“WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International is a global movement of more than 7 million people who campaign for a world where human rights are enjoyed by all. Our vision is for every person to enjoy all the rights enshrined in the Universal Declaration of Human Rights and other international human rights standards. We are independent of any government, political ideology, economic interest or religion and are funded mainly by our membership and public donations. Cover photo: A picture of a map of Uzbekistan. sevenMaps7/Shutterstock.comA © Amnesty International 2016 Except where otherwise noted, content in this document is licensed under a Creative Commons (attribution, non-commercial, no derivatives, international 4.0) licence. https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode For more information please visit the permissions page on our website: www.amnesty.org Where material is attributed to a copyright owner other than Amnesty International this material is not subject to the Creative Commons licence. First published in 2016 by Amnesty International Ltd Peter Benenson House, 1 Easton Street London WC1X 0DW, UK Index: EUR 62/5974/2017 Original language: English amnesty.org CONTENTS 1. EXECUTIVE SUMMARY 5 2. BACKGROUND 6 2.1 SORM AND SURVEILLANCE IN UZBEKISTAN 6 2.2 THE ROLE OF TELECOMMUNICATIONS COMPANIES 7 2.3 HUMAN RIGHTS IN UZBEKISTAN: A CLIMATE OF FEAR 7 3. DMITRY TIKHONOV: FORCED TO FLEE THE COUNTRY BECAUSE OF AN E-MAIL HACK 9 4. DON’T PHONE HOME: SURVEILLANCE KEEPS REFUGEES FROM THEIR FAMILIES 13 “DILSHOD” 13 NADEJDA ATAYEVA 15 GULASAL KAMOLOVA 15 5. UZNEWS.NET: JOURNALISM AND PRIVACY IN AN INTER-CONNECTED WORLD 17 5.1 AN EMAIL HACK IN BERLIN 17 5.2 GULASAL AND VASILIY: JOURNALISTS IN UZBEKISTAN PUT AT RISK 19 5.3 UZNEWS.NET IS FORCED TO CLOSE 23 6. RECCOMMENDATIONS 25 6.1 TO THE GOVERNMENT OF UZBEKISTAN 25 6.2 TO OTHER GOVERNMENTS 25 6.3 TO TELECOMMUNICATIONS COMPANIES 25 “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 3 “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 4 1. EXECUTIVE SUMMARY Surveillance in Uzbekistan helps reinforce the already repressive environment for human rights defenders, journalists, political activists and others in Uzbekistan. Unlawful surveillance in Uzbekistan is facilitated by technical and legal systems that fail to provide checks against abuse, contrary to international law and standards. Inside Uzbekistan, hacking attacks and data breaches can lead to threats of prosecution, and force people to flee the country. But in today’s interconnected world, hacking and surveillance outside Uzbekistan can also have devastating effects for people in Uzbekistan, thousands of miles away. The converse is also true, even once safely outside of Uzbekistan, the threat of surveillance continues to exert its pressure on those who have fled. Because of the fear of surveillance, many refugees outside Uzbekistan are afraid to contact their families, fearing that even receiving a phone call from abroad could trigger harassment from mahalla (local neighbourhood) committees or security services. Unlawful surveillance in Uzbekistan keeps families apart and harms the rights to free expression around the world, and limits the ability of people inside and outside of Uzbekistan to receive information. This briefing highlights stories of seven Uzbekistani people, in Uzbekistan and in the diaspora, whose human rights have been negatively affected by the unlawful surveillance of the government of Uzbekistan. “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 5 2. BACKGROUND 2.1 SORM AND SURVEILLANCE IN UZBEKISTAN Surveillance of internet and telephone communications in Uzbekistan is ubiquitous, and poorly regulated. In 2014, Privacy International published a report detailing some of the technical capabilities of the Uzbekistani government for surveillance, as well as documenting several cases of apparently politically- motivated surveillance and human rights abuses.1 Surveillance in Uzbekistan is facilitated by the System of Operative Investigative Measures (known by its Russian acronym: SORM).2 SORM allow state authorities to directly access communications and associated data. Communications service providers (CSPs) are required by law to make their networks accessible to the authorities – at their own cost - for monitoring via the SORM system.3 Because surveillance conducted via SORM is achieved by direct state access to networks in secret, CSPs themselves are not aware of how often, or why, the authorities access their networks.4 Privacy International also documented the use of monitoring centres by the Uzbekistani authorities, which, as of 2013, were capable of monitoring up to 600 IP-based subscribers, as well as thousands of circuit- switched subscribers.5 State-owned Uztelecom controls access to the internet in Uzbekistan, while the activities of internet café users are subject to surveillance, and purchasing SIM cards requires production of a passport.6 In July 2015, leaked internal documents from the Italian company Hacking Team, who sell commercial spyware, revealed that Uzbekistan had purchased software from the company via NICE systems.7 The purchased product – Remote Control System (RCS) – enables the authorities to infect a target’s phone or computer with malware that can access all of the device’s content, as well as intercept communications, track its location and remotely activate and monitor the device’s microphone or camera.8 1 Privacy International, “Private Interests: Monitoring Central Asia,” https://www.privacyinternational.org/node/293 (hereinafter “Private Interests”) 2 Variants of the SORM system are used in Russia and many former-Soviet states. See, for example, Amnesty International, “It’s Enough for People to Feel it Exists: Civil Society, Secrecy and Surveillance in Belarus,” EUR 49/4306/2016, July 2016, https://www.amnesty.org/en/documents/eur49/4306/2016/en/ 3 Law of the Republic of Uzbekistan on Telecommunications, Article 18, http://www.lex.uz/Pages/GetAct.aspx?lact_id=33152; see also Presidential Decree 513 On measures to increase effectiveness of organization of operative investigation measures on telecommunication networks, http://ict.gov.uz/files/o%20povishenii%20effektivnosti.doc 4 See, for example, Teliasonera Law Enforcement Disclosure Report, January-June 2016, https://www.teliacompany.com/globalassets/telia- company/documents/about-telia-company/ledr_oct2016_final.pdf, at p. 17 (“When it comes to governments’ direct access, i.e. signals intelligence (intelligence gathering through analysis and processing of communication signals) and real-time access without requests (technical systems for more extensive monitoring of telecommunications), Telia Company has no insight into the extent of such surveillance and cannot provide any statistics”). Telia Company have publicly opposed such direct access systems: https://www.freedomonlinecoalition.com/how-we-work/working-groups/working-group-2/direct-access-systems/. 5 Private Interests, p. 42. 6 Freedom House, Freedom on the Net, Country Report: Uzbekistan, 2016, https://freedomhouse.org/report/freedom-net/2016/uzbekistan 7 Privacy International, Eight Things We Know So Far from the Hacking Team Hack, 9 July 2015, https://www.privacyinternational.org/node/619; The Guardian, Hacking Team hacked: firm sold spying tools to repressive regimes, documents claim, https://www.theguardian.com/technology/2015/jul/06/hacking-team-hacked-firm-sold-spying-tools-to-repressive-regimes- documents-claim 8 http://www.computerworld.com/article/2851498/detekt-tool-finds-the-hacking-teams-secret-surveillance-malware-on-pc.html “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 6 2.2 THE ROLE OF TELECOMMUNICATIONS COMPANIES Surveillance in Uzbekistan is facilitated by private telecommunications companies, who are required to provide direct, remote-control access to their networks to the Uzbekistani authorities. As laid out in the UN Guiding Principles on Business and Human Rights (UNGPs), companies have a responsibility to respect human rights wherever they operate in the world. The UNGPs require that companies take pro-active steps to ensure that they do not cause or contribute to human rights abuses within their global operations and respond to any human rights abuses when they do occur. In order to meet that responsibility, companies must carry out human rights due diligence to “identify, prevent, mitigate and account for how they address their human rights impacts.” The corporate responsibility to respect human rights exists independently of a state’s ability or willingness to fulfil its own human rights obligations and over and above compliance with national laws and regulations protecting human rights. For example, the interpretative guidance on the UNGPs specifically notes that a company may contribute to a human rights violation if it provides “data about Internet service users to a Government that uses the data to trace and prosecute political dissidents contrary to human rights”.9 In January 2017 Amnesty International wrote to two major private mobile communications providers operating in Uzbekistan as well as their foreign parent companies – UCell, a subsidiary of the Swedish Telia Company, and Beeline, a subsidiary of the Dutch company VimpelCom – asking what steps they had taken to identify, prevent and mitigate human rights risks connected to their operations or those of their subsidiaries. UCell, Beeline and Vimpelcom did not respond. Telia Company told Amnesty International that they have repeatedly and publicly argued that direct access by governments to companies’ networks harm free expression rights.10 They regularly publish transparency reports which document instances of law enforcement requests for data, and in direct access countries where this is not possible, publish details on domestic legislation relevant to government access to networks.11 As part of their announced intention to withdraw from Central Asian markets, Telia have published a human rights risk assessment of their exit from the market that acknowledges risks posed by SORM,12 and have a system in place for escalating – and where possible publicizing – unconventional data requests. These are welcome steps to identify human rights risks from their operations, and will hopefully over time help play a role in preventing problematic arrangements such as direct access. However, in the short run, they do not appear adequate to prevent or mitigate the human rights risks of Telia’s subsidiary’s operations in Uzbekistan. 2.3 HUMAN RIGHTS IN UZBEKISTAN: A CLIMATE OF FEAR Amnesty International has documented serious human rights violations, including pervasive torture by security forces and arbitrary detention, in Uzbekistan.13 Torture and other ill-treatment have long been defining features of the Uzbekistani criminal justice system, and central to how the Uzbekistani authorities deal with dissent, combat actual or perceived threats to national security, and repress political opponents. Torture and the threat of torture are used routinely by 9 UN Office of the High Commissioner for Human Rights, The Corporate Responsibility to Respect Human Rights: An Interpretive Guide, p. 17 http://www.ohchr.org/Documents/Publications/HR.PUB.12.2_En.pdf. 10 See, for instance, http://www.teliacompany.com/globalassets/telia-company/documents/about-telia-company/public-policy/telia- company_group-policy_freedom-of-expression-in-telecommunications.pdf, https://www.freedomonlinecoalition.com/how-we-work/working- groups/working-group-2/direct-access-systems/ and http://www.teliacompany.com/en/newsroom/news/news/news-articles/2016/respecting- freedom-of-expression--telia-company-view-on-changes-of-law-on-electronic-communications-in-lithania/. 11 see, e.g. http://www.teliacompany.com/globalassets/telia-company/documents/about-telia-company/ledr_oct2016_final.pdf 12 http://www.teliacompany.com/globalassets/telia-company/documents/about-telia-company/bsr-telia-company-hria-summary.pdf 13 Secrets and Lies: Forced Confessions Under Torture in Uzbekistan, EUR 62/1086/2015, https://www.amnesty.org/en/documents/eur62/1086/2015/en/ “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 7 security services to obtain forced confessions; punish detainees, prisoners and their relatives; incriminate others; or extort money.14 Human rights defenders, government critics and independent journalists have been forced to leave Uzbekistan to escape arrest or sustained harassment and intimidation by security forces and local authorities. Those few who remain in the country are routinely monitored by uniformed or plain-clothes security officers. Human rights defenders and journalists continue to be summoned for questioning at their local police stations, placed under house arrest or otherwise prevented from attending meetings with foreign diplomats and delegations, or from taking part in peaceful demonstrations. They are often beaten and detained by law enforcement officers or beaten by people suspected of working for the security services.15 The national press continue to regularly broadcast and publish programmes and articles denouncing independent journalists and the international networks they work for, and calling them traitors. Human rights defenders, both those active abroad and in Uzbekistan, also regularly find themselves and their families the target of extensive and repeated media campaigns, both on government-owned or controlled websites and printed press.16 It is a common and widespread practice in Uzbekistan for local authorities, police and SNB (Sluzhba Natsionalnoi Bezopastnosti, the Uzbekistani National Security Service) officers to harass and threaten families as a means of exerting pressure on them to disclose a suspect’s whereabouts, or to make suspects hand themselves in to the police or the SNB, sign a “confession”, incriminate others, retract a complaint or pay a bribe.17 Security forces frequently beat relatives of suspects, threaten them with rape or the murder of their children, sexually humiliate them, call them in for repeated questioning or force mahalla (local neighbourhood) committees to expel them from their homes and employers to dismiss them from their jobs. They do not hesitate to resort to other physical and psychological abuse amounting to torture or other ill-treatment in order to trace and secure the conviction of a suspect.18 Former-President Karimov explicitly endorsed this practice, as it relates to relatives of so-called “Islamist fundamentalists.”19 Starting in 2014, the law formally codified the practice of keeping lists of people suspected of being at risk of committing crimes. Individuals are then monitored by mahalla committees and the security forces.20 In this environment, working as a human rights defender is extremely difficult. The UN Human Rights Committee has expressed concern about “consistent reports of harassment, surveillance, arbitrary arrest and detention, torture and ill-treatment by law enforcement officers and prosecutions on trumped-up charges of independent journalists, government critics and dissidents, human rights defenders and other activists, in retaliation for their work.”21 14 Amnesty International, Fast Track to Torture: Abductions and Forcible Returns from Russia to Uzbekistan, EUR 62/3740/2016, https://www.amnesty.org/en/documents/eur62/3740/2016/en/ 15 Amnesty International Submission to the UN Human Rights Committee, http://tbinternet.ohchr.org/Treaties/CCPR/Shared%20Documents/UZB/INT_CCPR_ICO_UZB_17734_E.doc 16 Amnesty International Submission to the UN Human Rights Committee, http://tbinternet.ohchr.org/Treaties/CCPR/Shared%20Documents/UZB/INT_CCPR_ICO_UZB_17734_E.doc 17 Amnesty International, Fast Track to Torture: Abductions and Forcible Returns from Russia to Uzbekistan, EUR 62/3740/2016, https://www.amnesty.org/en/documents/eur62/3740/2016/en/ 18 Amnesty International, Fast Track to Torture: Abductions and Forcible Returns from Russia to Uzbekistan, EUR 62/3740/2016, https://www.amnesty.org/en/documents/eur62/3740/2016/en/ 19 Secrets and Lies: Forced Confessions Under Torture in Uzbekistan, EUR 62/1086/2015, https://www.amnesty.org/en/documents/eur62/1086/2015/en/ 20 Secrets and Lies: Forced Confessions Under Torture in Uzbekistan, EUR 62/1086/2015, https://www.amnesty.org/en/documents/eur62/1086/2015/en/ 21 United Nations Human Rights Committee, Concluding Observations: Uzbekistan (2015), CCPR/C/UZB/CO/4, para. 23. “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 8 3. DMITRY TIKHONOV: FORCED TO FLEE THE COUNTRY BECAUSE OF AN E-MAIL HACK “There is now one less human rights defender in Uzbekistan … I had to leave my home country and it is impossible to hold anyone responsible for that.” Dmitry Tikhonov “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 9 Dmitry Tikhonov is a human rights defender who – until recently - worked inside Uzbekistan. In 2015 he was working on a project to document forced labour, including child labour, during the cotton harvest. Reports of forced labour, including of children, have been made repeatedly by Uzbekistani and international human rights groups.22 Cotton is a billion-dollar industry in Uzbekistan, and controlled by a small elite linked to the government.23 Because of the sensitivity of this work, Dmitry had to take measures to ensure that surveillance did not compromise the identity or safety of the people he worked with, or spoke to: “As a human rights defender, I have been monitoring the situation around forced labour (children and adult) in cotton manufacturing in Uzbekistan, for many years… I did my best not to discuss personal details of a particular individual. I never discussed what he went through, what happened. We only discussed when and where to meet and possibly dropped some hints of what we might talk about. That was it. All the details were discussed face-to-face only. It is a matter of safety of those people who disclose that information.”24 Around September 2015, he began to experience renewed problems with the authorities, including being summoned by the police over his work documenting labour conditions in the cotton industry. He began to suspect he was subject to physical surveillance. Subsequently, video footage he had collected as part of his work was leaked from his personal Google Drive account and placed online, which resulted in an administrative charge being brought against him: “When I realised I was under surveillance, I left my city and moved to another town. I decided to wait for this situation to pass while being there, as I realised everything was serious. After several days – I left on 30 of September and that happened sometime in the middle of October – one of the websites published an article that undermined my reputation. The article stated I was a fraud stealing money from companies and that I published video footage of some women illegally. …I realised all that information was taken from my email account because this information was nowhere in public access. I didn’t publish this data and it was impossible for it to appear anywhere. I realised that my email account was hacked, all the information from there was stolen and it was used against me. All of that happened because the information was stolen from the Internet. My information. Then they initiated two administrative cases. The second case was based on a video that I stored on my Google disk, in my email account. They took that video and published it on Youtube and on the same website. Then they showed that to the women present in the video and told them that Tikhonov published this on YouTube without their permission They initiated an administrative case. But I didn’t published that video in the Internet. It wasn’t meant to be published anywhere at all. There shouldn’t have been any publicity.”25 Including these charges, Dmitry soon had three administrative charges pending against him, and so he again went into hiding, and re-emerged only when news reached him that his house had been burnt down: “I went to another city and switched all my mobile phones off. I removed the batteries and sim-cards and stored all that stuff separately. I completely ceased using my phones. You know, they can use phones for GPRS navigation and it is possible to find a person by a phone call. I found another phone and used it. Those people – my acquaintances, my circle of contacts, those people who knew me well and communications with whom might cause me to be located – I ceased any communication with all those people at that moment, in order to prevent them finding me. 22 Uzbekistan is the world’s fourth largest exporter of cotton. International organizations accused the government of continuing to use forced labour in the cotton industry on a massive scale. They estimated that in order to fulfill annual quotas issued by the central government local authorities compelled over a million public sector employees to work in the cotton fields. See, e.g., http://www.cottoncampaign.org/; http://www.globalslaveryindex.org/country/uzbekistan/ and https://www.hrw.org/news/2013/01/25/uzbekistan-forced-labor-widespread- cotton-harvest 23 https://www.amnesty.org.uk/webfm_send/1273 24 Amnesty International Interview with Dmitry Tikhonov, 2016. 25 Amnesty International Interview with Dmitry Tikhonov, 2016. “WE WILL FIND YOU, ANYWHERE” THE GLOBAL SHADOW OF UZBEKISTANI SURVEILLANCE Amnesty International 10