A/HRC/39/29 possible in the context of such measures” (see A/HRC/33/29, para. 58). 19 As the European Court of Human Rights has pointed out, “a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it”.20 Access to the user data of business enterprises 18. States often rely on business enterprises for the collection and interception of personal data. For example, some States compel telecommunications and Internet service providers to give them direct access to the data streams running through their networks. Such systems of direct access are of serious concern, as they are particularly prone to abuse and tend to circumvent key procedural safeguards.21 Some States also demand access to the massive amounts of information collected and stored by telecommunications and Internet service providers. States continue to impose mandatory obligations on telecommunications companies and Internet service providers to retain communications data for extended periods of time.22 Many such laws require the companies to collect and store indiscriminately all traffic data of all subscribers and users relating to all means of electronic communication. They limit people’s ability to communicate anonymously, create the risk of abuses and may facilitate disclosure to third parties, including criminals, political opponents, or business competitors through hacking or other data breaches. Such laws exceed the limits of what can be considered necessary and proportionate. 23 Hacking 19. Governments appear to rely increasingly on offensive intrusion software that infiltrates individuals’ digital devices. This type of hacking enables indiscriminate interception and collection of all kinds of communications and data, encrypted or not, and also permits remote and secret access to personal devices and data stored on them, enabling the conduct of real-time surveillance and manipulation of data on such devices. 24 That poses risks not only for the right to privacy but also for procedural fairness rights when such evidence may be used in legal proceedings (see A/HRC/23/40, para. 62). Hacking also raises significant extraterritoriality concerns, as it can affect individuals across many jurisdictions.25 Furthermore, hacking relies on exploiting vulnerabilities in information and communications technology (ICT) systems and thus contributes to security threats for millions of users. Attempts at weakening encryption and anonymity 20. Recurring attempts by States to weaken encryption technology and limit access to anonymity tools similarly threaten the security and confidentiality of communications and other activities online. Some States call for mandated back doors in encrypted communications, require providers of encrypted communications services to hand over encryption keys (see A/HRC/29/32, paras. 38–45) or even ban or block certain secure communications applications, including encrypted messaging and virtual private and anonymization networks. Encryption and anonymity provide individuals and groups with a zone of privacy online where they can hold opinions and exercise freedom of expression without arbitrary and unlawful interference or attacks (A/HRC/29/32). 26 Encryption and 19 20 21 22 23 24 25 26 6 See also A/HRC/27/37, para. 25. See Roman Zakharov v. Russia, para. 232. See Roman Zakharov v. Russia, para. 270. See CCPR/C/ZAF/CO/1, paras. 42–43, and CCPR/C/PAK/CO/1, paras. 35–36. See, for example, European Court of Justice joined cases C-203/15 and C-698/15, Tele2 Sverige AB v. Swedish Post and Telecom Authority and Secretary of State for the Home Department v. Watson, judgment of 21 December 2016, para. 107; CCPR/C/ZAF/CO/1, paras. 42–43; and CCPR/C/CMR/CO/5, paras. 39–40. See Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, “Encryption and anonymity follow-up report” (June 2018). See submission of Privacy International. See also UCI Law International Justice Clinic, “Selected references: unofficial companion to report of the Special Rapporteur (A/HRC/29/32) on encryption, anonymity and the freedom of expression”;