Draft law would criminalize online protest, remove checks on surveillance