When Colombia’s national intelligence agency, known as DAS, was disbanded in October 2011 after revelations of illegal surveillance and harassment of the press and public figures, many journalists breathed a sigh of relief. But recent claims of reporters being spied on and government agencies buying advanced surveillance technology without ensuring clear guidelines over its use, has raised questions about the country’s commitment to ending abusive practices.
President Juan Manuel Santos disbanded DAS (the administrative department of security) after news magazine Semana found in 2009 that some of its members were illegally spying on journalists, had issued death threats against investigative reporter Claudia Julieta Duque and her daughter, and used agents disguised as body guards for surveillance.
Santos appeared committed to ending the culture of surveillance, breaking up the agency in October 2011 and signing in Colombia’s first intelligence law, which went into effect in 2013.
The law, which established political oversight for intelligence agencies, including the police and the armed forces, was perceived by its supporters as a way to prevent illegal spying. “The law sets limits for intelligence and counterintelligence activities and establishes harsh consequences for those who do not comply with the law,” Senator Juan Manuel Galán, who authored the bill, wrote in an email to CPJ.
But journalists and human rights activists with whom CPJ spoke are skeptical that reforms have been sufficient to prevent abuses and ensure consistent oversight. Reports in December that members of Colombia’s national police allegedly spied on the journalists Vicky Dávila and Claudia Morales and 2014 allegations that the army wiretapped journalists in a military operation codenamed Andromeda revived concerns about abuses of surveillance technology. “With new allegations of spying, the concern is that Colombia has not learned its lesson from the DAS,” Julián Martínez, a reporter for the privately owned Noticias Uno and author of ChuzaDAS: Eight Years of Spying and Barbarity, a book about the DAS case, told CPJ.
One of the key reforms in the 2013 intelligence law was the creation of the Congressional Legal Commission to Oversee Intelligence and Counterintelligence Agencies–a government body set up to monitor the work of intelligence agencies.
According to Carlos Lasprilla, an aide to commission member Senator Carlos Fernando Galán, and a report by the Colombian digital rights group Fundación Karisma the commission has been hampered by bureaucratic and technical delays. The limitations of the commission are illustrated by the response to the Andromeda allegations. The oversight commission sent questions to the defense ministry and the joint intelligence committee. Although the agencies prepared responses, they were unable to submit them, allegedly because the security procedures for transferring sensitive information between the commission and intelligence agencies have not yet been approved, Lasprilla said in a telephone interview with CPJ.
Information shared with CPJ from the office of Senator Carlos Fernando Galán show that as of mid-February 2016, the commission has yet to receive any reports from intelligence agencies or produce any public reports about these agencies. Senator Juan Manuel Galán told CPJ that Carlos Fernando Galán, who was president of the commission from 2014 to 2015, had significantly advanced the groundwork for the commission to start operating. Lasprilla said, “Despite all of our efforts, we are concerned that the commission has not been able to make progress on activities of political control.”
Even if the oversight commission was fully functioning, its activities are constrained by a legal framework that relies heavily on self-monitoring by the intelligence agencies, Juan Diego Castañeda, a lawyer with Fundación Karisma, told CPJ. The intelligence law allows the commission to review reports submitted by intelligence agencies, request information about expenditure by these agencies, and produce an annual report, but it does have strong powers of investigation. “There is a lack of democratic oversight and transparency obligations,” Castañeda said.
The current president of the commission, Pedro Orjuela, did not immediately respond to CPJ’s requests for comment.
Concerns have also been raised by digital rights and privacy advocates, including Fundación Karisma and Privacy International, that intelligence agencies are buying advanced surveillance technology. In July 2015, hackers released files from an Italian surveillance developer named Hacking Team that appear to show Colombian law enforcement agencies spent US$370,000 on advanced surveillance equipment. The police released a statement at the time denying they had had a contract with the company.
Aside from claims that Colombia was buying advanced technology, concerns were raised by the London-based digital rights group Privacy International about the legality of law enforcement using such products and whether sufficient checks are in place. In its September 2015 report, “Shadow State: Surveillance, Law, and Order in Colombia.” Privacy International wrote, “Key agencies in Colombia that monitor communications all compete for resources and capabilities. This has resulted in overlapping, unchecked systems of surveillance that are vulnerable to abuse.”
The report detailed a number of police contracts from 2005 to 2014, allegedly for the purchase of technology capable of intercepting and analyzing massive amounts of data. One of the key concerns of Privacy International is that this technology appears to be connected to the backbone of the telecommunications structure, which means that instead of needing to issue a warrant to telecommunications companies, police have the technical capacity to access it directly. The police told Privacy International that intercepted communications still had to be authorized by the attorney general’s office, but Privacy International said its investigation showed the agency still had the technical capacity to receive and store data.
“The main development with new technologies is that there is no intermediary step between the data and the intelligence services. There is no clear check on where the information goes or who accesses it,” a spokesperson for Privacy International, who asked to remain anonymous due to the sensitive nature of the organization’s research, told CPJ. “Not in Colombia or anywhere else should there be direct access to data. With this access, you have to rely on the goodwill of the intelligence services.”
When CPJ contacted the attorney general and the national police agency for comment about the use of surveillance software in Colombia, a spokesman for the attorney general told CPJ the information was confidential. A representative for the police said he was not authorized to give public comment.
Only the attorney general’s office has authority to order the interception of communications as part of a criminal investigation, but rights groups such as the Foundation for a Free Press (FLIP) and Dejusticia say that the intelligence law provides a loophole for warrantless surveillance by intelligence agencies, through a provision that allows for the “monitoring of the electromagnetic spectrum.” The provision was approved by the Constitutional Court, which said monitoring was different than warrantless interception because it was not directed at a specific target.
Press freedom and human rights advocates say there is little technical difference between monitoring and interception. A 2014 report by FLIP criticized the use of monitoring without a judicial warrant. The Privacy International representative with whom CPJ spoke added: “We do not see the intelligence law as technically sound. It’s interception by another name.” The vagueness of what is covered under the term “electromagnetic spectrum” was also highlighted by rights groups.
In other instances the attorney general has moved to rein in the use of surveillance technology.
In August 2014, it cited privacy concerns when ordering the national police to halt the development of PUMA, a system of automatic mass surveillance, until it could be brought under supervision of the attorney general, according to reports. Privacy International and Fundación Karisma have called for greater transparency over the status of PUMA and similar technologies.
In a country where journalists are wary of surveillance, questions about the oversight and transparency of technologies are crucial, the journalists and digital rights organizations with whom CPJ spoke, said. Some said there was concern that the overall threat of surveillance against journalists would remain as long as there were no major legal or structural changes.
“There is a major contradiction between the government’s rhetoric, [which] insists that it does not spy on journalists, and the fact that there is an [intelligence] law that lacks sufficient oversight, the Andromeda scandal, widespread allegations of interceptions, and acquisition of powerful surveillance technology,” said Pedro Vaca, the director of FLIP, which released its annual report on February 8. “It is like a mercenary who has all the weapons but claims not to use them, and yet there are victims,” Vaca added.