Cybersecurity as a Straitjacket in Mexico's Regulatory Framework
In Mexico, the discussion on the regulation of cybersecurity resurfaced due to two bills: the Federal Cybersecurity Bill recently presented on February 14 and the Federal Cybersecurity Law, which was originally introduced on April 25, 2023. Both bills pose risks to digital rights. They encroach on privacy and place apparently arbitrary activities under the control of the State. The wording of the bills is ambiguous and unclear in determining the powers, procedures and criminal classification of behaviors within the “cyberspace.” This represents threats to freedom of expression and the protection of personal data on the Internet.
The draft of the Federal Cybersecurity Law of April 25, 2023, was withdrawn recently by the sponsor representative Javier López Casarín after several attempts to arrange meetings between the United Commissions and the secretariats of the Treasury, National Defense and Navy, National Guard ,and the National Intelligence Center. The bill was strongly criticized by digital rights organizations and experts because at various points it affected freedom of expression. The most problematic points were the following:
- The bill promotes the militarization of cybersecurity by empowering the Secretariats of National Defense and the Navy to monitor and carry out “military operations” in cyberspace, without specifying what type of activities could be carried out.
- It facilitates Internet censorship by creating a new “National Cybersecurity Agency” and empowers it—along with the National Guard, the Attorney General's Office, and judicial authorities—to “deregister” Internet sites, IP addresses, and domains without the specific judicial procedures or mechanisms. In this sense, the bill did not meet the requirements of the three-part test of the Inter-American Human Rights System that is used to determine whether restrictions on the right to freedom of expression are acceptable under the parameters of the American Convention.
- It facilitates encroachments on privacy related to intelligence activities without clearly defining procedures, requirements and safeguards against abuse.
- The bill establishes ambiguous computer crimes: the proposed legal descriptions of the crimes are not precise and lead to different interpretations that can lead to arbitrary actions by State agents.
- The bill criminalizes legitimate behaviors, such as the production of digital content that “incites” “hostility” or “misinforms the population.”
After several discussions and opposition from different stakeholders, the project was shelved.
On the other hand, the Federal Cybersecurity Bill of Law of February 14, 2024, proposes to repeal various crimes from the Federal Penal Code and include them in the Federal Cybersecurity Law. Chapter IV includes crimes against sexual privacy, where those who “exhibit,” “transmit” or “disseminate” sexual images through information and communication technologies without the consent of the affected party are held liable. Although the provision pursues a laudable purpose, the current wording lacks clarity since as it is written, intermediaries could be considered liable for third-party content without any judicial notice informing them of the commission of an illegal act.
The wording of Article 58 of the bill would have the same issues by placing liability for the crime on anyone who exhibits or disseminates pornographic material without due warnings to restrict access to children and adolescents. By not establishing a specific consideration of intermediary liability, it is possible to create conditions that encourage improper censorship of third-party content.
In addition to the establishment of cybercrimes, the bill proposes creating the National Cybersecurity Committee. This introduces various questions. On the one hand, it is somewhat unnecessary since in Mexico there is a National Security System. On the other hand, it is also concerning that the Secretariat of National Defense and the Secretariat of the Navy are members of this Committee. These government agencies have used tools to spy on citizens and do not have a good record of respecting human rights in this matter. Several practices associated with illicit acts such as identity theft have been documented.
The bill proposes that this Cybersecurity Committee shall collect information from public and private entities, but does not provide for external control mechanisms. These actions are very similar to those included in the Domestic Security Law that was declared unconstitutional by the Supreme Court of Justice of the Nation on November 15, 2018.
Conclusions
Both bills are challenging for the development of digital rights and freedom of expression, the protection of personal data, and intellectual property. They criminalize behaviors on the Internet that can be considered legitimate, at least under certain conditions. These behaviors will be pursued by state authorities through procedures that are not entirely clear.
There are also a series of ambiguities within the legislation regarding the authorities' powers in “cyberspace,” the procedures, the judicial mechanisms that allow rights to be protected in the event of state abuses and the criminalization of behaviors within the digital ecosystem. This point is the most relevant and concerning.
Finally, these initiatives do not comply with international standards regarding the three-part test of legality, necessity, and proportionality outlined in the Inter-American human rights system.
The analyzed bills show an alarming trend, which is important even if they fail to amass the necessary legislative support. The regulatory framework regarding these matters should not impede, or give the impression of impeding, rights in digital environments. The criminalization of conduct by the state is an ultima ratio, to which the authorities should resort through precise, limited, and limited application legal definitions of crimes. They are the necessary conditions for the flow of information on the Internet to remain free of undue censorship.
