IT Best Practices Matrix Spam 2005: Technology, Law and Policy Search Shi Tao Illegally providing state secrets November 23, 2014 HRIC Trends Bulletin on "China's Environment and Situation of Water" HRIC Statement for Tibetan Uprising Day: "March 10: Out of Exile, Into the Streets!" Where's Hu Now?: Let your voice be heard on Hu Jintao's U.S. visit HRIC Comments on HR 4780: Global Online Freedom Act of 2006 Li Zhi Appellate Ruling: English translation HRIC Testimony to "Monitoring Respect for Human Rights" Articles Alert: Feb 2006 HRIC Trends Bulletin: Media Crackdowns in China HRIC Testimony to "Internet in China" Congressional Hearing		Change text size Print this page Human Rights and Spam: A China Case Study [First published in the Center for Democracy & Technology's Spam 2005: Technology, Law, and Policy.] "Regarding Internet security, we use pseudonyms, but the vast majority of Chinese or social classes do not have Internet access. Even though I am [writing] to you, there are thoughts I must keep to myself; there is no opportunity to speak, even briefly, and this is also most regrettable. However, ultimately, one blade of grass can set the prairie ablaze!" — An e-mail received from a Chinese lawyer, who is a reader of Human Rights in China's Chinese weekly e-newsletter, Huaxia Bao. Addressing spam mail via technology and legislation raises key issues of balancing protection of users from unwanted commercial e-mail while protecting their freedom of expression and access to information. These can be seen in the case of China, a leading source of spam mail, one of the most repressive governments, and a major hub for ICT development, representing particular challenges when implementing anti-spam strategies. Even as the Chinese government signs on rhetorically to emerging international norms and encourages the growth of the Internet, it continues to build a sophisticated architecture of censorship and information control that undermines technology as a tool for empowerment. Actions must be analyzed within the realities of local situations to ensure that the crusade to eliminate spam does not aid governments in the repression of their people. With many ICT companies bidding on projects for the 2008 Beijing Olympics and eager to participate in the China-boom, HRIC recommends developing "best" business practices, targeted towards different types of IT companies and at multiple levels, integrating an international human rights framework into the development and implementation of anti-spam technology and legislation, and ICT infrastructure at large. Technology and Human Rights Technology has the potential to serve as a tool for empowering peaceful human rights activism, and building a more open and democratic civil society through the free flow of information and online collaboration. More specifically the Internet, including e-mail, can be used to amplify dissident and activist voices; generate global support and attention to critical issues; build a virtual space for citizens to meet and organize; and access shared resources inside and outside of China. Such use of technology empowers China's human networks, including Chinese NGOs, workers, peasants, students, religious practitioners, intellectuals, democracy activist, journalists, lawyers, AIDS activists and public health advocates. [1] Technology used in collaboration with human rights activism can advance the development of normative standards that the international community has already adopted, such as freedom of expression and access to information, as articulated in the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights. In addition to signing and ratifying treaties, many governments are also engaged in global norm-setting processes, such as the World Summit on Information Society (WSIS). The WSIS Declaration of Principles includes equitable distribution and access to technology, and protection of indigenous knowledge, culture, and language, in addition to freedom of expression and access to information.[2] Disproportionate Development and Information Control in China Even as the Chinese government signs on rhetorically to emerging international norms of inclusiveness, democracy and a "people-centered" vision of an information society[3] and encourages the growth of the Internet, it continues to build a sophisticated architecture of censorship and information control that undermines technology as a tool for empowerment. The exponential adoption and development of the Internet in China is accompanied by persistent and serious social and economic gaps reflected in a digital divide of gender, economic, geographic and social disparities. [4] In the past seven years, the number of Internet users has grown exponentially from 620,000 to 87 million. [5] The current demographics of Internet users show that 60 per cent of the Chinese Netizen population is made up of young males, and just over half are less than 25 years old.[6] In a country where 364 million young people do not have the opportunity to enroll in secondary education, and where many villages, especially in western China, do not even have sufficient basic infrastructure such as water, power or telephone lines, the potential of the Internet to act as a democratizing force is undermined by uneven access and disparities in economic privilege. [7] As the Human Development Map[8] below shows, along the affluent eastern coast where Beijing, Guangzhou and Shanghai are located, there are significantly higher levels of infrastructure development than in the west, allowing more users to surf the Net from home. Moving away from the financial hubs, a higher percentage of Internet users depend on cyber cafes,[9] which are required by government to use surveillance software and are under constant threat of closure by authorities. Thus, official crackdowns on Internet cafes have a disproportionate impact on less economically privileged users and those in the least affluent parts of the country. In addition to these economic and social disparities, a major challenge to building a more open and democratic China is reflected in the People Republic of China's (PRC) control over the flow of information. It uses technical, social and legal approaches within a broader existing legal framework of governing state secrets and state security. Firewalls, proxy servers, filtration software for Internet Service Providers and Internet cafes, e-mail and search engine filtration, Web site blocking, and surveillance of Internet cafes are among the technical approaches that the Chinese government implements to impede the flow and availability of information to Chinese citizens.[10] In conjunction with filtering, blocking, and surveillance, social methods, such as mass media, ideology and propaganda are used to control the flow of information, and social order at large. [11] More than 60 laws govern Internet activities in China, including self-censorship regulations to which over 120 Chinese and international companies have agreed to abide. With over 30,000 state security employees monitoring Web sites, chat rooms, and e-mails, the PRC executes a very effective police apparatus. Currently, over 60 Internet users are in detention for publishing "subversive" content online, including calling for political reform and the free flow of information. These technical, social, and legal techniques to control freedom of expression and access to information function within a broader, sophisticated, and complex framework of national security, state secrets and criminal law. The law defines states secrets as "matters that affect the security and interests of the state?0"3?0¡K2" with information that can be classified retroactively and based on consequences.[12] These methods are not new culturally or historically, but the Internet and new technologies have provided a technological upgrade for the police state. As a result, China's information control has resulted in censorship and self-censorship; a culture and climate of fear; and an undermined capacity to deal with problems. Duality concerns for anti-spam approaches in China Addressing spam mail via anti-spam technology and legislation raises key issues of balancing protection of users from unwanted commercial e-mail, while protecting their freedom of expression and access to information. Spam, defined as unsolicited commercial e-mail, currently floods 60 per cent of e-mail traffic, posing a significant global problem. Unwanted e-mail presents security and privacy risks, and costs businesses and organizations time and money. To address these problems, governments, multinational corporations, consumer protection groups, and others have developed a "cocktail" approach to stemming the flow of spam, using technology, industry, enforcement through legislation, and consumer education measures. [13] The CAN-SPAM Act of 2003 was enacted by the US to regulate spam e-mail, imposing limitations and penalties on violators of the Act. In particular, the Act directs the Federal Trade Commission (FTC) to cooperate with foreign states to minimize the dissemination of unwanted e-mails.[14] Information technology and digital communications as tools for empowering human rights activism may be hampered by overbroad anti-spam technology and legislation. The over breadth and vagueness of the definition and implementation of anti-spam technology may have unintended consequences of blocking freedom of expression. New requirements that e-mail senders identify themselves may undermine protections of anonymity and privacy. The duality[15] of the technology tools raises concerns for a country with an authoritarian government. The tools used to send non-commercial bulk e-mails, such as domain spoofing and word obscuring, are often deployed by activists to avoid detection in face of a government architecture of surveillance and censorship. On the other hand the same e-mail filtering tools that block obscene or commercial content, with nothing more than a change in settings, is used by governments to block "subversive" content. Technological methodology to track down individual spammers can also be used to identify the anonymous author of an e-mail critical of government policies. Legislative solutions should recognize this duality in the use of new technologies. Currently the CAN-SPAM Act includes no explicit safeguards regarding the exchange of information across borders and between governments; this lack of transparency regarding the repercussions of technical assistance to repressive governments is also an issue that arises from the current framework to address spam mail. There is currently no mechanism in place for citizens to monitor the actions of their government under the Act and raise concerns over potential repercussions to freedom of expression or access to information. Time and money spent to protect individuals and non-profits from overbroad anti-spam technology may create higher costs to entry for non-governmental organizations and compromise the democracy-enhancing character of the otherwise inexpensive Internet/E-mail medium. Addressing Spam in China As a leading source of spam mail, a country with one of the most repressive governments, and a major hub for ICT development, China raises particular challenges when implementing anti-spam technology and legislation. China sends the highest percentage of spam e-mail in comparison to the amount of "good" e-mail sent.[16] (The US sends between 50 to 55 per cent spam e-mail; and close to 60 per cent "good" mail.) In defense of their spam mail problem, the PRC Ministry of Information Industry claims that foreign spammers were utilizing Chinese computers to send spam in order to avoid punishment under their own country's law.[17] As a result, the PRC is asking for more cooperation with other countries in law enforcement to control spam and more assistance from international companies on network security to strengthen anti-spam technology, which raise questions of transparency and the consequences of information sharing across borders. [18] With the highest number of Internet activists imprisoned[19] and a sophisticated architecture of surveillance and censorship, the PRC is also one of the leading countries in information control. [20] Because anti-spam technology works similarly to filtering and censorship measures that the PRC currently deploys, anti-spam technology and legislation may legitimize China's position to further control and repress the flow of information - both within China, and in and of China. Anti-spam tools may also provide the government with greater ability to track people's actions on the Internet, violating privacy and security rights, and leading to increased self-censorship and more arbitrary arrests and detentions. The intersection of China's state secrets and state security legislation and the over breadth and vagueness of anti-spam legislation and technology could provide more tools for the PRC government to chill freedom of expression and foster a climate of fear. Getting a 'Piece of the Action' China's booming IT market and its hosting of the 2008 Beijing Olympics are attracting high profile ICT companies to get a "piece of the action." Yet the 2002 self-censorship pledge[21] and recent issues with Google's search engine in China raise questions about the role of companies - both international and domestic - doing work in China. In March 2002, the Internet Society of China asked international and Chinese companies to "volunteer" signing on to a self-censorship pledge, in which companies agreed to refrain from posting information that will "jeopardize state security and disrupt social stability" among other restrictions. A few months ago and still ongoing, studies by the Open Net Initiative [22] and Dynamic Internet Technology, Inc.[23] on Google's search engine in China show that the Chinese government is filtering search results and keywords. With existing Internet companies already being compromised of filtering their search engines, what are the implications of deploying anti-spam technology in China? How can companies, governments, consumers, and NGOs ensure that technology built for China is not also implemented or modified for repressive purposes? With many ICT companies bidding on projects for the Olympics and eager to participate in the China-boom, HRIC recommends developing "best" business practices, targeted towards different types of IT companies and at multiple levels. The circuit tree below describes the path a user request travels, identifying key transactions. Every request routed through the network passes multiple points at which concerns exist for censorship or the invasion of privacy. Starting at the desktop level, Internet cafes and many companies are required to install filtration and surveillance software. At the ISP level it is possible to capture user requests and search for specific terms and data. When the request moves out into the Internet backbone it must pass through the "Great Firewall." Finally, at the destination server information can be collected based both on automated Web logging as well as data requested or offered by the users. Each level is distinct and although the basic concerns stay the same, different mechanisms are needed to protect them based on the technical details of each. Additionally, we have identified examples of some companies carrying the traffic at each level. Based on the circuit tree above we have outlined a possible framework for exploring best practices that should be developed with the input and participation of multiple stakeholders, including NGOs, consumers, and business. The matrix focuses on three types of IT companies: information providers, hardware and software developers; and connectivity. Mapped to each of type of company are the backbone, Internet Service Provider, and end user levels. The matrix reflects a preliminary model for developing best practices that address both domestic implementation and cross-border impact of anti-spam technology and legislation with regards to censorship and freedom of expression; privacy and anonymity; and surveillance and security issues. For each area of concern, the framework identifies some specific issues to consider in developing best practices. Integrating an International Regulatory Framework China illustrates the dangers of cross-border implementation, on legal, technical, and policy levels, of anti-spam technology and legislation. To address these challenges, HRIC urges policy interventions at multiple levels, integrating an international human rights framework into the development and implementation of anti-spam technology and legislation, and ICT infrastructure at large. An international regulatory framework that can be applied across borders will prevent adverse consequences in other regions. To govern an increasingly global Internet, transparency and accountability for both multinational corporations and governments are critical to properly monitor the modification and implementation of technology. In addition, careful and independent monitoring will ensure that freedom of expression and access to information on the Internet are protected, and that all stakeholders are included in a meaningful way in the design and implementation of the future Internet, both in policy-making and in engineering. // ENDNOTES [1] Sharon Hom, Amy Tai, and Gabriel Nichols, "The Rise of the Internet and Advancing Human Rights," China Rights Forum No.3, 2004. [2] "Declaration of Principles," World Summit on Information Society, December 12, 2004, http://www.itu.int/wsis/documents/doc_multi.asp?lang=en&id=1161|1160 [3] "Strengthening cooperation, promoting development and moving towards the information society together," Dec 10, 2003. Statement by H.E. Mr. Wang Xudong, Minister of Information Industry, People's Republic of China at the World Summit on Information Society. [4] Sharon Hom, "The Internet and Free Flow of Information in China," Congressional Executive Commission on China, Apr 15, 2002. http://www.cecc.gov/pages/roundtables/041502/hom.php (Aug 4 2004) and Jonathan Watts, "China Admits First Rise in Poverty since 1978," The Guardian, Jul 20, 2004, http://www.guardian.co.uk/china/story/0,7369,1264917,00.html (Aug 25, 2004) [5] China Internet Network Information Center (CNNIC). www.cnnic.cn (Aug 4 2004). [6] Id. [7] Asian Development Bank, 2002. [8] China Human Development Index for 2002. [9] Bu Wei, "The Social Impact of the Internet," Presentation at the China Digital Freedom conference at University of California, Berkeley. May 1, 2004. http://journalism.berkeley.edu/projects/chinadn/en/archives/002534.html [10] Jonathan Zittrain and Benjamin Edelman, "Empirical Analysis of Internet Filtering in China," http://cyber.law.harvard.edu/filtering/china/ and Open Net Initiative, http://www.opennetinitiative.net [11] Bill Xia, "The Coming Crash of the Matrix," China Rights Forum No. 3, 2004. [12] Human Rights in China with China Labour Bulletin, "Labor and State Secrets," China Rights Forum No.3, 2004. [13] J. Trevor Hughes, "The Status of Spam." Presentation at the Spam Consultation at Center for Democracy and Technology, July 15, 2004. [14] CAN-SPAM Act of 2003, http://www.spamlaws.com/federal/108s877enrolled.pdf. [15] "Dual use technology" is generally used to define technology that has both military utility and sufficient commercial potential to support a viable industrial base. In this case study, HRIC uses this term to refer to technology that can be used to protect users from spam mail, but also be deployed by repressive governments to control information flow. [16] China sends 15 percent of spam mail and less than 5 percent of good mail. George Webb, "Toward a Spam-Free Future: Microsoft's Anti-spam Vision." Presentation at the Spam Consultation at Center for Democracy and Technology, July 15, 2004. [17] Presentation at ITU on countering spam July 2004 [18] Id. [19] Reporters without Borders, "Internet Under Surveillance." 2004. http://www.internet.rsf.org [20] Out of 167 countries, the Press Freedom Index rated China 162nd, with 167th being the most repressive country of the flow of information. Reporters without Borders. http://www.rsf.org/article.php3?id_article=11715 [21] "Public Pledge on Self-Discipline for China Internet Industry," (English translation) www.isc.org.cn/20020417/ca39030.htm [22] Open Net Initiative, "Google Search & Cache Filtering Behind China's Great Firewall," August 30, 2004. http://www.opennetinitiative.net/bulletins/006/ [23] Dynamic Internet Technology, Inc., "Google Chinese News Censorship Demonstrated," September 16, 2004. http://www.dit-inc.us/report/google200409/google.htm. //
Copyright © 2006 Human Rights in China. All rights reserved. Disclaimer  /   hrichina[a]hrichina.org  /   www.hrichina.org