had previously been among the few unfettered sources of information in many countries. Bloggers and online journalists covering antigovernment demonstrations faced arbitrary detention and, at times, physical violence at the hands of police or progovernment thugs. Dozens of citizen journalists were killed in Syria, and an independent reporter was fatally shot while covering an antigovernment demonstration in Egypt. Citizen journalists covering mass protests in Turkey and Ukraine were also physically assaulted. Online journalists were arrested in 7 out of 12 sub-Saharan African countries examined in Freedom on the Net 2014.

Authorities in Jordan, Singapore, and Russia introduced, updated, or enforced rules mandating that news sites and popular blogs obtain licenses or register with the government, a trend that may inhibit independent reporting given the fear of government retribution. In addition to licensing requirements, authoritarian governments used a variety of laws to arrest and intimidate government critics who publish stories online. In Morocco, Ali Anouzla, the Arabic editor of the news site Lakome, was arrested for inciting terrorism after he published an article that contained a hyperlink to a Spanish news site, which in turn had embedded an extremist propaganda video. Lakome was subsequently blocked in one of Morocco’s first cases of politically motivated blocking in years.

In Iran, 16 employees of the gadget review site Narenji were arrested over alleged links to foreign governments and “anti-Iranian media.”

Online journalists and others who publish independent reporting online were arrested in at least 25 countries during the coverage period. In Ethiopia, six writers from the Zone9 news blog were arrested in April 2014 and face charges related to accepting foreign funding and inciting violence through social media. In Iran, 16 employees of the gadget review site Narenji were arrested over alleged links to foreign governments and “anti-Iranian media,” with some apparently charged due to their participation in training programs run by the Persian service of the British Broadcasting Corporation (BBC), which the Iranian government linked to the British intelligence agency MI6. Eleven of the defendants were later found guilty, and the website’s founder received the heaviest sentence—11 years in prison.

At times, authorities used trumped-up charges with no link to actual reporting to punish independent journalists. In Uzbekistan, Sergey Naumov, an independent journalist who has contributed reporting for the Ferghana News website, was arrested in September 2013 on charges of hooliganism and given a 12-day jail sentence after he allegedly collided with a woman on the street, who then accused him of harassing her.

The charges came days after Naumov began recording video about forced labor practices during the country’s annual cotton harvest. In Azerbaijan, several news site editors were also arrested on apparently fabricated charges of drug possession or hooliganism. In Belarus, a blogger who exposed police corruption was forced to undergo a psychiatric evaluation and faced harassment by police. And in Vietnam, lawyer and ’blogger Lê QuÔc Quân was sentenced to 30 months in prison for tax evasion, a charge that is frequently used by the government to silence dissidents. He had been arrested in 2012, shortly after publishing an article on the website of the BBC’s Vietnamese service.

Civil society activists who use ICTs to document abuse or rally supporters, or simply as a part of their daily lives, also faced threats. Two senior members of Odhikar, a nongovernmental organization (NGO) in Bangladesh, were arrested and charged under the ICT Act for “fabricating” reports of a government crackdown on protesters to “enrage” the public. Alaa Abd el-Fattah, a prominent Egyptian blogger and activist, was sentenced to 15 years in prison in June 2014 for organizing a protest against military trials for civilians. He was not allowed to attend his own sentencing. Although he was released on bail pending a retrial, he was later rearrested. Abd el-Fattah has faced legal harassment from every Egyptian regime since that of former president Hosni Mubarak.

Emerging Threats

In addition to the clear infringements on internet freedom caused by the proliferation of restrictive laws and the rise in arrests and attacks on users and online journalists, Freedom House has identified three emerging threats that are placing the rights of internet users at increasing risk:

  • Data localization, by which private companies are required to maintain data storage centers within a given country to allow for greater government control

  • A harsh environment for women and members of the LGBTI (lesbian, gay, bisexual, transgender, and intersex) community, who are both underrepresented online and disproportionately harassed for their online activities

  • Lack of cybersecurity for human rights activists and political opposition members, who have increasingly been targeted with technical attacks and spying by repressive governments

Data Localization

As governments search for ways to maintain or expand their jurisdiction over the online sphere, internet companies are finding themselves under increasing pressure, whether through court decisions that increase intermediary liability or through government decisions to block access to their platforms. Within this broader trend, proposed data localization requirements—obliging companies to store communications data on servers located within the country in question—have multiplied over the past year, in some cases gaining traction due to the NSA revelations. While these policies could create prohibitive barriers for companies seeking to operate in certain countries, they also pose significant threats to internet users’ rights and ability to access information, for instance by potentially limiting users’ choice of internet platforms and subjecting them to more surveillance by their own governments.

Over the past year, the Russian government has significantly stepped up efforts to exert control over the internet, partly by attempting to regulate the flow of data itself. A law signed in July 2014 requires internet companies to store Russian citizens’ data on servers in Russia. An amendment in September moved up the compliance date from September 1, 2016, to January 1, 2015, which could present a significant challenge for companies like Facebook and Twitter that do not currently have servers within the country. Many human rights advocates are concerned that the new law will make it even easier for Russian intelligence agencies to access the communications data of Russian users, particularly activists and opposition figures who may then face arrests and prosecution for their online activities.

In July 2013, the Vietnamese government issued Decree 72, which, among other things, requires international internet companies to establish at least one server in the country, subject to local law and oversight. Despite the fact that numerous international organizations criticized the original draft of the decree as a significant threat to free speech and privacy, the revised drafts maintained the data localization requirement, though it remains unclear how or whether it will be enforced.

Many governments are understandably concerned about how their citizens’ information makes its way in and out of other countries’ jurisdictions, as the data may be subject to surveillance abroad. But given the decentralized structure of the internet, data localization requirements alone will not prevent crucial information from flowing across borders. Indeed, authoritarian regimes seem to be using these policies for other goals, ranging from enhanced domestic surveillance to reduced competition for domestic internet companies. While data localization may succeed in boosting the economic success of local data centers, they could also have costly effects for other domestic businesses that rely on foreign internet companies.

Harassment of Women and LGBTI Users

Internet freedom is particularly tenuous for LGBTI people and women. Globally, women continue to face immense cultural and socioeconomic barriers to ICT access, resulting in a significant gender gap in ICT use. While increasing access to digital media has helped women to fight for political, social, and economic equality, closing the digital gender gap is not enough to guarantee women’s participation in the online sphere. Increasingly, women around the world are subject to harassment, threats, and violent attacks for their online activities, which can lead to self-censorship among female internet users and significantly inhibit their freedom of expression.

Internet freedom is particularly tenuous for LGBTI people and women.

In some countries where fundamental rights for women are routinely flouted, they are increasingly targeted for merely accessing ICTs. In Pakistan, a woman was stoned to death by local men in June 2013 after a tribal court convicted her of possessing a mobile phone. Also that month, a group of men fatally shot a woman and her two daughters in the country’s north after a video of the women laughing, which male family members considered shameful, circulated on local mobile networks.

In Azerbaijan, investigative journalist Khadija Ismayilova has repeatedly been subjected to blackmail and gender-based smear campaigns in an attempt to silence her and discredit her work. In India, women’s rights activist Kavita Krishnan was harassed online by a person using the handle “@RAPIST.” Digital activists were also penalized for documenting violence against women; Mukhlif al-Shammari was jailed for five years in June 2013, in part for posting a YouTube video on the mistreatment of girls in Saudi Arabia.

Members of the LGBTI community have faced targeted threats and harassment via ICTs, impeding their ability to freely use certain tools. In Egypt, there were reports that the authorities used the dating application Grindr to entrap and prosecute gay men. Following the adoption of Uganda’s Anti-Homosexuality Act in February 2014, numerous members of the LGBTI community reported receiving e-mail spyware known as “Zeus malware” that sought to access their contact details and confidential information from compromised computers. Similarly in Russia, where the parliament passed a law against LGBTI “propaganda” in June 2013, vigilante groups used online tools to bait gay men, luring them to in-person encounters where they were physically assaulted and threatened with public exposure.

Lack of Cybersecurity

As users have become more privacy conscious, malware attacks against government critics and human rights organizations have evolved to take on a more personalized character. Technical attacks against such targets were noted in 32 of the 65 countries examined this year.

So-called spear phishing has emerged as one of the most effective techniques for hijacking online accounts and collecting sensitive information. Victims receive customized e-mail messages that typically direct them to an official-looking page, run by the hackers, where they are prompted to enter their e-mail or social-media credentials. These sorts of attacks were employed by the Syrian Electronic Army against international news organizations such as the New York Times, Global Post, CNN, and Forbes over the past year.

Once in control of an opposition website or socialmedia account, hackers can post hyperlinks to online petitions or exciting news stories to lure users into clicking. These links often have hidden tracking capabilities that can ascertain a user’s location. According to a report by BahrainWatch, malicious links have been used to identify and arrest several anonymous Twitter users who were outspoken against the government in that country. The increased use of “social engineering”—essentially tricking users into revealing information—and account hijacking has reinforced the idea that one’s own digital security often depends on the actions and judgment of those in one’s broader social or professional network.

In many cases, assailants perform substantial research about a target’s interests, professional connections, and personal relationships in order to create an individually tailored attack. For instance, bogus Facebook, Google, LinkedIn, and Twitter profiles have been set up by Iranian intelligence agents to “friend” foreign targets. One LinkedIn profile under the name of John Bolton, the former U.S. ambassador to the United Nations, was created to ensnare pro-Israel researchers and exiled members of Iran’s persecuted Baha’i community. Attackers sometimes spend several months building trust before sending a link to a relevant news story that contains malicious code.

Spear-phishing victims are often prompted to download a particular file that then installs a malware program. Hackers using this technique have targeted members of the Ethiopian exile community, such as opposition figure Tadesse Kersmo and staff at the Virginia-based news outlet ESAT. Researchers at the University of Toronto’s CitizenLab have traced the attacks to individuals working for or in close coordination with the Ethiopian government.

In Pakistan, a woman was stoned to death by local men in June 2013 after a tribal court convicted her of possessing a mobile phone.

The Ethiopian example reflects a growing trend in which progovernment hackers are expanding their operations beyond national borders. In one case, attackers hijacked the profotn site of a Vietnamese blogger living in California and used it to publish her personal photos and e-mails. Researchers noted that the malware employed was detectable by only 1 in 47 antivirus programs at the time, reflecting an unusually high level of sophistication that suggested state involvement.

The Global Struggle for Internet Freedom

Despite overall declines in global internet freedom, an ongoing trend of pushback from civil society was amplified this year by reactions to the NSA surveillance revelations. Awareness of the threats to fundamental rights expanded beyond civil society, as ordinary users around the world became more engaged in securing their privacy and freedom of expression online. In select cases, long-running internet freedom campaigns finally garnered the necessary momentum to succeed.

The most widely praised step forward for internet freedom over the past year was the passage of Brazil’s Marco Civil da Internet, thanks in large part to pressure from activists and the public. The bill, which had stalled in Congress after numerous debates and revisions, gained fresh traction following the disclosure that the NSA and other intelligence agencies had engaged in mass collection and storage of the communications data of users around the world.

The widespread alarm inspired potentially negative revisions to the bill, such as data localization requirements, but these were ultimately removed. In a more positive response to the NSA scandal, a Brazilian legislator included even stronger privacy provisions for user data. The final bill also contains key provisions restricting traffic discrimination in order to guarantee net neutrality, and ensuring strong protections for freedom of expression online. While there are still some problems with the final text, including the mandatory retention of access data for six months, the Marco Civil was widely regarded as a positive example for other countries.

Popular uproar over government surveillance had a positive effect elsewhere in Latin America, where problematic proposals were halted. In Ecuador, lobbying efforts by the Internet Libre collective resulted in the defeat of Article 474 of the penal code, which would have forced ISPs to record all user activity for six months. In Argentina, community members prevented a government initiative to proactively monitor socialnetworking sites for potentially disruptive events, which opponents deemed “preemptive surveillance.”

In Europe, outrage over the NSA revelations brought the topic of user privacy to the center of discussions in the European Parliament and EU member states. In December 2013, the European Court of Justice ruled that current requirements placed on ISPs to indiscriminately store data on their customers were in contravention of Articles 7, 8, and 52(1) of the Charter of Fundamental Rights of the European Union. Civil society critics had long argued that the requirements of the European Data Retention Directive constituted mass surveillance and far exceeded what was necessary for law enforcement purposes. However, the decision to strike down the directive has prompted a range of reactions among the member states, with some drafting their own retention laws to ensure that ISPs continue to store user data.

These legislative and judicial successes notably occurred in democratic states, where the rule of law prevails and governments are generally held accountable to citizens and civil society. In Brazil, for example, the draft of the Marco Civil was the result of a collaborative process that included input from civil society and ordinary citizens, and it had support from members of Congress and the president.

In more authoritarian settings, and in democracies where needed reforms are still pending, individuals and companies have taken matters of privacy and freedom of expression into their own hands by using anonymizing and encryption tools. Products that emphasize user privacy have logged a notable increase in users since June 2013. On the anniversary of the NSA revelations, civil society campaigns placed an emphasis on educating users about available privacy tools. And internet companies that initially came under fire for cooperating with intelligence agencies or not adequately protecting user data have since taken steps to improve their encryption standards.

Internet freedom is important not just for its own sake, but because it facilitates expression and activism on other issues. Civil society organizations have continued to use ICTs to advocate for positive change in their communities, such as the recognition of women’s rights in the Middle East. In Lebanon, online campaigns by the NGOs Nasawiya and Kafa contributed to the passage of a law on domestic violence. Since a 2013 UN report found that over 99 percent of Egyptian women had experienced sexual harassment, websites such as Harassmap have spread awareness about the issue while providing tools for victims to report incidents and obtain psychological or legal support. In Saudi Arabia, a campaign to allow women to drive cars gained momentum after a dozen women posted videos of themselves driving in a coordinated day of action in October 2013.

In these and a growing number of other countries, the internet is a crucial medium not just for personal communication or news and information, but for political participation and civic engagement. The struggle for internet freedom is consequently inseparable from the struggle for freedom of every kind.