On 1 May 2019 Friedhelm Weinberg, Executive Director, HURIDOCS, published “3 ways activists are being targeted by cyberattacks’ on the website of World Economic Forum (see below). A timely piece in view of the current turmoil surrounding the discovery of spyware crafted by a sophisticated hackers-for-hire, who took advantage of a flaw in WhatsApp. The Financial Times identified the actor as Israel’s NSO Group, and WhatsApp all but confirmed the identification, describing hackers as “a private company that has been known to work with governments to deliver spyware.” .. As late as Sunday, as WhatsApp engineers raced to close the loophole, a UK-based human rights lawyer’s phone was targeted using the same method. Researchers at the University of Toronto’s Citizen Lab said they believed that the spyware attack on Sunday was linked to the same vulnerability that WhatsApp was trying to patch. NSO’s flagship product is Pegasus, a program that can turn on a phone’s microphone and camera, trawl through emails and messages and collect location data. NSO advertises its products to Middle Eastern and western intelligence agencies, and says Pegasus is intended for governments to fight terrorism and crime. … Asked about the WhatsApp attacks, NSO said it was investigating the issue. “Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company said. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer].”
Several reports have shown Israeli technology being used by Gulf states against their own citizens (AFP/File photo)
Middle East Eye of 13 May 2019 reports that Amnesty International is pushing for Israel’s defence ministry to withdraw an export license for NSO Group, an Israeli tech firm that the human rights group has accused of selling spyware to repressive governments to spy on activists. In a statement on Monday, Amnesty said it plans to file a legal petition to the District Court of Tel Aviv on Tuesday to block the export licenses. Danna Ingleton, deputy director of Amnesty Tech, said in an affidavit on Monday that NSO Group has not done its job to protect human rights defenders from being targeted. Instead, many reports have shown that governments have deployed Pegasus spyware “to surveil human rights defenders”, Ingleton said.
NSO Group has been under increased scrutiny after a series of reports about the ways in which its spyware programme has been used against prominent human rights activists. Last year, a report by CitizenLab, a group at the University of Toronto, showed that human rights defenders in Saudi Arabia, the United Arab Emirates and Bahrain were targeted with the software.
In October, US whistleblower Edward Snowden said Pegasus had been used by the Saudi authorities to surveil journalist Jamal Khashoggi before his death. “They are the worst of the worst,” Snowden said of the firm. Amnesty International said in August that a staffer’s phone was infected with the Pegasus software via a WhatsApp message.
——-
Friedhelm Weinberg‘s piece of 1 May is almost prescient and contains good, broader advice:
When activists open their inboxes, they find more than the standard spam messages telling them they’ve finally won the lottery. Instead, they receive highly sophisticated emails that look like they are real, purport to be from friends and invite them to meetings that are actually happening. The catch is: at one point the emails will attempt to trick them.
1. Phishing for accounts, not compliments
In 2017, the Citizen Lab at the University of Toronto and the Egyptian Initiative for Personal Rights, documented what they called the “Nile Phish” campaign, a set of emails luring activists into giving access to their most sensitive accounts – email and file-sharing tools in the cloud. The Seoul-based Transitional Justice Working Group recently warned on its Facebook page about a very similar campaign. As attacks like these have mounted in recent years, civil society activists have come together to defend themselves, support each other and document what is happening. The Rarenet is a global group of individuals and organizations that provides emergency support for activists – but together it also works to educate civil society actors to dodge attacks before damage is done. The Internet Freedom Festival is a gathering dedicated to supporting people at risk online, bringing together more than 1,000 people from across the globe. The emails from campaigns like Nile Phish may be cunning and carefully crafted to target individual activists.. – they are not cutting-edge technology. Protection is stunningly simple: do nothing. Simply don’t click the link and enter information – as hard as it is when you are promised something in return.
Often digital security is about being calm and controlled as much as it is about being savvy in the digital sphere. And that is precisely what makes it difficult for passionate and stressed activists!
2. The million-dollar virus
Unfortunately, calm is not always enough. Activists have also been targeted with sophisticated spyware that is incredibly expensive to procure and difficult to spot. Ahmed Mansoor, a human-rights defender from the United Arab Emirates, received messages with malware (commonly known as computer viruses) that cost one million dollars on the grey market, where unethical hackers and spyware firms meet. See also: https://humanrightsdefenders.blog/2016/08/29/apple-tackles-iphone-one-tap-spyware-flaws-after-mea-laureate-discovers-hacking-attempt/]
Rights defender Ahmed Mansoor in Dubai in 2011. Image: Reuters/Nikhil Monteiro
3. Shutting down real news with fake readers
Both phishing and malware are attacks directed against the messengers, but there are also attacks against the message itself. This is typically achieved by directing hordes of fake readers to the real news – that is, by sending so many requests through bot visitors to websites that the servers break down under the load. Commonly referred to as “denial of service” attacks, these bot armies have also earned their own response from civil society. Specialised packages from Virtual Road or Deflect sort fake visitors from real ones to make sure the message stays up.
How distributed denial of service (DDoS) attacks have grown. Image: Kinsta.com; data from EasyDNS
Recently, these companies also started investigating who is behind these attacks– a notoriously difficult task, because it is so easy to hide traces online. Interestingly, whenever Virtual Road were so confident in their findings that they publicly named attackers, the attacks stopped. Immediately. Online, as offline, one of the most effective ways to ensure that attacks end is to name the offenders, whether they are cocky kids or governments seeking to stiffle dissent. But more important than shaming attackers is supporting civil society’s resilience and capacity to weather the storms. For this, digital leadership, trusted networks and creative collaborations between technologists and governments will pave the way to an internet where the vulnerable are protected and spaces for activism are thriving.
Google announced on 7 May 2019 that the Geneva-based NGO is one of 20 organizations that will share 25 million US dollars in grants from the Google Artificial Intelligence Impact Challenge. The Google Artificial Intelligence Impact Challenge was an open call to nonprofits, social enterprises, and research institutions to submit their ideas to use artificial intelligence (AI) to help address societal challenges. Over 2600 organizations from around the world applied.
Geneva-based HURIDOCS will receive a grant of 1 million US dollars to develop and use machine learning methods to extract, explore and connect relevant information in laws, jurisprudence, victim testimonies, and resolutions. Thanks to these, the NGO will work with partners to make documents better and freely accessible. This will benefit anyone interested in using human rights precedents and laws, for example to lawyers representing victims of human rights violations or students researching non-discrimination.
The machine learning work to liberate information from documents is grounded in more than a decade of work that HURIDOCS has done to provide free access to information. Through pioneering partnerships with the Institute for Human Rights and Development in Africa (IHRDA) and the Center for Justice and International Law (CEJIL), HURIDOCS has co-created some of the most used public human rights databases. A key challenge in creating these databases has been the time-consuming and error-prone manual adding of information – a challenge the machine learning techniques will be used to overcome.
“We have been experimenting with machine learning techniques for more than two years”, said Natalie Widmann, Artificial Intelligence Specialist at HURIDOCS. “We have changed our approach countless times, but we see a clear path to how they can be leveraged in groundbreaking ways to democratise access to information.” HURIDOCS will use the grant from Google to work with partners to co-create the solutions, carefully weighing ethical concerns of automation and focusing on social impact. All the work will be done in the open, including all code being released publicly.
“We are truly excited by the opportunity to use these technologies to address a problem that has been holding the human rights movement back”, said Friedhelm Weinberg, Executive Director of HURIDOCS. “We are thankful to Google for the support and look forward to be working with their experts and what will be a fantastic cohort of co-grantees.”
“We received thousands of applications to the Google AI Impact Challenge and are excited that HURIDOCS was selected to receive funding and expertise from Google. AI is at a nascent stage when it comes to the value it can have for the social impact sector, and we look forward to seeing the outcomes of this work and considering where there is potential for use to do even more.” – Jacquelline Fuller, President of Google.org
Next week, the HURIDOCS team will travel to San Francisco to work with the other grantees, Google AI experts, Project Managers and the startup specialists from Google’s Launchpad Accelerator for a program that will last six months, from May to November 2019. Each organization will be paired a Google expert who will meet with them regularly for coaching sessions, and will also have access to other Google resources and expert mentorship.
The winner of the 2019 German Africa Prize is Juliana Rotich, founder of software project Ushahidi, which was introduced to monitor violence in Kenya following the 2007 general elections.
Juliana Rotich became known in professional circles in 2007 as the co-founder of the open source platform Ushahidi (a Swahili word meaning ‘testimony’), which began in Kenya as an internet platform developed to map reports of post-election violence and which went on to revolutionize the international flow of data and information.
A 16-member independent jury selected Rotich from a list of 18 African nominees. The 42-year-old was informed at a meeting on Thursday 4 April 2019 at the German embassy in Nairobi, attended by Deputy Ambassador Michael Derus and the General Secretary of the German Africa Foundation, Ingo Badoreck. The award pays tribute to the Kenyan entrepreneur not only for her business achievements and technological innovations but also for her outstanding sense of social responsibility. For more on this another regional awards for Africa see: http://www.trueheroesfilms.org/thedigest/awards/german-africa-award]
In an interview with DW in 2013, Rotich explained the philosophy behind Ushahidi: “One of the things that we are doing is that we have a partnership with civil society organizations, peace networks and youth networks. And these are organizations that are doing peace work in terms of messaging and encouraging the population to be peaceful and to conduct themselves in a peaceful way. So in that respect we are part of a partnership. Ushahidi’s key role in this partnership is the technology. And this is the crowdsourcing technology that allows people to report but also provides a way for digital humanitarians to volunteer and help to sift through the information, categorize it and make it available on the website.“
Today Ushahidi is used in over 160 countries as a tool for crisis response and for independent election monitoring, for example in Nigeria and Afghanistan. It has also been used following natural disasters in Chile, Haiti and New Zealand. Juliana Rotich is regarded as one of the leading figures of the digital revolution in Africa and beyond.
From Ushahidi she went on to found BRCK, an innovative technology company which is now the biggest Wi-Fi provider in sub-Saharan Africa. The central product is a battery-operated modem which can function for up to eight hours without electrical power. It is used in 150 countries.
Are you an organisation, human rights group, or activist registering, documenting, analysing human rights cases? HURIDOCS invites you to join this webinar and discussion of the events method for documenting human rights violations!
What: Presentation and discussion on the events method for documenting human rights violations
Who: Bert Verstappen, Senior Documentalist at HURIDOCS
When: Thursday, 7 March 2019 from 14:00 to 15:30 UTC/GMT
Data is like water – it needs a container to make it useful. The beginning of a human rights documentation projects often starts with containers like lists and spreadsheets. But at some point, the information will outgrow these containers – both in terms of quantity and complexity.
The way you design these containers will have an impact on what information you will gather, how you organise the information, and the kind of analysis you can carry out. HURIDOCS and its network developed the Events Standard Formats methodology (we now call the events method) – to provide a container specifically for organisations documenting human rights violations.
The purpose of the events method is to capture essential information with regard to individual cases of human rights violations in order to better understand patterns of violence, including “who did what to whom”. It involves gathering information about:
facts: what happened, where, and when
the possible human rights violations that were committed
the persons involved: which alleged perpetrator did what to which victim, what are the sources of information and which interventions were made.
For those who like to reflect on what was achieved in 2018, here the self-report of one of the smaller, specialized NGOs, HURIDOCS:
At HURIDOCS, we work with human rights organisations to preserve documentation for memory, advance accountability for abuses and bring key information on human rights at our fingertips. As we are nearing the end of 2018, I want to look back at some of the highlights that shaped our year.
Personally, I have been thrilled to see how much more human rights information we supported to become truly open, across the globe. Next to sustaining our flagship collaborations – the African Human Rights Case Law Analyser, SUMMA and RightDocs – we have supported more than ten collections to be launched this year alone. Together, these collections cover more than 10,000 documents of precedent decisions, resolutions and reports.
This includes pioneering work on digital rights with CYRILLA, economic and social rights with Resourcing Rights, minority issues with minorityforum.info – to only name a few. This is only possible thanks to the excellent collaborations with our partners that curate the collections, and our team that has developed Uwazi to be a flexible and adaptable tool. Together, we make human rights information accessible, as a fundament for activists and advocates to press for change.
Similarly, we have worked with partner organisations to strengthen their capacity to document and investigate human rights violations. Much of this work is sensitive, so it is not prudent for us to celebrate it here, but you can see a glance of just how important it is by reading about our recently completed work with Migrant Forum Asia (MFA), a network of more than 50 local organisations in Asia and the Gulf, on the Hamsa database and accompanying mobile application. This is a comprehensive solution for recording, managing, analysing, and sharing information on labour migration rights. Hamsa currently covers more than 4,500 cases, which were recorded by the MFA network.
Next year, we will also see even more of this work, as our newest tool, Uwazi Reveal, matures through our collaborations with our partners. Their realities and unique contexts shape the development of the tool as a community-sustained resource…
A global cooperation platform has been launched to advance the fight against torture and ill-treatment worldwide: https://www.startnext.com/atlas-of-torture. The Atlas of Torture – developed by Ludwig Boltzmann Institute of Human Rights in Austria together with HURIDOCS– aims at providing the largest database on torture and ill-treatment, a map of organisations and activities as well as a learning and exchange platform for states, researchers, human rights defenders and the general public. Thereby they want to raise awareness, improve the access to information, strengthen cooperation and empower people worldwide. The project has already been endorsed by many human rights experts (from the UN SPT, Council of Europe, NGOs, academics and medical professionals). You will be able to view their testimonials over the coming weeks on the project’s Facebook <https://www.facebook.com/Atlas-of-Torture-115526871812308/> and Twitter <https://twitter.com/AtlasofTorture> channels.
A concept note with more details is available from: contact@atlas-of-torture.org
HURIDOCS developed RightDocs to improve the accessibility and effectiveness of these resources for human rights advocates and others around the world, as well as to support the transparency and accountability of the Human Rights Council. With the 35th Regular Session of the UN Human Rights Council, it has updated the information on RightDocs with the most recent final Council resolutions and reports – now including all past sessions other than HRC34. [see also: https://humanrightsdefenders.blog/2016/03/07/human-rights-resolutions-count-at-rightdocs/]
RightDocs is the complete, searchable, and filterable collection of official Human Rights Council resolutions, amendments, presidential statements, decisions and reports. This platform allows users to:
Search full-text resolutions, amendments and reports
Filter by topic, agenda item, session, (co)sponsor States, voting results and dates
Discover voting patterns on topics over time, and compare those patterns
Identify prospective co-sponsors or supporters to approach
Why digitise? Digitising your documents greatly improves access to your information, whether you are building an online public library to share documents related to corruption, or making documents searchable for your team. Digitisation also helps to preserve and protect important human rights information. Many defenders run the risk that malevolent groups seeking to destroy or confiscate witness testimony, evidence of abuse, and other sensitive information. Others run the risk of documents being subject to harmful storage conditions, such as humidity, insects, and rodents. These are just a few reasons for digitising your documents. However, figuring out the most efficient, affordable, and responsible way to digitise thousands of documents can be a daunting task especially for human rights defenders in the field.
Therefore the NGO HURIDOCSis organizing two live webinars. These webinars will explore the process of digitising documents and the best practices that should be applied. A summary of the discussion will be written and shared on the HURIDOCS website.
Where: ReadyTalk (use the access code 2458641 to join)
Who: Open to anyone who wants to learn more about digitizing documents
Whether you are a seasoned digitization expert or a human rights defender just starting to think about digitisation, this is a good occasion to learn and share.
If you are interested, please contact Kristin Antin at kristin@huridocs.org. Here is an example of a webinar hosted in January on managing contact information.