How Colombia built a shadow state, a new Privacy International investigation reveals

“We always assume we are being watched. It is part of our understanding,” explained Father Alberto. The clergyman knows what it's like to live under surveillance. Father Alberto is Executive Secretary of the Inter-ecclesiastical Commission for Justice and Peace in Colombia, which supports displaced and conflict-affected communities in their struggle for justice. The CIJP also works in the restive Urabá region, where they document and litigate on the links between neo-paramilitary groups, private companies and the Colombian military.

He adds “We think it’s a tactic to wear us down. We get tipped off by people in the state. They tell us ‘people are listening to you.’...

Father Alberto is one of the many Colombians with whom Privacy International spoke for our investigation released today, Shadow State: Surveillance Law and Order in Colombia.

Our investigation presents the clearest picture to date of the state of surveillance in Colombia. The key agencies in Colombia that monitor communications compete for resources and capabilities. This has resulted in overlapping, unchecked systems of surveillance that are vulnerable to abuse. Agencies' appetite for capturing and analysing more and more communications data, coupled with poor regulation and oversight of what they are doing, leaves the entire surveillance infrastructure open to serious abuse

Systems and scandals

Colombia has been fighting various armed insurgencies for over 50 years. This has involved a massive amount of spying, facilitated by an extensive defence budget bolstered by international aid.

For nearly two decades, the Colombian government has been expanding its capacity to spy on the private communications of its citizens. But efforts were not well coordinated.

The nation’s most visible communications interception system is Esperanza (Sistema Esperanza). The Office of the Attorney General (Fiscalía General de la Nación, ‘Fiscalía’) manages and administers the system and it is heavily supported by the US Drug Enforcement Agency (DEA). Esperanza can obtain mobile and fixed-line call data.

The system has always had its limitations it relies on telecommunications operators' compliance and is targeted towards specific requests. And it has had other technical problems with its software and analysis platforms, as outlined in our report. The access of agencies like the Police judicial investigation directorate (DIJIN) to Esperanza's intercepted data was also subjected to firm interception quotas.

By 2007, the Police had had enough of these restrictions. They started to build the Single Monitoring and Analysis Platform ('PUMA') which aimed to capture communications data in a different way. Unlike Esperanza, PUMA would be an automated interception system placed in the backbone of Colombia's telecoms, which had the capacity to collect en masse the data travelling through it. Additionally all data that passed through the interception system would be available for analysis at monitoring centres. Israeli companies Verint Systems Ltd, and later NICE Systems, won contracts for this system.

A surveillance system managed by another branch of the Police, the Police intelligence directorate (DIPOL), also has mass surveillance capacities. The Integrated Recording System it managed collected and stored communications data using technologies from Israeli company Verint Systems Ltd. Over a dozen international companies, primarily from the US, the UK and Israel have worked with Colombian partners to build a surveillance infrastructure in Colombia. These companies' dealings feature in Privacy International investigation Demand/Supply: Exposing the Surveillance Industry in Colombia, which will be released this Wednesday.

Where there is lack of oversight, there is abuse. In 2009, it was revealed that the now-disbanded Administrative Department of Security (Departamento Administrativo de Seguridad, ‘DAS’) had surveilled and harassed over 600 public figures.

Setting the record straight

The scandals have had some positive impacts, too. The Colombian government has reformed its surveillance laws, interrogated its technical capabilities, and even disbanded one of its security agencies in light of revelations about the abuse of surveillance systems. Yet more work remains to be done to ensure that surveillance in Colombia does not violate Colombians' constitutional right to privacy (article 15). The expansion of the PUMA system appears to be proceeding without public consultation and the government has been negotiating the purchase of controversial and highly intrusive surveillance malware, which is not regulated under Colombian law.

Father Alberto is sceptical of the PUMA system's value as a law enforcement tool without a fundamental realignment of intelligence priorities. “There may be people who want to use it [PUMA] for good internally. But people who want to follow laws have difficulties because there hasn’t been a cleansing of the DAS involved in interceptions. When the institutions were changed, people were just reassigned elsewhere. Military intelligence has not been changed.”

We recommend that the Colombian Senate Legal Commission for the Monitoring of Intelligence and Counter- Intelligence Activities convene a hearing to determine how Colombia’s national intelligence and police agencies acting under the authorisation of the 2013 Intelligence Law were carrying out interceptions. This would be the first step to gaining transparency on the ways in which the government spies on its citizens and ensure that these activities are in line with domestic law and international norms. Surveillance needs to be necessary and proportionate. Mass surveillance is neither.