The right to freedom of expression includes the right to access online communication; the right to seek, receive, and impart information online without arbitrary restrictions; and the right to communicate privately or anonymously online.

To protect and foster these rights, governments should adhere to the following principles in their policies toward the Internet:

(1) Ensure the international right to freedom of expression generally, and ensure that all regulations pertaining to electronic communications comport with that right.

All legislation, policies, and practices, including those that pertain to the Internet, should be consistent with the universally recognized right to free expression. The International Covenant on Civil and Political Rights, which has been ratified by all but five countries in the region, guarantees to every person "freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice."

Many countries of the region have press laws and penal codes that invite abuse of the right to free expression in various ways. Internet regulations in Tunisia explicitly extend criminal penalties for defamation and false information to online speech; Internet users in Qatar are subjected to a vaguely worded requirement in their service contract that they refrain from "carry[ing] out any activity which is contrary to public order." Jordan and Morocco, meanwhile, have no Internet-specific laws restricting free expression; however, both have laws that curb press freedom, and those laws, such as the ones that prohibit defaming or disparaging the monarchy, narrow the boundaries of what can be expressed online.

(2) Access to the Internet to receive and impart information is integral to the right of free expression.

Governments should take appropriate measures to facilitate affordable access to all without discrimination to online means of communication. For example, Syria, where selected state institutions are connected to the Internet, should move rapidly toward making access available to ordinary citizens.

(3) Censoring mechanisms, if used, should be in the hands of individual users, not governments.

End-users should have the sole responsibility in deciding if and how to filter or block online content for themselves and their non-adult charges. Governments should abolish or avoid regulations that empower official agencies to block online content.

Users, if they wish, can choose from a wide range of free or inexpensive software ("censorware") that filters content accessed from the World Wide Web. They can also purchase modem locks and other devices to prevent unsupervised access by their children.

The governments of Tunisia, Bahrain, Iran, and the United Arab Emirates are among those that block selected web sites dealing with politics or human rights, thus preventing users in their respective countries from accessing them. This form of censorship violates the rights of people to receive and impart information and should be halted immediately.

(4) Common data carriers, such as Internet service providers, generally should not be liable for Internet content.

Laws assigning liability for online content should target the content originator (for example, the author) and not the carrier or conduit (such as the Internet service provider or owner of a computer through which content was transmitted). Laws targeting ISPs impose a heavy and perhaps technically impossible burden on the data carrier, one that is incompatible with protecting the right to freedom of expression online.

Tunisia requires ISPs to designate a director who "assumes responsibility, in accordance with the...press code, for the content of pages and Web pages and sites that the ISP is requested to host on its servers." The decree states that ISPs must allow nothing to "remain" on their servers that harms "public order and good morals." This type of legislation runs counter to the principle of free expression online by imposing a regulatory burden on ISPs that--to the extent that it is even feasible given the nature of data flow online--forces them into the role of censors on behalf of the state.

(5) Strong encryption should be available to individuals.

Individuals should be able to send and receive encoded or encrypted communications. They should not be compelled to obtain authorization to do so; nor should they be compelled to provide in advance to third parties access to encoding "keys" or other mechanisms that would permit the decoding of their communications. Countries that currently bar unauthorized encryption include Israel, Saudi Arabia, and Tunisia.

(6) Government surveillance of electronic communications should not infringe unduly on the right to privacy and other civil rights, and should be subject to the requirements of due process and judicial supervision.

One argument against controls on encryption is that governments retain other effective law enforcement tools, such as surveillance, search, and seizure. However, these should always be used in conformity with international human rights law and the requirements of due process. In particular,

• Investigations or surveillance in public online forums should adhere to international standards protecting the rights to freedom of association and political activity. Such guidelines should be made public.
• Governments should not monitor individual Internet users for civil or criminal investigatory purposes or collect information on the way they use the Internet, except pursuant to a judicial process and judicial oversight that is consistent with internationally recognized principles of privacy.
• Governmental searches or seizure of electronic communications should be conducted pursuant to legally authorized procedures that require there to be sufficient evidence that the user is engaged in illegal activity to justify the search. Any such search should be conducted under judicial supervision.

• Any search should be narrow in its scope and effect.⁽¹⁾

(7) Individuals should have the right to communicate and receive information anonymously.

Regulations should not unreasonably require identification of persons when they access the Internet or exchange information and opinions online. ISPs should, wherever practicable, preserve the right of users to access the Internet anonymously.

Legislation in Tunisia requires Internet service providers to submit the names of their clients to the government on a monthly basis. Such a disclosure requirement constitutes by its sweeping nature a violation of the right to seek, receive, and impart ideas anonymously.