Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Google, Microsoft, Yahoo & Others Nearing Completion of Online Human Rights Code

Document is designed to set IT standards for users' rights to privacy, freedom of speech

The group of companies that promised to write an online code of human rights for Internet users in 2006 is close to completing the document.

In a letter to two U.S. senators about the human rights code, Yahoo's top legal executive said earlier this month that the group is "working as swiftly as possible" on the code and gave a rough idea on how it will be implemented.

Back in January 2007, Google, Microsoft, and Yahoo led a group of IT companies that promised to "produce a set of principles guiding company behavior when faced with laws, regulations and policies that interfere with the achievement of human rights." The idea was to create a code of conduct that would help companies do the right things in protecting user privacy and provide a method to resist censorship and jailing of bloggers and political dissidents by governments.

If the code is accepted and widely adopted, it could change some enterprises' privacy policies and make it more difficult for corporations or governments to duck through loopholes in rapidly changing and frequently outdated laws, observers say.

In his letter of Aug. 1, Samway gave an outline of the code's basic principles.

"[These will] provide direction and guidance to the [IT] industry and its stakeholders in protecting and advancing the enjoyment of freedom of expression and privacy globally," he said. "The Principles describe key commitments in the following areas: Freedom of Expression; Privacy; Responsible Company Decision Making; Multi-Stakeholder Collaboration; Governance, Accountability & Transparency."

The group will not only define the principles, but also a method of verifying compliance, as well the means for holding companies accountable "through a system of independent assessment" if they don't comply, Samway said.

The code appears to focus most heavily on the practice of censoring Internet content, as well as on recent instances of legal or criminal action being taken against bloggers who speak out against their government. However, the more thorny question has to do with the rights of government or corporations to monitor users' online behavior, which is a common practice by both groups today. Samway's letter gave no indication on how the group will codify such practices.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused att...
PUBLISHED: 2021-05-16
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the othe...
PUBLISHED: 2021-05-16
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
PUBLISHED: 2021-05-16
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
PUBLISHED: 2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.