Several times a year, the U.N. Human Rights Council evaluates the human rights situation of U.N. member states through a process called the Universal Periodic Review (UPR). Since 2006, this process has aimed to promote respect for human rights and hold states accountable to their obligations. Access Now often joins with partners around the world to submit reports on countries due for review, providing an overview of the state of digital rights in the countries, and highlighting any developments since the previous UPR cycle that affect rights online.
One of the countries under review this year is Iran, and Access Now joined with ARTICLE 19 to discuss the threats to access to information, data protection, and freedom of expression in the country, including:
- the draft bills tabled for ratification by parliament, particularly the Preservation and Protection of Personal Data Bill, which is an abuse of data protection;
- the problematic legal infrastructures weaponized to restrict freedom of expression such as the Islamic Penal Code; and
- digital surveillance, harassment, and unlawful arrests and prosecutions of journalists, human rights defenders, and other dissenting voices.
The Preservation and Protection of Personal Data Bill is concerning due to the threat it poses to data protection. The draft bill was unveiled in 2018 and reflects policies released by the Supreme Council of Cyberspace in 2017, which aimed to nationalize the internet infrastructure in Iran. The bill would force internet service providers and platforms to relocate data processing centers to Iranian territory, and to store data relating to Iranian nationals exclusively inside Iran. It would also enable surveillance and reduce the availability of foreign-owned apps and social media platforms, increasing reliance on less secure Iranian technologies. The implementation of this bill, combined with the imposition of restrictions on apps and services by technology companies such as Apple and Google, would leave Iranians without full or secure access to the internet. Rather than creating laws that put users at risk online, the government must develop rights-respecting data protection laws and we encourage regulators to consult our data protection guide for policymakers.
The legislative and institutional tools used to restrict the freedom of expression in Iran are also particularly troubling in their severity. For example, the Islamic Penal Code makes the crime of “sowing corruption on earth” punishable by death, an extreme penalty for a vague provision which includes acts such as “spreading lies,” “establishment of, or aiding and abetting in, places of corruption and prostitution,” or “disruption of the economic system” if the action “causes severe disruption in the public order of the state and insecurity.” Other forms of expression such as insulting officials or religious leaders are punishable by imprisonment. These laws are consistently applied against dissenting voices, putting human rights defenders at risk.
Further instances of apps and websites that have been temporarily or permanently blocked demonstrate the extent of the threat to freedom of expression in Iran. For example:
- During protests in December 2017 and January 2018, internet users reported intermittent periods of disconnection across various ISPs throughout Iran where users could not connect to websites and applications hosted outside of Iran. Circumvention tools such as “Lantern” were also targeted by blocking access to cloud-host services such as Digital Ocean, despite the fact that many local businesses use this website for other purposes.
- Twitter remains entirely blocked in Iran. It was first blocked in 2009 during Presidential elections and protests. Senior members of the judiciary have signaled the imminent blocking of Instagram for alleged promotion of immorality. Telegram – by far the most popular messaging app in Iran, with 40 million users – was permanently blocked by court order on April 30, 2018 on the basis of national security, though use of the app around organization of protests in early 2018 is suspected to be the true motivation.
- As access to Telegram and other platforms has become more restricted, privately-owned, Iranian versions of these platforms have grown in popularity, e.g. platforms such as “Hotgram” and “Telegram Talaee.” Suspected links between owners of these platforms and government raise serious concerns for privacy and safety of users. The majority of these platforms also fail to use end-to-end encryption, further undermining the security of users.
Additionally, a proposed bill would criminalize accessing blocked internet sites by imposing a penalty of up to six months’ imprisonment for users who attempt to access those sites.
As the government continues to restrict freedom of expression through legislation and blocking access to sites, it also continues to silence dissenting voices. Authorities retaliate against those perceived as criticizing the state, promoting minority or opposition viewpoints, and reporting on corruption or human rights violations perpetrated by the state. This harassment includes digital attacks as well as the misuse of the legal framework. In recent years, journalists, human rights lawyers, and environmental human rights defenders have been subjected to unlawful detentions, harsh sentencing, and arrests. Many have also suffered cyber attacks, including suspected government hacking, and illegal accessing of their digital devices.
In light of these violations to the rights to freedom of expression and privacy, we call on the Iranian government to:
- refrain from all measures to intentionally disrupt access to the internet or mobile networks – including internet shutdowns, blocking, and filtering measures – in particular during protests and elections;
- lift blocking orders on Telegram and Twitter;
- guarantee privacy online by refraining from introducing measures to restrict online anonymity, including the use of encryption and circumvention tools;
- repeal and reform legislation affecting freedom of expression and privacy, including the Islamic Penal Code and the Personal Data Bill, to bring them into compliance with international human rights law and standards; and
- cease the abusive and arbitrary application of the legal framework against dissenting voices by dropping all outstanding charges and guaranteeing the immediate and unconditional release of those detained for exercising their rights to freedom of expression.