VPNs with servers in El Salvador

Decree 552 (Diario Oficial 225, 29 November 2022) added to article 32 a duty to keep registers of users, with no anonymous accounts or accounts under false names. Its new article 43 binds operators holding geolocation data or records to cooperate with the Attorney General and to provide platforms for direct access to the databases required.

Article 47 of Decree 285 also obliges operators to give prosecutors, on a reasoned order, line, call, e-mail and other telecommunication records within set deadlines, and to keep all those records for not less than ten years. Whether a VPN operator is an operator within article 4(e) is not established.

The Special Law against Computer Crimes and Related Offences (Decree 260 of 2016) punishes sexual content involving children, adolescents or persons with disabilities made, distributed or held through information technology: article 28 (four to eight years), article 29 (eight to twelve years for producing or distributing it), article 30 (two to five years for acquiring or possessing it) and article 31 (eight to twelve years for corrupting them).

The same law punishes a person who torments, harasses, humiliates, insults or denigrates a child, adolescent or person with disabilities through information technology with two to four years (art. 32). Impersonating a person’s identity carries three to five years, more where personal data are taken (art. 22); unwanted sexual conduct online carries four to six years (art. 27); and intercepting transmissions without justification carries seven to ten years (art. 21).

Article 24 of the Constitution allows interception only temporarily and with a written, reasoned judicial authorisation, as Decree 552 recites. The state of exception declared on 27 March 2022 suspends Articles 12(2), 13(2) and 24, and the extension decree of 31 July 2025 maintained all three for 30 days.

Article 49 of Decree 285 provides that, in a state of exception suspending Article 24, the declaring decree may widen the offences open to interception, but prior judicial authorisation and the law’s procedure continue to apply.

In January 2022 Citizen Lab confirmed Pegasus infections on 37 devices of 35 people, journalists and civil-society staff, between July 2020 and November 2021. It did not conclusively attribute them to a government customer, but found a strong El Salvador government nexus. The order of the rows is the security score, and a server’s location is not a recommendation.