VPNs with servers in Cuba

Decree 42, the General Regulation, lets persons who contract network infrastructure from public operators provide value-added services to third parties only with the Ministry of Communications’ prior authorisation (art. 6), and requires authorisation from the competent entity for private networks that use cryptographic protocols (art. 8(2)). Neither text sets a retention period for traffic or subscriber records. Whether a VPN operator is covered by these duties is not established.

Decree-Law 35 requires operators and providers, in coordination with the competent authorities, to apply technical measures of operation and supervision, or to interrupt services, when their networks transmit false, offensive or degrading information, or content contrary to public morality or public order, or serve to commit unlawful acts (art. 69).

Decree 42 requires them to suspend the service or end the contract of users who use it for such content (art. 53(b)). Users must not use public services to attack State security and internal order, to transmit false reports or news, or to commit unlawful acts (Decree-Law 35, art. 15(e)).

Law 151 of 2022, the Penal Code, punishes propaganda inciting against the social order, international solidarity or the socialist State with three to eight years’ deprivation of liberty, four to ten where mass media in their physical and digital spaces are used (art. 124). Whoever permits that use of such media, or of a medium in their care, faces two to five years (art. 124(3)–(4)).

Knowingly spreading false news or malicious predictions to cause alarm, discontent or disinformation carries one to three years or a fine, and two to five years where social networks or mass media are used (art. 266). Public defamation of State institutions, mass organisations, heroes and martyrs carries two to five years or a fine (art. 270).

The Constitution makes correspondence and other communications inviolable, to be intercepted or registered only through a warrant issued by a competent authority, in the cases and with the formalities the law sets (art. 50). Decree-Law 35 obliges providers to build interception facilities into their systems (art. 68(c)); it creates no separate oversight body for interception. The order of the rows is the security score, and a server’s location is not a recommendation.