A/HRC/17/27 rights organizations and dissidents are frequently and increasingly becoming targets of DDoS attacks, some of which are included in the first addendum to this report. 52. When a cyber-attack can be attributed to the State, it clearly constitutes inter alia a violation of its obligation to respect the right to freedom of opinion and expression. Although determining the origin of cyber-attacks and the identity of the perpetrator is often technically difficult, it should be noted that States have an obligation to protect individuals against interference by third parties that undermines the enjoyment of the right to freedom of opinion and expression. This positive obligation to protect entails that States must take appropriate and effective measures to investigate actions taken by third parties, hold the persons responsible to account, and adopt measures to prevent such recurrence in the future. F. Inadequate protection of the right to privacy and data protection 53. The right to privacy is essential for individuals to express themselves freely. Indeed, throughout history, people’s willingness to engage in debate on controversial subjects in the public sphere has always been linked to possibilities for doing so anonymously. The Internet allows individuals to access information and to engage in public debate without having to reveal their real identities, for example through the use of pseudonyms on message boards and chat forums. Yet, at the same time, the Internet also presents new tools and mechanisms through which both State and private actors can monitor and collect information about individuals’ communications and activities on the Internet. Such practices can constitute a violation of the Internet users’ right to privacy, and, by undermining people’s confidence and security on the Internet, impede the free flow of information and ideas online. 54. The Special Rapporteur is deeply concerned by actions taken by States against individuals communicating via the Internet, frequently justified broadly as being necessary to protect national security or to combat terrorism. While such ends can be legitimate under international human rights law, surveillance often takes place for political, rather than security reasons in an arbitrary and covert manner. For example, States have used popular social networking sites, such as Facebook, to identify and to track the activities of human rights defenders and opposition members, and in some cases have collected usernames and passwords to access private communications of Facebook users. 55. A number of States are also introducing laws or modifying existing laws to increase their power to monitor Internet users’ activities and content of communication without providing sufficient guarantees against abuse. In addition, several States have established a real-name identification system before users can post comments or upload content online, which can compromise their ability to express themselves anonymously, particularly in countries where human rights are frequently violated. Furthermore, steps are also being taken in many countries to reduce the ability of Internet users to protect themselves from arbitrary surveillance, such as limiting the use of encryption technologies. 56. The Special Rapporteur also notes that there are insufficient or inadequate data protection laws in many States stipulating who is allowed to access personal data, what it can be used for, how it should be stored, and for how long. The necessity of adopting clear laws to protect personal data is further increased in the current information age, where large volumes of personal data are collected and stored by intermediaries, and there is a worrying trend of States obliging or pressuring these private actors to hand over information of their users. Moreover, with the increasing use of cloud-computing services, where information is stored on servers distributed in different geographical locations, ensuring that third parties also adhere to strict data protection guarantees is paramount. 15