A recent transparency report published by telecom company Telefónica, the parent company of Movistar Venezuela, revealed the indiscriminate and widespread use of interception of the communications of their subscribers in the country by orders of security agencies of the Venezuelan State
According to the document, Telefónica intercepted the communications of 1 million 584 thousand 547 lines belonging to customers in Venezuela in 2021, more than 20% of all phone or internet lines. These interventions would have been carried out by order of the government of Nicolás Maduro and meant intercepting or “tapping” calls, monitoring SMS, giving the location of people through their cell phones, or monitoring their internet traffic. According to the report, no other country came close to 1% of lines intercepted.
The prevalence of telephone tapping and the excessive and unjustified monitoring of other forms of communication have been a topic of discussion in Venezuela for years, but for the first time, it is possible to trace the reach of this threat to civil rights. Although the interception of communications can be a tool to investigate serious crimes, its use must comply with human rights standards. However, the large number of intercepted lines suggests systematic abuse.
Figures from other phone operators and internet services providers remain unknown because the companies do not publish transparency reports, but, in the case of state-run telecom companies, it must be assumed that they are similar, or possibly worse. The idea that 20% or more of all telephone lines or internet connections from other operators could also be spied on by the Government is a highly authoritarian prospect.
The Telefónica report, which also presents figures for other countries in which it operates, coincides with multiple cases reported before, including a case documented by Venezuelan organization VESinFiltro in a 2021 report, where it drew attention to the case of a local human rights NGO that was the victim of unauthorized access to its communication service account. There is evidence that this occurred due to the facilitation and interception of verification SMS by the organization’s phone operator. In recent years, VESinFiltro has warned of other cases of journalists and civic actors whose communications have apparently been spied on.
The revelations made in the report highlight the need for journalists, spokespersons or sources, human rights defenders, and activists to avoid the use of phone calls or SMS to communicate, in favor of encrypted means of communication such as Signal or even WhatsApp, which can be safer than SMS or phone calls.
The report also reinforces the importance of at-risk users choosing two-step verification of their accounts through means other than SMS or phone calls, such as authentication apps like Google Authenticator and physical items like security keys.
Key figures
- Lines (accesses) affected by interceptions: 1,584,547 (21% of all lines)
- Lines (accesses) affected by metadata requests: 997,679 (13% of all lines)
- Telephone and internet accesses provided by Movistar Venezuela: 7,730,000
- Percentage of accesses affected by requests of both types: 33%
- The number of lines (accesses) affected by interceptions increased 7 times since 2016 when 234,932 accesses were affected
- The operator has not received requests through judicial orders, but rather from investigative, police, military, and intelligence agencies and even the National Security University (UNES)
- The operator recognizes having begun blocking 27 URLs by orders of the National Commission of Telecommunications (CONATEL)
The violation of the right to privacy in details
According to Movistar Venezuela, the authorities with competence in requesting the interception of communications include the Public Ministry, the national investigative police (CICPC), and other police forces “qualified to exercise powers in matters of a criminal investigation” and, oddly enough, the National Experimental Security University (UNES).
Similarly, the listed agencies, including military and police organs, can require metadata about a subscriber’s communications and information (e.g. outgoing calls, duration of the call, the subscriber’s data, etc.).
Nowhere does the report mention orders emanating from courts or judges, as is customary in other countries, suggesting that these are the entities from which the operator has received the requests, never with the validation of a court.
In the Venezuelan legislation cited by Movistar, valid requests for interception must be approved by a judge, with the particular exceptions of cases of emergencies and flagrante delicto, in which the CICPC can make a request with notification to the Public Ministry and proof in the criminal file.
The abuse in obtaining communications metadata is also a violation of people’s rights when it is not conducted in a way that respects human rights. The location of users, the people they communicate with, the means of communication, and the duration, frequency, and content of such communications constitute sensitive information.
International human rights standards establish that any interception of communications (of any kind) must meet at least the following conditions:
- It must pursue a legitimate objective and a necessary legal interest in a democratic society that respects human rights, such as investigating a crime.
- A practice that could violate people’s rights should not be used if it is not necessary to pursue those legitimate purposes.
- As the use of surveillance interferes with human rights, interceptions should only be used when it is proportional to the seriousness of the crime under investigation; all efforts should be made to minimize the amount of data obtained to what is strictly necessary. Access to the information should only be granted for approved purposes, and irrelevant information must be discarded.
- The interception must be adequately regulated by the law.
- A judicial order of a competent court independent from the authority interested in the surveillance of communications must be issued.
- The interception must observe due process, notify the person when possible, and maintain transparency at all times.
Privacy is a fundamental and inalienable Human Right, which in turn is key to the free exercise of freedom of expression and association, among other rights.
Internet blocks were also reported
Telefónica‘s transparency report also recognized that the National Telecommunications Commission (CONATEL) requested the blocking of 30 URLs in 2021. The blocking of websites has long become a systematic form of human rights violation in Venezuela.
Also in 2021, the annual report of VESinFiltro documented at least 68 blocks to internet domains during the year, affecting 59 websites. Movistar is the internet provider with the second-highest number of documented blocking events after the state-owned CANTV. 45 of the 68 domains blocked in Venezuela belonged to news media, and 3 to organizations that promote Human Rights and the use of tools to evade censorship.
By 2022, VESinFiltro has documented new blocking events, affecting both news media and human rights organizations. The most recent took place in June 2022, when the website of the Venezuelan NGO Justicia, Encuentro y Perdón was blocked by CANTV and Movistar.
Recommendations:
- Movistar should list the number of requests received by the issuing body and clarify what percentage of the requests are endorsed by a court.
- Movistar should define more clearly what a “real-time” request means and when the information is no longer available. Likewise, it poorly defines the possible scope of requests other than blocks and the concept of the number of accesses affected by the requests.
- Venezuelans must be aware that any unencrypted communication can be tapped without respecting international human rights standards.
- Journalists, human rights defenders, and activists in Venezuela must avoid the use of phone calls, SMS, and unencrypted communications on the internet.
- Journalists, human rights defenders, and activists at risk in Venezuela should enable the use of two-step authentication in their internet service accounts and avoid the use of SMS or phone calls as a verification method in favor of code-generating apps like Google Authenticator and physical items like printed backup codes kept in a safe place, or, ideally, use FIDO digital security keys (Yubico is one of the best-known brands) and Google Authenticator as a backup.
- VESinFiltro recommends the use of Signal for calls and messages over the internet and the use of a VPN or Tor Browser to visit web pages that are sensitive in the Venezuelan context.
- VESinFiltro recommends the use of a VPN to access blocked websites in Venezuela.
Translated by José Rafael Medina
