On 1 May 2019 Friedhelm Weinberg, Executive Director, HURIDOCS, published “3 ways activists are being targeted by cyberattacks’ on the website of World Economic Forum (see below). A timely piece in view of the current turmoil surrounding the discovery of spyware crafted by a sophisticated hackers-for-hire, who took advantage of a flaw in WhatsApp. The Financial Times identified the actor as Israel’s NSO Group, and WhatsApp all but confirmed the identification, describing hackers as “a private company that has been known to work with governments to deliver spyware.” .. As late as Sunday, as WhatsApp engineers raced to close the loophole, a UK-based human rights lawyer’s phone was targeted using the same method. Researchers at the University of Toronto’s Citizen Lab said they believed that the spyware attack on Sunday was linked to the same vulnerability that WhatsApp was trying to patch. NSO’s flagship product is Pegasus, a program that can turn on a phone’s microphone and camera, trawl through emails and messages and collect location data. NSO advertises its products to Middle Eastern and western intelligence agencies, and says Pegasus is intended for governments to fight terrorism and crime. … Asked about the WhatsApp attacks, NSO said it was investigating the issue. “Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company said. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer].”
Several reports have shown Israeli technology being used by Gulf states against their own citizens (AFP/File photo)
Middle East Eye of 13 May 2019 reports that Amnesty International is pushing for Israel’s defence ministry to withdraw an export license for NSO Group, an Israeli tech firm that the human rights group has accused of selling spyware to repressive governments to spy on activists. In a statement on Monday, Amnesty said it plans to file a legal petition to the District Court of Tel Aviv on Tuesday to block the export licenses. Danna Ingleton, deputy director of Amnesty Tech, said in an affidavit on Monday that NSO Group has not done its job to protect human rights defenders from being targeted. Instead, many reports have shown that governments have deployed Pegasus spyware “to surveil human rights defenders”, Ingleton said.
NSO Group has been under increased scrutiny after a series of reports about the ways in which its spyware programme has been used against prominent human rights activists. Last year, a report by CitizenLab, a group at the University of Toronto, showed that human rights defenders in Saudi Arabia, the United Arab Emirates and Bahrain were targeted with the software.
In October, US whistleblower Edward Snowden said Pegasus had been used by the Saudi authorities to surveil journalist Jamal Khashoggi before his death. “They are the worst of the worst,” Snowden said of the firm. Amnesty International said in August that a staffer’s phone was infected with the Pegasus software via a WhatsApp message.
——-
Friedhelm Weinberg‘s piece of 1 May is almost prescient and contains good, broader advice:
When activists open their inboxes, they find more than the standard spam messages telling them they’ve finally won the lottery. Instead, they receive highly sophisticated emails that look like they are real, purport to be from friends and invite them to meetings that are actually happening. The catch is: at one point the emails will attempt to trick them.
1. Phishing for accounts, not compliments
In 2017, the Citizen Lab at the University of Toronto and the Egyptian Initiative for Personal Rights, documented what they called the “Nile Phish” campaign, a set of emails luring activists into giving access to their most sensitive accounts – email and file-sharing tools in the cloud. The Seoul-based Transitional Justice Working Group recently warned on its Facebook page about a very similar campaign. As attacks like these have mounted in recent years, civil society activists have come together to defend themselves, support each other and document what is happening. The Rarenet is a global group of individuals and organizations that provides emergency support for activists – but together it also works to educate civil society actors to dodge attacks before damage is done. The Internet Freedom Festival is a gathering dedicated to supporting people at risk online, bringing together more than 1,000 people from across the globe. The emails from campaigns like Nile Phish may be cunning and carefully crafted to target individual activists.. – they are not cutting-edge technology. Protection is stunningly simple: do nothing. Simply don’t click the link and enter information – as hard as it is when you are promised something in return.
Often digital security is about being calm and controlled as much as it is about being savvy in the digital sphere. And that is precisely what makes it difficult for passionate and stressed activists!
2. The million-dollar virus
Unfortunately, calm is not always enough. Activists have also been targeted with sophisticated spyware that is incredibly expensive to procure and difficult to spot. Ahmed Mansoor, a human-rights defender from the United Arab Emirates, received messages with malware (commonly known as computer viruses) that cost one million dollars on the grey market, where unethical hackers and spyware firms meet. See also: https://humanrightsdefenders.blog/2016/08/29/apple-tackles-iphone-one-tap-spyware-flaws-after-mea-laureate-discovers-hacking-attempt/]
Rights defender Ahmed Mansoor in Dubai in 2011. Image: Reuters/Nikhil Monteiro
3. Shutting down real news with fake readers
Both phishing and malware are attacks directed against the messengers, but there are also attacks against the message itself. This is typically achieved by directing hordes of fake readers to the real news – that is, by sending so many requests through bot visitors to websites that the servers break down under the load. Commonly referred to as “denial of service” attacks, these bot armies have also earned their own response from civil society. Specialised packages from Virtual Road or Deflect sort fake visitors from real ones to make sure the message stays up.
How distributed denial of service (DDoS) attacks have grown. Image: Kinsta.com; data from EasyDNS
Recently, these companies also started investigating who is behind these attacks– a notoriously difficult task, because it is so easy to hide traces online. Interestingly, whenever Virtual Road were so confident in their findings that they publicly named attackers, the attacks stopped. Immediately. Online, as offline, one of the most effective ways to ensure that attacks end is to name the offenders, whether they are cocky kids or governments seeking to stiffle dissent. But more important than shaming attackers is supporting civil society’s resilience and capacity to weather the storms. For this, digital leadership, trusted networks and creative collaborations between technologists and governments will pave the way to an internet where the vulnerable are protected and spaces for activism are thriving.
Google announced on 7 May 2019 that the Geneva-based NGO is one of 20 organizations that will share 25 million US dollars in grants from the Google Artificial Intelligence Impact Challenge. The Google Artificial Intelligence Impact Challenge was an open call to nonprofits, social enterprises, and research institutions to submit their ideas to use artificial intelligence (AI) to help address societal challenges. Over 2600 organizations from around the world applied.
Geneva-based HURIDOCS will receive a grant of 1 million US dollars to develop and use machine learning methods to extract, explore and connect relevant information in laws, jurisprudence, victim testimonies, and resolutions. Thanks to these, the NGO will work with partners to make documents better and freely accessible. This will benefit anyone interested in using human rights precedents and laws, for example to lawyers representing victims of human rights violations or students researching non-discrimination.
The machine learning work to liberate information from documents is grounded in more than a decade of work that HURIDOCS has done to provide free access to information. Through pioneering partnerships with the Institute for Human Rights and Development in Africa (IHRDA) and the Center for Justice and International Law (CEJIL), HURIDOCS has co-created some of the most used public human rights databases. A key challenge in creating these databases has been the time-consuming and error-prone manual adding of information – a challenge the machine learning techniques will be used to overcome.
“We have been experimenting with machine learning techniques for more than two years”, said Natalie Widmann, Artificial Intelligence Specialist at HURIDOCS. “We have changed our approach countless times, but we see a clear path to how they can be leveraged in groundbreaking ways to democratise access to information.” HURIDOCS will use the grant from Google to work with partners to co-create the solutions, carefully weighing ethical concerns of automation and focusing on social impact. All the work will be done in the open, including all code being released publicly.
“We are truly excited by the opportunity to use these technologies to address a problem that has been holding the human rights movement back”, said Friedhelm Weinberg, Executive Director of HURIDOCS. “We are thankful to Google for the support and look forward to be working with their experts and what will be a fantastic cohort of co-grantees.”
“We received thousands of applications to the Google AI Impact Challenge and are excited that HURIDOCS was selected to receive funding and expertise from Google. AI is at a nascent stage when it comes to the value it can have for the social impact sector, and we look forward to seeing the outcomes of this work and considering where there is potential for use to do even more.” – Jacquelline Fuller, President of Google.org
Next week, the HURIDOCS team will travel to San Francisco to work with the other grantees, Google AI experts, Project Managers and the startup specialists from Google’s Launchpad Accelerator for a program that will last six months, from May to November 2019. Each organization will be paired a Google expert who will meet with them regularly for coaching sessions, and will also have access to other Google resources and expert mentorship.
Are you an organisation, human rights group, or activist registering, documenting, analysing human rights cases? HURIDOCS invites you to join this webinar and discussion of the events method for documenting human rights violations!
What: Presentation and discussion on the events method for documenting human rights violations
Who: Bert Verstappen, Senior Documentalist at HURIDOCS
When: Thursday, 7 March 2019 from 14:00 to 15:30 UTC/GMT
Data is like water – it needs a container to make it useful. The beginning of a human rights documentation projects often starts with containers like lists and spreadsheets. But at some point, the information will outgrow these containers – both in terms of quantity and complexity.
The way you design these containers will have an impact on what information you will gather, how you organise the information, and the kind of analysis you can carry out. HURIDOCS and its network developed the Events Standard Formats methodology (we now call the events method) – to provide a container specifically for organisations documenting human rights violations.
The purpose of the events method is to capture essential information with regard to individual cases of human rights violations in order to better understand patterns of violence, including “who did what to whom”. It involves gathering information about:
facts: what happened, where, and when
the possible human rights violations that were committed
the persons involved: which alleged perpetrator did what to which victim, what are the sources of information and which interventions were made.
A global cooperation platform has been launched to advance the fight against torture and ill-treatment worldwide: https://www.startnext.com/atlas-of-torture. The Atlas of Torture – developed by Ludwig Boltzmann Institute of Human Rights in Austria together with HURIDOCS– aims at providing the largest database on torture and ill-treatment, a map of organisations and activities as well as a learning and exchange platform for states, researchers, human rights defenders and the general public. Thereby they want to raise awareness, improve the access to information, strengthen cooperation and empower people worldwide. The project has already been endorsed by many human rights experts (from the UN SPT, Council of Europe, NGOs, academics and medical professionals). You will be able to view their testimonials over the coming weeks on the project’s Facebook <https://www.facebook.com/Atlas-of-Torture-115526871812308/> and Twitter <https://twitter.com/AtlasofTorture> channels.
A concept note with more details is available from: contact@atlas-of-torture.org
Why digitise? Digitising your documents greatly improves access to your information, whether you are building an online public library to share documents related to corruption, or making documents searchable for your team. Digitisation also helps to preserve and protect important human rights information. Many defenders run the risk that malevolent groups seeking to destroy or confiscate witness testimony, evidence of abuse, and other sensitive information. Others run the risk of documents being subject to harmful storage conditions, such as humidity, insects, and rodents. These are just a few reasons for digitising your documents. However, figuring out the most efficient, affordable, and responsible way to digitise thousands of documents can be a daunting task especially for human rights defenders in the field.
Therefore the NGO HURIDOCSis organizing two live webinars. These webinars will explore the process of digitising documents and the best practices that should be applied. A summary of the discussion will be written and shared on the HURIDOCS website.
Where: ReadyTalk (use the access code 2458641 to join)
Who: Open to anyone who wants to learn more about digitizing documents
Whether you are a seasoned digitization expert or a human rights defender just starting to think about digitisation, this is a good occasion to learn and share.
If you are interested, please contact Kristin Antin at kristin@huridocs.org. Here is an example of a webinar hosted in January on managing contact information.
On 15 February 2017, the chair of HURIDOCS, Gisella Reina announced the appointment of Friedhelm Weinberg as the new Executive Director. She added: “HURIDOCS has a young and energetic director that listens and leads. His experience with our global network, having worked in Asia, Africa and the Former Soviet Union region, gives him the firm understanding of what our community thinks and wants. Friedhelm has proven his capacity to strengthen and motivate our international and distributed team to be creative and effective.”
From mobilizing supporters, to organizing interviews, to fundraising, to persuading decision-makers, relationships are at the heart of human rights work. This is why it’s so important to have a system to document and manage these relationships. There are many Constituent Relationship Management (CRM) systems out there to help manage this information, but human rights groups often require additional attention to security, sustainability, and other custom features. So what CRM systems are human rights groups using today? What’s working well, and what are the challenges?
This HURIDOCS community discussion is an opportunity for CRM users, developers and advocates to share their experiences, knowledge and advice on contact management. A summary of the discussion will be written and shared on the HURIDOCS website.
When: 12 January 2017 at 4pm GMT
Where: Watch the webinar below from the embedded Hangout On Air, and participate via Twitter.
Who: open to anyone who wants to learn more about managing human rights contacts
So far, HURIDOCS has recruited human rights practitioners to present on their experiences using:
CiviCRM
Civi (a CiviCRM distribution)
Salesforce
ActionKit
If you have CRM experience you want to share, please contact: kristin@huridocs.org! To ask questions or make comments, use the #HURIDOCS hashtag on Twitter:
A willingness to embrace new challenges with HURIDOCS’ partners while ensuring continuity and quality in our work and products.
Some travelling will be required, but Geneva will be the base for the most part of the working time.
An open management style, with regular contact and ongoing communication and dialogue with all staff members regardless of their physical location. [HURIDOCS employs 17 staff members with a total of 13 full time positions with many staff members operating remotely]
General Duties include:
Lead strategic planning and implementation of strategy
Fundraising
General management of HURIDOCS resources, including financial and human resource
Representing HURIDOCS to the human rights community, and to the public at large
Maintaining knowledge of the needs in relation to information and documentation of organisations in the human rights space, as well as an understanding of technology trends and directions from a management perspective
Specific Duties:
Overall supervision and guidance of the software development process
Identifying and understanding the needs of the organisations HURIDOCS serves, and available opportunities
Cultivating the ground for HURIDOCS‘ powerhouses’ – organisations in different regions to serve as focal points for HURIDOCS’ human rights solutions in different regions of the world
Qualifications:
University education: Preferably at least a master’s degree in a discipline relating to the work of HURIDOCS, or its equivalent in a relevant field
A background in the Human Rights environment and knowledge of how legal systems operate is highly desirable
An ability to communicate about complex topics in engaging ways
Skills include:
Proven ability to raise funds and to secure strategic relationships with key actors (Required)
Fluency in both written and spoken English and proficiency in another language (Required)
Familiarity with different types of technology and their application in a human rights context (Required)
Strong interpersonal skills and the ability to manage a diverse international and multicultural workplace (Required)
Ability to lead negotiations (Required)
Experience:
Experience in the successful management of a non-profit organisation (Required)
At least 5 years experience in the human rights field (Strongly desired)
The new Executive Director should be in place in Geneva in January 2017. Visit www.huridocs.org for more information. If you have any specific questions you may contact HURIDOCS Board Member Douglas Arellanes at douglas.arellanes@huridocs.org. Your application and CV should be sent to edrecruitment@huridocs.org no later than 15 October 2016.