Although prosecutions for online expression are rare in Colombia, two high profile cases in 2014 and 2015 attracted national and international criticism. In one case, the courts confirmed the conviction of an internet user who posted a comment criticizing a public official anonymously on a newspaper’s website, in the first online criminal defamation case in Colombia. Another user faces up to eight years in prison under Colombia’s excessively harsh copyright laws after he posted an academic article on the website Scribd.  Although the government has taken some positive steps to prosecute illegal surveillance in recent years, evidence suggests that surveillance and violations of privacy remain widespread.

Legal Environment

Article 20 of Colombia’s National Constitution guarantees freedom of information and expression and prohibits prior restraint. This article was developed by the Constitutional Court in accordance with the standards of the Inter-American Court of Human Rights. Article 73 further provides for the protection of “the liberty and professional independence” of “journalistic activity.” Although there are no specific provisions protecting freedom of expression online, a blogger has the same liberties and protections as a print or broadcast journalist.[66] The Constitutional Court confirmed the application of such protections to the internet in a 2012 ruling.[67] In its decision, the Court stressed the Joint Declaration on Freedom of Expression and the internet, which states that “freedom of expression applies to the internet, as it does to all means of communication,” and that “restrictions on freedom of expression on the internet are only acceptable if they comply with established international standards…are provided for by law, and…are necessary to protect an interest which is recognized under international law [the “three-part” test].”[68]

Despite the protections for free expression established in Colombian law, Colombia still has criminal penalties for defamation, which have been applied to online speech. According to the Colombian penal code, individuals accused of insult can face between 1.3 and 6 years in jail and a fine of between US$3000 and US$345,000, and individuals accused of libel can face between 1.3 and 4.5 years in jail, with the same possible fines.[69] Although there are no penalties in place for libel, defamation, irresponsible journalism, or rumormongering that are specific to online content, cases pertaining to online defamation have occasionally been brought before the court with varying outcomes. 

The courts have not applied the penal code’s provisions on libel and slander to third party intermediaries; however, the penal code includes a concerning provision regarding online publication or reproduction of insults against others. According to Article 222 of the penal code, “whoever publishes, reproduces, or repeats insult or libel” may also be subject to punishment. This article raises concerns as it leaves open the possibility for charges of indirect insult and libel. The following article in the penal code establishes the use of “social mediums of communication or of other collective divulgence” as an aggravating circumstance that can increase the penalty for insult or libel. The use of internet was considered an aggravating circumstance in the case against Gonzalo Hernán López (See Prosecutions and Detentions for Online Activities).[70] 

In July 2015, after the end of the coverage period for this report, two bombings in the capital city of Bogotá injured ten people.[71] In the wake of the attacks, the Prosecutor General declared that anyone who shares photos or videos of possible terrorist attacks in publications or on social networks instead of surrendering the material directly to the authorities is subject to prosecution.[72] The statement received widespread criticism since such prosecutions would lack legal basis and would entail a serious violation of the right to expression and information;[73] however, no one has yet been prosecuted under this edict.

Prosecutions and Detentions for Online Activities

Prosecution, imprisonment, or detention for ICT activities is quite rare in Colombia, and writers, commentators, or bloggers are not systematically subject to imprisonment or fines as a result of posting material on the internet.[74] Nevertheless, in a ruling that clearly violated international norms for freedom of expression, which state that criminal penalties should not apply in defamation cases, Colombian courts confirmed the first sentence for online defamation in July 2014.  By applying Colombia’s criminal defamation laws to online speech, this ruling sets a concerning precedent for violations of user rights.

In February 2014, private citizen Gonzalo López was convicted of libel for using an anonymous profile to insult Gloria Escalante,[75] the manager of a public utility company, in the comments section of the online version of the newspaper El País in 2008.[76] Judicial police identified López through his IP address and seized two computers from his office. López, who called Escalante a “rat” and a “thief” in his comments, was the first Colombian to be convicted of libel for content posted online. He was sentenced to 18 months and 20 days in prison and issued a fine of COP 9,500,000 (US$4,700), although he did not serve jail time based on provisions in Colombian law that allow certain defendants to avoid imprisonment depending on their sentence and prior record.

López appealed the sentence, but the Supreme Court of Justice confirmed the conviction in July 2014. In October 2014, using a writ of protection of fundamental rights (acción de tutela), López again challenged the sentence for violating his right to freedom of expression, but his appeal was denied in February 2015. Finally, the Constitutional Court did not select the case for revision, which exhausts his options to overturn the conviction.[77]

The outcome of López’s case differed from a previous case where the court acquitted a journalist for insult despite the fact that the complainant was a well-known and powerful politician.[78] In July 2013, the Supreme Court overturned the conviction of Luis Agustín González for insult or slander. He was initially convicted by a lower level court for publishing an editorial that referred to a local politician as, “arrogant, humiliating, despotic, capricious, extravagant, and defiant.” Following an appeal from the politician, the Constitutional Court reopened the case in March 2014, but the complainant lost the appeal.[79]

Colombia has harsh penalties for copyright violations and currently lacks the flexible fair use standards employed in many countries. In July 2014, the Colombian student Diego Gómez was charged with violating copyright violations for uploading an academic thesis onto Scribd. The author complained and pushed for a criminal prosecution. As of May 2015, the case was still ongoing. If convicted, Gómez may face up to eight years in prison on top of substantial fines.[80]

In July 2014, the Superior Tribunal of Bogotá overturned the conviction of Joaquín Pérez Becerra, director of Anncol (“the New Colombia News Agency”), a Swedish-based news site that criticizes the economic and political policies of the Colombian government from a far left perspective. After being arrested while traveling through Venezuela, Becerra was brought to Colombia and convicted and sentenced to eight years in prison in 2012 on the charge of criminal conspiracy as an ally of the FARC guerrilla group.[81]  According to the prosecutor’s office, his work in the news agency served FARC's interests and connected them with funds from his connections in Europe. After spending three years in prison, the higher tribunal ordered his release, saying that they could not find adequate evidence to support his conviction.[82]

Surveillance, Privacy, and Anonymity

During the coverage period, the courts sought to reign in illegal and excessive surveillance, passing down sentences to former public officials involved in a 2009 wiretapping scandal; meanwhile, the Prosecutor General ordered a halt in the development of a centralized surveillance platform being developed by the national police based on concerns that the platform lacked sufficient oversight. Despite this progress, however, concerns about illegal surveillance by certain sectors of the government and military persist, with investigative journalists continuing to uncover grave privacy violations by the police and military in 2014 and 2015.

While intercepting personal communications in Colombia is authorized only for criminal investigation purposes and legally requires a judicial order,[83] service providers are required to collaborate with intelligence agencies by providing access to the communications history or technical data of any specific user without a warrant.[84] Retention and treatment of user data by authorities other than the intelligence agencies and departments related to criminal investigation has not yet been regulated in Colombia. Colombian law also allows intelligence agencies to monitor the electromagnetic spectrum without a judicial order.[85] An additional threat to user privacy comes in the form of Article 2 of Decree 1704 (2012), which requires that ISPs have backdoor access for criminal investigation purposes—which can be used under the Prosecutor General’s authorization.[86] A service provider that does not comply with these obligations will face fines and could lose its license to operate.[87]

Colombia has no general restrictions against anonymous communication, and there are no registration requirements for bloggers, cybercafe owners, or users. However, the police have access to a database that must be maintained by telecommunication service providers. This database contains user data, such as name, ID number, place and residence address, mobile phone number and service activation date. [88] Users must provide accurate information under penalty of perjury, which is punishable by a minimum of six years in prison.[89]

Since 1993 Colombian law has banned the use of “communication devices that use the electromagnetic spectrum” to send “encrypted messages or messages in unintelligible language.”[90] In response to an information request, the ICT ministry explained that those provisions apply only “to the content of the communications, not the encryption of the medium.” Despite of the ambiguous wording of the law, the ICT ministry further claimed that these provisions only apply to radio-like devices and not to the internet.[91] The Intelligence and Counterintelligence Act stipulates that voice encryption service may be implemented “exclusively” for the intelligence agencies and “high government” officials by telecommunications service providers.[92] Thus, mobile voice encryption is restricted for any citizen who is not part of the “high government” or intelligence agencies.

Although investigative journalists have sought to uncover surveillance practices, the scope of government and military surveillance in Colombia is still unclear. Apart from the occasional public bidding or contract that sheds some light on the matter, gaining an accurate picture of Colombia’s surveillance activities is very difficult. The lack of clarity regarding surveillance is aggravated by the fact that information related to intelligence activities is classified under Law 1621 (2012). Further complicating the matter, there is no independent body to oversee surveillance activities or to hold those in charge accountable. Congress receives a yearly intelligence report, but as there is no independent oversight, partial or biased information can be submitted.[93]

In July 2015, a hacker leaked 400 GB of documents from the Italian information technology company Hacking Team, which is best known for providing spyware to governments.[94] Among these documents were emails suggesting that the Colombian government had contracts with the company, evidence that supports research published by Citizen Lab at the University of Toronto in early 2014.[95] Leaked emails reference the National Police Office’s purchase of Hacking Team’s Remote Control System (RCS) called “Galileo,” which is capable of accessing and taking control of (hijacking) the target devices’ keyboard register, microphone and camera.

Although National Police have denied any direct relation with Hacking Team and have only admitted to contractual ties with a Colombian company called Robotec, which distributes Hacking Team’s services,[96] the leaked documents indicate that the National Police contacted Hacking Team directly to activate spyware.[97] Another leaked email suggested that the U.S. Drug Enforcement Agency (DEA) may be engaged in surveillance practices in Colombia.[98] Although it is still unclear if Hacking Team software is currently being used by the National Police or U.S. DEA, and, if so, how it is being used, several Colombian civil society organizations criticized the excessive and apparently uncontrolled use of intelligence tools in the country, which they argue has been facilitated by “weak legislation” on intelligence matters.[99]

Episodes of illegal surveillance (known in Colombia as “Las Chuzadas”), carried out by intelligence agencies, the army or the police, have constituted an ongoing scandal in Colombia in recent years. In February 2014, the Colombian magazine Semana exposed an illegal wiretapping operation carried out by the army against government representatives taking part in peace talks with FARC leaders in Havana, Cuba.[100] According to the media, the military set up a fake internet cafe under the code name Andrómeda, which it used to illegally target government and FARC representatives. In addition to conducting illegal surveillance, the army also recruited hackers to illegally access communications between representatives on both sides of the peace talks.[101] 

In May 2014, in the midst of presidential election campaigns, Semana revealed a video in which Andrés Fernando Sepúlveda, who worked for the presidential campaign of Oscar Iván Zuluaga—a frontrunner against President Juan Manuel Santos—was seen discussing confidential information about FARC members participating in the peace talks and strategies to use that information during the campaign.[102] It is not clear if Sepúlveda intercepted communications or paid for information from people participating in Andrómeda,[103] but he eventually signed a plea bargain and was sentenced to 10 years of prison for illegal interception of communications and use of malicious software, amongst other charges.[104]

In October 2014, reporters revealed that military intelligence services maintained a list of professional and personal email addresses of national and international journalists who had covered the peace talks between the Colombian government and FARC representatives, as well as personal email addresses of NGO members and foreign embassies diplomats. The purpose of the list is unknown.[105] In early 2015 the military confirmed that they were conducting investigations and that some officials involved in the scandal were relieved of their duties, and five were removed entirely from the service.[106]

The government has taken some steps over the past year to punish perpetrators of illegal surveillance, although it seems unlikely that these efforts have changed the overall environment for surveillance in Colombia, as intelligence agencies continue to operate with minimal oversight. On April 29, 2015, the Supreme Court sentenced Maria del Pilar Hurtado, former director of the government Administrative Security Department (DAS), and Bernardo Moreno, former secretary of the president’s office, to 14 and 8 years in prison, respectively, on charges of illegal interception of communication.[107] Hurtado and Moreno carried out a secret wiretapping operation, exposed in 2009 by investigative journalists at the magazine Semana, in which the now-defunct DAS intercepted the private communications of journalists, politicians, and NGOs. Although the government dissolved DAS in 2011 in the wake of the scandal, many of the public officials who staffed the project were transferred to the National Intelligence Agency (ANI), the new federal security agency that replaced DAS. The large transfer of personnel between the DAS and ANI has engendered concern over the scope of the new agency’s activities.[108]

In August 2014, the Prosecutor General’s office ordered the national police to stop development of a centralized platform for monitoring and analysis, known as PUMA, because of the lack of transparency and guarantees to its lawful use. Details about PUMA initially surfaced in June 2013, when journalists reported that the government was investing upward of US$100 million in a monitoring platform, which was to become operational by the end of 2014 and would provide the government with the capacity to intercept communications in real-time, extending to social media, email, telephone networks, and internet data traffic.[109] Official reports identified PUMA as a “fundamental tool for criminal investigation to ensure public safety” and assured that it would not be used as a general intelligence-gathering apparatus. Skeptical of this assurance, the Prosecutor General’s office asserted in their 2014 decision that the only way in which PUMA may be deployed is under control of the prosecutor’s office. Nevertheless, it is not clear if the national police still have the monitoring equipment or it has been handed to prosecutor’s office.[110] Recent Hacking Team leaks raise further questions, as they seem to indicate that PUMA may be up and running under the National Police.[111]

Intimidation and Violence

Corruption, longstanding armed conflict and associated surveillance, and the war against drugs have become the greatest threats facing freedom of expression in Colombia—regardless of whether that expression occurs in print or online. According to the NGO FLIP, at least sixteen journalists have been murdered and many more have been threatened since 2005.[112] These statistics represent a continuation of violence in a country that has seen at least 142 murders of journalists in the past four decades. Of these, 67 cases have already reached their statute of limitations, meaning that the victims’ families will never see justice.[113] Impunity—a pervasive problem in Colombia’s judicial system—is ranked by the nonprofit PAN’s Freedom of Expression and Access to Information Index as one of the gravest threats to overall expression.[114] Colombia has the third highest impunity rate on the Global Impunity Index of the Center for Studies on Impunity and Justice Institute.[115]

Due to the country’s high level of violence, it is difficult to isolate deaths that have resulted specifically from online activity. One recent murder, however, appears to have been connected to online activism. In September 2013, lawyer Edison Molina was murdered in Puerto Berrío, Antioquia.[116] Although there have been no significant advances in the judicial investigation, FLIP has suggested that Molina’s online activity, in which he denounced acts of corruption in local government, may have led to his murder.[117] Daniel Mejía, activist and director of the magazine Senxura, received a threat against his life and the life of his family in October 2014, allegedly for his reporting on illegal brick factories in Sogamoso, which he published through traditional and online media.[118] Mejía alleges that the threats came from paramilitary organizations with the participation of a member of the military forces.[119]

Colombia’s Ombudsman Office reported that more than 93 journalists were threatened between January to August 2014, though most worked offline.[120] There is no broad trend of retaliation specifically for online content in Colombia, and in general, online journalists have not faced the same level of danger as print journalists. A high level of intimidation towards media and human rights defenders in general, however, creates a climate of fear that also affects online journalists.

Technical Attacks

Various types of cybercrime, including hacking, illegal interception and use of data, and the distribution and use of malware are criminalized under Law 1273, which was passed in 2009. Penalties range from 36 to 48 months’ imprisonment, along with fines.[121] While phishing—the stealing of sensitive personal data via malware disguised as legitimate email—appears to be a significant issue in Colombia,[122] most evidence of hacking and other interception has involved interagency spying and intelligence work carried out primarily by the government, the army, and other official bodies (see Surveillance, Privacy, and Anonymity).

In early 2014, following the army’s Andrómeda hacking scandal, President Santos publicly stated that Colombia’s cyber defense sector was sorely lacking, and announced the creation of a commission focused on strengthening national cybersecurity.[123] Colombia then partnered with the Organization of American States (OAS) to develop two bodies—the Colombian Cyber Emergency Response Group (coICERT) and the Cyber Police Center (CCP)—in order to ensure the country’s cybersecurity.[124] Despite the president’s recent emphasis on Colombia’s vulnerability to cyberattacks, there are few known cases of technical violence perpetrated by private actors.[125] One year after the government announced its cybersecurity strategy with OAS support, digital rights activists continue to push for greater participation in reforming cybersecurity and the inclusion of human rights protections in the development of the cyber security agenda.[126]