Ecuador is set to finish a major revision to its Criminal Code on Friday, and it’s not looking good for user rights. Even as the country’s president, Rafael Correa, has been outspoken in criticizing NSA surveillance, the Ecuadorean Assembly is charging ahead with a requirement that all internet service providers spy on their customers, in violation of the country’s Constitution and international law.
One of the worst provisions of the proposed Criminal Code would require all internet service providers to retain records of user internet activity for at least six months, and to video record users of cybercafes (more on that below).
Article 474, as translated by Access, states:
1. “The suppliers and distributors of information and telecommunications services must retain subscribers’ or users’ data about the contract and preserve the integrity of data related to phone numbers, static and dynamic IP addresses and connecting traffic, as well as connection traffic, transactional access and information of wireless communications links of service and communication route for a minimum of six months in order to perform relevant investigations . . .”1
As written, this provision is a violation of Article 66.21 of Ecuador’s Constitution, which establishes that “any physical and virtual information . . . cannot be retained, opened or examined, except in those cases provided by law, without prior judicial intervention.” (Although this excerpt makes references to instances “provided by law,” the clause refers to the country’s Criminal Procedure, not the Criminal Code under revision at the moment.)
The bill fails to provide any meaningful privacy or due process protections and does not specify any limitations on how these data can be used, with the effect of turning all Ecuadoreans into suspects.
It would be a fundamental change in how the government accesses user data, installing a mandatory data retention regime where none currently exists — currently, law enforcement must first get a court order before obtaining user data.
The Ecuadorean Constitution is quite explicit about the kinds of communications that are protected, online and offline, and is very deliberate about the prohibition against arbitrary retention or examination of this information. A departure from this constitutional standard would enable mass surveillance and have a chilling effect on freedom of expression, in violation of the International Covenant on Civil and Political Rights and the American Convention on Human Rights, both of which Ecuador has ratified. Ecuador has already slipped 15 spots in RSF’s World Press Freedom Index this year, demonstrating how much these rights are already under threat.
It’s worth noting that data retention provisions in other countries have been thrown out on the basis of mass violation of rights: The Chilean Constitutional Court decided to ban a similar provision in 2011, ruling that such a measure would disproportionately affect the fundamental rights to privacy and equality before the law of cybercafes users. The decision held that it was unacceptable that the law 1) considers only cybercafe users who are 2) engaging in a perfectly legal and legitimate activity.
Cybercafes forced to videotape users
Another concerning provision of the proposed Criminal Code, in the second part of the Article 474, would require all cybercafes to install video cameras. As translated by Access, it states:
2. “The subscribers of the telecommunications services that share or distribute to third parties their data or voice connection, in a commercial or gratuitous way, must store their users’ data on the bases of a physical connection registry and preserve the integrity of the data about user identification, date and time of the initial connection, for a minimum time of six months with the appliance of video cameras, to be able to perform the relevant investigations…”
Although the government justifies placing video cameras in cybercafes to record any crimes that occur in these venues, members of Ecuadorean civil society counter that the provision is intended to facilitate the government’s efforts to associate the identify of the people using cybercafes with their online accounts. Such an action would be fundamentally destructive to online anonymity.
Economic costs endanger internet access and low-income communities
In addition to the deep human rights concerns, Article 474 also poses significant economic costs. Many of Ecuador’s internet users connect through cyber cafes, often small businesses in the room of a private home. Section 2 of the Article provides that those suppliers and distributors of information also must record the user identification, date and time of connection, as well as record their activities on video, again, for a minimum of six months.
The high costs of this provision — from purchasing video recording equipment to storing all user data for at least six months — may prove to be prohibitively expensive for many of these cybercafes, forcing them to go out of business. This would certainly diminish Ecuador’s already low Internet penetration rate of 27.2%.
Given that cybercafes are disproportionately used and run by low-income communities, this provision will not only place an economic strain on the families that provide these services, but also result in discrimination against people of low socioeconomic status who use cybercafes to access the internet. If this provision is included in the final text, being poor in Ecuador will be a de facto condition for surveillance.
The International Principles on the Application of Human Rights to Communications Surveillance
Ecuador’s proposed Criminal Code violates multiple fundamental rights and is an economic burden for businesses and families. The International Principles on the Application of Human Rights to Communications Surveillance, which have been endorsed by more than 280 organizations worldwide and have been held up as a standard in global fora, can serve as a guide to the Ecuadorean government as it reforms its Criminal Code. A review of these standards — principally due process, adequacy, and integrity of communications systems — would significantly improve the text of the Code and protect Ecuadoreans’ rights to privacy, freedom of expression, and other fundamental rights.
1 Los abonados de servicios de telecomunicaciones que compartan o distribuyan a terceros su interconexión de datos o voz de forma comercial o gratuita, deben almacenar los datos relativos a un usuario sobre la base de un registro físico de conexión y preservar la integridad de los datos sobre identificación del usuario, fecha y hora de conexión inicial y final, por un tiempo mínimo de seis meses con la aplicación de medidas de cámaras de video seguridad, a fin de poder realizar las investigaciones correspondientes.”