FREEDOM ON THE NET 2023 • • The Repressive Power of Artificial Intelligence Do state actors manually search people’s electronic devices, including while in detention, for the purposes of ascertaining their online activities or their personal data, without appropriate oversight? Do government surveillance measures target or disproportionately affect dissidents, human rights defenders, journalists, or certain ethnic, religious, gender, LGBT+, migrant, diaspora, and other relevant groups? 6. Does monitoring and collection of user data by service providers and other technology companies infringe on individuals’ right to privacy? (0–6 points) • • • • • • • • Do specific laws or binding legal decisions enshrine the rights of individuals over personal data, including biometric information, generated, collected, or processed by public or private entities? Do regulatory bodies, such as a data protection agency, effectively protect people’s privacy, including through investigating companies’ mismanagement of data and enforcing relevant laws or legal decisions? Can the government obtain user information from companies (e.g., service providers, providers of public access, internet cafés, digital platforms, email providers, device manufacturers, data brokers) without a legal process, including by purchasing it? Are these companies required to collect and retain data about their users? Are these companies required to store users’ data on servers located in the country, particularly data related to online activities and expression that are protected under international human rights standards (i.e., are there “data localization” requirements)? Do these companies monitor individuals and supply information about their digital activities to the government or other powerful actors (either through technical interception, data sharing, or other means)? Does the state attempt to impose similar requirements on these companies through less formal methods, such as codes of conduct, threats of censorship, legal liability for company employees, or other economic or political consequences? Are government requests for user data from these companies transparent, and do companies have a realistic avenue for appeal, for example via independent courts? 7. Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? (0–5 points) • • • • • Are individuals subject to physical violence—such as murder, assault, torture, sexual violence, or enforced disappearance—in relation to their online activities, including membership in certain online communities? Are individuals subject to other intimidation and harassment—such as verbal threats, travel restrictions, nonconsensual sharing of intimate images, doxing, or property destruction or confiscation—in relation to their online activities? Are individuals subject to online intimidation and harassment specifically because they belong to a certain ethnic, religious, gender, LGBT+, migrant, diaspora, or other relevant group? Have online journalists, commentators, or others fled the country, gone into hiding, or undertaken other drastic actions to avoid such consequences? Have the online activities of dissidents, journalists, bloggers, human rights defenders, or other individuals based outside the country led to repercussions for their family members or associates based in the country? 8. Are websites, governmental and private entities, service providers, or individuals subject to widespread hacking and other forms of cyberattack? (0–3 points) • • • • 42 Have websites belonging to opposition, news outlets, or civil society groups in the country been temporarily or permanently disabled due to cyberattacks, particularly at politically sensitive times? Are websites, news outlets, blogs, or social media accounts subject to targeted technical attacks as retribution for posting certain content, for example on political and social topics? Are financial, commercial, and governmental entities subject to significant and targeted cyberattacks meant to steal data or disable normal operations, including attacks that originate outside the country? Do specific laws, policies, or independent bodies prevent and protect against cyberattacks (including systematic attacks by domestic nonstate actors)? @freedomonthenet #FreedomOnTheNet