VPNs with servers in Colombia

Article 44 of Law 1621 of 2013 obliges telecommunications operators, on a written request of an intelligence agency’s director in an authorised operation and where technically feasible, to supply the call history, subscriber identification data and cell locations of the subscribers concerned. The request may cover no more than five years.

Operators must also announce network changes that affect interception at least 60 days ahead and make interception equipment available at a reasonable cost (art. 44, para. 1). Whether a VPN operator is a provider of telecommunications networks and services within these provisions is not established.

Law 679 of 2001 forbids providers, administrators and users of global information networks to host images, texts or audiovisual files involving sexual activity with minors, pornographic material where there are indications that those shown are minors, or links to sites distributing such material (art. 7).

They must report crimes against minors, combat the spread of such material by all technical means available, and set up technical blocking mechanisms with which users can protect themselves or their children (art. 8).

The Criminal Code (Law 599 of 2000) punishes injuria, a dishonouring imputation (art. 220), with 16 to 54 months and a fine, and calumnia, the false imputation of a criminal conduct (art. 221), with 16 to 72 months and a fine. Penalties rise by a sixth to a half when a mass medium is used (art. 223). Proof of truth is a defence, with listed exceptions (art. 224).

Law 1273 of 2009 adds computer offences: unauthorised access to a system (art. 269A) carries 48 to 96 months, and intercepting data without prior judicial order (art. 269C) 36 to 72 months. Providers hold the subscriber data under Decree 1704, article 4.

Article 17 of Law 1621 separates monitoring of the electromagnetic spectrum, which it says is not interception, from interception of private telephone conversations and private data communications. The latter must satisfy article 15 of the Constitution and the Code of Criminal Procedure and may take place only within judicial proceedings. Spectrum information that serves none of the law’s purposes must be destroyed.

A joint legal commission of eight members of Congress, four from each chamber, follows intelligence activities (art. 21). Operators are not liable for how agencies use the user data they supply under article 44. The order of the rows is the security score, and a server’s location is not a recommendation.