Archives for March 2017

Help us fund translation of the Ranking Digital Rights 2017 Corporate Accountability Index into other languages!

Please help us make the 2017 Corporate Accountability Index and its findings more accessible to people all over the world.

RDR evaluates companies that are headquartered around the world, and whose products and services are used by people across the globe. Due to limited resources, however, the 2017 Index report and website are currently available only in English. Please help us change that!

We have partnered with Global Voices Translation Services to translate key components of the 2017 report and methodology into major languages—or possibly the whole thing—as funds permit.

We will start with Spanish, French, Arabic, Chinese, and Russian—in that order, as funds permit.

Key findings and recommendations, methodology and indicators, and selected company report cards with greatest relevance to specific language communities will be the priority.

Click here to support translation by Global Voices of the RDR 2017 Index and methodology.

If you have further questions or would like to fund the translation of specific components of the report into specific languages, please contact us at info AT rankingdigitalrights.org.

See you at RightsCon!

This week, the Ranking Digital Rights team is in Brussels for RightsCon, an annual conference on digital rights organized by Access Now. We are organizing and participating in several sessions and look forward to discussions with human rights and technology experts and advocates from all over the world.

On Wednesday March 29 at 2:30pm, we will host the European launch of the newly-released 2017 Ranking Digital Rights Corporate Accountability Index, which found that 22 of the world’s leading internet, mobile, and telecommunications companies are leaving users in the dark on their policies affecting free expression and privacy rights. Project director Rebecca MacKinnon will give a brief presentation highlighting the report’s key findings and recommendations, followed by a discussion with panelists and audience members. We hope the session will provide a jumping off point for further conversation throughout RightsCon with people interested in collaborating on research and advocacy. The launch event will be held in “Creativity & Exploration, 1st Floor.”

On Friday March 31 at 12pm, join us for “How to Talk So Companies Will Listen, and Listen So Companies Will Talk: Doing company advocacy and research.” In this roundtable discussion, seasoned researchers and advocates will share how they work to understand company policies and practices, and share insights on the most effective ways to engage with companies for change. Participants will discuss challenges they’ve encountered in their research and advocacy efforts as well as tips and best practices for overcoming them. This session will be held in “Evasion, 1st Floor.”

Rebecca MacKinnon is also speaking in the session, “Everything We Know About Internet Shutdowns,” on Wednesday March 29 at 12pm, in “Palace Ballroom I, Ground Floor.”

The full conference program is available here. Our team will be at RightsCon for the entire conference, so feel free to get in touch if you’d like to connect: info@rankingdigitalrights.org.

Can the internet sustain human rights?

People around the world increasingly rely on the internet and digitally networked devices in all aspects of their lives. But do we have a global information ecosystem in which future generations’ rights can be respected?

Unfortunately, the answer is “no,” according to our research. Ranking Digital Rights (RDR) on March 23 launched its 2017 Corporate Accountability Index which ranks 22 of the world’s most powerful telecommunications, internet and mobile companies disclosed commitments and policies affecting user’s freedom of expression and privacy. Findings showed that companies did not disclose enough information about policies affecting users’ rightsand as a result most of the world’s internet users lack the information they need to make informed choices.  

Click image to watch video of the full event. (Photo by Niels ten Oever)

“There is tremendous room for improvement by all companies,” said project director Rebecca MacKinnon, despite positive steps by some companies since organization released its inaugural Index in 2015. Only two companiesGoogle and Microsoftscored more than 60 percent on this year’s Index, with the remaining 20 companies evaluated receiving failing grades.

This year’s Index included an evaluation of the “mobile ecosystems” controlled by Apple, Google and Samsung. Findings showed that Apple’s iOS, Google’s Android, and Samsung’s implementation of Android all offered poor disclosure of policies affecting users’ freedom of expression and privacy. This is a particular concern given that most of the world’s new internet users are coming online with smartphones.  

MacKinnon also highlighted that companies overall struggled to disclose policies affecting users’ freedom of expression. For example, all telecommunications companies evaluated had insufficient disclosure on their policies for responding to requests for network shutdowns. Telefónica and Vodafone tied for the highest score on this indicator, but these companies still fell short. None of the telecommunications companies evaluated provided any information on the number of network shutdown requests with which they complied.

Companies that disclosed data breach-related policies.

While companies tend to focus more on privacy and security than freedom of expression, there are nonetheless serious gaps. On the indicator measuring company disclosure of their policies for responding to data breaches, only three out of all 22 companies evaluated, disclosed any information. This is troubling given recent news of various high-profile data breaches, and this issue is of particular concern for users and investors alike.

MacKinnon was joined for a panel discussion by Melissa Brown, Partner at Daobridge Capital and Arvind Ganesan, Director of Business and Human Rights at Human Rights Watch. Moderating the discussion was Niels ten Oever, Head of Digital at Article 19, and Open Technology Institute Director Kevin Bankston.

Panelists discussed whether rankings like the Index can motivate companies to change their policies make policy change. Does highlighting differences in company performance promote competition and a “race to the top”? Do companies that perform better do so because of their business models, because they have been exposed to public scrutiny for longer, or because of other factors?

As speakers noted, there have already been some improvements since the first Index in 2015. Bankston pointed out that in the 2015 report, not a single company received any credit for disclosure of data about content takedowns due to the company’s terms of service enforcement. In the 2017 Index, three companies received some credit on this indicator, and just this week Twitter released its latest transparency report, for the first time including some data on terms of service takedowns.

“With that domino falling, if the trend goes the way it usually does, this is going to become a common practice in the next five or ten years, and that will be due in no small part to the work of Ranking Digital Rights,” said Bankston.

Many people in the audience were concerned about poor company disclosure of the user information they collect, share, and retain. “If someone built a profile on me based on my use of Google, Facebook, AT&T, and my iPhone ecosystem, what kind of profile could be built about me? I need to have enough information that I have some sense of that so that I can then make informed choices. And right now, people are much too far in the dark on that.” One person asked whether it is harder to get companies to change when opacity about the handling of user information is connected to companies’ business model. Another audience member who works for  a company not covered by the Index responded: “If you don’t have people trusting you, you don’t have a business.”

The impetus for change can come not only from civil society activists and policymakers but also from investors. As Daobridge’s Capital’s Melissa Brown pointed out, investors are not monolithic:  some focus on human rights issues in general but few truly understand digital rights issues. However, Brown believes that the Index shows the extent to which “companies are outsourcing privacy and security risks to users,” without giving users enough information to understand or protect themselves against the risks. Over the long run, privacy and security will become “increasingly material” to investors, Brown said.

Fortunately, the Index provides a roadmap for companies to improve. Of course, the 2017 Index is just the beginning of the conversation. We look forward to continuing this dialogue, starting with RightsCon in Brussels next week!

A webcast of the event is available here.

The Ranking Digital Rights 2017 Corporate Accountability Index is now online!

The 2017 Ranking Digital Rights Corporate Accountability Index finds the world’s most powerful internet, mobile and telecommunications companies leave users in the dark, failing to disclose key information about policies affecting users’ rights.

Tune in here at 9:30am ET (13:30 GMT) to watch the 2017 Index launch event at New America in Washington, DC. You can also join the conversation on Twitter by following @rankingrights and by using the hashtag #rankingrights.

According to the 2017 Corporate Accountability Index, top companies fail to disclose key corporate policies and practices affecting freedom of expression and privacy. While some companies have improved since they were first evaluated in 2015, most of the world’s internet users do not receive adequate information about how companies’ policies affect what users can or cannot say online or who is tracking them. Ranking Digital Rights analyzed a representative group of 22 companies whose products and services collectively are used by over half of the world’s 3.7 billion internet users. It builds on the 2015 Corporate Accountability Index, which found widespread failure by companies evaluated to disclose key information about their policies and practices affecting freedom of expression and privacy.

Companies were assessed on 35 indicators in three categories: Governance, Freedom of Expression, and Privacy. This methodology was revised since the 2015 Index, following an extensive review and consultation process. It also includes new indicators, focusing on company disclosures related to issues such as network shutdowns and  data breaches.

Selected findings include:

Top scores: Overall, Google ranked highest among 12 internet and mobile companies, followed closely by Microsoft. They were the only two companies to score over 60 percent.

The U.K.-based Vodafone and U.S.-based AT&T tied for first place among 10 telecommunications companies, despite significant gaps resulting in scores of less than 50 percent.

Mobile ecosystems: Six new companies were added to the 2017 Index, including Apple and Samsung, which control the world’s largest mobile ecosystems.

Apple ranked seventh among the 12 internet and mobile companies evaluated, with an overall score of only 35 percent, despite the company’s strong public stand for users’ privacy rights in the face of recent U.S. government demands. A major reason for Apple’s relatively low score was lack of disclosure about commitments and policies affecting freedom of expression. Also, next to its U.S. peers, Apple disclosed little about how or whether it has institutionalized commitments to protect users’ rights. Samsung ranked ninth out of 12 companies in the same category, scoring only 26 percent.

Given that most of the world’s new internet users are coming online through smartphones it is especially troubling that companies controlling the world’s mobile ecosystems do not clearly disclose policies affecting users’ freedom of expression and privacy. We hope the Index will lead to greater corporate transparency across the industry, thereby empowering users to make more informed decisions about how they use technology.

Other highlights of the 2017 Index:

  • Freedom of expression is getting short-changed. How do the company’s actions affect our ability to publish, transmit, or access content? With a couple of notable exceptions, most companies disclosed the least amount of information about policies that affect users’ freedom of expression.
  • Handling of user information is opaque. How and for what purpose is our information collected, shared, retained, and used?  If somebody were to build a profile on us using this information what would it look like? Companies don’t disclose enough for us to understand our risks and make informed choices.
  • Security commitments lack sufficient evidence. Is a company making maximum efforts to keep our information secure? While we don’t expect companies to reveal security information that will help attackers, they need to provide clearer evidence that their security policies and practices are robust enough for us to trust them with sensitive information.

The Index also includes practical recommendations for steps that internet and telecommunications companies–as well as other companies throughout the sector–can take to improve. These include:

  • Provide concrete evidence that the company has institutionalized its commitments. While it is important for company leaders to demonstrate strong personal commitments to users’ rights, it is even more important that such commitments be clearly institutionalized. Otherwise, how do users know whether policies and practices will change or stay the same after key individuals leave the company?
  • Explain to users why speech, access to information, or access to service may be blocked or constrained. Who has the ability to ask the company to remove or block content or otherwise restrict speech? How does the company handle these requests? Are there effective grievance and remedy mechanisms? Companies must be transparent and accountable about the circumstances under which access to a service may be denied, or content is restricted or blocked.
  • Demonstrate a credible commitment to security. Companies should maintain industry standards of encryption and security, conduct security audits, monitor employee access to information, and educate users about threats. These policies and practices should be disclosed to users.

To view and download the complete reportincluding in-depth analysis and “report cards” for each company—as well as raw data files and other materials, visit rankingdigitalrights.org/index2017.

The 2017 Index website and data visualization were developed in partnership with the SHARE Foundation, a digital rights NGO.

Ranking Digital Rights Partners with Consumer Reports to Set Standards for Privacy and Security

We are thrilled to announce Ranking Digital Rights’ participation in a new collaborative partnership with Consumer Reports and several other leading privacy, security, and human rights organizations to develop a digital standard to measure the privacy and security of products, apps, and services.

The goal is to help companies prioritize consumers’ data security and privacy needs, and to help consumers make informed choices. The first version of the standard was unveiled today at https://thedigitalstandard.org.

The digital standard draws from the Ranking Digital Rights research methodology along with other technical testing and research methodologies developed by Disconnect and the Cyber Independent Testing Lab with assistance from our friends at Aspiration.

As a part of today’s launch, the coalition behind the new digital standard is inviting broader input and collaboration from a range of stakeholders to help develop and improve the new protocol. Click here to review the proposed criteria for evaluating software, services, and devices and to find out how to contribute to the standard via GitHub.

We will be talking about the standard and how it was developed at South by Southwest (SXSW) in Austin, TX on March 13th at 9:30am and look forward to many more discussions over the coming months.