Source: https://necessaryandproportionate.org/country-reports/colombia
Timestamp: 2019-04-26 12:28:13+00:00

Document:
March 2016 - Colombia's Constitution grants that international human rights treaties ratified by Colombia carry the same level of enforceability as the Constitution itself; collectively, those treaties and the Constitution itself comprise the constitutional block, the most important set of laws governing Colombia. Treaties encompassed under the constitutional block include the American Convention on Human Rights and the International Covenant on Civil and Political Rights, two treaties that provide for important safeguards against unchecked surveillance by the Colombian government.
The extent to which the Colombian government recognizes those rights and limits to surveillance varies considerably. Colombian law distinguishes government surveillance for the purposes of law enforcement investigations and surveillance for the purposes of intelligence and counterintelligence; the former takes more steps to recognize Colombians' rights than the latter does, but both can be improved.
According to the Constitution, under most circumstances, the government needs a court's approval in order to conduct surveillance on a citizen. There is one exception: under certain circumstances, the Attorney General's office can conduct surveillance on a citizen it's investigating without seeking permission from a judge first; however, the office must retroactively seek permission from a judge within 36 hours of the surveillance activities.
There are safeguards for citizens' rights in laws covering intelligence as well, but there are some areas in which those safeguards aren't adequately followed. For example, the use of IMSI catchers appears to be in violation of Colombian law on intelligence. Another issue with intelligence law is how it treats data from Internet companies. Intelligence agencies are allowed to request certain data from providers, but as written, the law is ambiguous about what data providers are required to retain.
Nowadays, States have an increased technological capacity to conduct surveillance on all communications. As stated by the UN Special Rapporteur for Freedom of Expression in his 2013 report, the States have an unprecedented capability to conduct simultaneous, invasive, targeted, and large-scale surveillance activities due to technological advances.1 This represents a threat to several rights recognized in State constitutions and by international human rights treaties that have been ratified by various States. These rights include privacy, since private information may be accessed without the owner's authorization; freedom of association, since the activities of a group of people may be surveilled; freedom of expression, since communications surveillance may lead to self-censorship or repression; and access to information, since information collected and stored by way of surveillance may be hidden from its owner and used for unknown purposes.
This reports aims to analyze current State communications surveillance law and practices in Colombia and to recommend improvements to these regulations and practices, which prioritize human rights to the maximum extent possible. In order to achieve this general aim, the report has two specific goals.
First: To identify and explain Colombian legislation relating to current State communications surveillance, in order to facilitate understanding about the legal framework of surveillance, the institutional oversight mechanisms, and the rights that are guaranteed to an individual. Specifically, this paper describes one particular issue with communications surveillance: how may the State access people’s communications? When dealing with State communications surveillance, it’s especially important to analyze domestic law with regard to the protection of human rights in order to establish limits for State institutions that conduct surveillance.
Second: To present the international standard on human rights, which should serve as a parameter for State communications surveillance regulations. This report will also assess the extent to which Colombia currently observes such international standards by looking at national regulations and practices. These international human rights standards apply at a domestic level by virtue of the constitutional block—which allows the State to legally invoke treaties at a domestic level in order to protect the rights of those affected by State communications surveillance; and to help draft communications surveillance legislation that better protects human rights.
International human rights law is important to reference when proposing limits to State communications surveillance. In recent years there have been important statements by international bodies about the interpretation and guidelines to define the instances in which a State must comply with its international human rights obligations when conducting communications surveillance.
“Communications surveillance” in the modern environment encompasses the monitoring, intercepting, collecting, obtaining, analyzing, using, preserving, retaining, interfering with, accessing, or similar actions taken with regard to information that includes, reflects, arises from, or is about a person’s communications in the past, present, or future.
“Protected Information” is information that includes, reflects, arises from, or is about a person’s communications and that is not readily available and easily accessible to the general public.
Communications surveillance is often at odds with several fundamental rights recognized by the Constitution and many international human rights treaties. The most obvious right when speaking about communications surveillance is the right to privacy. There exist many national and international laws that regulate the content of this right. Some of these laws are general, but some are specific and take into account concrete consequences. Either way, as briefly stated in the introduction, the right to privacy is not the only right that's threatened by State communications surveillance. There are other rights at odds with communications surveillance, such as freedom of expression, access to information, freedom of association, and due process. These rights are also regulated by general constitutional provisions. Others are of a legal or regulatory type, which are more specific about the scope and content of each one.
All of these regulations make up the legal framework to protect human rights against State communications surveillance. To apply this framework, it is necessary to address the main provisions regulating individuals' privacy.13 This report first covers the provisions about communications surveillance that are found in the Political Constitution, where the essential safeguards with regard to communications surveillance are established.
This report includes a contrasting analysis between the provisions in international human rights law and those outlined in the constitution, since the Colombian legal system recognizes the normative nature of international human rights treaties in domestic law. This normative power is not always consistent. Therefore, it is necessary to make some distinctions. As such, this report briefly presents the doctrine of the Constitutional Court on the constitutional block, which specifically focuses on explaining the normative power granted to certain international human rights documents, which are, by nature, the same as some that have studied the application of human rights to communications surveillance in the last few years.
Several international documents and declarations made by international bodies reference the rights that can be affected by State communications surveillance. It is essential to include them in the legal framework of communications surveillance in Colombia since, by virtue of the Constitution, international regulations have normative power on the domestic legal system. According to what has been clarified by constitutional jurisprudence, some provisions are binding while others have interpretative power.
The normative power of some of these international law provisions in the domestic system finds its legal basis in the Constitution; it establishes various explicit clauses referencing international law in Article 53, about international job agreements; Article 93, about treaties and regulations on human rights; and Article 214, about international humanitarian law.
On this basis, the Constitutional Court has allowed declarations made by international bodies like the Inter-American Commission on Human Rights,17 the Inter-American Court of Human Rights,18 and the United Nations Human Rights Bodies19 to influence domestic legislation.
Similarly, it is necessary to mention that experts from civil society and the academic world have undertaken the study of the application of international human rights law to State communications surveillance. As a result, principles that establish the regulations and the existing jurisprudence on this subject have been developed. The best example of these types of initiatives is the International Principles on the Application of Human Rights to Communications Surveillance, drafted by several academic experts and activists.
International bodies have already recognized them as authoritative guidelines for the interpretation of the meaning and scope of human rights to communications surveillance.28 Taking into account the aforementioned Constitutional Court case law, as these principles interpret rights included in treaties that make up the constitutional block—like the American Convention on Human Rights or the International Covenant on Civil and Political Rights—they represent a relevant doctrine for interpreting these rights, regardless of the fact that some of these principles have greater normative power because they replicate existing regulations in treaties that make up the constitutional block.
Finally, the Constitutional Court also recognizes the importance of decisions that were made in various other treaties that Colombia has not signed, but whose content is similar to the ones it did—like, for example, the European Court of Human Rights, which uses the European Convention for the Protection of Human Rights and Fundamental Freedoms. According to the Constitutional Court, the declarations made by the European Court of Human Rights are relevant to Colombian legislation for at least two reasons: first, because national and foreign case law is always a source of interpretation for legal provisions; and second, because, although Colombia has not participated in the European Convention on Human Rights, several of its provisions are replicated in treaties that Colombia has signed. Therefore, its provisions are “useful criteria for understanding the content and scope of Colombian international agreements on human rights.” It is essential to mention the relevance of this body for our analysis, since the European Court of Human Rights has made important decisions related to State communications surveillance, which may provide more reasonable legal solutions for the challenges that it poses.
According to this court, in order for an interference not to be arbitrary or abusive, it must a) be provided for by law, b) pursue a legitimate aim, and c) be adequate, necessary, and proportionate.30 These limitations have been generally defined by the Inter-American Court, but are also found in detail in the European Court of Human Rights. The latter has stipulated that surveillance measures, among others, must be based on a particular and precise law, mainly due to the implicit risk of abuse any surveillance system poses and to technological advances that make it easy to carry out these practices.31 As such, surveillance legislation that is general and vague does not meet the legality criterion.
Safeguards under international human rights law that consider valid limits to the right to privacy are detailed in the International Principles on the Application of Human Rights to Communications Surveillance. Not only do these principles state that interference with the right to privacy, or any human right, must be necessary and proportionate and provided for by law, but they also explain in detail the scope of these safeguards. For example, they mention that in order for a measure to be proportionate, it must a) pursue a legitimate aim, b) be adequate for this aim, c) be necessary, and d) be strictly proportionate, for which they specify a series of burdens of proof on the State in order for communications surveillance to be considered legitimate.
Article 15 of the Colombian Political Constitution establishes the general legal framework of the right to privacy, specifying its scope and the way in which it may be interfered with. This article recognizes three different rights: the right to privacy, the right to a good name, and the right of habeas data. The Constitutional Court has maintained on repeated occasions that these three rights are autonomous, since they protect different spheres of an individual's life and, as a consequence, require different safeguards.
In general terms, Colombian case law has defined the scope of the protection of these three rights as follows:34 The right to a good name “refers to the image that members of society have about an individual and his or her behavior, integrity, decorum, qualities, human and professional conditions, and criminal records.”35 In order to illustrate the content of the right to privacy, there is the metaphor “private sphere,” which is “exempt of State intervention or arbitrary social interferences,” whose protection is deemed necessary to allow full personal, individual, and cultural growth.36 Finally, habeas data refers to the right to know, update, and rectify any personal information contained in databases and private entities.
This general rule has a specific exception, also established in the Political Constitution: The Office of the Attorney General has the power to conduct “searches, house visits, seizures and interceptions of communications” without a prior judicial decision. As mentioned above, this is the only circumstance in which the government is permitted to interfere with the right to privacy without a judicial decision. The following is a detailed explanation of the legal regulations on this subject matter.
Hacking tools: The report reveals that DIPOL acquired malicious software (malware) that can infiltrate and control a phone, computer or device remotely. DIJIN is not authorized to engage in “interception” without the supervision of the prosecutor according to Colombian law.
Taking into account what is established in Article 15 of the Political Constitution, Article 11 of the American Convention on Human Rights, and Article 17 of the International Covenant on Civil and Political Rights, below you will find an explanation of the Colombian legislation that regulates multiple circumstances in which State authorities may record or access an individual's private communications.
Colombian criminal legislation regulates State communications surveillance in two ways: First, criminal procedure law establishes that in order to conduct communications surveillance, it must be for the sole purpose of collecting evidence for a criminal investigation. Second, the criminal legislation outlines a series of behaviors related to communications surveillance that it considers to be illegal and punishable.
According to Article 250 of the Political Constitution, the Office of the Attorney General must take possession of the evidence in the framework of a criminal investigation. It specifies that “when additional measures that imply the infringement of fundamental rights is required, the appropriate authorization must be obtained from the judge responsible for the control of guarantees in order to proceed.” In the same way, it stipulates that the Office of the Attorney General may “conduct searches, house visits, seizures, and interceptions of communications” without prior judicial decision, but must get subsequent permission of a judge within thirty-six (36) hours.
The above-mentioned exception must be strictly interpreted so that the safeguard of a prior judicial authorization is not bypassed. Under this rule, for example, the Constitutional Court has held that practices like selectively searching a database for an accused person’s confidential information is not one of the activities that may be conducted by the sole request of the Office of the Attorney General of the Nation subject to subsequent judicial review by a judge.49 Therefore, the Court has demanded that, in order to proceed with such searches, there must be prior judicial authorization.
Criminal procedure legislation also stipulates that “competent authorities” shall be in charge of the technical proceedings for the interception and its processing. Despite the vagueness of the law in relation to the authorities in charge of conducting the proceedings, the Constitutional Court endorsed it. The Court argued that the law does specify which authority gives the order and conducts the interception—the Office of the Attorney General of the Nation—and grants this office the power to determine which authorities conduct the interception and processing.
Moreover, the Office of the Attorney General has the power to conduct surveillance on an accused person during a criminal process. In order to make use of this power, the following must be met: (i) there must exist a prior authorization from the National Directorate or the Sectional Director of the Office of the Attorney General; (ii) there must exist reasonable, well-founded motives to assume that the information of the accused person is useful to the investigation; (iii) the tracking will last for a limited time period; (iv) if there are no results during the year following the issuing of the surveillance order, the surveillance order must be canceled, but it may be issued again when new motives arise; (v) during surveillance, any type of sensible technical means may be used; (vi) surveillance shall have the purpose of collecting information relevant for identifying and individualizing of the perpetrator or any participants, their social relations, the places they frequent, and similar aspects, without unnecessarily affecting the privacy of the accused or third parties; and (vii) there must be subsequent judicial authorization within 36 hours.
Separate from criminal prosecutions, the law has provided for the ability to interfere with an individual's rights by conducting communications surveillance through intelligence and counterintelligence activities. On several occasions, the Constitutional Court has deemed the interference with certain rights, like the right to privacy or freedom of expression, legal. Intelligence and counterintelligence activities are aimed at collecting, analyzing, and disseminating information that aids lawmakers and other entities in deciding which measures are suitable for the protection of national security.56 Hence, they resort to communications surveillance, with the purpose of obtaining information that might threaten national security. Due to the aim these activities pursue, the fact that they interfere with individuals' rights has been deemed legal so long as certain criteria are met. According to the Constitutional Court, “the powers of the intelligence and counterintelligence organizations must be strictly conducted in the framework of the Constitution, international human rights law, and international humanitarian law.”57 Thus, in order to determine the criteria that allows for intelligence and counterintelligence activities, it is important to consult not only the Colombian Constitution, but also international treaties and the provisions contained in international documents.
The International Principles on the Application of Human Rights to Communications Surveillance outline that the measures that involve communications surveillance must be stipulated by law; pursue a legitimate aim; be adequate, necessary, and proportionate; establish institutional and non-institutional public oversight mechanisms; and guarantee due process and transparency.
The Intelligence and Counterintelligence Law (law 1621 of 2013) enables security agencies to conduct certain activities that pose a potential violation of individuals' rights. This law establishes which agencies can carry out intelligence and counterintelligence in Colombia. According to Article 3 of this law, that function is carried out by units of the Armed Forces and the National Police organized for this purpose, the Unit of Information and Financial Analysis, and others that enforce the law. According to this article, these are the only bodies that can carry out intelligence and counterintelligence.
In particular, Act 1621 enables security agencies to conduct the following activities that interfere with individuals' rights: (i) monitor the electromagnetic spectrum (espectro electromagnético in Spanish) and (ii) request information from the telecommunications companies to help identify and locate users of these services. This act does not enable communications interception, since it explicitly claims that interception is exclusively regulated by the Political Constitution and the Criminal Procedure Code. As mentioned above, the disclosure of an individual's private information interferes with the fundamental right to privacy. The following is a detailed explanation of the activities that are allowed by intelligence agencies and how they may affect individuals' private lives.
The Colombian legislation, thus, distinguishes between communications interception and the monitoring of the electromagnetic spectrum. The latter is, according to the Constitutional Court, a “random and indiscriminate tracking activity,” and implies “the incidental collection of communications which reveal circumstances that allow the prevention of attacks and the control of risks to the Nation's defense and security. Technically, it is a sort of tracking of shadows, images and sounds represented by electromagnetic radiation and radio waves.”62 That is, the norm creates a legal difference between monitoring communications aimed at national security and intercept communications under the rules of criminal procedure. It is worth mentioning that this definition of “monitoring of the spectrum” corresponds to a judicial interpretation by the Constitutional Court, and that the law does not stipulate any specific views on the definition.
However, it can be argued that the application of the intelligence legal framework suggests that the “monitoring of the spectrum” (monitoreo del espectro electromagnético, in Spanish) is performed in a much broader way that the one defined by the Constitutional Court. As detailed in the report by Privacy International, various agencies in Colombia, as the Directorate of Police Intelligence (DIPOL); the Criminal and INTERPOL Research (DIJIN); and the DAS, until its dissolution, have used “devices for the interception of communications mobile (known generically as IMSI catchers) that allow localized indiscriminate interception of all mobile phone calls and text messages in a specific place.” These tasks are far from the “incidental interception”64 which is how the Court understands the monitoring of communications.
Another key aspect of the Law on Intelligence and Counterintelligence involves the regulation of encrypted voice messages. Paragraph 2 of Article 44 of this law states that operators of telecommunications services must offer intelligence agencies encrypted voice calls. The article adds that this service will be exclusive to high government and intelligence agencies, which can be interpreted as prohibiting the use of encrypted voice messages to those who are not part of high government or intelligence agencies.
This provision in intelligence law compels companies to deliver technical data on the information mentioned therein, setting a maximum time limit of five years. Interestingly, it stipulates that its application should be “technically feasible.” That is to say, this provision does not explicitly impose a data retention obligation on companies, but if companies already have the data, the government may request access to it for a time period of up to five years. This suggests that companies must voluntarily implement data retention practices in order for this law to work.
The Colombian legislation outlined in the previous section may be at odds with the human rights standards specified at the beginning of this report. In several cases, there is a lack of compliance with multiple international standards on State communications surveillance. These standards aim at protecting, to the maximum extent possible, human rights that may potentially be affected by surveillance activities. What follows is an analysis of the regulations stipulated in the International Principles on the Application of Human Rights to Communications Surveillance—hereafter the Principles. There follow recommendations for improvement so that the regulations are aligned with the Principles. This is particularly relevant since the respect for human rights in all areas is a duty that the Colombian State has agreed to through the signing of international treaties on this subject matter.
According to the Principles, any communications surveillance measure that poses a limitation to human rights must be prescribed by law. Moreover, State communications surveillance must meet a standard of clarity and precision that is sufficient to ensure that individuals have advance notice of and can foresee its application. Finally, the principle of legality states that laws that limit human rights should be subjected to periodic review by means of a participatory legislative or regulatory process for the updating of regulations on State communications surveillance.
In accordance with the Colombian regulations mentioned, the principle of legality has been established in a general way by the Constitutional Court through the doctrine of legal specificity (reserval legal in Spanish), which lays out that the decisions that restrict the human rights of those under investigation must be provided for by law. This Principle is, in practice, respected when it comes to criminal legislation that deals with communication surveillance.
However, when it comes to some situations regarding intelligence activities and regulations on telecommunications, the Principle of legality is not fully complied with.
This Principle has also been mentioned in the decision made by the Constitutional Court about the scope of intelligence activities, demanding that they, as well as their proceedings, the officials in charge, and their motivations, be prescribed by law in a clear and precise way. Nonetheless, intelligence law is vague and ambiguous when regulating a wide range of subjects; activities that limit individuals' rights must be clear and precise, as established by the Principle of legality.
In particular, the motives that justify conducting intelligence and counterintelligence activities—such as the protection of national security, democratic institutions, and national defense, among others—are not clear. The Colombian legislation does not provide examples of the issues that the intelligence and counterintelligence services will be responsible for. This may lead to a situation where intelligence agencies are interpreting and determining when to execute intelligence and counterintelligence activities when, in fact, this should be the lawmaker's job.
Intelligence and counterintelligence law also fails to regulate classification of information. It is the government that does so by decree.70 The Constitutional Court approved this by arguing that, in all cases, the law provides criteria for the fulfillment of the regulations.71 By giving the government power to determine classification levels of information, the executive branch may define criteria to classify intelligence information, and it is the intelligence and counterintelligence agencies that must apply this criteria in practice.72 It is ignored that the secrecy of information, whenever it entails a limitation to the right to access to information, should be clearly defined by law in accordance with the Principle of legality.
Additionally, an important gap contained in this the law was to not specifically define the activities that can be carried out by the intelligence agencies. Especially regarding the monitoring of the electromagnetic spectrum, this is a power that intelligence agencies have and is restricted to monitoring the set of all wavelengths of electromagnetic radiation.73 In Colombia, this power does not have a legal definition, (there is only one definition of interpretation by the Constitutional Court tied to the electromagnetic spectrum).
In our opinion, the lack of precision in Colombian law partly explains the controversy that has arisen in Colombia in recent years about the legal basis for starting to use massive interception of communications, that will be carry out by intelligence agencies through the systems such as the Single Monitoring and Analysis Platform (PUMA) and the Integrated Digital Recording System (sigD). The legality of the use of these tools has been questioned by the Public Prosecutor.74 Disputes of this kind can be avoided by clear and specific laws that indicate precisely the kind of work that can be undertaken and monitoring specific parties authorized to undertake them.
The intelligence legislation must in any case take into account the constitutional rule according to which the interception of communications of people can only be done individually, in the context of criminal proceedings, and with the participation of Public Prosecutions of the Nation and national judicial authorities.
Communications companies' duty to deliver user information to the authorities that fulfill the functions of judicial police is not provided for by law, nor available to the public. It is a decree that compels Internet and communications service providers to deliver user information. Thus, this decree does not have legal standing from the democratic body nor is it published like typical laws. Besides not having the authority of a law, it is not specific enough since it does not specify the circumstances in which its application is appropriate.
Furthermore, it fails to clarify the scope of the regulations on telecommunications that compel Internet and communications service providers to retain user information in the criminal context: it does not specify whether this information should be about users' identification—such as their ID numbers, or mailing address—or whether it should be about the usage of these services—date, time and duration of communications, browsing history, persons with whom they communicate, etc.
This vagueness exists because Decree 1704 from 2012 does not exhaustively prescribe what type of users' information is to be kept by Internet and telecommunications service providers, for it refers in general terms to user information that allows the identification of the users, and it provides few examples of this type of information.
With regard to human rights, the Principles specify that laws should only permit State communications surveillance to achieve a legitimate aim that corresponds to a predominantly important legal interest that is necessary in a democratic society.
In Colombia, the criminal procedure law complies with this Principle by establishing the proceedings that must be followed in order to conduct communications surveillance, with the sole purpose of collecting evidence for a criminal process.
Similarly, the Principle of a legitimate aim has been expressed in the decision made by the Constitutional Court about the limits to intelligence activities, demanding that they pursue constitutionally legal aims, such as the protection of constitutional democracy, national security, and national defense.
This Principle establishes that the regulations applicable to State communications surveillance must be limited to those which are strictly and demonstrably necessary to achieve a legitimate aim.
The Colombian criminal law complies with this Principle, since the Office of the General Attorney is allowed to intercept communications, seize equipments and data storage devices, and track any individual who is involved in a criminal process or the like, with the sole purpose of finding material evidence and physical evidence transmitted through any communications network and which is relevant for a criminal investigation. It must be expressed in writing and may not be used on communications between the accused and his or her lawyer. Moreover, these activities must be carried out over a limited time period—a maximum of three months—and must be subjected to prior or subsequent judicial control.
Likewise, legislation on intelligence and counterintelligence enshrines the Principles of adequacy, necessity, and proportionality. In relation to the necessity Principle, it points out that “intelligence and counterintelligence activities must be necessary to achieve constitutional aims, i.e. they may be resorted to whenever there are no other less detrimental activities available to achieve these aims.”75 Similarly, the decision made by the Constitutional Court about the limits to intelligence activities demands that they be limited to those which are strictly necessary to achieve the specified legitimate aim.
Regarding surveillance regulations on telecommunications, it's been established that Internet and telecommunications service providers must have the technological infrastructure in place to ensure they can access the communications that are sent through their networks. There is no additional regulation that specifies what kind of use they will give to the surveillance technology, nor a rule that describes that the technology that is implemented should be as invasive as possible.
This principle stipulates that any instance of communications surveillance authorized by law in each country must be appropriate to fulfill the specific legitimate aim.
The adequacy Principle is recognized in intelligence and counterintelligence legislation. Article 5 of Act 1621 of 2013 outlines: “Intelligence and counterintelligence activities must make use of measures that are adequate for the aims defined in Article 4 of this Act; that is to say, the most adequate measures for the fulfilling these aims are to be used, and any others should be discarded.” In this provision, the law establishes that the information collected through activities related to monitoring the electromagnetic spectrum (espectro electromágnetico in Spanish) that is useless for the objective of the investigation must be destroyed and not stored in databases.76 Furthermore, intelligence law stipulates that each organization in charge of fulfilling these functions must create a committee to update and eliminate intelligence data and information.
The observance of these Principles requires that regulations on communications surveillance must include mechanisms that protect human rights violations against authorized communications surveillance measures. Akin to the assessment of whether the mechanisms outlined in the regulations are efficient at verifying if interference is limited and reasonable in relation to the specified legitimate aim is the preservation of human rights to the maximum extent possible.
According to the European Court of Justice, mass data retention exclusively conducted for a limited time period is a disproportionate infringement on the right to privacy, for (i) it encompasses the entire population of a nation, any means of communication and all data traffic without limitation, differentiation or exception; (ii) it does not have an objective criterion to determine the circumstances for when data can be accessed or a procedure for this to happen; and (iii) it does not distinguish the duration of data retention or the usefulness of the retained data.80 The International Principles on the Application of Human Rights to Communications Surveillance point to the same direction, as they dictate that mass data retention that is not relevant to face a specific threat is an infringement on the right to privacy.
The observance of the Principles regarding this subject matter in order to protect human rights to the maximum extent possible is guaranteed by the authorization for a communications surveillance measure from a competent judicial authority, who shall be impartial, independent, and also versed in technology and shall have the appropriate resources to fulfill his or her functions on this matter.
In Colombia, the Constitutional Court has established the rule of judicial safeguard, which implies that the general principle in the Colombian legal system is for decisions that infringe upon human rights of those being investigated must involve judicial authorization.
The judicial control of intelligence activities is limited to communications interceptions, and does not apply in cases of communications monitoring.
Finally, the regulations on telecommunications do not mention the existence of a judicial order as a requirement for the delivery of users' identification data, which ignores the safeguards for individuals' rights, made up by the judicial revision of legality and proportionality of the measure taken.
In order to protect human rights that are affected by surveillance, the Principles require that the authorization of a communications surveillance measure be conducted in the framework of due process, which provides for a public hearing for the individual affected, within a reasonable time period (prior or subsequent to the authorization of the measure) in an independent, competent and impartial tribunal. Additionally, there must be opportunities for remedy.
One of the safeguards provided by the Principles is that all individuals subject to communications surveillance should be notified and allowed to challenge the decision. In criminal law, this Principle is guaranteed since an individual who has been surveilled has the opportunity to question the legality of the measures taken against him or her in a hearing. Depending on the stage where in which the criminal procedure is, the accused may have the ability to intervene in a hearing about the legality of the tracking measures or to request a new hearing to ask for the exclusion of evidence.
Intelligence regulations do not provide for user notification of communications surveillance, which is a State duty that may only be suspended—though not obviated—when certain circumstances arise, according to what is established by the Principles. In Colombia a person may not know whether there have been intelligence activities carried out against him or her in present time, or in the past. They may not ask for correction, nor is there a judge who controls certain intelligence activities that can have an impact on an individual's human rights.
The Principles require the implementation of transparency measures in the regulations on communications surveillance. The State should publish, at minimum, aggregate information on the specific number of requests approved and rejected, a disaggregation of the requests by service provider and by investigation authority, type, and purpose, and the specific number of individuals affected by each. The goal is to provide individuals with sufficient information to enable them to fully comprehend the scope, nature, and application of the laws permitting communications surveillance.
The Transparency Principle has been recognized in the decision made by the Constitutional Court about the scope of intelligence activities, demanding that they include elements for accountability, such as the submission of periodic intelligence and counterintelligence reports and a record of the authorized and conducted activities.
However, intelligence law does not provide for a public mechanism to oversee intelligence activities. Instead, it establishes internal and external controls of intelligence activities. Among the external ones, we find judicial intervention—limited to communications interception: It does not apply in cases of communications monitoring—and public control, in charge of the Legal Commission for the Monitoring of Intelligence and Counterintelligence Activities. This Commission has three main functions: to conduct political follow-up and oversight, to verify the efficient use of resources, and to confirm the legality of intelligence services actions. The powers of this Commission are devoted to inspecting the functioning of the oversight mechanisms of intelligence activities.
The first paragraph of Article 22 says that the Legal Commission shall be able to meet with the Joint Intelligence Committee, have access to the annual reports form inspectors, request additional information from the inspectors and the internal control offices, summon the chiefs and directors of the intelligence agencies and be acquainted with the national intelligence aims outlined in the Colombian National Plan of Intelligence. Thus, in order to verify the legality of the actions conducted by intelligence and counterintelligence agencies, the Legal Commission shall be limited to judge on the basis of the information that the agencies themselves provide, which is especially critical when it comes to secret activities, since those who conduct them may, as an excuse, say that information is confidential in order hide their actions.
In using this legal power, the government issued a decree requiring Internet and communications service providers to implement and guarantee the necessary technological infrastructure to allow competent authorities, with a prior authorization from the Office of the Attorney General, to conduct interception of communications.
Act 1621 relating to intelligence activities enables security agencies to request information that helps to identify and locate users from the telecommunications companies. However, the limits to these activities are the regulations provided for by the Political Constitution and by the Criminal Procedure Code.
Those provisions seriously affect the Principle of Integrity of Communication System.
The Principles take into account the existence of international mutual legal assistance treaties (MLAT) applying to communications surveillance, in order to guarantee the highest level of protection for individuals in each of the countries. Additionally, this Principle stipulates that whenever the States seek assistance for internal law enforcement purposes, the principle of dual criminality should be applied.
There is a Colombian-French agreement on information exchange about transnational organized crime.84 Article 2 of this agreement provides for regulations on the processing of identification data transmitted from one country to the other as a result of the agreed upon assistance. The communication of data must be conducted explaining which specific purposes it has and its period of use. When this period has finished, the data must be destroyed. The types of transnational crime considered for information exchange are: terrorism, asset laundering, drug trafficking, arms trafficking, counterfeit money, human trafficking, illicit trafficking of cultural property, industrial and intellectual property infringements, and illegal trafficking of natural resources.
Colombia has signed a treaty on security cooperation aimed at exchanging intelligence information with the North Atlantic Treaty Organization (NATO).85 This Agreement establishes measures for the exchange and protection of the information shared between the parties. Some of these measures include the protection of and safeguards for the information and material exchanged between the parties, which implies the observance of mutual security proceedings, as well as the commitment of confidentiality in relation to third parties, unless there is consent from the party originating such information.
There is also an agreement between Colombia and the European Police Office.86 Among other sorts of cooperation, this agreement is based on the exchange of information regarding serious international organized crime investigations, such as drug trafficking, crimes related to nuclear materials, illegal immigration, human trafficking, crimes related to motorized vehicles, counterfeit money and money laundering. The agreement provides for a series of provisions related to the purpose of exchanging information, the way of transmission and preservation, as well as the possibility to classify its level of confidentiality and the measures devoted to limiting and protecting the use of the exchanged information.
The International Convention for the Suppression of Terrorist Bombings87 provides for some multilateral agreements on information exchange. This Convention requests that the States exchange information related to the location of the individuals responsible for an offense and immediately take the necessary measures—which ought to be in accordance with national legislation—required to investigate acts related to terrorist bombings. It further establishes that any person who is taken into custody or has been involved in any other measures or proceedings shall be guaranteed fair treatment, including enjoyment of all rights and guarantees in accordance with the law of the State in the territory of which that person is present and applicable provisions of international law, including international human rights law.
A bilateral agreement between the Government of the Republic of Colombia and the Government of the Federative Republic of Brazil on Cooperation on Security matters also exists.88 The aim of this agreement is to promote cooperation between Colombia and Brazil on security matters, especially in investigation, logistic support, aviation, maritime and land industry, knowledge exchange about experiences and expertise, and mutual training activities, in order to enhance the responsiveness of national authorities in both countries and to increase the exchange of experiences, expertise and strengths in the many areas. The parties in this agreement are committed to keeping the confidentiality of the information and material exchanged between them.
The Principles establish that States should enact legislation criminalizing illegal communications surveillance by public or private actors, in order to protect communications privacy. Moreover, it stipulates that the law should provide avenues for redress by those affected.
The existence of this remedy is consistent with the case law of the Constitutional Court, which has held that “there is confidentiality with regard to the content of a public document, but not with regard to its existence.”92 This provides a solid justification to the idea that there should be a remedy by which individuals know whether there exists information against them, even if they could not have access to said document.
The lack of this remedy is even more serious when one takes into account that the communications history of the connected phones, the technical identification data of the users who are being surveilled, the location of cell towers and any other type of information that contributes to location must be delivered to intelligence agencies without the need for a judicial control whatsoever, despite the fact that this information interferes with the privacy of the users and, hence, it should have some kind of legal protection.
In order to adapt the Colombian legislation on communications surveillance to what is provided for by international human rights law, there are several alternatives that could be taken into account by civil society. The following are four recommendations; three of them are related to legislation and regulations on intelligence and counterintelligence activities, and the other is related to the obligations telecommunications companies have to cooperate with the national authorities.
The Colombian legal system provides for different actions that allow a challenge to the validity of the Colombian legislation that is at odds with international human rights law. Thus, Colombian laws—like the intelligence and counterintelligence law—may be contested through the action of unconstitutionality, and the decrees—like the one that regulates data retention—may be challenged through simple nullity. In the framework of a judicial process or administrative operation, it is also possible to present the applicability of the unconstitutionality exception, to request the invalidity of a regulation that is not recognized in the Constitution.
The action of unconstitutionality would be appropriate even for intelligence and counterintelligence law (Act 1621 of 2013), which was completely revised by the Constitutional Court, taking into account that in its sentence93 this court only dealt shortly with different serious aspects regulated by this act briefly, which would allow for a new sentence by the court, by virtue of the relating res judicata. The same happens, for instance, with the scope of the obligation to cooperate that the communications service providers have. In this issue, the possibility for these companies to conduct mandatory data retention has not been dealt with.
When it comes to the specific legislation on intelligence activities, the Advisory Committee for the Filtering of Intelligence Records (Comisión Asesora para la depuración de archivos de inteligencia) may be an interesting instance of advocacy, since its purpose is to make recommendations about policy in the framework of a serious issue related to communications surveillance: the filtering of intelligence records. In its report submitted to the national government, this commission may suggest important adjustments for the legislation on intelligence, such as the need for a mechanism that enables individuals to request information about the existence of intelligence activities conducted against them.
The Colombian legislation is particularly ambiguous in regards to the scope of the obligation that involves telecommunications companies handing over data to intelligence agencies. This should be clarified. As previously stated, Article 44 of Act 1621 requires that telecommunications companies deliver subscriber data to intelligence agencies, and in any case, the agencies shall limit their request to a time period of, at most, five years. This implies that, in order for this obligation to work, telecommunications companies should already have the data storage technology covering that period. What happens to the companies that do not have this technology is yet to be known, as well as what would happen to a company that has the technology but wants to stop using it. These issues must be solved by law.
There is also uncertainty about the scope of the regulation that stipulates that “Internet and telecommunications service providers must keep their subscriber information up to date and store it for at least five years.” It is necessary to clearly specify that this provision does not compel companies to keep data about users' communications or also known as metadata, since it would be a disproportionate intrusion on Colombian human rights.
Recent international revelations about the intensity and areas in which various authorities carry out communications surveillance have caught the attention of the civil society, interested in limiting the scope of action of the authority in order to guarantee the protection of human rights that are so often affected by surveillance activities. The achievement of this purpose poses a lot of different challenges: the most basic one is to understand the way in which the nation regulates State communications surveillance measures to understand what is legal and what isn't. One of the most complicated ones would be to identify the way in which said legislation is applied on the day-by-day, given the pace of technological advances that enable surveillance.
This report aims to be a tool for the assessment and debate about the necessary safeguards in Colombia in order to protect individuals' rights from State communications surveillance. Having this purpose in mind, this report has presented the regulations granting different agencies the power to conduct communications surveillance on individuals, seeking to schematically and comprehensively explain the legal framework in which they are immersed. It has also mentioned the national and international case law, as well as the application of specific regulations, aiming to provide an answer to the issues of adapting the regulations and practices of State communications surveillance to the protection of human rights.
Moreover, this report provides further recommendations applicable for the adaptation of the Colombian national legislation to the international standards for the protection of human rights against State communications surveillance.
Even though the legislation has begun to deal with diverse aspects of communications surveillance—criminalizing illicit data and communications access and regulating intelligence activities, among others—the regulations it provides fail to be absolutely clear, complete and sufficient, or in some other cases, the legislative brand has yielded these tasks to the executive power—for instance, the delimitation of the level of classification of intelligence information. The above poses a serious threat to the right to privacy, freedom of association or freedom of expression, which is why these must be taken into account by competent authorities. The inaction of the Colombian State in relation to the aforementioned problems may challenge, at an international level, its commitment to the acknowledgment of and respect for human rights.
5. Article 2.1 of the American Convention of Human Rights and Article 2.2 of the International Covenant on Civil and Political Rights.
12. International Principles on the Application of Human Rights to Communications Surveillance (2014). Available at: https://necessaryandproportionate.org/text [Accessed September 6, 2015]; See also, Frank La Rue, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, A/HRC/23/40, 17 April, 2013, page 3.
13. In the original paper, written in Spanish, the terms “privacy” and “intimacy” are synonyms. They both make reference to the same right. The former is used at the international level—where we speak of “private life”—and the latter is used at the national level—where we speak of the right to intimacy.
16. To see a more comprehensive analysis of the constitutional block doctrine, go to Carlos Ernesto Molina's complaint of partial unconstitutionality against article 19 of the Substantive Labor Code, sentence C-401, Constitutional Court, April 14, 2005, available at: http://www.corteconstitucional.gov.co/RELATORIA/2005/C-401-05.htm and Rodrigo Uprimny Yepes, Constitutional, Human Rights and New Criminal Procedure Block, Judicial School Lara Bonilla, Superior Council of Judicature, Bogotá, 2006.
17. On several occasions, the Constitutional Court has taken decisions made by the Inter-American Commission on Human Rights to interpret the regulations appropriate for its own decisions.
18. See Ernesto Rey Cantor’s complaint of unconstitutionality against articles 2 (partial), 3 (partial), 5, 6 (partial) 7 c) and f), 8 third section, 10, 11 (partial), 13 first section, 14, 15 (partial), 19 and 20 f) of Act 74 of 1966, through which the transmission of broadcasting services is regulated, sentence C-010, Constitutional Court, January 19, 2000, available at: http://www.corteconstitucional.gov.co/relatoria/2000/c-010-00.htm, in which the Court claimed that inasmuch as the Constitution establishes in article 93 that the constitutional rights and obligations must be interpreted in accordance with the international human right treaties ratified by Colombia, it is evident that the case law of international courts, in charge of interpreting these treaties, make up a hermeneutic criterion relevant to establish the meaning of constitutional regulations on human rights.
19. On multiple occasions, the Constitutional Court has granted a relevant nature to the decisions made by the UN Human Rights Committee, and in some cases, it has made them binding. For instance, in a case about freedom of expression, the Court maintained that For the purpose of this case, the constitutional block related to freedom of expression must be made up by international regulations, namely the Pact of San José and the International Pact on Civil and Political Rights, as well as the interpretations of those documents made by the Inter-American Commission on Human Rights, the Inter-American Court of Human Rights and the United Nations Human Rights Committee. Also, opinions shall be granted a different importance, for the judicial nature of the Inter-American Court of Human Rights and its power upon Colombia implies that opinions must be taken into account and shall not be domestically ignored. Rodríguez v. Alvarez, sentence T-1319, Constitutional Court, 2001. Also, see sentences C-872 of 2003, C-370 of 2006, T-391 of 2007, C-728 of 2009, among others.
23. Ben Emerson, Informe del Relator Especial sobre la promoción y la protección de los derechos humanos y las libertades fundamentales en la lucha contra el terrorismo, UN Doc. A /69/397, disponible en: https://eff.org/A-69-397.
25. Frank La Rue, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, 2013.
26. The Right to Privacy in the Digital Age, 2014.
29. Case of Escher et al v. Brazil, Interpretation of the Judgment on Preliminary Objections, Merits, Reparations, and Costs. Inter-American Court of Human Rights, sentence on July 6, 2009. Series C Nº 200, paragraph 114.
30. Tristán Donoso v. Panama, Interpretation of the Judgment on Preliminary Objections, Merits, Reparations, and Costs. Inter-American Court of Human Rights, sentence on January 27, 2009. Series C Nº 193, paragraph 55.
31. Uzun v. Germany, Case Nº 35623/05 European Court of Human Rights, sentence on September 2, 2010, paragraph 61 and Weber and Sarabia v. Germany. Case Nº 54934/00, sentence on June 29, 2006, paragraph 93.
32. Human Rights Committee, General Comment Nº 16, Article 17 - The Right to Privacy, paragraph 4.
34. See Juan Carlos Upegui Mejía, Habeas data. Fundamentos, naturaleza, régimen, Edition Universidad Externado de Colombia, Bogotá, 2008.
37. Constitutional Court, sentences T-129 of 2010, T-067 of 2007, T-411 of 1995, among others.
38. The case law on the non-absolute character of fundamental rights is abundant. In one of the sentences in which the Constitutional Court made reference to this, it indicated: “fundamental rights, regardless of their constitutionality and importance, are not absolute and, therefore, must be consistent with each other and the other goods and values protected by the Constitution, for, if otherwise, the absence of this essential relativism may lead to the impossibility of social and institutional life.” Constitutional Court, sentence C-239 of 1997.
52. Articles 236 and 237 of the Criminal Procedure Code.
53. According to article 213 of the Constitution, the state of internal disturbance is declared “in the case of a serious disruption of the public order imminently threatening the institutional stability and security of the State, or the peaceful coexistence of the citizenry—and which cannot be met by the use of ordinary powers of the police authorities”.
55. Act 1273 of 2009.
59. Tristán Donoso v. Panama, Inter-American Court of Human Rights (2009), paragraph 56 Escher v. Brazil Inter-American Court of Human Rights (2009), paragraph 116.
60. Myrna Mack Chang v. Guatemala, Series C Nº. 101, Inter-American Court of Human Rights, sentence on November 25, 2003, paragraph 284. Similarly, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, Case nº 62540/00, European Court of Human Rights, sentence on June 28, 2007, paragraph 77.
62. Sentence C-540, Constitutional Court, 2012.
65. Act 1341 of 2009.
66. Decree 1704 of 2012.
67. The use of the expression “or other competent authorities” has been temporarily suspended by the Council of State, which claimed that allowing authorities other than the Office of the Attorney General to have the power to request information from communications companies may infringe Act 1453 of 2011 and the Political Constitution. Council of the State - First section, filing number 11001-03-24-000-2013-00018-00, speaker Magistrate Guillermo Vargas Ayala, July 31, 2013.
68. Article 44 of Act 1621 of 2013.
70. Article 37 of Act 1621 of 2013.
71. Sentence C-540, Constitutional Court, 2012.
72. The national government regulated the levels of classification of intelligence and counterintelligence information through decree 857 of 2014.
74. El Tiempo, “Prosecutor says no to the interceptation system Puma of the Police”, August 30, 2015, available at: http://www.eltiempo.com/politica/justicia/sistema-de-interceptacion-de-la-policia-puma/14462092.
75. Article 5 of Act 1621 of 2013.
76. Article 17 of Act 1621 of 2013.
77. Article 31 of Act 1621 of 2013.
78. Articles 236 and 237 of the Criminal Procedure Code.
82. Article 237 and 238 of Act 906 of 2004.
83. Act 1341 of 2009.
89. Act 1273 of 2009.
93. Sentence C-540, Constitutional Court, 2012.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.