In Colombia, the discussion about the legitimacy of using encrypted communications must start from the fact that there is already legislation on the matter.

By Juan Diego Castañeda Gómez

It is not unusual that, with attacks such as those in Paris against the satirical magazine ‘Charlie Hebdo,’ governments react by promising legislation that would increase the powers of the police and intelligence services. On this occasion, the Minister of the Interior of the French Government, Manuel Valls, said that new measures against terrorism are necessary. On the other hand, the Prime Minister of the United Kingdom, David Cameron, has proposed measures against private communications encryption, so that, “blocked areas” for security agencies should not exist.

Of course, such proposals have been criticized because, among others, the privacy of communications strengthened by encryption is an essential guarantee for the realization of the rights to privacy and freedom of expression. Interestingly, the latter was the right that occupied the media coverage of the attack on the French magazine.

In Colombia, the discussion about the legitimacy of using encrypted communications must start from the fact that there is already legislation on the matter.

In the case of encrypted cell phone communications, the legislation has two areas. On the one hand, operators can only provide encryption service to certain government officials. On the other, sending encrypted and encoded messages are banned. Let’s take a look.

The Intelligence and Counterintelligence Act (Law No. 1621 of 2013) provides that telecommunications services providers must offer encrypted voice call service to high government and intelligence officials. This means that a very small segment of the population can acquire the encryption service, leaving out, for example, journalists and human rights activists.

Moreover, since 1997, users of “communications equipment that use the electromagnetic spectrum,” besides needing a “subscription card” by the operator, have limited the use of these for personal purposes and banned sending “encrypted messages or in unintelligible language.” (Article 1, Law No. 1738 of 2014 in which Article 102 of Law No. 418 of 1997 is extended).

The text of this statute was approved for the first time in 1993 and was revived four years later. In addition, it has been continuously renewed until today (in 2014, its validity was established until 2018). In addition to this norm, others were approved in the same way, that is, without proper democratic debate or without revising the powers granted to an entity such as the National Police, which may request subscriber data, seize equipment and restrict the use of interceptors, scanners and open broadband receivers.

Some criticisms

– The sum of all powers:

First, these powers are in addition to others that have the Colombian government to fulfill its constitutional duties to pursue the prosecution and protection of citizens and public order.

Telecommunications service providers must inform the Prosecutor about the type of technology they used in order to facilitate interception of their networks. They must follow the guidelines issued by the Ministry of ICT to carry out the interception. They must also report to the Prosecutor about identification data of subscribers and keep them for five years. Finally, if required, operators must provide the information they have in their databases to geographically locate cell phone devices in “real time” (Articles 1, 4 and 5, Decree No. 1704 of 2012).

Since 2013, the intelligence agencies have the power to monitor the electromagnetic spectrum and to obtain from telecommunications service providers the “communication history” of subscribers, their identification data and, in general, any information needed to pinpoint the location of equipment. Like the Prosecution, the intelligence authorities may request the mentioned information for a period of five years.

Taken together, the power of the Prosecutor and State intelligence agencies seem sufficient to fulfill its mission. In that sense, banning the use of encryption or sending coded messages is neither necessary nor proportionate as regard to fundamental rights.

– Lack of clarity:

A big problem with these standards is that we are unclear about technologies and information included. For instance, the statute does not define what is meant by “communications equipment that use the electromagnetic spectrum” (it can range from cell phones and radios to wireless routers). Such a broad definition does not allowed to know if it is banned encrypting messages in a device, regardless of the transmission channel used (voice and/or data). In any case, beyond the precise interpretation of the notions, a statute allowing such intrusion into the privacy of communications should be much more specific.

– Measures that go unchecked:

In our analysis, we find that the proscription of encryption in Colombia exists since 1993 and has been renovated in laws passed in 1997, 1999, 2002, 2006, 2010 and 2014. This shows an almost routinely extension of the period of validity and, what is worse, without any discussion of its necessity and proportionality, despite the profound technological changes that have occurred since it was first approved. Any extensions should serve, for instance, to clarify the ambiguity in the above-mentioned notions.

In a 1995 lawsuit, it was alleged that the statute infringed the right of freedom of expression. However, the Constitutional Court ruled that the State can (1) impose rules on use of spectrum, (2) limit fundamental rights to preserve public order, and (3) that the measure does not affect privacy because it is not a authorization to conduct wiretapping without legal and constitutional requirements. Of course, at the time, technological developments were not the same and the possibility of massive and illegal state surveillance was not recognized, which facilitates the ubiquity of digital technology. Therefore, although the topic is reviewed formally, it would be worth to be re-evaluated.

As for the electromagnetic spectrum monitoring authorized in the Intelligence Law, the Constitutional Court found that the wording of the statute did not permit the interception of communications, as monitoring is an impersonal activity not targeted to specific subjects. In any case, it is unclear, for example, how can “monitored” cell phone calls in an area without intersecting it. However, for the Court this action does not require judicial authorization (Corte Constitucional de Colombia. Sentencia C-540 de 2012).

In conclusion, in Colombia is still not clear what communications cannot be encrypted nor in what sense the monitoring of the electromagnetic spectrum is not interception. 2014 will be remembered as the year of surveillance due the many scandals. But what It seems to be clear is that governments do not know how to regulate the powers we have given them.

*Translated by, Amalia Toledo