EFF, Article 19, Fundación Karisma, and Privacy International, represented by Berkeley Law’s International Human Rights Law Clinic, urged the Inter-American Court of Human Rights to rule that Colombia’s existing legal framework regulating intelligence activities, and the unlawful and arbitrary surveillance of members of the Jose Alvear Restrepo Lawyers Collective (CAJAR) and their families, violated a constellation of human rights, including the rights to privacy, freedom of expression, and association, and forced CAJAR members to limit their activities, change homes, and go into exile to avoid violence, threats, and harassment.

Members of CAJAR, a Colombian human rights organization defending victims of political persecution, indigenous people, and activists for over 40 years, have had their communications intercepted by Colombian intelligence agencies and faced ongoing threats and intimidation since the 1990s, EFF and its partners said in an amicus brief submitted to the court in CAJAR’s lawsuit against the Colombian state. Since at least 1999, Colombian authorities have subjected CAJAR members to constant, pervasive secret surveillance on every facet of their professional and personal lives, including their locations, activities, finances, travel, contacts, clients, and protection measures.

The brief demonstrates that Colombia's intelligence law and unlawful communication surveillance practices violate the right to privacy and other human rights under the American Convention on Human Rights. The brief also provides evidence of the range of targeted and mass surveillance tools employed by the state. In short:

“While international law permits targeted surveillance in limited circumstances and with strict safeguards, mass surveillance is an inherently disproportionate interference with the international human rights to privacy.  But in the last few years, law enforcement and intelligence services in Colombia have purchased tools to expand their pervasive spying network and capture large amounts of communication data."

As the brief explains, Colombia employs both targeted and mass surveillance tools. Colombian authorities collect, monitor, and intercept, in real-time, individual audio and data communications from mobile and landline phones. Intelligence authorities intercept communications data without prior authorization or judicial oversight, with direct access to communication networks, despite the fact that Colombian law does not authorize any agency to engage in communications interception outside the confines of criminal investigations and without judicial oversight. Colombian intelligence services also have conducted intrusive operations exploiting software, data, computer systems, or networks to gain access to user information and devices.

This case presents an unprecedented opportunity for the court to examine whether Colombia’s intelligence surveillance practices and legal regime comport with the American Convention, the brief, filed on May 24, said. If it finds violations, the court can establish measures to be taken by Colombia to strengthen safeguards against government surveillance. These include requiring prior judicial authorization, effective independent oversight, and transparency measures, like notifying people targeted by surveillance to ensure effective remedies in case of abuse.

Testimony during the hearing presenting the case to the court in May has also provided clear indications of abusive government surveillance practices. An expert witness defending Colombia's Intelligence Law's compliance with human rights standards explained that the monitoring of electromagnetic spectrum–a surveillance measure authorized by the law–could entail monitoring conversations within an entire city zone (public hearing at 2:28:00, in Spanish). He mentioned the random nature of the monitoring, which is not targeted to specific persons, as a positive feature and justification for not requiring a prior judicial authorization. However, such random, dragnet surveillance can’t be deemed compatible to the American Convention’s necessity and proportionality standards.

The expert witness also said the use of malicious software for intelligence activities is regulated in Colombia “in the sense it is channeled within the monitoring tasks,” as per the Intelligence Law (public hearing at 2:00:13, in Spanish). Yet, the law does not contain any particular authorization for the use of malware technology. This means that, aside from proportionality concerns the use of malware raises, Colombia’s Intelligence Law does not clearly and precisely authorize the state to employ this type of technology–which the principle of legality requires under international human rights law.   

Colombia has argued that its Intelligence Law, approved in 2013 following media reports unveiling wrongful surveillance by intelligence agencies targeting human rights defenders and journalists, establishes specific circumstances under which intelligence activities can be authorized. The government claimed the law ensures that any intelligence action conforms to the principles of legality, proportionality and necessity, and provides human rights safeguards at various levels.

Yet, the brief explains that Colombia's intelligence legal framework has enabled abusive surveillance practices in violation of the American Convention and has not prevented authorities from unlawfully surveilling, harassing, and attacking CAJAR members. Even after Colombia enacted the new law, authorities continued to carry out unlawful communications surveillance against CAJAR members, using an expansive and invasive spying system to target and disrupt the work of human rights defenders, journalists, and others.

The brief builds on the most protective understanding of international human rights law and standards held by international courts and human rights bodies. It urges the Inter-American Court to establish rigorous human rights protections that limit state surveillance and prevent future violations. With this case, the court has a crucial opportunity to ensure that the American Convention's safeguards are applied to, and serve as a check on, unparalleled state surveillance powers employed in the digital age.