A/HRC/29/32 must also be “proportionate to the interest to be protected”. 21 A high risk of damage to a critical, legitimate State interest may justify limited intrusions on the freedom of expression. Conversely, where a restriction has a broad impact on individuals who pose no threat to a legitimate government interest, the State’s burden to justify the restriction will be very high. 22 Moreover, a proportionality analysis must take into account the strong possibility that encroachments on encryption and anonymity will be exploited by the same criminal and terrorist networks that the limitations aim to deter. In any case, “a detailed and evidence-based public justification” is critical to enable transparent public debate over restrictions that implicate and possibly undermine freedom of expression (see A/69/397, para. 12). B. State practice: examples and concerns 36. The trend lines regarding security and privacy online are deeply worrying. States often fail to provide public justification to support restrictions. Encrypted and anonymous communications may frustrate law enforcement and counter-terrorism officials, and they complicate surveillance, but State authorities have not generally identified situations — even in general terms, given the potential need for confidentiality — where a restriction has been necessary to achieve a legitimate goal. States downplay the value of traditional nondigital tools in law enforcement and counter-terrorism efforts, including transnational cooperation. 23 As a consequence, the public lacks an opportunity to measure whether restrictions on their online security would be justified by any real gains in national security and crime prevention. Efforts to restrict encryption and anonymity also tend to be quick reactions to terrorism, even when the attackers themselves are not alleged to have used encryption or anonymity to plan or carry out an attack. Moreover, even where the restriction is arguably in pursuit of a legitimate interest, many laws and policies regularly do not meet the standards of necessity and proportionality and have broad, deleterious effects on the ability of all individuals to exercise freely their rights to privacy and freedom of opinion and expression. 37. It also bears noting that the United Nations itself has not provided strong communication security tools to its staff or to those who would visit United Nations websites, making it difficult for those under threat to securely reach the United Nations, human rights mechanisms online.24 1. Encryption 38. Some Governments seek to protect or promote encryption to ensure the privacy of communications. For instance, 25 the Marco Civil da Internet Law of Brazil, adopted in 2014, guarantees the inviolability and secrecy of user communications online, permitting exceptions only by court order. The E-Commerce Act and Telecommunication Act of Austria do not restrict encryption, and the Government has undertaken public awareness 21 22 23 See ibid., para. 14. See Inter-American Commission on Human Rights, OEA /Serv.L/V/II.149, para. 134. But see Centre for International Governance Innovation and Chatham House, Toward a Social Compact for Digital Privacy and Security: Statement by the Global Commission on Internet Governance (2015). https://ourinternet- files.s3.amazonaws.com/publications/gcig_social_compact.pdf 24 25 For instance, staff of the Office of the United Nations High Commissioner for Human Rights (OHCHR) in Geneva do not have access to end-to-end e-mail encryption, and the OHCHR website is not encrypted. Many examples in this paragraph are taken from the relevant government submissions. 13