A/HRC/41/41 Cybercrime laws 33. The prohibition against the use of electronic devices “to ruin communal harmony or create instability or disorder or disturb or is about to disturb the law and order situation”,38 found in the Digital Security Act 2018 of Bangladesh, for example, grants officials excessive discretion to determine what would constitute unlawful conduct and to pursue criminal actions against individuals based on arbitrary and subjective grounds. Authorities could conflate calls for peaceful assemblies on social media with the creation of instability, or ruining communal harmony. Other cybercrime laws give wide-ranging power to governments to block websites deemed critical of the authorities, such as those belonging to human rights defenders,39 based on broadly defined concepts of national security. Antiterrorism laws 34. Mandate holders have raised concern on several occasions about the excessively broad language often used in antiterrorism legislation. 40 Although the Special Rapporteur is aware that States have an interest in protecting national security and public safety, which are legitimate grounds for restricting freedom of association and assembly, these laws often are drafted in ways that give opportunities for abuse. For example, many laws include broad and subjective concepts in the definition of terrorism, such as “widespread terror through political extremism”, “serious social disturbance”,41 “disrupting public services”, “inciting violence at demonstrations” and “creating fear amongst the public to jeopardize the solidarity” of a country.42 The vagueness of the concepts makes it extremely difficult to determine with reasonable certainty what kind of conduct (online and offline) would be considered “terrorism”. Organizations and individuals that are deemed to be promoting or propagating views or beliefs not shared by the majority of the population or that are unfavourable to the authorities are particularly vulnerable. This would lead to a significant chilling effect among them and further exclude them from the digital space. Surveillance laws 35. Mandate holders have stressed that overly broad and vague surveillance laws often fail to target specific individuals on the basis of a reasonable suspicion. 43 For example, the Investigatory Powers Act 2016, of the United Kingdom of Great Britain and Northern Ireland, contained vague language that allowed authorities to target a group or category of people without requiring each target of the surveillance to be individually identified. 44 Other forms of surveillance law give enormous licence to States to monitor citizens’ online activities, such as the Telecommunications and Other Legislation Amendment Bill, of Australia, which includes provisions that would grant authorities unfettered powers to compel companies to facilitate access to encrypted user data for security agencies and weaken encryption technologies. 45 The risks of abuse are increased given that many existing laws and regulations governing surveillance do not keep pace with rapid changes in surveillance technology and its potential uses. Media and anti-”fake news” laws 36. During consultations with civil society, concerns were raised about the broad language used in Cambodian interministerial decree (prakas) No. 170 of 28 May 2018, which prohibits online activities “intended to create turmoil in society”. This provision grants authorities excessive discretion to prohibit a wide range of activities online – 38 39 40 41 42 43 44 45 See BGD 4/2018, accessible from https://spcommreports.ohchr.org/Tmsearch/TMDocuments. See, for example, EGY 13/2017. A/HRC/26/29, para. 59. See BRA 8/2015. Asian Forum for Human Rights and Development (Forum-Asia), Instruments of Repression: A Regional Report on the Status of Freedoms of Expression, Peaceful Assembly, and Association in Asia, pp. 84 and 89. See A/HRC/35/28/Add.1. Ibid. See AUS 5/2018. 9