A/HRC/35/22 The mandatory retention of large amounts of user data runs contrary to established due process standards, such as the need for individualized suspicion of wrongdoing. Undermining encryption 21. Since the Special Rapporteur’s report on encryption and anonymity (A/HRC/29/32), unnecessary and disproportionate measures to undermine encryption have increased globally and threaten to undermine both the freedom of expression and digital security of users. In the United Kingdom of Great Britain and Northern Ireland, for example, the 2016 Investigatory Powers Act permits the Secretary of State to issue “technical capability notices” that require providers to remove “electronic protection” from communications — a measure that could compel backdoors or otherwise limit or weaken encryption. 41 States have not provided sufficient evidence that such vulnerabilities are the least intrusive means of protecting national security and public order, particularly given the breadth and depth of other investigative tools at their disposal (Ibid., para. 39). Direct access 22. Direct access to Internet and telecommunications networks enables authorities to intercept and monitor communications with limited legal scrutiny or accountability. Technological advances have enhanced the ability of law enforcement and intelligence agencies to obtain a direct connection to networks without the involvement or knowledge of the network operator.42 During the 2014 general election in the former Yugoslav Republic of Macedonia, intelligence authorities allegedly obtained direct access to the country’s major telecommunications networks to intercept the communications of over 20,000 people, including politicians, activists, government officials and journalists. Many targets were also sent a transcript of their phone calls. 43 In India, it appears that authorities are developing a Central Monitoring System programme that would enable “electronic provisioning of target numbers by government agency without any manual intervention from telecommunications service providers on a secure network.”44 These activities do not appear to be provided by law, lacking both judicial authorization and external oversight. Furthermore, the risks they pose to the security and integrity of network infrastructure raise proportionality concerns. C. Net neutrality 23. Network neutrality — the principle that all Internet data should be treated equally without undue interference — promotes the widest possible access to information. 45 In the digital age, the freedom to choose among information sources is meaningful only when Internet content and applications of all kinds are transmitted without undue discrimination or interference by non-State actors, including providers. The State’s positive duty to promote freedom of expression argues strongly for network neutrality in order to promote the widest possible non-discriminatory access to information. Paid prioritization 24. Under paid prioritization schemes, providers give preferential treatment to certain types of Internet traffic over others for payment or other commercial benefits. These schemes effectively create Internet fast lanes for content providers that can afford to pay extra and slow lanes for all others. 46 This hierarchy of data undermines user choice. Users 41 42 43 44 45 46 8 United Kingdom of Great Britain and Northern Ireland, Investigatory Powers Act (2016), art. 253; also OHCHR, letter to the Government of the United Kingdom, 22 December 2015 (AL GBR 4/2015). Privacy International submission; and Telecommunications Industry Dialogue submission, p. 3. Privacy International, “Macedonia: Society On Tap” (23 March 2016). Access Now submission, part II, p. 4. Luca Belli submission; and Article 19 submission, pp. 7-8. Dawn C. Nunziato and Arturo J. Carrillo, “The price of paid prioritization: The international and domestic consequences of the failure to protect Net neutrality in the United States”, Georgetown