Peru bill could imprison average internet user
4:13pm | 3 July 2012 | by Peter Micek, English
Access is concerned over a new Peruvian proposal to impose criminal penalties for a variety of computer-assisted acts.
The Peruvian Congress has drafted a proposal to amend the country’s Criminal Code by introducing new crimes related to the use of information communication technology. The proposal aims to guarantee Peruvians their "right to development." However, it is difficult to see how the proposed law would aid the average citizen or their development, in economic, political, social, or legal terms.
In the latest version of the bill made public, Article 23 allows police to demand personal data, including name, address, phone numbers, IP addresses, and "phone call traffic" from ISPs within 48 hours of the request, without requiring a court order. Currently, the Peruvian Constitution protects this data under the right to the secrecy of communications, but the new law would override that provision. Companies must comply with requests for data if police are acting "in fulfillment of their functions." But private companies should not be forced to vet the motivations of police. Indeed, that is the role of judges and courts. By empowering prosecutors and law enforcement over the judiciary, this bill poses a serious risk to due process and civil liberties and overrides the Peruvian Constitution.
It is easy to imagine this law negatively impacting freedom of speech in Peru. In the country’s impoverished highlands, mining is a very controversial industry. China is proposing to develop a $2.2 billion copper mine that will displace a small town. Nationwide, protests over natural resources have already resulted in the deaths of 10 people this year. If this law were to pass, a blogger who anonymously posted content opposing the new mine, could have his or her identifying information turned over to the police by his or her ISP, chilling free speech and endangering the blogger.
The Peruvian Congress, currently in recess, has not voted on the proposal or set a date to do so. However, Peru lacks a robust community of digital rights NGOs, and with a unicameral legislature, there are very few procedural hurdles to overcome in the path to this bill becoming law -- after the full Congress gives its approval all that’s needed for it to become law is the signature of the President.
It does not appear that the law's author consulted international legal authorities or agreements. The law jumps from intellectual property protection, to police guidelines on search and seizure of counterfeiting equipment, to all types of data and information system crimes. No meaningful public consultation was held, and it shows in the law's haphazard choice of subject matter, and its seemingly random penalties:
- 1-3 years in prison for unauthorized access to information systems or interception or interference of data (Art. 2)
- 1-4 years in prison for damaging a system or extracting data from one (Art. 3)
- 2-6 years in prison for, without authorization, altering or receiving data (Art. 3)
- 2-5 years in prison for phishing for personal data, or getting/selling/tampering with passwords (Art. 4)
- 1-6 years in prison for "information fraud" (Art. 8)
The proposed law bases most of the crimes on "unauthorized" use or access to data, but does not make clear whose authorization is needed. Left unanswered is whether simply violating a website or software's terms of service or license is illegal, "unauthorized" use punishable by years in prison. If private terms of service agreements are elevated to the level of legal codes, private companies -- even those based in foreign countries -- would hold unprecedented power over the country’s internet users, setting a dangerous example in the region. Indeed, many users could end up in trouble with the law simply for failing to read complicated terms of service agreements.
Moreover, the proposal’s preamble was reported to have been plagiarized from various websites. When asked about this, the President of the Commission admitted that there were parts of the document that were literally copied without citing the original source, arguing that they were preliminary documents and were only used as a “reference.” While plagiarism undermines the legitimacy of any legislative initiative, the President’s statements are particularly concerning as they indicate that the Commission will continue to hastily push this rights-abusing law through.
The bill analyzed above is subject to amendment, and a new proposal may issue from the Commission of Justice and Human Rights in the Peruvian Congress. Regardless, this law must be stopped and rewritten in collaboration with a diverse range of stakeholders including civil society, members of the media, and the legal community, and brought in line with international laws and norms. Keep visiting the Access blog for more information on the law.