The European: Mr. Bar, with the Ranking Digital Rights project, you’re working to rank globally operating technology companies in terms of how well they honor the human rights of their users. Where did this idea come from?
Allon Bar: The idea originated with a few people around Rebecca MacKinnon, the project’s founder and director, who’s based in Washington, DC at a think tank called New America. She’s written a lot about what technology companies are doing in this area with respect to human rights. Also, how they deal with situations such as working in an authoritarian country and having to deal with government demands when it isn’t always clear if they are in place for legitimate reasons or if they are meant for political persecution. Coming out of that experience, Rebecca and a few others saw an opportunity to try to encourage companies to do better on these issues, not just through advocacy or research, but to actually try to give insight into how companies measure up to each other on a comparative scale. So that’s how the idea originated, and that’s also what we’ve been trying to do since.
The European: How long have you been working on the ranking?
Bar: The project has been around for a bit longer than two years, without any actual ranking being published. Just creating the ranking system was actually very time-consuming and intense. We want to ensure that what we publish will actually be meaningful, will be verifiable by others, will provide useful insights, etc. So we’ve been tailoring the methodology to that. We’ve been doing case study research in lots of countries, and we did a pilot on a few companies last year. And this year, we’ve finally started to do the research for the first public ranking, and we will publish that ranking in November.
“A ranking can provide them with concrete steps they should be taking to do better”
The European: And who do you expect will benefit from the existence of a corporate digital human rights ranking?
Bar: Mainly, we hope that individuals’ human rights when they use technology will be protected in a better way. With the direction that some things are taking in the world, this means stopping a negative trend that is occurring concerning how people’s right to free expression and right to privacy are being treated. We are trying to target a number of different stakeholders with the ranking. One group is the companies themselves. We hope to give them insight into what they should be doing. We’re setting standards, and we’re measuring them on those standards to make clear exactly they could be doing to improve their practices. Now they say, “oh, we’re doing this, we’re doing that,” but a ranking can provide them with concrete steps they should be taking to do better. Another group of stakeholders who will benefit are obviously users themselves, who may want to know which of these companies is more likely to respect their rights than others. We’re also targeting responsible investors, who are also increasingly taking an interest in human rights issues. Then there are advocacy groups, who are campaigning for human rights issues, but don’t necessarily have the data about company practices to substantiate their campaigns. And finally, we think the ranking will be useful to policymakers, who are making regulations and laws based on the reality that they are seeing, but who might only see some of reality without some sort of measurement.
The European: What are the criteria you use?
Bar: Privacy and freedom of expression are the two key rights we’re focusing on. These are the rights that we feel have the strongest connection between how technology companies operate and how users’ rights are being treated. Our ranking is focused on company transparency: what the company is saying they are doing. It’s hard to measure company practice, because we can’t really go into the headquarters of the company and see what is actually happening there. But what we are measuring is what companies are disclosing. The focus of our ranking in this stage is strictly on internet companies and telecommunication companies. Next year, we want to include network equipment manufacturers, device manufacturers and software producers.
“We can only go by what companies are publishing”
The European: So, if you can’t determine practice, how can you measure transparency? How can you be sure the companies’ practices are in line with what they’re disclosing?
Bar: It is a challenge, for sure. But some things we can measure. We ask questions in our methodology. For example, what kind of data does the company collect? In our pilot, we had questions like does the company say what data they collect, how they collect it, how they share it, etc.? Now, for the public ranking, we’re also including an answer category that says they’re not collecting any data. Or they’re not sharing any data. So companies that are transparent but aren’t doing the best thing will not get the same rating as companies that are transparent and are doing a better thing. But it is a challenge sometimes to come up with criteria that we really think are important and that we can verify publicly.
The European: In addition to the publicly available data you’re using for this project, are there other kinds of data that you also think are important for digital rights, that you would like to include but can’t for logistical reasons?
Bar: Yes, there are some things that we would like to know better about companies’ internal polices, and we can only go by what companies are publishing, for example whether a company has a policy in place to deal with requests from government agencies for user data or for taking down content. We can only assess whether a company publishes a process for this, so that users can understand what would happen if such a situation were to occur. But we don’t know what their internal practices are. There are some other practices where public information hasn’t been sufficient. Net neutrality, for example. Do internet service providers somehow degrade or prioritize certain services or websites as a way to encourage some companies to pay more for their services? There are projects and experiments around trying to measure that. We don’t have the capacity to do that on a global scale for the number of companies that we’re including in our ranking.
“We’d love for local groups to pick this up and do rankings of their own”
The European: Is there any way to bridge the divide between your capacities and other areas you’d like to see covered?
Bar: Yes, this ranking that we’re creating will not stand on its own. We’re focusing on globally active technology companies, so not only European companies or American companies, but companies that do business around the world. This means we’re looking only at the largest companies. But companies that operate only nationally or regionally should be no less obligated to respect users’ rights. We’d love for local groups to pick this up and do rankings of their own. Our methodology is open source, people can use it as they see fit, they can take part in it or not. But we think the standards we’re setting are helpful. We’ve talked to civil society groups around the world, and they do seem interested in applying the approach within individual countries. So ideally, we will soon have local counterparts evaluating companies active at a national level.
The European: What have you found companies’ responses to the rankings project to be?
Bar: I would say increasingly positive. In the beginning there was more hesitation, and now the response I see around the project is that companies are engaging more and more with us and are interested in seeing what we come up with. As I said, we did a pilot last year, and we sent out our preliminary results of our research to companies. Some did not respond to us at all. Others were interested, but did not want to take the opportunity to write feedback. There were quite a few companies that were very interested in providing feedback and saying, we think you should have included this data that we have, or this policy that we implement, etc. So, companies seem to be paying attention, that’s one thing. They seem interested in the ranking generally. We’ve also heard of several cases where champions within companies have found that the ranking is very helpful to them. They’re trying to advocate for certain polices within the company, and with our ranking and our measuring these things, they have ammunition to push for a change, to advocate better policies. So in that sense, it’s increasingly positive. But there definitely are also still companies that aren’t participating and are totally disinterested in rankings.
“Even though people’s consciousness is increasing, that does not necessarily mean that they will change their behavior”
The European: You’re someone who thinks about the idea of digital rights presumably every day and interacts with a lot of people who are already interested in this topic. Do you have a sense of whether the broader public is aware of digital rights being an important aspect of human rights in general?
Bar: I do think that issues of human rights and how people are experiencing them when they use technology are getting a lot more attention in the public space. And that’s both in the media and also in terms of how consumers in general—the person who is using the technology—is thinking about things. What people working on public attitudes have encountered is that, even though people’s consciousness is increasing, that does not necessarily mean that they will change their behavior. That is, if people realize that what they’re doing digitally is being exposed, or their data might not be safe or will be handed over to advertisers, it doesn’t necessarily mean that they’ll no longer want to use that service or technology. That is a huge challenge, even, for example, if you’re training human rights activists on how to use technology safely. You have to convince them that it’s important they use the right tools so that their data’s not exposed to government agencies in a way that puts them at risk. It’s an even greater challenge with the general public.
The European: Is that pattern changing with time?
Bar: Public responses to things like the Snowden revelations and other disclosures by companies have shown these things do worry people. I do think that means there is a fertile ground in this area for people wanting to see how they can improve. I think it also means that there is an interest on the companies’ side to improve how they do on privacy and freedom of expression issues. And that is obviously what we’re aiming for: that companies improve their practices. Companies’ recognition of this being an increasingly important issue is something that we’re hoping will continue to rise.
“The key thing is that human rights are something that every individual around the world is entitled to”
The European: Do you think that there’s a difference in practices culturally—either because of the culture of a company or the company’s concerns about the users’ reactions—in different geographical areas?
Bar: There are different sorts of effects that you see. For example in Europe, attention to privacy is greater than in the United States. That is, in terms of legislation, companies focus on privacy issues a bit differently here than do some American companies. So I think there is a difference. Whether that’s the company’s intent, or whether it’s just a difference in regulatory environment that causes companies to behave a certain way is hard to say. In terms of countries that are authoritarian, you see a stronger difference, because companies often can’t really make a public case for freedom of expression or privacy in the same way, and there’s often a much closer working relationship between the company and the state. So in that case, the public expectation of what the company is doing is a different one from what we’d expect here in Europe or what you would expect in the United States.
The European: And that’s reflected in company practices?
Bar: Often. The key thing is that human rights are something that every individual around the world is entitled to. So whether a company is operating in China, or the United States, or Europe, or Kenya, or Latin America, users’ rights should be respected, and we are encouraging companies to behave in such a way irrespective of where they operate. Sometimes it’s easier for a company to be respectful of privacy when they’re active in Europe or the United States, and in other environments their behavior is not necessarily the same as it is there. We’re trying to encourage them to follow that high standard everywhere, to provide transparency about their policies everywhere. In some countries, when you sign up for a cell phone subscription, you don’t know what the privacy policies are, and we want everyone to be able to know the details of the practices that affect their digital rights.
The Ranking Digital Rights project’s rankings will be released in November. Information about the companies included in the ranking and the methodology will be made available on the project’s website shortly.
Did you like the conversation? Read one with Kasha Jacqueline Nabagesera: “Many people want me dead”