Earlier this month, El Salvador’s Legislative Assembly approved a reform to the country’s Criminal Procedural Code on computer crimes that could infringe on privacy and chill free expression and association.
Under the reform, digital agents operating under police control would conduct “necessary undercover digital operations” to investigate crimes under El Salvador’s Special Law Against Computer Crimes and other “special laws.” The agents would operate with the Attorney General Office’s approval and without a court order. The reform is vague about the scope of the agents’ operations, raising questions about the extent to which they will be allowed to intrude on privacy rights. It also does not specify or limit the circumstances in which agents might be deployed, and establishes no independent oversight to audit cases, raising transparency and accountability concerns.
These provisions are particularly troubling against the background of other amendments the assembly made to the Special Law Against Computer Crimes in December, which define offenses in broad and vague terms. For example, one of the amendments would criminalize using technology to obtain or distribute “confidential” information, a provision that could easily be misused against journalists, advocacy groups, or whistleblowers. Several organizations, including digital rights group Derechos Digitales, expressed alarm at the reforms.
The reforms come in the context of multiple Salvadoran government efforts to stifle dissent. Last November, the government proposed a “foreign agents” bill that, if passed, would heavily restrict the work of journalists and civil society.
Recent reports that Pegasus spyware, which enables surveillance of a person and their contacts through their mobile phone, had been used to hack at least thirty-five Salvadoran journalists and civil society members also raise significant concerns over illegal surveillance. Attorney General Rodolfo Delgado, appointed by the government’s ruling party, said he would investigate the allegations.
Israel-based company NSO Group, which develops and sells Pegasus spyware, says it only sells its products to governments and law enforcement agencies. The Salvadoran government has denied using Pegasus and being an NSO Group client. NSO reportedly declined to comment on whether El Salvador was a Pegasus customer. NSO also said it is not involved in surveillance operations and that its policies bar misuse of its spyware for activities such as monitoring dissidents, activists, and journalists. However, evidence indicates that Pegasus is being used for this purpose in multiple countries.
In this context, the recent computer crimes reforms look like an attempt to provide legal cover for surveillance or harassment of journalists and others. It is more important than ever for the international community to support their efforts to counter the government’s authoritarian tendencies.
