Score Change: The score improved from 4 to 5 because internet users experienced faster internet speeds, according to some measurement sources.

Internet access continues to increase in Colombia. According to the most recent data from the International Telecommunications Union (ITU), internet penetration stood at 65.01 percent in 2019.1 Fixed internet connections increased from 13.81 connections for every 100 inhabitants at the end of 2019 to 15.38 connections for every 100 inhabitants at the end of 2020. Mobile connectivity also increased from 30.9 million to 32.5 million connections during the same period.2

Obstacles to access remain, including a lack of infrastructure in rural areas, low levels of digital literacy, and high prices for service (see A2). The government has worked to address the lack of connectivity in the country, especially in remote and isolated areas.3

Though Colombia ranks relatively low in global surveys of mobile and fixed broadband speeds, fixed broadband speeds have improved in recent years. Speedtest recorded an average fixed download speed of 53.73 megabits per second (Mbps) in April 2021, up from 28.29 Mbps in April 2020, placing Colombia 73rd out of 175 countries surveyed.4 Mobile broadband speeds still lag; with an average download speed of 17.76 Mbps, Colombia ranked 120th among 140 countries surveyed as of April 2021.

In June 2020, the Ministry of Information and Communication Technologies (MinTIC) announced the “Plan de Transición a Nuevas Tecnologías” (Plan to Transition to New Technologies), which lays out a strategy to modernize second-generation (2G) and 3G networks into 4G networks nationally by 2022.5 As of August 2020, the government had also started 5G network trials in five cities.6

Geographic and socioeconomic disparities in internet access are significant, but efforts to address them have been undertaken by current and previous governments.

According to the Colombian Chamber of Information Technology and Telecommunications (CCIT), an information and communications technology (ICT) trade association, 75 percent of higher-income people have internet access, compared to fewer than 50 percent of lower-income people. Fixed internet speeds vary greatly among lower and higher-income households.7 There is also a gap between urban and rural areas; over 80 percent of people are disconnected in some regions.8

While Colombia continues to face gaps in access and challenges to reducing them, the MinTIC has recently attempted to address these issues through various plans. In 2018, the incoming government launched a new policy for the sector called “El futuro digital es de todos” (The Digital Future Belongs to Everyone), Colombia’s ICT plan for 2018 to 2022. The government aims to provide fixed connectivity to 50 percent of households, an increase from 37 percent of households in March 2019. The government also aims for 70 percent of households to have internet access, either through a fixed subscription or through at least one mobile subscription per family by 2022, compared to 50 percent as of March 2019.9 As part of the policy, the government proposed the ICT Modernization Law, which aims to close the digital gap largely through public and private sector cooperation. It was approved by Congress in June 2019 (see A5).

Policies to close the digital gap have achieved some success. The MinTIC had connected 200,000 new low-income households to the internet as of August 2020 and planned to connect 140,000 more by the end of the year.10 In March 2020, the ministry announced subsidized monthly internet fees for users in isolated and rural areas. That same month, the ministry, which also presides over the Last Mile Program that aims to provide access to 500,000 low-income households, reported that nearly 270,000 subsidized fixed connections had already begun to be installed.11

The MinTIC also aims to install over 10,000 internet access points, connecting villages and townships in remote and rural areas in all 32 departments with free internet access through 2030. Three percent of the access points, known as Digital Centers, will be set in Indigenous and afro-Colombian communities. The MinTIC has heralded the project, which will be implemented between January 2021 and July 2022, as the “largest rural connectivity project in the history of the country.”12

In recent years, Colombia has ranked highly in the Affordability Drivers Index (ADI) report, which measures policy and regulatory factors that can enable more affordable broadband. The latest report ranked Colombia in second place out of 72 countries, citing sound regulatory decisions to improve affordability and access in the country.13

The government does not place limits on bandwidth, nor does it impose control over infrastructure, except in emergency situations when internet service providers (ISPs) are required to make their infrastructure available for official responses.14 The government has not centralized telecommunications infrastructure and does not deliberately shut down internet or mobile connections. However, some analysts reported that connectivity disruptions were detected during the coverage period.

Netblocks reported that fixed-line and cellular services were disrupted in Cali in May 2021, amid widespread protests (see B8). Movistar, a service provider, reported that vandalism had disrupted service around this time.15 There was no evidence that government authorities had intentionally restricted connectivity in Cali.

Colombia has only one internet exchange point (IXP), NAP Colombia, through which ISPs exchange traffic to improve efficiency and speed. Located in Bogotá, the IXP is managed by the Colombian Chamber for Informatics and Telecommunications (CCIT).16

Colombia is home to around 500 ISPs.17 While approximately 75 percent of the market is concentrated in the hands of three companies, there are nonetheless multiple options for consumers and healthy competition. The market is led by three providers: Claro, with a 38 percent market share, followed by UNE with a 22 percent share, and Movistar with a 14.2 percent share.18 Nonetheless, market entry is straightforward, and it is possible for anyone to establish an ISP by following the general requirements of the ICT Law, which establishes free competition and prioritizes efficient use of infrastructure and access to ICTs.19

Registration requirements are neither excessive nor onerous. Business owners must provide personal and tax identification as well as a description of services, but no fee is required. This information is published in an open registry, and the MinTIC has 10 days to verify the data before the business may begin operating. Registration can be denied when information is incomplete or false, or when an ISP does not have the proper commercial status to offer the necessary services.20 ISPs must also apply for licenses to utilize the radioelectric spectrum, although there have been no complaints of difficulties or bias with this process.

The mobile landscape is more concentrated. Although there are 10 providers, nearly 94 percent of the market is in the hands of three companies: Claro (55.7 percent), Movistar (23.4 percent), and Tigo (14.8 percent).21 Mobile service providers must contribute 0.01 percent of their annual income to a MinTIC fund, Fondo Único TIC, which is devoted to the development of nationwide ICT projects.

The ICT modernization law, which was passed by Congress in June 2019 and aims to increase connectivity (see A5), risks maintaining and augmenting market concentration by favoring more established and larger telecommunications providers. The spectrum licensing period, for instance, was extended from 10 years to up to 20.22 While this extension provides more stability for private investments, it could limit competition at the infrastructural level.

The modernization law also provides that, while service providers were previously obligated to pay a contribution of 0.01 percent of their annual income to the MinTIC fund, the payment amount will vary depending on ambiguous qualitative variables such as “social benefit.” Moreover, these criteria will be determined at the ICT minister’s discretion. A share of the fund will be used to increase connectivity, and service providers that partner with the government to do so will be allowed to pay up to 60 percent of their contribution in kind, also at the ICT minister’s discretion.23 In December 2020, the MinTIC published regulation that outlines requirements and procedures for authorizing and quantifying such contributions.24

The regulation of Colombia’s ICT sector changed significantly in 2019, after Congress approved the ICT modernization law after months of contentious debate. It notably eliminated the National Television Authority (ANT) and established a convergent regulator—through a restructured Communication Regulation Commission (CRC)—to regulate the ICT sector, television, and radio. Critics of the law contended that the new regulatory body concentrates too many functions in the government and lacks independence.25

In a move criticized by the Organization for Economic Co-operation and Development (OECD), the law also establishes two decision-making entities within the CRC: the Commission for Audiovisual Content (CCA), covering issues related to pluralism and audiences, and the Communications Commission (CC), dealing with technical and market regulation. The CCA has three members, two chosen through a public contest and one chosen by regional channels. The CC has five: the ICT minister, a commissioner chosen by the president, and three selected by the government through an open application process.26 In May 2020, the Constitutional Court rejected a legal challenge to the new law.27

The president appoints the ICT minister, who oversees the telecommunications sector through the ministry; that minister is also responsible for leading the CRC.28 The minister also designates the head of the National Spectrum Agency (NSA), which manages Colombia’s radioelectric spectrum. Some have suggested that this executive-driven design prevents objective oversight of the sector and affords the president undue influence over its operations. After the coverage period, in September 2021, ICT minister Karen Abudinen Abuchaibe resigned amid a corruption scandal involving the disappearance of millions of dollars intended to provide internet to rural schools.29

Since 2009, a government-appointed concessionaire has been responsible for administering the .co domain. For the domains org.co, edu.co, mil.co, and gov.co, applicants must comply with specific requirements; for edu.co, for example, the applicant must be an educational institution.30 During 2019, the process for awarding a public tender for the administration of the .co domain was mired in public and legal controversy; the selection, managed by the MinTIC was criticized for irregularities in calculating qualified bidders, leading the Office of the Inspector General of Colombia to request a suspension to the tender process. Then ICT minister Sylvia Constaín, resigned in May 2020, reportedly due to the flawed process.31 B. Limits on Content

Score Change: The score declined from 5 to 4 based on evidence that at least one provider temporarily blocked two sites, ghostbin.co and archive.org, during the coverage period.

Blocking or filtering of political, religious, or social content is not a regular occurrence in Colombia.32 YouTube, Facebook, Twitter, and international blog-hosting services are generally freely available, though two sites were reportedly blocked by at least one provider during the coverage period.

Researchers and civil society organizations found that archive.org and ghostbin.co were temporarily blocked by at least one local provider between May 26 and May 31, 2021. Fundación Karisma reported that the Superintendency of Industry and Commerce (SIC) ordered the blocks through a resolution due to alleged leaks of personal data belonging to security and government personnel by the hacking group, Anonymous (see C8). The organization also reported that access was blocked for customers of providers Emcali and Avantel. The Open Observatory of Network Interference (OONI) was able to confirm the block on Emcali’s network.33 It is unclear whether the blocks persisted after the coverage period or when they were lifted.34

No content is systematically blocked under Colombian law besides child sexual abuse images and unlicensed online gambling. Since 2018, the gambling regulator has regularly requested the blocking of unauthorized websites.35 As of October 2020, 4,296 such websites had reportedly received blocking orders.36

Transportation apps, like Uber, have been the center of much debate. Since 2016, Uber has faced an ongoing legal battle with traditional transportation service providers that led to a 2019 decision by the SIC to order the app to suspend operations. The decision was revoked in June 2020 by Bogotá’s Superior Court.37 There have been conflicting views among governmental institutions on the blocking of Uber: unlike the antitrust authority, the MinTIC has invoked the net neutrality principle, which does not allow network operators to discriminate against specific content or services. 38

The Colombian government does not regularly order the removal of content, though a problematic 2019 Supreme Court ruling could facilitate future restrictions. Periodic court cases have resulted in judicial orders requiring the removal of specific information deemed to violate fundamental rights (see B3). News outlets separately report receiving legal threats intended to force them to remove content based on the “right to be forgotten” and defamation lawsuits.

In December 2019, the Supreme Court ruled that blog and forum operators would be legally responsible for third-party defamatory user comments if they did not adopt mechanisms to control them. The decision was criticized for creating an incentive to excessively restrict comments or totally eliminate comment sections.39

The government has requested that platforms restrict content considered to incite violence. In January 2021, the director of the national police asked Twitter and Facebook to block accounts linked to Revolutionary Armed Forces of Colombia (FARC) dissidents following the publication of a video that showed a former FARC leader criticizing the government alongside armed individuals. Twitter suspended at least three accounts managed by former FARC leaders and dissidents, and Facebook reportedly removed related content.40

The Foundation for Press Freedom (FLIP) has noted that judicial harassment with the goal of restricting content has reached unprecedented highs within the past few years.41 For example, in October 2020, a judge ordered magazine Semana to remove a news program from their website that contained recordings of conversations that involved witnesses in a high-profile witness tampering case. The decision was based on the right to personal and family privacy. Local press freedom organizations condemned the ruling as censorship that ignores protections constitutionally guaranteed to those disseminating information in the public interest.42

Colombian authorities and courts place some restrictions on digital content, with some of these decisions taking place in an opaque environment and with sparse or no public explanation; this is especially true in cases of images depicting sexual abuse against children and online gambling. Users have limited avenues to appeal blockings or restrictions.

Police and other institutions may limit content on a range of topics, from sexual abuse to “inappropriate content” or “other issues,” in order to protect minors. Child sexual abuse images, which are illegal under international law, are subject to blocking.43 Decree 1524 (2002) requires ISPs to undertake technical measures to prevent the online availability of child sexual abuse images.44 The possibility for civil or judicial oversight for restriction of such content is limited because information about which websites are blocked is classified—possibly out of fear that individuals would use circumvention tools to access such material if a list of banned sites were made public.45

Online gambling legislation also allows for the blocking of websites (see B1), but there is no centralized, public reporting system with explanations for why sites are blocked, and the reasons are not always disclosed. Users are sometimes redirected to pages displaying the reason a website is blocked, but this does not always occur. In some cases, entire websites are blocked for having gambling-related advertisements.46

ISPs have slowly begun to publish data or transparency reports on government requests to restrict content since 2015, when digital rights organization Fundación Karisma first began publishing its yearly ¿Dónde están mis datos? (Where is my data?) report.47 According to the 2020 report, only two companies, Movistar and Claro, give detailed information about URL takedowns.48 There are no mechanisms to appeal blocking decisions.49

Often, content takedown requests are brought before judicial authorities through the “acción de tutela,” a legal action aimed at protecting fundamental rights outlined in the constitution, such as privacy and reputation. Some of these cases have been reviewed by the Constitutional Court of Colombia. For example, in 2015, the Court ruled on a case in which a woman requested Google and a news outlet to delink and delete information that was truthful but not updated. The Court strengthened the precedent that search engines should not be held liable for linking to content,50 but it did order the news outlet to make the disputed information harder to find.51

Content takedown cases carried out through judicial channels generally uphold transparency and due process for all parties. Judges sometimes neglect, however, proper consideration of the necessity and proportionality of a case.52 One such case currently under review by the Constitutional Court involves a judicial order from February 2020 to take down a picture of a street mural in Bogotá that was posted on Twitter. The mural depicts high-ranking officials involved in the “false positives” scandal, referring to the years in which the military killed thousands of innocent civilians extrajudicially and presented the bodies as those of guerrilla fighters.”53 The Foundation for Press Freedom (FLIP), a local organization, had filed for the annulment of the case on the grounds that it goes against due process and seeks to excessively burden content hosts.

Self-censorship is a notable problem for journalists and likely affects online publications.54 According to a 2015 survey of journalists by Proyecto Antonio Nariño (PAN), an alliance of organizations focused on freedom of expression and access to information, 25 percent of respondents stated that they avoided publishing information due to fear of aggression; 21 percent feared losing their jobs or having their media outlets closed; and 21 percent knew about media that avoided publishing information due to fear of losing advertising revenue.55

According to a March 2019 report from Deutsche Welle (DW) Akademie, many private media outlets are owned by members of the country’s elite, and members of press engage in self-censorship. The report also noted that many private media outlets rely heavily on advertising from large corporations and public agencies, and that newer outlets lack financial independence (see B6). While there is no indication that the owners of these newer outlets directly interfere in editorial decisions, their agendas may nevertheless influence coverage.56

Nongovernmental organizations (NGOs) that focus on local press freedom have also reported a significant increase of online harassment against female journalists by politically driven troll farms, which has led to some self-censorship.57 Female activists also face online intimidation (see C7).58

Misinformation and coordinated attempts to amplify political narratives have sometimes influenced online information in Colombia, especially in acutely political or social contexts.

In February 2020, for instance, journalistic coalition La Liga Contra El Silencio (The League Against Silence) published an investigation of a WhatsApp group that aimed to increase the social media impact of the ruling party, Centro Democrático (CD), and conducted organized attacks of government critics. According to the report, the group was created in September 2019 by diplomat Claudia Bustamante, and included Víctor Muñoz, then an advisor to President Duque. Other members included associates of former president Álvaro Uribe, members of the CD, and the founder of a news outlet that disseminated articles written by politicians. The WhatsApp group disbanded soon after its creation, but coordinated activity continued through at least the end of 2019.59

Events of high national interest, like presidential elections, frequently generate manipulated content online. For example, during the 2018 presidential campaign, disinformation and hateful content was propagated through social media and WhatsApp.60 A network of media outlets that normally specialized in motorcycles, pets, maternity, and sports was being used to disseminate propaganda and misleading information favorable to then presidential candidate Duque.61 A digital safety firm calculated that over 35 percent of the followers of the three most popular presidential candidates on Twitter at the time were fake.62 Researchers did not find significant evidence of botnet operations; however, the Atlantic Council’s Digital Forensic Research Lab found the main amplifiers of false or misleading claims to be “high-profile and well-known partisans or politicians.”63

Many online news outlets are thought to avoid coverage of certain issues in order to maintain relationships with advertisers, whose purchases provide the outlets with revenue. According to a 2015 survey of journalists by PAN, between 40 and 66 percent of respondents believed that media outlets in their region modify their editorial positions to protect advertising revenue, depending on the region; 64 percent said that the way official advertising is awarded is opaque; and 75 percent agreed that it is necessary to change the way in which official advertising contracts are allocated.64

The use of official advertising to coerce outlets into positive reporting on the government has remained a threat. In May 2021, news outlet El Espectador published leaked audio clips in which members of the ruling party leadership discussed how to leverage advertising money to pressure the press into changing their narrative surrounding the government’s role in national strikes.65 A February 2021 announcement that the MinTIC would invest 85 billion Colombian pesos ($23.7 million) in subsidies for media outlets has also sparked concern within civil society that these pressures might devolve into forms of bribery. Outlets that hope to receive funding will have to comply with requirements set by the government, and the ministry will decide which outlets receive funding.66

Colombia has numerous digital media outlets and online spaces for political debate, and Colombians are able to view and disseminate a wide range of content.

Many professional media enterprises thrive in Colombia’s largest cities and, in general, authorities do not interfere with their operations. However, there is a lack of media diversity in many regions. According to the FLIP, almost 60 percent, or 578 of the 994 municipalities they mapped, had no media that produced local news. Out of almost 1,335 media outlets operating in those regions, 113 were digital.67

Indigenous voices are underrepresented in the online landscape, which lacks relevant linguistic and cultural diversity.68 False or misleading content has also contributed to offline harms for Indigenous Colombians. During a national strike in May 2021, false claims spread on social media that members of the Cauca Regional Indigenous Council (CRIC) were entering residential complexes in Cali with the intent to loot. Residents, panicked and bolstered by the disinformation, violently confronted the group; eight Indigenous people were injured, including the CRIC’s leader, Daniela Soto, who was shot in the abdomen.69

Social media has played an essential role in providing online space for organizing that has led to offline mobilization in recent years. However, police have at times responded to protests with arbitrary detentions, physical violence, and device seizures.

Throughout the coverage period, several protests were sparked and sustained by online users. In September 2020, a series of protests erupted after a video of police brutalizing law student Javier Ordoñez, who died in custody shortly thereafter, went viral on social media. The call for mobilization mainly took place on online platforms.70

Separately, in April 2021, nationwide protests that began in opposition to a proposed tax reform quickly escalated to a mass antigovernment movement. Demonstrators were met with severe abuses by police, which led citizens to turn to social media to document and condemn the brutality by sharing videos of the violence and generally continuing the momentum of the movement.71

Device seizures and online surveillance by state actors magnify the perceived risk of those organizing online and offline, heightening potential for self-censorship and restricting free assembly. Police and security forces reportedly seized protestors’ mobile phones during the April 2021 demonstrations. One participant detained during the protests reported that an officer pressed her fingertips to her phone to unlock it while she was handcuffed, under the auspices of loosening the cuffs.72 Civil society organizations have condemned the device seizures, citing Colombian authorities’ history of extralegally surveilling journalists’ and activists’ communications (see C5).73

Official actors have sought to stigmatize and threaten individuals using digital channels to comment on social issues, which may also limit public willingness to engage and mobilize online. The Ministry of National Defence launched the #ColombiaEsMiVerdad (#ColombiaIsMyTruth) campaign in May 2021 to monitor and tackle content that depicts security forces abusing their authority during demonstrations. Using official social media accounts, the ministry has since alleged that those discrediting military and police personnel online in relation to protests were carrying out “digital terrorism.”74 During the previous coverage period, the day before a national strike was planned as part of antigovernment protests in late 2019, millions of Claro, Movistar, and Tigo users reportedly received a mass text message from the government encouraging a peaceful demonstration. The message could also be understood, though, as a disincentive to participate.75

Platforms also played a role in restricting political and social content during the coverage period. Amid protests against police brutality in September 2020, Facebook temporarily restricted access to content with the hashtag #ACAB (All Cops Are Bastards) in Colombia and multiple other countries in the region. Digital rights organization Fundación Karisma denounced the lack of transparency around the restrictions, which Facebook claimed were to maintain the safety of the online community.76 Instagram users also reported that their posts and stories about the antigovernment protests were taken down by the platform in May 2021. The platform blamed the removals on an error in their automated systems.77

Colombia’s constitution includes protections for free expression, though judges sometimes rule against these rights through disproportionate orders to restrict content. Article 20 of the constitution guarantees freedom of information and expression and prohibits prior restraint. Article 73 further provides for the protection of “the liberty and professional independence” of “journalistic activity.” Although there are no specific provisions protecting freedom of expression online, according to the Constitutional Court, online journalists and bloggers have the same liberties and protections as print or broadcast journalists.78

The judiciary consistently exhibits independence. However, judges sometimes rule against free expression, frequently ordering content to be restricted based on an “acción de tutela” (see B3).

Colombia maintains criminal penalties for defamation. According to the Colombian penal code, individuals accused of making “dishonourable accusations” can face up to four-and-a-half years in jail, while individuals accused of libel can face up to six years in jail. Sanctions may be heightened when the crime is committed through the use of “social mediums of communication or of other collective divulgence.”79 Whoever “publishes, reproduces, or repeats” dishonorable accusations or libel may also be subject to the same punishment.80

According to the Center for Studies on Freedom of Expression and Access to Information at Palermo University, 36 percent of laws passed between 1998 and 2020 that restrict freedom of speech fail to meet legality, necessity, and proportionality standards.81

Though a number of bills have been proposed in recent years with potential to restrict online expression, including by increasing government regulation of social networks or prohibiting broadly defined content, none had passed by the end of the coverage period.82 Congress did, however, approve a new electoral code in December 2020 that includes provisions that could threaten free speech, which is currently awaiting review by the Constitutional Court. Multiple free expression and digital rights organizations jointly filed an intervention with the Constitutional Court against the new code, arguing that it establishes disproportionate and ambiguous restrictions on citizen’s political expression over social media.83 For example, the code classifies “any expression that denigrates women in exercise of their political functions” as gender-based political violence and broadly prohibits such content, providing a vague definition that could be used to censor legitimate criticism.

Score Change: The score declined from 5 to 4 because online journalists and photographers covering protests were arbitrarily detained, while multiple criminal defamation suits were filed against reporters working for online outlets.

Prosecution and imprisonment for online activities is quite rare in Colombia, though brief detentions have become more common amidst recent political and social unrest. Writers, commentators, and bloggers are not systematically subject to imprisonment or fines for posting material on the internet. Criminal defamation suits pose a legitimate threat to journalists.

Brief prison sentences have been handed to journalists in connection to their online activities in the past, though they do not always serve all (or any) of their sentences. In March and October 2020, respectively, journalists Edison Lucio Torres and Gustavo Rugeles were handed fines and brief prison sentences after being sanctioned for not complying with orders to take down articles from their respective news sites that alleged corruption by a religious leader and a public servant.84 However, only Lucio Torres ended up serving his ten-day sentence.85 Previously, in August 2018, Juvenal Bolívar, a journalist at news outlet Corillos, and Sofía Ortíz Delgado, a former staff member there, each served a 10-day sentence after Bolívar refused to comply with a ruling ordering him to withdraw an investigation into a city official from his website, after a process plagued by procedural irregularities.86

Digital media personnel covering protests also risk arbitrary detention by authorities. In June 2020, three contributors to ab zurdo, a photography account on Instagram, were detained and held overnight while covering a demonstration against the government’s COVID-19 response. The three social media users had identified themselves as press, and were released after receiving a fine for violating the city’s lockdown orders, despite regulation allowing reporters to go outside during the lockdown.87 Four journalists from the digital medium La Otra Verdad were also detained for seven hours while covering protests in September 2020, after identifying themselves as press to police.88

Criminal defamation suits were filed against journalists in retaliation for their online reporting during the reporting period. In September 2020, two freelance journalists for the online news magazine Volcánicas were ordered by the attorney general’s office to appear for questioning for a criminal defamation complaint that had been filed against them in July of that year. The complainant, screenwriter and director Ciro Guerra Picón, filed the case in response to an article the journalists published in June 2020 reporting on at least eight separate cases accusing Picón of sexual harassment.89 In May 2021, a court ordered the journalists to add additional context and details to their published testimonies.90 Separately, in April 2021, the attorney general’s office notified investigative journalist Jeremy McDermott of a criminal defamation suit filed against him by Colombia businessman Guillermo Acevedo. The lawsuit is in response to a series published on McDermott’s investigative site, InSight Crime, that alleged that the complainant used to be a drug trafficker and paramilitary leader.91 Acevedo was arrested in June 2021 on charges of illicit enrichment, criminal conspiracy, and money laundering.92

A nascent criminal case with significant implications for journalists who expose media censorship also began during the coverage period. In October 2020, the attorney general’s office announced it would file criminal charges against former public TV station manager, Diana Díaz, due to a complaint filed against her by her former supervisor the year before. Díaz had leaked audio clips to the Foundation for Press Freedom (FLIP) in which her supervisor, Francisco Pablo Bieri, suggested cancelling a program after its host had criticized a proposed telecommunications law. There were no updates to the case as of the end of the coverage period.93

Colombia has no general restrictions against anonymous communication, and there are no registration requirements for bloggers or cybercafé owners, though users must register to obtain telecommunication services. Police have access to a database that must be maintained by telecommunication service providers. This database contains user data, such as name, identification number, place and residence address, mobile phone number, and service activation date.94 Users must provide accurate information under penalty of perjury, which is punishable by a minimum of six years in prison.95

In April 2017, the prosecutor general announced a proposal to force WhatsApp and other internet intermediaries to decrypt users’ communications for law enforcement purposes.96 Even though the proposal was never enacted, the announcement raised concerns about the state’s surveillance ambitions, as well as officials’ lack of understanding regarding technology like encryption.97 Providers that use end-to-end encryption communications cannot decrypt them.

Since 1993, Colombian law has banned the use of “communication devices that use the electromagnetic spectrum” to send “encrypted messages or messages in unintelligible language.”98 In response to an information request, the MinTIC explained that those provisions apply only “to the content of the communications, not the encryption of the medium.” Despite the ambiguous wording of the law, the MinTIC further claimed that these provisions only apply to radio-like devices and not to the internet.99 The Intelligence and Counterintelligence Act stipulates that telecommunications service providers may only offer encrypted voice services to intelligence agencies and “high government” officials.100

Intercepting personal communications in Colombia is authorized only for criminal investigation purposes and legally requires a judicial order.101 Colombian law allows intelligence agencies to monitor devices that use the electromagnetic spectrum to transmit wireless communication without a judicial order.102

Episodes of extralegal surveillance carried out by intelligence agencies, the army, and the police against journalists, activists, and opposition leaders have constituted an ongoing scandal in Colombia for over ten years.103 Some steps have been taken in recent years to punish perpetrators, including with the arrests of former heads of illegal wiretapping and interception networks.104 The Inter-American Commission on Human (IACHR) confirmed in October 2020, however, that impunity persists for those conducting illegal surveillance.105

Two investigations published by the magazine Semana in January and May 2020 revealed the processes and equipment used in illegal military surveillance. The January report exposed the use of sophisticated technology and open-source intelligence—including International Mobile Subscriber Identity (IMSI) catcher equipment, a malware system called Invisible Man, and the artificial intelligence tool Voyager— to spy on politicians, magistrates, generals, social leaders, activists, and journalists in 2019. The military used technology originally provided by the United States to address drug trafficking and the fight against guerrillas, compiling files on each target that included excerpts of social media conversations, photographs, videos, contacts, and maps tracing their movements.106 The May report noted that military intelligence targeted 130 people for surveillance in 2019, including 30 journalists from prominent outlets, human rights defenders, and the regional head of Human Rights Watch (HRW).107

Social media monitoring also threatens the continued activities of journalists and activists. In August 2020, a national observatory revealed that the mayor of Medellin, Daniel Quintero, had used public resources to hire a firm to monitor the social media profiles of journalists, social leaders, politicians, and regular citizens who were critical of his administration in 2020.108

In 2015, documents leaked from the technology company Hacking Team, which is known to provide spyware to governments, suggested that the Colombian government had contracts with the company. Police would only acknowledge having contractual ties with a Colombian company called Robotec, which distributes Hacking Team’s services,109 though the leaked documents indicate that the national police contacted Hacking Team directly to activate spyware.110 Another leaked email suggested that the US Drug Enforcement Agency (DEA) may have been conducting surveillance in Colombia through spyware and dragnet internet surveillance.111

Also in 2015, Privacy International found that the Bogotá police bought technology from the companies NICE (sold to Elbit Systems the same year) and Verint that could intercept phone calls in order to monitor government opponents. According to a 2018 investigation by Israeli newspaper Haaretz, Colombia has continued to purchase technology from Verint.112

While some constitutional and legal protections regulate the government’s use of data, service providers in Colombia are obligated to share data with the intelligence community with limited judicial review; providers are also obligated to capture and store user data for use in criminal investigations.

Service providers are required to collaborate with intelligence agencies by providing access, when feasible, to the communications history, location data, or technical data of any specific user without a warrant; intelligence agencies conducting an authorized operation only need to request the data. However, Colombian intelligence and counterintelligence agencies are also subject to Statutory Law 1621 of 2013, which binds agencies to respect “rights to honor, good name, personal and family privacy, and due process.” Article 4 restricts the discriminatory use of intelligence data, including on the basis of gender, race, or origin (see C5).113

Service providers are also obliged to retain subscriber data for the purposes of criminal investigations and intelligence activities for a period of five years.114 An additional threat to user privacy comes in the form of Article 2 of Decree 1704 (2012), which requires that ISPs create access points that capture communications traffic on their networks for criminal investigation purposes—which can be used under the prosecutor general’s authorization. A service provider that does not comply with these obligations faces fines and could lose its operating license.115

In March 2020, the Superintendence of Industry and Commerce (SIC), a consumer protection agency that operates under the purview of Colombia’s trade ministry, released a circular that authorized telecommunications firms to share user data with public authorities as part of the country’s COVID-19 response. While public entities are obliged to secure data and respect its confidentiality,116 the decision opens users to risks including discrimination, undue surveillance, invasion of privacy, and the revelation of journalistic sources. The circular does not specify what data should be collected and imposes no time limit.117

Though online journalists have historically faced less deadly violence than print journalists, attacks and harassment by state and non-state actors continue to undermine freedom of expression in Colombia.

Deadly violence, potentially in retaliation for online activity, poses a threat to digital media personnel. In April 2021, freelance photojournalist Luis Carlos Ayala was shot by an unidentified person riding a motorcycle in Cali. Ayala often contributes to digital outlet Colombia Informa and had spent months on a story about Indigenous and Afro-Colombian communities defending their land against drug trafficking groups and business interests.118

Security forces also attempted deadly violence against online media personnel during the coverage period. Soldiers shot at Fernando Osorio, a photographer for digital news cooperative Voces del Guayabero, while he was covering an antimilitary protest by coca farmers in August 2020. A soldier had partially severed two of Osorio’s fingers and broke his camera in June while he was covering another protest.119

Threats are frequently levelled against online reporters, leading some to close their outlets entirely. The director of digital outlet Sahagún 180 Degrees, Gerson Gil Ortiz, decided to close his platform in June 2020 following threats he received on social media after denouncing alleged overspending on uniforms for local teachers.120 Director of online outlet CF New Baranoa Noticias, Carlos Franco, received death threats over WhatsApp in April 2021 after he ran a story on clandestine parties that violated local COVID-19 lockdown rules. A group then came to his home and broke windows.121 In June 2021, after the coverage period, the Inter-American Commission on Human Rights (IACHR) reported instances of severe online harassment against journalists, especially female reporters, who were covering the 2021 national strike.122

Online outlets and journalists have been targeted by cyberattacks, and in 2020, FLIP recorded 10 cyberattacks against websites belonging to media outlets.123

Journalists have recently been victims of hacking attempts. In April 2021, Diana Calderón announced that her WhatsApp account had been hacked and was now part of a hacking chain, in which her contacts would receive requests for a code from her account that would allow the hackers full access to their own accounts, if provided. Calderón is the director of a radio show and regularly writes articles for El Pais that are published online. The hack also targeted high-level politicians and two other Colombian journalists.124

Outlets themselves are also among the victims of cyberattacks. In March 2020, before the coverage period, online news outlet La Oreja Roja published an article discussing deceased drug trafficker José Guillermo “Añe” Hernández’s suspected involvement in a vote-buying campaign during the 2018 presidential election. The website was made inaccessible the weekend after the article was published. 125

Government institutions also face cyberattacks, including in retaliation for the state’s crackdown on protesters during the coverage period. This was the justification provided by Anonymous in April 2021 when the group claimed to have used distributed denial-of-service (DDoS) attacks, which aim to crash websites by bombarding their host servers with information requests, to take down the official pages of the presidency and the senate. They also claimed to have leaked the personal information of members of the army through cyberattacks.126