W7y8w3

in public discourse as new tools to fight organisedcrime and possible external threats, as well as toimprove policing services through technology. TheUruguayan government, similar to governmentsin many other Latin American countries, is underheavy pressure to deal with security issues, mostnotably street crime. In this context there are threedevelopments that offer a set of challenges to privacyand democracy:• The purchase and use of digital technology(software) to potentially spy on the civilianpopulation. 7• The development of surveillance systems usingCCTV cameras and drones to foster public safetyand better policing. 8• The development of a cyber-crime law which effectivelyoutlaws a set of behaviours considered“dangerous” and limits liberties in the digitalage. 9The aforementioned developments are taking placein a context of a lack of regulation and understandingof a number of human rights issues on the partof the authorities, the judiciary and institutions defendinghuman rights.The Guardian: Software for surveillanceIn July 2013, the local newspaper El País broke thenews about the secret purchase of The Guardiansoftware by the Uruguayan government. 10 The Ministryof Home Affairs (Ministerio del Interior), whichis responsible for security issues, classified thispurchase as secret under the access to informationlaw, hiding it from official records. There was no tenderas it was a direct and exceptional purchase. Thecost of the software licence was USD 2 million andthere is a yearly service fee of USD 200,000. TheGuardian is a system designed to monitor severalnetworks, allowing up to 30 people to work simultaneouslyon mobile phones, landlines and emails.The software was designed by a Brazilian companycalled Digitro Tecnologia. Uruguay has recentlypassed a “free software” law, which essentially suggeststhat the government should use free or opensource software unless a good justification exists.7 Terra, G. (2013). Op. cit.8 El País. (2014, April 21). Así vuelan los colibríes de la Policíauruguaya. El País. www.elpais.com.uy/informacion/asi-vuelancolibri-drones-ministerio.html9 Presidencia de la República. (2014, June 30). Ejecutivo remitióal Parlamento proyecto de ley que pena los delitos cibernéticos.Presidencia de la República. www.presidencia.gub.uy/comunicacion/comunicacionnoticias/seguridad-informaticaproyecto-ley10 Terra, G. (2013). Op. cit.The Guardian does not comply with this regulationas it is proprietary software.According to El País, Digitro also provides servicesto the Brazilian Federal Police. In Brazil therehas been intense debate about the use of TheGuardian. The army and the police in Brazil openlyadmit that they use the tool. 11 Several accountabilityagencies are worried about the extent to whichthe software is being used on its civilian populationand how exactly several state units at the nationaland state level are using it. 12 For instance, therewere concerns that it was used in the context of thelast Confederations Cup football tournament in Brazil,and the social unrest that erupted in a numberof cities. Privacy Latam, a specialised blog dealingwith surveillance in Latin America, reports thataccording to General José Carlos dos Santos fromthe Brazilian Army’s Centre for Cyber Defence, “themonitoring is legal and justified on the groundsof national security policies and actions.” He alsoclaims that the software is adapted and customisedby the user and is not used to monitor citizens ingeneral, and that it was “used only during the 2013Confederations Cup.” 13In Uruguay, the authorities have reassured themedia that the surveillance software will be usedwithin the traditional legal framework, which impliesthat the judiciary would need to authorisesurveillance activities. In the words of the Secretaryof the Presidency of the Republic: “This system willcentralise surveillance through telecommunicationsand will provide more guarantees to subjectsduring this process. The technology is much moreadvanced than we currently have in Uruguay. But weare going to keep using [as required] an order froma competent judge or a request from the public solicitor,with the consent of the telecommunicationsoperator. Guarantees remain in place.” 14Since then the media and the government havebeen relatively silent about the use of The Guardian.While the assurances that there will continueto be a legal framework that respects basic libertiesand due process are comforting, there are seriouschallenges ahead. There are still no regulations con-11 Lobo, A. P. (2013, July 17). Exército usou software Guardiãopara monitorar redes sociais. Convergência Digital. wap.convergenciadigital.com.br/cgi/cgilua.exe/sys/start.htm?infoid=34302&sid=11#.U5ZMmS9htb012 Veja. (2013, May 6). Conselho do MP investiga uso de grampos porpromotores. Veja. veja.abril.com.br/noticia/brasil/conselho-domp-investiga-uso-de-grampos-por-promotorias13 Monteiro. (2014, February 13). Brazil monitors protests against the2014 World Cup. Privacy Latam. www.privacylatam.com/?p=20014 Portal 180. (2013, July 30). Gobierno: Guardián centraliza vigilanciaelectrónica pero mantiene garantías. Portal 180. www.180.com.uy/articulo/34766_Gobierno-guardian-centraliza-vigilanciaelectronica-pero-mantiene-garantiascerning the specific use of this tool for intelligencegathering by authorities. Currently Uruguay is in themiddle of a discussion about how to structure securityand intelligence services and as a result the useof these kinds of technologies is poorly regulated.At the same time, the triangulation of data collectedthrough different security services such as the newCCTV system in place and drones is a matter of worry.A set of key questions emerge:• How will this complex set of surveillance technologiesbe deployed? What is the protocol fordeploying them and will it reflect the proportionalityand necessity principles?• What are the basic accountability arrangementsfor security officers operating thesetechnologies?• How will Uruguayan agencies cooperate withother intelligence agencies around the worldand the region, and to what extent?Another set of questions emerge about how thecurrent privacy laws apply in this setting. There isa need to rethink privacy in the context of surveillanceof communications, particularly where privateinformation is held, and for how long Uruguayan authoritieswill be able to hold this information.The fact that this software was purchased usinga secret procedure with no parliamentary control orthe involvement of other oversight bodies showsthat it is necessary to rethink the accountabilityarrangement in this sector. Furthermore, while theMinistry of Home Affairs argues that the softwareis auditable, there is no specification of how it isauditable, who would perform such an audit, andwhether the results of these audits are going to beavailable to the public.ConclusionThe debate about surveillance, intelligencegathering and privacy is ill-informed in Uruguay. Authoritiesare reacting to a regional and global trendto use software to monitor telephone calls and networksfor security purposes with no clear guidanceor strategy (at least known to the public) that reflecthuman rights concerns. While public reassurancesabout upholding the rule of law are a good sign, thecomplexity of the matter calls for better regulationand engagement with civil society organisationsand human rights institutions, in order to work on ahuman rights approach to surveillance in an age oftechnological change. The Uruguayan governmentand civil society organisations are not prepared tohave a proper debate on the matter yet. On the otherhand, due to its tradition of upholding the rule oflaw, Uruguay presents an opportunity to foster appropriateand proportionate regulation in this field.Action steps: A call for a human rightscentredvision of security in the digital ageDenying the challenges that the state faces in anage of transnational crime is foolish and irresponsiblefrom a citizen’s perspective. But granting “carteblanche” to government authorities for surveillancewith no restrictions is equally irresponsible.Uruguay has a history of less technologically developedbut equally damaging surveillance duringthe 1973-1985 dictatorship. Until now, the releaseof these files and access to the records for peoplewho were under surveillance remain problematic. Inthe context of a progressive democratic society, asUruguay portrays itself, it is time to have a seriousdebate about privacy and security in the digital age.The following steps are recommended to advancea human rights-centred agenda on this topic:• Foster dialogue about principles for the use ofThe Guardian and other surveillance technologiesbetween human rights institutions (such asthe Ombudsman), the intelligence communityand civil society, to identify common ground onthis issue.• Define clear protocols to use these tools andclear lines of accountability for public officialsinvolved in the surveillance process.• Define clear lines of democratic accountabilityand transparency on surveillance processes involvingthe parliament, the Ombudsman andcivil society. In particular, establish a minimumof transparency around surveillance activitiesand a yearly report open to public scrutiny.• Review the current privacy law and identify gapsand best practices in the context of surveillanceand security activities. Consider progressiveframeworks in terms of data retention and accessto data for people potentially subject tosurveillance.• Promote the use of auditable (ideally opensource or free software) technologies to managedata retention and secure critical data forintelligence and surveillance activities.For a democratic society, the way forward impliesallowing access to knowledge around surveillanceactivities, as well as keeping agencies in checkwhen these technologies are developed. The aforementionedrecommendations are the starting pointfor much-needed dialogue and debate on these issuesin Uruguay.268 / Global Information Society Watch uruguay / 269