6 min read

THE ONLINE REGULATION SERIES 2021 | KAZAKHSTAN

Fred McDonnell Dec 20, 2021 12:59:32 PM

News Online Regulation

THE ONLINE REGULATION SERIES 2021 | KAZAKHSTAN

The regulatory environment in Kazakhstan poses high barriers to entry for foreign entities and domestic companies with no state ties, and places significant restrictions on the creation and circulation of user-generated content online. Many of the country’s key regulatory frameworks are designed to restrict or block illegal content, with regular demands on companies to remove content considered to be extremist in nature. Freedom House has noted that with wide discretion to determine what constitutes extremist or illegal content, but without a clear legal definition, political opponents and promoters of unsanctioned religious groups are vulnerable to censorship and prosecution. Freedom House and human rights organisations have also critiqued Kazakhstan for undermining freedom of expression and privacy online in its attempts to regulate telecommunications and online platforms with the use of extensive government oversight, and for substantial state involvement in domestic information and communications infrastructure. ^[1]

Key regulatory frameworks

The Mass Media Law, 1999, amended April 2019, concerns media intended for a national audience, and establishes the state’s guarantee of freedom in accordance with the Constitution.
Kazakhstan's Communications Law, 2004, provides for the lawfulness of communications in Kazakhstan. The Law determines the powers of state bodies to regulate communications, as well as the rights and obligations of both users and providers of communications services.
The Law on Informatisation, 2015, provides for the state support of the industrial development of information and communication technologies.
Kazakhstan’s Criminal Code, 2014, amended in 2016, prohibits acts of and support for terrorism and extremism in Articles 174 and 405.
The "Anti-Extremism and Terrorism" Law, January 2017, establishes new punishments for sharing the beliefs of religious communities unlicensed by the state, and provides for the censorship of religious literature as well as controls on pilgrimage abroad. ^[2]

Proposed legislation

In September 2021, Kazakhstan’s parliament approved a bill requiring owners of foreign social media and messaging apps to establish a physical presence in the country or risk being blocked, in an effort to streamline the handling of official requests to remove illegal content. Local offices must be headed by Kazakh citizens. Though the bill’s purported aims are to prevent cyber-bullying and the spread of prohibited content, critics have accused authorities of seeking to add another level of surveillance. ^[3]

Main regulatory bodies

The Ministry of Information and Social Development (MISD) oversees mass media, including online content. The MISD determines the procedures for restricting access to illegal content and keeps a register of internet resources that have published such content. ^[4]
The National Security Committee (NSC) monitors presidential, government, and military communications.
The Kazakhstan Association of IT Companies is the officially recognised administrator of the “.kz” domain. Though it is registered as an NGO, it is 80% government-owned.

Key takeaways for tech companies

Kazakhstan’s Criminal Code, Article 405, prohibits "organising or participating in the activity of a social or religious association” or of other banned extremist or terrorist organisations.
- Article 174 of the Criminal Code prohibits the "incitement of social, national, clan, racial, or religious discord, insult to the national honour and dignity or religious feelings of citizens, as well as propaganda of exclusivity, superiority or inferiority of citizens on grounds of their religion, class, national, generic or racial identity, committed publicly or with the use of mass media or information and communication networks, as well as by production or distribution of literature or other information media, promoting social, national, clan, racial, or religious discord".
The Mass Media Law states that all internet resources, including websites and pages on social media platforms, are considered media outlets.
- The Prosecutor General’s Office is authorised to order ISPs to block content without a court order, and there is no discretion for an ISP to reject the order. The NSC has the right to suspend access to the websites or information they host, and to only notify the Prosecutor General’s Office and regulator afterwards.
- Web publishers, including bloggers and social media users, are liable for the content they post, but it is not specified whether publishers are responsible for content posted by third parties. Under this law, all forms of mass media are deputised by the state to counter terrorism by disclosing data promoting or justifying extremism or terrorism. ^[5]
Kazakhstan's Communications Law obliges Internet Service Providers (ISPs) to monitor content passing through their networks and to decide whether to restrict prohibited material. The law does not specify how ISPs should carry out this obligation, but fines are imposed if ISPs do not comply. Once prohibited content is identified, ISPs and the State Technical Service (STS) must suspend access to the website or page within three hours.^[6]
There are a number of regulatory obstacles that restrict materials. If ISPs fail to block content in a timely manner, the STS restricts access directly and may issue fines. ^[7]
According to the Law on Informatisation, in order to operate in Kazakhstan, owners and other legal representatives of a foreign online platform must undergo state registration as a legal entity or a branch of foreign legal entities.
- Foreigners may not act as heads of local branches. Upon receipt of an order from the Kazakh government, the branch of the foreign online platform must implement it within 24 hours by either deleting content or limiting its distribution. ^[8]

Tech Against Terrorism’s Analysis and Commentary

Concerns for freedom of expression online

According to Freedom House, Kazakhstan’s government uses a number of provisions in the criminal code to restrict forms of online expression that may be protected under international human rights standards. Freedom House has additionally noted that the vaguely worded legislation provides space for legitimate speech, such as criticism and opinions, to be categorised as defamation or extremism. Furthermore, Kazakhstan’s efforts to counter violent extremism and terrorism depend heavily on the enforcement of criminal law.

Many online platforms, in particular messaging apps, are often blocked
ahead of protests or elections to prevent users from accessing group chats
to coordinate protest actions. ^[10]

Provisions on proactive monitoring of content

Kazakhstan's Communications Law obliges ISPs to monitor content passing through their networks and to decide whether to restrict prohibited material. Though the law fails to specify how ISPs should carry out this obligation, fines are imposed when ISPs do not comply. Furthermore, once illegal content is identified, ISPs and the STS must suspend access to the website or page within three hours. ^[11]

As Tech Against Terrorism has noted throughout the first and second edition of the Online Regulation Series, including in our recent entry on Russia and Indonesia , an increased reliance on automated moderation solutions raises the risk of false positives in taking down content that is legal, and raises questions about the accountability of removal decisions. Such reliance can, when coupled with a lack of guidance on carrying out the monitoring and removal obligations, the short timeframe allowed for suspending access to content, and the risk of fines, cause platforms to err on the side of over-removal and thereby endanger the freedom of expression online.

In 2019, the government tested the National Security Certificate, a
machine-in-the-middle technology enabling it to monitor users’ online
activities. Kazakhtelecom, Kazakhstan’s state telecommunications operator,
used this to regularly intercept encrypted web connections. Usually,
attacks on encrypted HTTPS connections are detectable via visible browser
warnings or other safeguards. However, Kazakh ISPs sent instructions to
users instructing them to compromise their own security by manually
trusting the certificate on their devices and browsers, thereby bypassing
built-in security checks. This two-step process of Kazakh ISPs deploying
an untrusted certificate, and instructing users to manually allow that
certificate, allowed the ISPs to read and even alter online communication
of any of their users (including user data, emails, messages, and
passwords sent over the web).^[12] In response to this surveillance, Google,
Mozilla, and Apple blocked the certificate Kazakh ISPs used for traffic
interception and thereby ensures that their users’ personal data could not
be intercepted.^[13] Though this was technically a “pilot”, this occurred again
for six days in December 2020 prior to parliamentary elections. Kazakhstan
has indicated its intention to repeat such interception in the future,
stating that its purpose was to engage in the targeted blocking of
unlawful content. However, research suggests that the targets of the
certificate included Facebook, Gmail, Instagram, Mail.ru, OK.ru, Twitter,
VK, and YouTube.^[14]

Social Media Involvement

There have been recent concerns regarding the November 2021 statement made
by the Kazakh Government which claimed that Facebook / Meta had granted
the government exclusive access to the company’s content reporting system.
This was touted as a compromise solution after Kazakhstan had threatened
to block Facebook domestically.

Kazakhstan’s statement on its alleged access to Facebook’s reporting
systems quotes the company’s regional public policy director George Chen
as saying “we are delighted to provide the 'content reporting system' to
the government of Kazakhstan, which we hope can help the government to
deal with harmful content in a more efficient and effective manner.”^[15]
However, Facebook / Meta spokesperson Ben McConaghy has since denied
claims that specific exclusive access has been granted, stating in an
email to the Reuters news agency that "[w]e follow a consistent global
process to assess individual requests - independent from any government -
in line with Facebook’s policies, local laws and international human
rights standards. This process is the same in Kazakhstan as it is for
other countries around the world."^[16]