Encryption Hub

What’s the relevance of the forum for encryption?

UN General Assembly (UNGA) resolutions are generally non-binding towards member states, but are influential on global policy, particularly when adopted by consensus. They set expected standards for state behaviour, and even offer concrete recommendations for national policy measures. In terms of encryption, the Third Committee in particular has recognised the importance of encryption as an enabler of human rights through its resolutions on the safety of journalists and the right to privacy (see below). These serve as important normative statements which can be used by human rights defenders in advocacy in other global forums, and at the national level. For example, human rights defenders and journalists can point to the recognition, by all UN member states, of the importance of encryption to the work of journalists and the media when policies at the national level are proposed which undermine encryption.

Rhythm of business

The UNGA begins every September for regular sessions and may meet at other points throughout the year for special sessions or emergency special sessions. Resolutions at the UNGA usually require a simple majority vote to pass. However, there are instances where the UNGA determines that a particular resolution is important enough to merit a two-thirds majority. These types of resolutions normally pertain to significant issues of international peace and security, or admission of new member states to the UN.

New iterations of resolutions are opportunities for language in the resolutions to be revised, and for text—including commitments to acknowledge or protect encryption—to be either weakened or strengthened.

Relevant outputs

UNGA resolution: The Right to Privacy in the Digital Age, A/C.3/75/L.40, adopted by Third Committee 20 November 2020 (link)

• Preambular part: “Emphasizing that, in the digital age, technical solutions to secure and to protect the confidentiality of digital communications, which may include measures for encryption, pseudonymization and anonymity, can be important to ensure the enjoyment of human rights, in particular the rights to privacy, to freedom of opinion and expression and to freedom of peaceful assembly and association, and recognizing that States should refrain from employing unlawful or arbitrary surveillance techniques, which may include forms of hacking”
• Operative part: “Encourages business enterprises to work towards enabling technical solutions to secure and protect the confidentiality of digital communications and the protection of individual users against arbitrary or unlawful interference, which may include measures for encryption, pseudonymization and anonymity, and calls upon States not to interfere with their the use of such technical solutions, with any restrictions thereon complying with the obligations of States under international human rights law, and to enact policies that recognize and protect the privacy, including by developing technical solutions, of individuals’ digital communications”

UNGA Resolution: The Right to Privacy in the Digital Age, A/Res/73/179, adopted 17 December 2018 (link)

• Preambular: “Emphasizing that, in the digital age, technical solutions to secure and to protect the confidentiality of digital communications, which may include measures for encryption, pseudonymization and anonymity, can be important to ensure the enjoyment of human rights, in particular the rights to privacy, to freedom of expression and to freedom of peaceful assembly and association, and recognizing that States should refrain from employing unlawful or arbitrary surveillance techniques, which may include forms of hacking”

UNGA Resolution: The Safety of Journalists and the Issue of Impunity, A/Res/72/175, adopted 19 December 2017 (link)

• Preambular: “Emphasizes that, in the digital age, encryption and anonymity tools have become vital for many journalists to freely exercise their work and their enjoyment of human rights, in particular their rights to freedom of expression and to privacy, including to secure their communications and to protect the confidentiality of their sources, and calls upon States not to interfere with the use of such technologies and to ensure that any restrictions thereon comply with States’ obligations under international human rights law”

What’s the relevance of the forum for encryption?

The United Nations Human Rights Council (HRC) is an intergovernmental body within the United Nations system, made up of 47 states, and responsible for the promotion and protection of all human rights around the world. It has the ability to discuss all thematic human rights issues and situations that require its attention throughout the year. It meets at the UN Office in Geneva.

While resolutions passed by the HRC are not legally binding, they are recognised as an influential source of ‘soft’ international law. Resolutions passed at the HRC indicate strong support for encryption. The most significant thematic resolutions relating to encryption are ‘The Right to Privacy in the Digital Age’ (2017) and ‘The Promotion, Protection and Enjoyment of Human Rights on the Internet’ (2018). Past declarations have recognised the importance of encryption for the exercise of human rights such as the right to privacy and freedom of expression. They have also called upon businesses to protect the confidentiality of digital communications through the use of encryption, and warned states not to restrict the use of encryption.

Rhythm of business

The HRC meets three times a year in regular sessions, usually March, June, and September. It can meet for special sessions if a request is made by one third of its members; and it occasionally hosts intersessional panels, which look at particular thematic issues. It can also call upon the Office of the United Nations High Commissioner for Human Rights to organise expert workshops.

Relevant outputs

Resolution adopted by the Human Rights Council on 23 March 2017 “The Right to Privacy in the Digital Age” A/HRC/RES/34/7 (link)

• “Emphasizing that, in the digital age, technical solutions to secure and to protect the confidentiality of digital communications, including measures for encryption and anonymity, can be important to ensure the enjoyment of human rights, in particular the rights to privacy, to freedom of expression and to freedom of peaceful assembly and association,” “Encourages business enterprises to work towards enabling technical solutions to secure and protect the confidentiality of digital communications, which may include measures for encryption and anonymity, and calls upon States not to interfere with the use of such technical solutions, with any restrictions thereon complying with States’ obligations under international human rights law”

Resolution adopted by the Human Rights Council on 5 July 2018: “The Promotion, Protection and Enjoyment of Human Rights on the Internet” A/HRC/RES/38/7 (link)

• “Emphasizing that, in the digital age, technical solutions to secure and protect the confidentiality of digital communications, including measures for encryption and anonymity, can be important to ensure the enjoyment of human rights, in particular the rights to privacy, to freedom of expression and to freedom of peaceful assembly and association”

What’s the relevance of the forum for encryption?

The United Nations Human Rights Council (HRC) has Special Procedures, which provide expert commentary on a range of issues, including on how encryption as a technology relates to and enables the rights to freedom of expression and privacy.

These Special Procedures are made up of Working Groups or Special Rapporteurs who serve in their personal capacity. Special Procedures undertake country visits; bring alleged human rights violations or abuses to the attention of states; conduct thematic studies and convene expert consultations; contribute to the development of international human rights standards; engage in advocacy; raise public awareness; and provide advice for technical cooperation.

There are two types of Special Procedures mandates: thematic mandates, such as the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, and country-specific mandates. These independent experts report at least once a year to the Council on their findings and recommendations, as well as to the UN General Assembly.

While reports presented are not binding, they may influence decisionmaking at other bodies at the UN. For example, policymakers and diplomats in the General Committees of the UN General Assembly (UNGA) refer to resolutions passed in the HRC, and the reports of the Special Procedures of the HRC are also presented at UNGA’s Third Committee annual sessions. Their reports and recommendations may also be taken up by member states and influence policymaking.

So far, Special Rapporteurs on the right to freedom of expression and the right to privacy have, through their annual reports, played an important role in outlining the relationship between encryption and human rights. For example, the former Special Rapporteur on the right to freedom of expression dedicated a report in 2015 to how encryption and anonymity technologies enable the enjoyment of the right to freedom of expression (link below), which has been reflected in the outputs of other UN bodies—including in HRC and UNGA Resolutions (see above).

Rhythm of business

Mandate holders change every three years and can be re-elected twice.

These independent experts report at least once a year to the Council on their findings and recommendations, as well as to the UNGA. They may also issue statements to respond to developments relevant to their mandate at any time during the year, whether the HRC is in session or not.

Relevant outputs

• Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Annual Report on Surveillance and human rights to HRC, A/HRC/41/35, 2019  (link)
• Research Paper, Encryption and Anonymity, 2018 (link)
• Special Rapporteur on the right to privacy, Annual Report on the Right to Privacy to HRC and UNGA, A/73/45712, 2018: “Weakening encryption technology puts at risk the modern information economy’s security… Addressing the complications caused for law enforcement investigations and intelligence collection by encryption, needs an approach that avoids weakening encryption and hence the national security of other countries”

What’s the relevance of the forum for encryption?

The G7 (previously G8) is an intergovernmental grouping, consisting of Canada, France, Germany, Italy, Japan, the UK and the US. As a convenor of powerful countries, its outputs and statements can signal the intentions of member countries at the national level, and also exert an influence on countries outside the G7, by offering joint recommendations for policy solutions to challenges requiring multilateral cooperation—such as terrorism, climate change and financial crises.

While some members of the G7 have reinforced the need to not weaken encryption and respect human rights, other members have been supportive of creating “backdoors” into encrypted communications for counter-terrorism and law enforcement purposes.

Rhythm of business

G7 summits are held annually and hosted on a rotational basis by the group’s members. As an informal group, the heads of state/government meet at the annual summit but take no binding decisions. Instead, the meeting is considered an opportunity to allow leaders to exchange ideas and coordinate on key policy issues. Ministerial group meetings are organised ahead of the annual meeting to coordinate messages on these key policy issues. Statements are generally made at the end of ministerial meetings and annual summits.

Summit and Ministerial Statements published at G7 meetings are not legally binding but can set up initiatives, or lead to government policies and measures at the national level, and can shape discussions in other global forums where the G7 members are active. For example, to promote international peace and security in cyberspace, in 2019 the G7 established a Cyber Norm Initiative (CNI) dedicated to sharing best practices and lessons learned on the implementation of previously recognised voluntary, non-binding norms of responsible state behaviour. Also in 2019, it tasked an internal working group (the Roma-Lyon Group set up in 2001) to “establish a full picture of the security risks that could impact law enforcement services with regard to counterterrorism and cybercrime in the context of the roll-out of the new generation of 5G communication networks, through continuous and instant data transfer”.

Relevant outputs

G7 Interior Ministers Outcome Document from April 2019: Combating the use of the Internet for Terrorist and Violent Extremist Purposes (link)

• “The G7 Ministers of Interior commit to implementing the following: Encourage Internet companies to establish lawful access solutions for their products and services, including data that is encrypted, for law enforcement and competent authorities to access digital evidence, including when it is removed or hosted on IT services located abroad or encrypted, without imposing any particular technology and while ensuring that assistance requested from internet companies is underpinned by the rule of law and due process protection. Some G7 countries highlight the importance of not prohibiting, limiting or weakening encryption”

What’s the relevance of the forum for encryption?

The Group of 20 is an international forum of 19 countries and the European Union, which—like the G7—convenes annually to address global challenges, focusing mainly on issues requiring economic cooperation. In addition to the US, those countries are: Argentina, Australia, Brazil, Britain, Canada, China, France, Germany, India, Indonesia, Italy, Japan, Mexico, Russia, Saudi Arabia, South Africa, South Korea and Turkey.Statements seen in various G20 documents from 2019 don’t provide strong views on encryption. They do, however, discuss challenges related to privacy, cross-border data flows, and other relevant issues that either directly or indirectly implicate encryption.Summit and Ministerial Statements published at G20 meetings are not legally binding but can set up initiatives or lead to government policies and measures at the national level, and can shape discussions in other global forums where the G20 members are active.

Rhythm of business

The G20 meeting is an annual gathering of the heads of government, Interior Ministers and Finance Ministers representing the 20 members. It is focused on several core issues around which its leaders hope to reach a consensus for collective action. The goal is to conclude the two-day gathering by issuing a joint statement committing its members to action, although the declaration is not legally binding.

• “Cross-border flow of data, information, ideas and knowledge generates higher productivity, greater innovation, and improved sustainable development, while raising challenges related to privacy, data protection, intellectual property rights, and security. By continuing to address these challenges, we can further facilitate data free flow and strengthen consumer and business trust. In this respect, it is necessary that legal frameworks, both domestic and international, should be respected.”
• “Technological innovations can deliver significant benefits to the financial system and the broader economy. While crypto-assets do not pose a threat to global financial stability at this point, we are closely monitoring developments and remain vigilant to existing and emerging risks.”

G20 Ministerial Statement on Trade and Digital Economy, 2019 (link):

• “At the same time, we recognize that the free flow of data raises certain challenges. By continuing to address challenges related to privacy, data protection, intellectual property rights, and security, we can further facilitate data free flow and strengthen consumer and business trust.”