Colombia’s sprawling spy network a threat to freedom

Key Findings

— Freedom of speech is guaranteed offline and online
— A widespread state surveillance network inhibits freedom
— Strict copyright laws are sometimes used as a means of censorship
— Government institutions must act fast to protect data

In recent decades, nothing has shaped Colombia more than the violent struggle between left-wing guerrillas, state armed forces and paramilitaries. Amid the fighting, the protection of digital rights was among the areas neglected. During the worst of the conflict, a surveillance apparatus was set up in Colombia, the exact scope of which remains unknown. “The Intelligence and Counterintelligence Act restricts freedom of expression in an indirect way,” says Amalia Toledo of Karisma Foundation, a civil society organization based in Bogotá that has been working on digital rights for years. The law grants authorities unfettered access to spy on citizens without a judicial order, like monitoring the electromagnetic spectrum. In 1993, a law was introduced that prohibits the use of “communication devices that use the electromagnetic spectrum” to send “encrypted messages or in unintelligible language.” However, so far it is not known whether this particular law has had an impact on digital communication in practice.

Office NGO Karisma Foundation

Other controversial provisions require Internet providers to create a ‘back door’ for the prosecutor's office to access user data. That’s on top of rules requiring providers to store connection data for five years. Throughout the legal code, the legacy of the civil conflict looms. 

There is plenty of evidence that illegal surveillance is a reality in Colombia, particularly for those seeking to scrutinize the powerful. In particular, journalists investigating corruption and irregularities within state security institutions have been subject to online (and offline) monitoring. The practice extends beyond the media. The communications of the individuals negotiating the country’s peace agreement were also intercepted, allegedly by elite army cyber-spies. It has been also revealed that the National Colombian Police purchased malicious software from "HackingTeam", an Italian firm specializing in intrusion. Journalists have claimed that the software was used to spy on them.  

In Colombian society, state surveillance is seldom questioned; it was generally viewed as legitimate because of the conflict situation. The capabilities of the surveillance state apparatus can at times make it challenging to protect journalistic sources. In 2017, the Colombian Supreme Court ruled that a business magazine had to reveal its sources for an article about “apparent irregularities” by Leyla Rojas, a former vice minister of water who at the time was responsible for sustainability at a coal project owned by a Brazilian business magnate. After a fierce backlash, another chamber of the court ruled in favor of the publicationand stated that journalistic work "is an exercise of the right to freedom of expression and information and, as such, democratic, legitimate and adjusted to the Constitution.” 

Free speech guarantees

Leaving aside the challenges of the conflict, the outlook for freedom of expression in the country is not bad. In 2012, the Colombian Constitutional Court said that freedom of expression — as granted in Article 20 of Colombia’s National Constitution — applies not only offline but also in the online world. Although there are no Internet or media specific laws in Colombia, a legal framework that guarantees the fundamental rights of its citizens in the digital sphere does exist. This is backed by Colombia's membership of the inter-American human rights system. The Inter-American Court of Human Rights, as its judicial organ, has also defended digital rights. It is one of the few countries globally, where Freedom House found no “key Internet controls.” In its latest “Freedom on the Net” report, Colombia is rated as “partly free.” According to the organization, “prosecution, imprisonment, or detention for ICT activities is quite rare in Colombia.” That means that everyone can, in principle, freely access information on the Web and publish content without restriction.
 

Censorship challenges

Although the situation is positive in many respects, there are still problems in exercising the right to freedom of expression. A climate of threat can lead to self-censorship and other constraints. In places where no government censorship exists, other means are often deployed to suppress unwanted stories. In Colombia’s case, it has been private actors rather than the state who have sought to censor, relying on Colombia's harsh penalties for copyright infringement. In recent years, one case in particular has attracted widespread attention: student Diego Gómez faced up to eight years imprisonment for uploading an academic thesis to the Internet. Although Gómez did not personally profit, the author of the thesis pushed for a criminal prosecution. In 2017, however, the Supreme Court finally ruled in favor of the accused — and thus against an abuse of copyright law.

In other cases, the ‘right to be forgotten’ has been used to make unwanted material disappear. Although there is no specific law yet, the Colombian Supreme Court has ruled on this issue, concluding that, in some instances, the right to honor and privacy carried more weight than the right to publish. The court ruled it was not the search engines that were responsible for removing the content, but the media producers, who were required to update their texts and, if necessary, have them removed from the index of the search engines. Since then, more and more individuals have sent media outlets intimidating letters in order to demand unfavorable stories be removed. “However, the so-called 'right to be forgotten'’ has no legal basis and the relevant jurisprudence is not uniform,” states the press freedom organization Flip, which advises media groups on how to defend themselves against such claims. 

There have also been problems with the big tech companies. On some platforms, political content has been blocked for reasons that are not always clear. In the case of YouTube, there have been reported cases of blockades because of copyright issues, explains Pedro Vaca from the Foundation for Press Freedom (FLIP). There have also been reports of political satire being removed from Facebook, with the platform describing it as “inappropriate content” on the basis of their internal guidelines, he says.

Data protection

It is not just about private companies when it comes to data protection. There is a data protection law, but in practice it has been inadequate. The business-focused Chamber of Industry and Commerce is the body responsible for regulating the law. Critics say it is not an organization that pays special attention to human rights aspects when it comes to data protection. Amalia Toledo of the Karisma Foundation says mobile operators are not scrupulous enough in protecting their customers' data. This also applies to mobile phone registrations: the files of the mandatory IMEI registration are stored in a central database operated by a private company. According to the Karisma Foundation, data protection standards are especially poor when it comes to data collected by government entities. Toledo says there is no oversight of government programs and that government websites often have glaring weaknesses in terms of cyber security.

But as a civil society organization, Karisma Foundation is trying to take a constructive approach. Working with the government, it has begun to analyze official websites such asthe Unit for the Attention and Integral Reparation to the Victims to see whether they comply with the requirements of the Data Protection Act, whether the website is digitally secure, and how robust privacy protection practices are. In that specific case, they were able to ensure that the shortcomings discovered were quickly rectified. Toledo and her colleagues want to continue the struggle, so that digital participation is not endangered by technical pitfalls.

What experts say

Amalia Toledo, Karisma Foundation, Bogotá

Although the foundation is one of Colombia’s leading digital rights groups, Toledo says that it can sometimes be difficult for her and her colleagues to emphasize how important their work is. “This country does not have a conscience when it comes to protection of the private sphere. For example, people are accustomed to giving their fingerprints everywhere,” she says.

Pedro Vaca, Executive Director Foundation for Press Freedom (FLIP)

Journalists in Colombia don't care enough about their digital security, says Vaca. “They are definitely not prepared, although their daily work is associated with great vulnerability.” He says a main problem is that digital security is only seen as an issue when it's too late. And he also sees mistakes made by the organizations offering training in this field. They mostly just offer short seminars on digital security. “We have to see it more as a process. A child doesn't learn to read in a day, either.”

Recommendations

— Fighting excessive government surveillance
Civil society should strengthen its oversight of government surveillance, and its efforts to reign in the excessive use of it, as it endangers the fundamental rights of citizens.

— Data protection in every field
Many Colombians are skeptical of card payments or online shopping, due to data protection concerns. Yet they do not question the widespread collection of fingerprints. There is, therefore, a need for better awareness and clarification of what data is actually worth protecting and for which reasons — so that political consequences can follow.

— Promoting digital self-defense
As even particularly vulnerable groups such as social activists and journalists do not have sufficient knowledge of digital security measures, more long-term and comprehensive training programs should be introduced.

The #speakup barometer is a DW Akademie project that examines the connection between digital participation, freedom of expression and access to information. Learn more at www.dw.com/barometer