MobileActive.org

Telcos or mobile operators have been in the news lately, implicated in the suppression of communications, tracking and surveillance of pro-democracy and human rights activists, and in their close collaboration with repressive regimes and their security apparatuses around the world. Now there is a new initiative spearheaded by advocacy organization Access Now that advocates for mobile operators to sign a set of five principles focused on human and democratic rights in return for their licenses.

Nothing New: How Cozy Telcos Are With Repressive Regimes

Vodafone's recent decision to shut down its communications network in Egypt and the delivery of pro-government propaganda via text message over its network made the news but that was just the tip of the iceberg. The examples abound: Uganda operators monitored and blocked certain SMS keywords in the advent of the recent election there, pro-Zanu propaganda is widely delivered over Zimbabwean operator networks, Russian mobile operators agreed to 'police' the Internet and their networks at the behest of the Russian government, and Belarussian telcos routinely supply information to the security police, including location information of known political activists.

This close collaboration of many operators with repressive states has been going on for some time but there is now a new activist movement forming, holding telcos accountable and to a higher standard. Led by activist shareholders and advocacy organizations like Access, activists point out that the negative publicity of this corporate behavior carries  financial implications that pose a risk to telco investors.

The Costs to Mobile Operators: Reputation, Legal, Financial

Vodafone is a case in point.  Mainstream and social media was abuzz with condemnation of the close cooperation of Vodafone Egypt with the then-regime; there are legal cases filed in Egypt alleging criminal liability in the injury and killing of protestors as a result of the communications shutdown. It has also been suggested that Vodafone may be liable in the United State under the Alien Tort Claims Act for aiding and abetting violations of international human rights law. Telcos also incur financial risks and lost revenue during a sudden shutdown as ordered by a state entity that are detrimental to shareholders and corporate revenues (although the exact costs that Vodafone incurred as a result of complying with the Egyptian order are not yet public.)

Despite the reputational, legal, and financial costs, it is unlikely that mobile operators suddenly see the light. As Access notes,

"despite the events in Egypt and their obvious impact, it is likely that telecoms will continue to operate under similar licenses in other repressive regimes. The risks to telecoms and investors... means the integration of international norms during the negotiation of operating license agreements should be a priority for investors and telecoms."

The Five-Step Telecom Action Plan

In response, Access and Fair Pensions have come out with a detailed set of principles, "Five-Step Telecom Action Plan" (pdf) that is specifically tailored to mobile operators. Modeled after the Global Network Initiative's (GNI) Principles that have been signed by the likes of Google, Yahoo, and Microsoft, the Five-Step Telecom Action plan contains principles that are specifically targeting mobile operators rather than conflating them with the internet companies GNI has focused on.

We are detailing these principles below in their entirety but in short, they are:

1. Providers should retain complete control over their network at all times and ensure
   that users always have access to it.
2. Providers have a duty to protect their users.
3. Providers should uphold principles of non-discrimination and should abstain from filtering their networks, except for the purposes of network security and management.
4. Providers should uphold principles of transparency, accountability, appealability, and due process in all of their actions and transactions.
5. Providers should commit to using spectrum allocation in a judicious and equitable manner.

For more on Access' campaign targeting Vodafone in particular, see here.

The Telecom Action Plan: Five Steps Every Rights-Respecting Telecom Should Take

1. Providers should retain complete control over their network at all times and ensure that users always have access to it. In practice, this means: 

1. Resisting any efforts to give governments control over network infrastructure – either technically or through regulatory authority.
2. Ensuring that in times of crisis, users always have the right to access the internet and mobile phone services.
3. Ensuring that users have the ability to call for emergency assistance at all times, even when they fail to pay their bill, or at moments of crisis. 
4. Refusing to act as a spokesperson of a government or the regime in power (e.g., by sending pro- or anti-government text messages). Government use of a network for emergency instructions and AMBER Alert-like messages is acceptable, but these messages must be sent by the provider itself at its discretion, and the sender clearly identified.

2. Providers have a duty to protect their users. In practice, this means:

1. Encrypting and anonymizing user data to ensure user privacy and security both on their personal devices and in centralized databases where user data is aggregated. This includes an obligation to always transmit user data over encrypted channels.
2. Actively protecting networks from hacks, malware, spam, and other vulnerabilities.
3. Reporting any data breaches to users and relevant government authorities with as littl delay as possible.
4. Never providing governments with blanket “backdoor” access to their networks. Government may have legitimate reasons to monitor the communications of suspected individuals for law enforcement and national security purposes. However, any proposed monitoring must be consistent with international human rights law as set out in Step 1b, including ensuring that:
   
   • any such surveillance may only be conducted with a warrant or other court order based on probable cause;
   • providers should only give government access to individual users (one warrant, one user);
   • providers should never grant universal access to all of their users’ communications;
   • in giving governments access to user communications, providers should interpret requests as narrowly as possible, require all requests to be made in writing, and require a human employee to be present/involved whenever user data is accessed by government.

3. Providers should uphold principles of non-discrimination and abstain from filtering their networks except for the purposes of network security and management. In practice, this means:

1. Treating all data traffic on an equitable basis no matter where it originated or the type of data.
2. Rejecting demands to engage in filtering for political, social, or conflict purposes, including and especially during moments of political turmoil. Any attempt to filter must be strictly consistent with international law and providers should follow the guidelines set out in Step 2d, which pertains to government requests to surveil users.
3. Refraining from filtering internet technologies (e.g. VoIP services and circumvention software).
4. Ensuring that all requests from governments regarding content manipulation (take-downs,filtering, etc.) and network shut downs follow established procedures which comply with Step 3, and disclosing such actions to users as soon as possible (ideally before any such actions occur).

4. Providers should uphold principles of transparency, accountability, appealability, and due process in all of their actions/transactions. In practice, this means:

1. Disclosing operating licenses wherever possible. When public disclosure is proscribed by law, providers should engage a respected independent body to do a human rights audit.
2. Having clear guidelines with respect to law enforcement access to user data, and a mechanism to challenge such requests.
3. Using clear and accessible language in terms of use, privacy policies, and other forms of user guidelines.
4. Translating terms of use and/or user guidelines into languages of platform’s use, and clearly indicate where terms of use vary across jurisdictions.
5. Having a clear appeals process and responding to appeals promptly.
6. Offering clear warning and response mechanisms both before and after any proposed account deactivation or content removal, and providing for intermediate steps or an escalation process during the content or account review process.
7. Providing clear channels through which users can contact the provider with complaints, questions, or other issues.
8. Accurately advertising the features of services offered (e.g. actual download/upload speeds). 

5. Providers should commit to using spectrum allocations in a judicious and equitable manner. In practice, this means:

1. Sharing spectrum to maximize the benefit to a nation’s inhabitants and promote innovation and economic growth.
2. Selling or returning at cost to a nation’s government unused spectrum that the provider does not plan to use.

Access notes further that telcos should engage in multi stakeholder collaboration including with civil society as a partner in the design and implementation of these 5 Steps. They should also establish standing channels of communication with civil society organizations to inform and advise on good practice and human rights issues. Access believes that telcos should join the Global Network Initiative, upon which this Telco Action Plan draws much of its inspiration, and be subject to assessment and evaluation of the implementation of its principles and implementation guidelines.

Photo courtesy flickr user Daveness_98.