(Moscow) – The Russian government will gain even greater control over freedom of speech and information online when the country’s “sovereign internet” law goes into effect on November 1, 2019, Human Rights Watch said today.
The law, adopted in April, obliges internet service providers to install special equipment that can track, filter, and reroute internet traffic. This equipment allows Russia’s telecommunications watchdog, Roskomnadzor, to independently and extrajudicially block access to content that the government deems a threat. Such interference can be also based on content’s origin, the type of app on which it was conveyed, and the like.
“Now the government can directly censor content or even turn Russia’s internet into a closed system without telling the public what they are doing or why,” said Rachel Denber, deputy Europe and Central Asia director at Human Rights Watch. “This jeopardizes the right of people in Russia to free speech and freedom of information online.”
In April, Human Rights Watch, together with nine other human rights, media, and internet freedom organizations, condemned the law in a joint statement, saying that “it will lead to further limitations of already restricted internet and media” in Russia.
The “sovereign internet” law purports to provide a legal basis for mass surveillance and allows the government to effectively enforce online existing legislation that undermines freedom of expression and privacy, Human Rights Watch said. For a law to provide a legitimate legal basis for restricting the protected rights or freedoms under international norms, it must be drafted with sufficient precision to be foreseeable in how it can be applied. The overly broad and vague provisions in the “sovereign internet” law do not meet this standard.
The vague definition of security threats leaves it to the authorities to decide which situation requires tracking, rerouting, or blocking. The process is not transparent and opens the door to abuse, Human Rights Watch said.
Blocking can range from a single message or post to an ongoing network shutdown, including cutting Russia off from the World Wide Web or shutting down connectivity within Russia. The Russian government allegedly experimented with temporarily turning off mobile internet services during local protests both in Moscow and Ingushetia, a southern region that has experienced mass protests. The new technology also could be used for more targeted censorship.
The equipment that internet service providers are required to install will conduct Deep Packet Inspection (DPI), an advanced method of network monitoring that can be used to block or surveil internet traffic. Experts have criticized the use of DPI for censorship and surveillance as an invasion of the privacy of communications and a means for total political repression. Although an adviser to President Vladimir Putin acknowledged that the equipment is not ready to be installed nationwide by November 1, media have reported that it is already being tested in several cities in the Ural mountains and in Tyumen.
The law’s proclaimed goal is to protect Russian websites and online services from external threats. But Russian authorities have an obligation to ensure that restrictions on online expression and access to information are necessary and proportionate to achieve specific and legitimate security objectives, Human Rights Watch said.
Instead, the law creates a system that is open to abuse by giving the government virtually unlimited ability and authority to continuously monitor all internet activity to identify possible threats. If service providers fail to cooperate with the authorities’ demands, operators of internet exchange points, key hubs for internet traffic exchange, are required to disconnect them.
Although about 30 by-laws and implementing regulations have yet to be adopted, independent experts and the Ministry of Economic Development have criticized the few that have been submitted for lack of clarity.
The law could also be used to limit Virtual Private Networks (VPNs), a common tool to bypass website blocking, by filtering individual VPN traffic. Russia already has laws limiting internet anonymity, making it illegal for VPN providers to provide access to banned websites, and for “organizers of information dissemination,” as the law describes it, including messaging apps, to allow unidentified users.
The law requires the creation of a national domain name system. This system works as the address book of the internet, translating a URL address into a numerical IP address, which is then used to connect a user to the website they are looking for. Beginning January 1, 2021, the internet service providers are required to use the national domain name system (DNS). This will provide Russian authorities with the ability to respond to a user’s request with a wrong address or no address at all, potentially manipulating search results and other sources of information.
The law is inconsistent with standards on freedom of expression and privacy protected by the International Covenant on Civil and Political Rights and the European Convention on Human Rights. Russia is a party to both. While both treaties allow states to limit these rights to protect legitimate national security objectives, these limitations must be established under clear legal criteria, and the least restrictive means of achieving these objectives.
“This law allows for colossal, extrajudicial blocking of speech and information without transparency, proper judicial authorization, or meaningful oversight,” Denber said. “This is bad news for Russia and creates a dangerous precedent for other countries. Russia should halt implementation of this system and instead commit to a free and open internet.”
