A/HRC/29/32 anonymous users of Tor. 56 In addition, Ethiopia, 57 Iran (Islamic Republic of) 58 and Kazakhstan59 have reportedly sought to block Tor traffic. Because such tools may be the only mechanisms for individuals to exercise freedom of opinion and expression securely, access to them should be protected and promoted. Restrictions during public unrest 53. Anonymous speech has been necessary for activists and protestors, but States have regularly attempted to ban or intercept anonymous communications in times of protest. Such attempts to interfere with the freedom of expression unlawfully pursue an illegitimate objective of undermining the right to peaceful protest under the Universal Declaration and the International Covenant on Civil and Political Rights. Intermediary liability 54. Some States and regional courts have moved towards imposing responsibilities on Internet service providers and media platforms to regulate online comments by anonymous users. Ecuador, for instance, in its Organic Communications Law, requires intermediaries to generate mechanisms to record personal data to allow the identification of those posting comments. In Delfi v. Estonia (application No. 64569/09), the European Court of Human Rights upheld an Estonian law that imposes liability on a media platform for anonymous defamatory statements posted on its site. Such intermediary liability is likely to result either in real-name registration policies, thereby undermining anonymity, or the elimination of posting altogether by those websites that cannot afford to implement screening procedures, thus harming smaller, independent media. The recently adopted Manila Principles on Intermediary Liability, drafted by a coalition of civil society organizations, provide a sound set of guidelines for States and international and regional mechanisms to protect expression online. Data retention 55. Broad mandatory data retention policies limit an individual’s ability to remain anonymous. A State’s ability to require Internet service and telecommunications providers to collect and store records documenting the online activities of all users has inevitably resulted in the State having everyone’s digital footprint. A State’s ability to collect and retain personal records expands its capacity to conduct surveillance and increases the potential for theft and disclosure of individual information. V. Conclusions and recommendations 56. Encryption and anonymity, and the security concepts behind them, provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age. Such security may be essential for the exercise of other 56 57 58 59 20 The original offer is available http://zakupki.gov.ru/epz/order/notice/zkk44/view/commoninfo.html?regnumber=0373100088714000008 from http://zakupki.gov.ru/epz/order/notice/zkk44/view/commoninfo.html?regNumber=0373100088714000008. Runa Sandvik, Ethiopia Introduces Deep Packet Inspection, The Tor Blog (31 May 2012); see also Article 19, 12 January 2015. “Phobos”, “Iran partially blocks encrypted network traffic”, The Tor Blog (10 February 2012). “Phobos”, “Kazakhstan upgrades censorship to deep packet inspection”, The Tor Blog (16 February 2012).