Expanding Freedom and Democracy
Freedom on the Net 2019

Colombia

Partly Free
67
100
A Obstacles to Access 17 25
B Limits on Content 27 35
C Violations of User Rights 23 40
Last Year's Score & Status
69 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.

header1 Overview

Internet access continues to increase in Colombia, but poor infrastructure, low digital literacy, and high costs still hamper widespread access. The online sphere also remained constrained by concerns over excessive surveillance, and journalists operate within a climate of threats and self-censorship. While prosecutions for dissemination of content online are rare, harsh penalties can be imposed for minor copyright violations, and criminal penalties for defamation continue to threaten users’ rights. Concerns over the impact of disinformation and misinformation online intensified ahead of a closely fought presidential run-off in June 2018.

Colombia is among the longest-standing democracies in Latin America, but one with a history of widespread violence and serious human rights abuses. The incidence of violence has declined in recent years, and public institutions have demonstrated the capacity to check executive power and enforce the rule of law. The government and the country’s main left-wing guerrilla group signed a peace accord in 2016, but Colombia still faces enormous challenges in consolidating peace and guaranteeing political rights and civil liberties throughout its territory.

header2 Key Developments, June 1, 2018 – May 31, 2019

  • The incoming government of Iván Duque pressed forward with programs to expand internet access across the country, notably those focused on public-private sector cooperation (see A1).
  • Two media workers were arrested for failing to comply with an order to remove a news item from their website, Corrillos. Press freedom advocates criticized the development, calling it harsh and implemented despite a number of procedural irregularities in the case (see B2 and C3).
  • Concerns over the impact of disinformation and misinformation online intensified ahead of a closely fought presidential run-off in June 2018. Among the disinformation campaigns was one that urged voters to abstain in the second round, claiming that their first round vote would still count (see B5).
  • In September 2018, charges were filed against a former senior police figure and others on allegations including abusive access to an IT system, personal data violation, malicious software use, and illegal interceptions (see C5).
  • A number of online media outlets saw digital attacks as they reported on a sprawling corruption scandal (see C8).

A Obstacles to Access

Internet access continues to increase in Colombia, although obstacles to access remain, including a lack of infrastructure in rural areas, low levels of digital literacy, and high prices for service. The incoming government of Iván Duque pressed forward with programs to expand internet access across the country, notably those focused on cooperation between the public and private sectors. The government does not place limits on bandwidth, nor does it impose control over infrastructure, except in emergency situations when internet service providers (ISPs) are required to make their infrastructure available for official response. A new ICT law passed in June 2019, after this report’s coverage period, was criticized for lacking safeguards to protect the independence of a new, powerful regulator.

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 4.004 6.006

Internet access continues to increase in Colombia, although obstacles to access remain, including a lack of infrastructure in rural areas, low levels of digital literacy, and high prices for service (see A2). According to official figures, the country’s internet penetration rate reached 62.2 percent in the third quarter of 2018, up from 57.7 percent the previous year.1 Internet access is facilitated primarily by DSL and cable connections.2

Colombia ranks relatively low in global rankings of mobile and fixed broadband speeds: Speedtest recorded an average fixed-download speed of 19.48 Mbps in May 2019.3 Colombia’s Commission for Communications Regulation updated the speed standards for broadband for 2019, stating that a minimum speed of 25 Mbps to download and 5 Mbps to upload are needed in order to be considered broadband.4

Government-led ICT projects to promote widespread access were under review during the coverage period, as the incoming government of Iván Duque launched a new sector policy called “El futuro digital es de todos” (the digital future belongs to everyone), with an emphasis on public- and private-sector cooperation.5 The ICT ministry under the presidency of Juan Manuel Santos had also promoted initiatives to connect people around the country,6 including plans focused on providing free Wi-Fi, as well as low-cost smartphones and mobile internet plans to new users with fewer resources.7

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 1.001 3.003

High internet prices and low levels of digital literacy continue to present substantial obstacles to internet access. A 2016 digital consumers’ survey revealed that 46 percent of respondents without internet in their homes cited high prices as the reason for not acquiring service, while 34 percent stated that they did not think the internet was necessary.1 However, the latest Affordability Drivers Index (ADI) report, which measures policy and regulatory factors that can enable more affordable broadband, ranked Colombia in second place, citing sound regulatory decisions to improve affordability and access in the country.2

Geographic and socioeconomic disparities in internet access are significant in Colombia.3 According to the ICT trade association the Colombian Chamber of Information Technology and Telecommunications (CCIT), some 75 percent of higher-income people have internet access, compared to lower-income people with less than 50 percent. There is also a gap between urban and rural areas; more than 80 percent of people are disconnected in some regions.”4

In rural areas, many Colombian users access the internet outside of their homes: almost 24.5 percent accessed the internet through cybercafés, and 43 percent through educational centers, while free public access points served 8 percent of internet users.5

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 6.006 6.006

The government does not place limits on bandwidth, nor does it impose control over infrastructure, except in emergency situations when internet service providers (ISPs) are required to make their infrastructure available for official response.1 The government has not centralized telecommunications infrastructure and does not deliberately shut down internet or mobile connections.

Colombia only has one internet exchange point (IXP), called NAP Colombia, through which ISPs exchange traffic to improve efficiency and speed. Located in Bogotá, the IXP is managed by the Colombian Chamber for Informatics and Telecommunications.2

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 4.004 6.006

Colombia is home to more than 300 ISPs.1 While approximately 82 percent of the market is concentrated in the hands of four companies, there are nonetheless multiple options for consumers and healthy competition.2 Market entry is straightforward, and it is possible for anyone to establish an ISP by following the general requirements of the ICT Law, which establishes free competition and prioritizes efficient use of infrastructure and access to ICTs.3

Registration requirements are neither excessive nor onerous. Business owners must provide personal and tax identification as well as a description of services, but no fee is required. This information is published in an open registry, and the ICT ministry has 10 days to verify the data before the business may begin operating. Registration can be denied when information is incomplete or false, or when an ISP does not have the proper commercial status to offer the necessary services.4 Service providers are obligated to pay a contribution of 0.01 percent of their annual income to an ICT Ministry Fund, Fontic, devoted to the development of nationwide ICT projects.5 ISPs must also apply for licenses to utilize the radioelectric spectrum, although there have been no complaints of difficulties or bias with this process. Some of these rules may change in light of the approval of a new ICT modernization law in June 2019 (see A5).

The mobile landscape is more concentrated than the ISP market. Although there are six providers, more than 93 percent of the market is in the hands of three companies: Claro, Movistar, and Tigo.6 Like ISPs, mobile service providers must also contribute 0.01 percent of their annual income to Fontic.

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 2.002 4.004

Colombia’s ICT sector has been subject to numerous regulatory bodies with varying but limited degrees of independence from the government.1 The president appoints the ICT minister, who oversees the telecommunications sector through the ICT ministry. The ICT minister also chairs the Communication Regulation Commission (CRC), which is responsible for ensuring efficient service and promoting competition in the telecommunications sector. It is made up of the minister and three commissioners who are also appointed by the president. The ICT minister designates the head of the National Spectrum Agency (NSA), which is the agency in charge of planning, managing and supervising the use of the radioelectric spectrum. While some have suggested that such an executive-driven design prevents objective oversight of the sector and affords the president undue influence over its operations, to date, there are no clear examples of executive bias in rulings.

Since 2010, a government-appointed concessionaire has been responsible for allocating the .co domain. For the domains org.co, edu.co, mil.co, and gov.co, applicants must comply with specific requirements; for edu.co, for example, the applicant must be an educational institution.2

In June 2019—beyond this report’s coverage period—Congress approved a new law for the ICT sector after months of contentious debate. It notably eliminates the National Television Authority and establishes a convergent regulator—the Communication Regulation Commission (CRC)—to be in charge of the ICT sector, television, and radio. Critics of the legislative proposal contend that the new regulatory body concentrates too many functions in the government, and lacks independence.3 The law also establishes that the CRC will have two decision-making entities: the Commission for Audiovisual Content, covering issues related to pluralism and audiences, and the Communications Commission, dealing with technical and market regulation. The former would have three members, two chosen through a public contest, and one chosen by regional channels. The latter would have five members: the ICT minister, a commissioner designated by the president, and three chosen through an open call for applicants handled by the government.4 As of October 2019, the law was under review by the Constitutional Court.5

B Limits on Content

Blocking or filtering of political, religious, or social content is not common in Colombia. However, in August 2018, two media workers were arrested for failing to comply with an order to remove a news item from their website, Corrillos; press freedom advocates criticized the development, calling it harsh and implemented despite procedural irregularities in the case. Disinformation and hateful content on social media networks surged during the hotly contested presidential campaign in 2018. Self-censorship is a notable problem for journalists and likely affects online publications.

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content? 5.005 6.006

Blocking or filtering of political, religious, or social content is not common in Colombia.1 YouTube, Facebook, Twitter and international blog-hosting services are freely available.

While no content is systematically blocked under Colombian law besides child sexual abuse images, in September 2018, Colombia’s gambling regulator submitted a list of over 1,800 gambling sites to be blocked by ISPs, following the approval of online gambling legislation in October 2016, which requires gambling sites to apply for a license. The regulator found that the sites were operating without authorization.2

Apps that rely on the internet to provide commercial services, such as Uber, have been the center of much debate, and the government has been trying to regulate Uber with little success. While the transportation ministry has argued in favor of blocking the app,3 the ICT ministry has invoked the net neutrality principle, which does not allow network operators to discriminate against specific content or services. ICT officials said that there are no grounds for blocking Uber, which is not illegal.4

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content? 3.003 4.004

The Colombian government does not regularly order the removal of content, although periodic court cases have resulted in judicial orders requiring the removal of specific information deemed to violate fundamental rights. News outlets separately report receiving threats intended to force them to remove content, as well as requests to eliminate content based on the “right to be forgotten.”1

In a controversial development in August 2018, two media workers were arrested for failing to comply with an order to remove a news item from their website, Corrillos (see C3). Press freedom group FLIP criticized such a drastic measure and various procedural irregularities in the case, which it said had forced the outlet to remove the item without offering the opportunity to present evidence to support its reporting.2

In May 2018, the Constitutional Court annulled a 2017 decision ordering Google to remove an anonymous post from its Blogger platform for alleged defamation.3 The blog post had accused a furniture company, Muebles Caquetá, of scamming its clients. Digital rights groups had expressed concerns about the dangerous precedent that this decision, if allowed to stand, could have set for freedom of expression on the internet.4 The annulled decision had notably ordered Google, in general, to actively remove anonymous defamatory contents upon notice, without a judicial order.5

Separately, a site that publishes consumer complaints against a government entity was repeatedly accused of infringing on that entity’s trademark, resulting in its removal. The website icetextearruina.com was first taken down in March 2016 by hosting provider GoDaddy on the basis of a complaint from ICETEX, an official entity in charge of student loans. The website is owned by the Association of Users of Student Loans (ACUPE), a legally recognized organization that denounces allegations of abuse involving loans. Civil society organizations said ICETEX was abusing GoDaddy’s complaints system to censor the allegations.6 The site remained inaccessible during the coverage period of this report.7

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 3.003 4.004

Police and other institutions may limit content on a range of topics, from sexual abuse to “inappropriate content” or “other issues,” in order to protect minors.1

Child sexual abuse images, which are illegal under international law, are subject to blocking.2 Decree 1524 (2002) requires ISPs to undertake technical measures to prevent the online availability of child sexual abuse images.3 The possibility for civil or judicial oversight for restriction of such content is limited because information about which websites are blocked is classified—possibly out of fear that individuals would use circumvention tools to access such material if a list of banned sites were made public.4 The multistakeholder group Te Protejo (I Protect You) is an alliance led by the civil society organization RedPaPaz, and reports websites that host child sexual abuse images to the authorities.5

Online gambling legislation also allows for the blocking of websites, but there is no centralized, public reporting system for why sites are blocked, and the reason is not always disclosed. In some cases, the user is redirected to a site in which the reason of blocking is given, but in other cases no reason is given. There are discussions of abuses in which, for example, entire websites are blocked due to advertisements.6

In 2017, the ISP ETB began to publish a transparency report on blocking orders, followed by four other ISPs in 2018. Nevertheless the information that is given is not always comprehensive. Fundación Karisma, in their December 2018 report Dónde están mis datos (Where is my data), notes that while information on the blocking of child sexual abuse images is somewhat clear, blockings related to gambling and cases of emergency are more opaque. In addition, there are no mechanisms to appeal blocking decisions.7

In May 2015, a court ruling strengthened the precedent that search engines should not be held liable for linking to content, even if the content has been found to violate the law.8 Although observers praised the fact that it exempted intermediaries from liability,9 some worried that the ruling might place an excessive burden on other digital content producers or publishers, because it required an online newspaper involved in the case to take steps to make the disputed information in question harder to find.10

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 3.003 4.004

Self-censorship is a notable problem for journalists and likely affects online publications.1 According to a 2016 national survey of journalists by Proyecto Antonio Nariño (PAN), an alliance of organizations focused on freedom of expression and access to information, 25 percent of respondents stated that they avoided publishing information due to fear of aggression; 21 percent feared losing their jobs or having their media outlets closed; and 21 percent knew about media that avoided publishing information due to fear of losing advertising revenue.2

  • 1Although there are studies concerning self-censorship among journalists, to date, there are none concerning self-censorship among ordinary internet users.
  • 2“Encuesta Nacional a Periodistas sobre Libertad de Expresión y Acceso a la Información- presentacion de resultados,” [Presentation of survey results on Freedom of Expression and Access to Information in Colombia], FLIP, December 16, 2015, https://flip.org.co/index.php/es/publicaciones/informes/item/1855-terce….
B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 3.003 4.004

Concerns about the spread of disinformation and hateful content on social media networks surged during the hotly contested presidential campaign in 2018. In addition to Twitter and Facebook, WhatsApp was a popular platform for sharing misinformation: the project El Poder de Elegir (The Power to Choose) verified a number of such chains circulating on the closed messaging platform.1

In a study conducted between January and June 2018, the Electoral Observation Mission (MOE), an election monitoring group, found that “social media allowed a great conversation about the electoral process, but this was not necessarily more plural, transparent, or deliberative. The communities that share false information do not interact with communities that deny it.” Moreover, it found that social networks generally performed a propagandistic function.2

In February 2018, a Twitter user found that a network of media portals that normally specialized in motorcycles, pets, maternity, and sports was being used to disseminate propaganda and misleading information favorable to presidential candidate Iván Duque.3 In February, a digital safety firm calculated how many fake followers the presidential candidates had on Twitter, and found that over 35 percent of the followers of the three most popular candidates on Twitter were fake.4

Concerns about the reach of online disinformation escalated ahead of the run-off elections held in June 2018, as viral hoaxes made headlines.5 That month, the attorney general’s office opened an investigation into the suspected author of false social media posts that urged voters to abstain in the second round, claiming that their first round vote would still count.6

On the other hand, researchers did not find significant evidence of botnet operations. Looking at the amplifiers of misinformation, Atlantic Council’s Digital Forensic Research Lab found that “the main vectors of false or misleading claims were not bots or “dark” entities, but high-profile and well-known partisans or politicians.”7

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

Many online news outlets are thought to avoid coverage of certain issues in order to maintain relationships with advertisers, whose purchases provide the outlets with revenue. According to the 2016 national survey of journalists by Proyecto Antonio Nariño, between 40 and 66 percent of respondents believed that media outlets in their region modify their editorial positions to protect advertising revenue, depending on the region; 64 percent said that the way official advertising is awarded is opaque; and 75 percent agreed that it is necessary to change the way in which official advertising contracts are allocated.1

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity? 3.003 4.004

Colombia has several digital media outlets and online spaces for political debate, and Colombians are able to view and disseminate a wide range of content. However, social media platforms were dominated by battles between rival campaigns in the lead-up to the presidential election in 2018.

Many professional media enterprises thrive in Colombia’s largest cities and, in general, authorities do not interfere with their operations. However, there is a lack of media diversity in many regions. According to the Foundation for Press Freedom (FLIP), 19 out of 21 departments studied had no media presence to produce and disseminate local information.1 Out of almost 1,335 media outlets operating in those regions, only 113 were digital, due to the low internet penetration rate outside large cities.2

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 5.005 6.006

Colombian social movements increasingly use online platforms for advocacy. Campaigns such as #CompartirNoEsDelito (Sharing is not a crime) have sought to promote open access to information and protest Colombia’s intellectual property law, which can carry harsh penalties and has been used to punish academics who shared research online (see C3).

Since 2011, the government has made four attempts to strengthen the legal framework for intellectual property in order to meet obligations under a trade agreement with the United States, but critics said the measures could make the situation worse.1 Advocacy efforts by civil society, copyright experts and the academic community, and pressure from social media, may have motivated lawmakers to put these initiatives on hold.2

  • 1The first was rejected in Congress; the second, although it became law, was declared unconstitutional by the Constitutional Court; the third project lost the support of the national government; the last one was introduced to Congress, but later withdrawn.
  • 2Perla Toro Castano, “La nueva ley Lleras recarga el ciberespacio de protestas,” [The new Lleras law fills cyberspace with protests], El Colombiano, March 28, 2012, https://www.elcolombiano.com/historico/la_nueva_ley_lleras_recarga_el_c….

C Violations of User Rights

The constitution provides protections for freedom of expression, but impunity for acts of violence severely threatens this right in practice. Colombia maintains criminal penalties for defamation, as well as harsh penalties for copyright violations, and lacks the flexible fair use standards employed in many countries. Concerns about illegal surveillance by certain sectors of the government and military persist. In September 2018, charges were filed against a former high member of the police and others on charges of abusive access to an IT system, personal data violation, malicious software use, and illegal interceptions. Several cyberattacks targeted news websites that reported on the corruption scandals.

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 3.003 6.006

Article 20 of Colombia’s National Constitution guarantees freedom of information and expression and prohibits prior restraint. Article 73 further provides for the protection of “the liberty and professional independence” of “journalistic activity.” Although there are no specific provisions protecting freedom of expression online, bloggers have the same liberties and protections as print or broadcast journalists.1 The Constitutional Court confirmed the application of such protections to the internet in a 2012 ruling.2

Impunity for perpetrators of violence is a pervasive problem in Colombia’s judicial system and represents a grave threat to freedom of expression, according to rights advocates.3

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities? 2.002 4.004

Colombia maintains criminal penalties for defamation. According to the Colombian penal code, individuals accused of insult can face up to six years in jail and a fine, while individuals accused of libel can face between fifteen months and four-and-a-half years in jail, also with possible fines.1 Cases pertaining to online defamation have occasionally been brought before the court with varying outcomes.

The penal code includes a concerning provision regarding online publication or reproduction of insults. According to Article 222 “whoever publishes, reproduces, or repeats insult or libel” may also be subject to punishment. This article raises concerns as it leaves open the possibility for charges of indirect insult and libel. The penal code also establishes the use of “social mediums of communication or of other collective divulgence” as an aggravating circumstance that can increase the penalty for insult or libel.2 However, courts have not held intermediaries responsible for defamatory content created or shared by third parties.

Colombia has harsh penalties for copyright violations and lacks the flexible fair use standards employed in many countries. In a prominent case, student Diego Gómez was charged in 2014 with violating copyright violations for uploading an academic thesis onto Scribd.3 Digital rights groups heavily criticized the decision to prosecute, especially when he did not claim to have authored the thesis and did not profit by sharing it.4 He was finally cleared of criminal charges in 2017.5

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities? 5.005 6.006

Prosecution, imprisonment, or detention for ICT activities is quite rare in Colombia, and writers, commentators, or bloggers are not systematically subject to imprisonment or fines for posting material on the internet. However, the detention of two media workers for not complying with an order to remove a news report from their website raised concerns among press freedom groups in 2018.

On August 9, 2018, Juvenal Bolívar, a journalist of Corrillos, and Sofía Ortíz Delgado, a former administrative worker with the same outfit, began serving a 10-day sentence that was arbitrarily imposed by a civil court in the city of Bucaramanga. The sentence was issued after Bolívar refused to comply with a ruling ordering him to withdraw an investigation into a city official from his website, after a process plagued by procedural irregularities.1

Threats to criminally prosecute users for spreading “economic panic” also threatened freedom of expression.2 In late 2018, after the Colombian holding company Aval Group was implicated in the Odebrecht corruption scandal, an online Twitter campaign urged people to close bank accounts in the companies it owns. The country’s financial superintendent announced that users could be criminally charged for causing economic panic under the penal code.3 The information was submitted to the attorney general’s office for investigation, and the move was supported by the vice presidency of Colombia.

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 3.003 4.004

Colombia has no general restrictions against anonymous communication, and there are no registration requirements for bloggers or cybercafé owners, though users must register to obtain telecommunication services. Police have access to a database that must be maintained by telecommunication service providers. This database contains user data, such as name, identification number, place and residence address, mobile phone number and service activation date.1 Users must provide accurate information under penalty of perjury, which is punishable by a minimum of six years in prison.2

In April 2017, the prosecutor general announced a proposal to force WhatsApp and other internet intermediaries to decrypt users’ communications for law enforcement purposes.3 Even though the proposal was never enacted, the announcement raised concerns about the state’s surveillance ambitions, as well as officials’ lack of understanding regarding technology like encryption.4 (Providers that encrypt communications end-to-end cannot decrypt them.)

Since 1993, Colombian law has banned the use of “communication devices that use the electromagnetic spectrum” to send “encrypted messages or messages in unintelligible language.”5 In response to an information request, the ICT ministry explained that those provisions apply only “to the content of the communications, not the encryption of the medium.” Despite the ambiguous wording of the law, the ICT ministry further claimed that these provisions only apply to radio-like devices and not to the internet.6 The Intelligence and Counterintelligence Act stipulates that telecommunications service providers may only offer encrypted voice services to intelligence agencies and “high government” officials.7

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

Episodes of extralegal surveillance carried out by intelligence agencies, the army or the police, have constituted an ongoing scandal in Colombia in recent years. Some steps have been taken to punish perpetrators of illegal surveillance, although it seems unlikely that these efforts have changed the overall environment, as intelligence agencies continue to operate with minimal oversight. Concerns about illegal surveillance by certain sectors of the government and military persist.

Intercepting personal communications in Colombia is authorized only for criminal investigation purposes and legally requires a judicial order.1 Colombian law allows intelligence agencies to monitor devices which use the electromagnetic spectrum to transmit wireless communication without a judicial order.2

Several Colombian civil society organizations have criticized the excessive and apparently uncontrolled use of surveillance tools in the country, which they argue has been facilitated by “weak legislation” on intelligence matters.3 In July 2015, documents leaked from the technology company Hacking Team, which is known to provide spyware to governments, suggested that the Colombian government had contracts with the company. Leaked emails referenced the National Police Office’s purchase of Hacking Team’s Remote Control System (called Galileo), which is capable of accessing and hijacking the target devices’ keyboard, microphone, and camera. Police would only acknowledge having contractual ties with a Colombian company called Robotec, which distributes Hacking Team’s services,4 though the leaked documents indicate that the National Police contacted Hacking Team directly to activate spyware.5 Another leaked email suggested that the US Drug Enforcement Agency (DEA) may be conducting surveillance in Colombia.6

In September 2015, police reportedly said that they would start testing a centralized platform for monitoring and analysis known as PUMA. They said telephone lines would be subject to monitoring, but not social networks and chats.7 The prosecutor general’s office had earlier ordered police to stop developing PUMA because of a lack of transparency and insufficient guarantees to ensure its lawful use. Journalists initially reported that the government was investing over $100 million in a monitoring platform in 2013. The system was intended to provide the government with the capacity to intercept telephone and internet communications in real-time, including private messages.8

Also in 2015, Privacy International found that the Bogotá police had bought technology from the companies NICE (sold to Elbit Systems the same year) and Verint that could intercept phone calls in order to monitor government opponents. According to an October 2018 investigation by Haaretz, Colombia has continued to purchase technology from Verint.9

Courts have sought to rein in illegal surveillance, sentencing former public officials involved in wiretapping scandals. In September 2018, the general attorney’s office filed criminal charges against a former high member of the police (retired general Humberto Guatibonza), a hacker, and three ex-members of the army for alleged illicit association, abusive access to an IT system, personal data violation, malicious software use, and illegal interceptions. While the investigation goes along, the alleged criminals are under house arrest.10

Several former heads of the now-dismantled government Administrative Security Department (DAS), notably Fernando Tabares, Jorge Noguera, and Maria del Pilar Hurtado, were convicted for illegal wiretapping in 2015. Bernardo Moreno, former secretary of the president’s office, also received an 8-year prison sentence on charges of illegally intercepting private communications of journalists, politicians, and civil society groups.11 Noguera was called to trial again and sentenced to 94 months in prison for his part in illegal interception activities against human rights defenders, journalists, and civil society organizations.12 Military officials were fired in early 2015 following a high profile wiretapping scandal.13

C6 1.00-6.00 pts0-6 pts
Are service providers and other technology companies required to aid the government in monitoring the communications of their users? 4.004 6.006

Service providers are required to collaborate with intelligence agencies by providing access to the communications history or technical data of any specific user without a warrant.1 Service providers are obliged to retain data for the purposes of criminal investigations and intelligence activities for a period of five years.2 An additional threat to user privacy comes in the form of Article 2 of Decree 1704 (2012), which requires that ISPs create backdoor access points for criminal investigation purposes—which can be used under the prosecutor general’s authorization. A service provider that does not comply with these obligations faces fines and could lose its operating license.3

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in retribution for their online activities? 3.003 5.005

Corruption, longstanding armed conflict and associated surveillance, and the war against drugs are the greatest threats to freedom of expression in Colombia, although online journalists have not been attacked as often as print journalists. According to FLIP, at least 21 journalists have been murdered and many more have been threatened since 2005.1 There is no broad trend of retaliation specifically for online content, but the high level of intimidation towards media and human rights defenders creates a climate of fear that also affects online journalists.

Journalists reporting on sensitive topics frequently receive threats and harassment online.2 In July 2018, a threat signed by the paramilitary group Central Bloc of Las Águilas Negras circulated, in which Jineth Bedoya and the journalists of news website La Silla Vacía were stigmatized as guerrillas and declared a military target. The names of other activists, social leaders, human rights defenders, and trade unionists also appeared.3 The same month, the journalist María Jimena Duzán received a rape and death threat through Twitter;4 also in July, journalist Vanessa de la Torre received death threats on Twitter after criticizing former president Álvaro Uribe.5 In May 2019, journalists of the New York Times were attacked by public officials online, after they published a story about the Colombian Armed Forces.6

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 1.001 3.003

In 2018 and 2019, FLIP recorded at least 14 cyberattacks against websites.1

Several attacks targeted news websites as they reported on corruption scandals. In November 2018, La Nueva Prensa was taken offline by a DDoS attack during the outlet’s live broadcast of a Senate debate on political control and now-former attorney general Néstor Humberto Martínez’s ties to the Odebrecht scandal.2 Its editor announced that his page had suffered damages on two occasions in early December. When trying to access the portal on the internet, users found the following message: "This Account has been suspended. Contact your hosting provider for more information."3

From late November until mid-December, 2018, the news portal Cuestión Pública was the target of over 200 cyberattacks from at least 81 IP addresses, in which strangers tried to access the website's content manager to modify or delete published articles. The attacks began when the outlet published an article linking members of the Aval Group, a Colombian holding company; government officials of former president Álvaro Uribe’s administration; and other people close to Odebrecht with corruption in the work of La Ruta del Sol, a major national transit corridor.

In March 2019, the website of media outlet La Línea del Medio collapsed after malicious JavaScript was injected into the programming of the website. This happened shortly after the outlet made public a letter addressed to the UN secretary general, signed by several former peace negotiators, congressmen, former officials, academics, and other citizens, in which they rejected the oppositions presented by the president of Colombia to the Law of the Special Justice for Peace (JEP) created with the peace agreement. After the attack, the engineers of the outlet managed to reestablish access to the portal. The information was not affected, as the programmers of the website had backup copies.4

Various types of cybercrime, including hacking, illegal interception and use of data, and the distribution and use of malware are criminalized under Law 1273, which was passed in 2009. Penalties range from three to four years’ imprisonment, along with fines.5 While phishing—the stealing of sensitive personal data via malware disguised as legitimate email—appears to be a significant issue in Colombia,6 most evidence of hacking and other interception has involved interagency spying and intelligence work carried out primarily by the government, the army, and other official bodies (see C5).

Following a scandal that implicated military officials in wiretapping abuses in early 2014, then president Santos announced the creation of a commission to strengthen national cybersecurity.7 Colombia partnered with the Organization of American States (OAS) to develop the Colombian Cyber Emergency Response Group (coICERT) and the Cyber Police Center (CCP).8 A digital security policy released by the government in April 2016 covered issues ranging from national defense and the protection of critical infrastructure, to cybercrime and digital risk management.9 Civil society groups criticized the policy for focusing on military and economic issues at the expense of broader social and human rights concerns.10

On Colombia

See all data, scores & information on this country or territory.

See More

Country Facts

  • Global Freedom Score

    70 100 free

  • Internet Freedom Score

    65 100 partly free

  • Freedom in the World Status

    Partly Free

  • Networks Restricted

    No

  • Websites Blocked

    No

  • Pro-government Commentators

    No

  • Users Arrested

    Yes