UPDATED March 12, 2015: Today, the draft bill on Data Retention #Pyrawebs was rejected in the Deputies Chamber, but the fight is not completely over. We will be keeping a close watch on the bill as it returns to the Senate. We were inspired by the activism of TEDIC, a digital rights organization and our allies in Paraguay, for leading an awe-inspiring campaign fighting for privacy rights. TEDIC, Amnesty International in Paraguay, and Internet users mobilized to push Paraguayan lawmakers in the right direction. Bravo TEDIC, bravo team anti-pyrawebs. You can all be proud today that there was no law enacted on Paraguayan's watch that would have compromised the online privacy rights of Paraguayan Internet users in the name of security.

__

Paraguay understands the dangers of pervasive surveillance. Its ex-dictator, Alfredo Stroessner, maintained his grip on power with the help of “pyragues”, informers who monitored the civilian population on his behalf. That’s why so many in the country recognise the dangers in its new proposed data retention bill. The bill, currently being debated by its politicians, would compel local ISPs to retain communications and location details of every user for a period of 12 months. No wonder it’s been described as creating a new gang of “pyrawebs”: online informers that the authorities can ask to pinpoint the movements, connections, and associations of any Paraguayan citizen.

"For the amount of data that may be available, I'm sure it will overtake the “Terror Archive of the Stroessner dictatorship,” blogger David Bogado, says of the new bill. “This is the Archive of Terror 2.0.”

Modern Paraguay has strong legal protections against the recurrence of a surveillance state. Its constitution, written after Stroessner,  takes special care to assert the inviolability of private communications. It also gives  international human rights treaties that the Paraguayan state has ratified the binding force of law.  In particular, Paraguay has ratified the Pacto de San José de Costa Rica, which protects civil and political rights, declaring:

“Nobody will be the subject of arbitrary or abusive interference in its private life, family, home or correspondence, nor illegal attacks to its honor or reputation.”

Paraguay does not, however, have a personal data protection law, which makes the unchecked nature of the data retention proposals even more dangerous, as it forces companies to comply with the state’s demand for data, without providing any way for citizens to limit or correct the data collected on them.

Maricarmen Sequera, the executive director of Paraguayan digital rights organization TEDIC spells out what the stakes are for the country.

“Thirty-five years of dictatorship in Paraguay scarred our society with silence and fear. The police state is not new to Paraguay; it makes it worse that in this case, the monitoring will be done by private companies. We want a democracy, not a new set of pyrawebs.”

The risks of Paraguay’s data retention bill

In contrast to other Paraguayan law initiatives which only allow the government access to stored data when investigating serious offenses, the new proposal would grant the government access to data for any type of offense, however minor, such as peer-to-peer downloads and defamation. The current draft does not specify a level of evidentiary proof or justification that should be be met in order to access the data.

“The pyrawebs law is ambiguous because it suggests the prosecution of serious crimes such as terrorism and pedophilia, but actually affects any offense such as slander, bribery, or Internet downloads that might infringe copyright law,” writes the sociologist and free software advocate Luis Alonzo Fulchi, who has been tracking the bill as it passes through Paraguay’s congress.

The bill’s language is vague enough in its scope to potentially require any physical person or entity that offers access to Internet to collect and store data for the government. That include cyber cafes, coffee shops, libraries, or firms that provide work Internet access. As with data retention proposals elsewhere, indisciminate and universal data collection opens the possibility for breaches of confidentiality between doctors and patients, lawyers and clients, journalists and their sources.

The bill does exclude the mass collection of the content of communications. But, as the rest of the world is slowly realizing, the increasing abundance of metadata, and the techniques for aggregating and analyzing it, means that “mere metadata”  on its own reveals a devastating amount about private citizens. The government’s ability to gather even the simplest forms of metadata, over a long period of time, and organize it using modern surveillance techniques can easily garner the kind of vicious insight that the original Pyragues could only dream of.  The Inter American Court for Human Rights made clear in Escher y Otros vs. Brasil1  that content, as well as metadata are protected by the Inter-American's human rights laws:

"Article 11 applies to telephone conversations irrespective of their content and can even include both the technical operations designed to record this content by taping it and listening to it, or any other element of the communication process; for example, the destination or origin of the calls that are made, the identity of the speakers, the frequency, time and duration of the calls, aspects that can be verified without the need to record the content of the call by taping the conversation.”

Paraguay must uphold its current international human rights obligations by introducing a law that will genuinely protect personal data. Moreover, the bill needs to comply with the principles of legality, legitimate aim, necessity, proportionality, among others. Allowing the parawebs law to pass would be an insult to Paraguay’s history, ignore decades of experience of what pervasive surveillance can do to a society. Join Paraguay’s activists and fight against the new bill at TEDIC’s new site:  http://pyrawebs.tedic.org/  and share our video explaining the dangers of data retention here.

Resources:

13 Principles Week of Action: The “Metadata Debate” ~ A Latin American Perspective

Originally published on November, 2014, republished on February 15, 2015. UPDATED: March 12, 2015

• 1. Inter-American Court of Human Rights. Case of Escher v. Brasil. Preliminary Objections, Merits, Reparations and Costs. Judgement of 6 July 2009. Series C No. 200, para. 114.