In late April, a wave of protests swept across Colombia, sparked by a proposed tax reform measure that many people worried would have disproportionately affected the country’s already struggling working class. Police soon began rounding up a number of the demonstrators, including one woman in the southwestern city of Cali. Authorities handcuffed her, took her cellphone, and then left her with a group of other detainees.
At some point, a police officer returned and offered to loosen the woman’s handcuffs. As they did so, the protestor realized the officer was pressing her fingertips to her phone in order to open it, she later told Fundación Karisma, a Colombian digital rights organization. When the authorities eventually gave the protester back their device, she noticed it was unlocked.
Human rights experts say incidents like these are on the rise in Latin America. Seized smartphones have become a trove of information for law enforcement officials hoping to build cases against social movements and opposition leaders. Until recently, most people had basic devices with just a few dozen contacts and little additional information of value. Now, the data on a person’s smartphone can often paint a full picture of their lives.
“A single activist has maybe 20 or 30 groups — between WhatsApp, Telegram, etc. — that they use to communicate with a few thousand people,” says Paolo Nigro, who helps run the global security helpline at Access Now, a digital rights nonprofit.
To break into devices more easily, a number of Latin American countries have contracted cybersecurity firms that make software allowing authorities to bypass encryption and other protections. The companies often argue that their tools help aid legitimate criminal investigations, but critics have said they’re often used by authoritarian regimes to infringe on civil rights.
Fundación Acceso, a digital rights advocacy organization based in Costa Rica, said in a report last year that El Salvador and Honduras have both purchased licenses from the firm Cellebrite, while Guatemala has used Magnet AXIOM, digital investigation software that lets law enforcement recover deleted information from cellphones. The same report said that Nicaragua sought a contract for EnCase, a suite of tools that claim to decrypt devices and copy their data.
But authorities often don’t need high-tech tools to gain access to the personal data stored on a phone. Many people in Latin America still use older models of both Android devices and iPhones without full device encryption, meaning that passwords don’t actually offer much protection. In those cases, “even if [police] cannot get into the actual operating system, [they] can take out all the data,” says Nigro.
Once law enforcement gains access to a device, competent officials will be able to take what they need within a matter of minutes. After it has been confiscated, “if you’re not sure if you got your information extracted from your phone, you probably have,” says Nigro.
Digital rights experts say that if a phone is seized, its owner may have little legal recourse, but protections vary from place to place. Last year, the Brazilian Superior Court of Justice ruled, in a landmark case, that forcing a defendant to turn over the passwords to their electronic devices violated their right against self-incrimination. The court argued that “no one is obligated to provide evidence against themselves,” citing the Brazilian constitution as well as the American Convention of Human Rights, which was ratified by most countries in the Americas (with the notable exception of the United States).
Colombia, Mexico, Peru, and a number of other Latin American countries require a judicial order for police to access private communications, but court decisions are often far removed from realities on the ground. “We have to understand that one thing is the legal validity of something in Latin America, a completely different thing is how things are done de facto,” says Nigro.
Over the last two months, Nicaraguan authorities have arrested more than a dozen opposition leaders ahead of national elections scheduled to take place in November. Rest of World has confirmed that police in the country seized phones from detainees and, in some cases, forced them to turn over their passwords. “In some cases, the warrants explicitly said there were fuertes incidicios [strong indications], which may mean [the police] didn’t have anything,” says Tiziano Breda, the Central America analyst for the International Crisis Group, a human rights nonprofit. “Possibly through the access of their phones, they could have tried to fetch further information.”
How to protect yourself for when your phone is seized
|Enable ““Find My Device”” (Android) or ““Find My Phone”” (iOS), which will allow you to remotely wipe your device in the event it’s confiscated.|
|Enable full device encryption, if your phone doesn’t have it enabled by default.|
|Use a long and unique password for your phone lockscreen.|
|Don’t enable access with only biometric checks like fingerprints and facial recognition — always combine these methods with a safe password.|
|Use safe messaging applications, such as Wire or Signal, and enable disappearing messages and passcodes. Delete old messages and conversation from other applications.|
|Make sure the people with whom you share information with also take these measures.|
|If your device is seized, ensure your immediate contacts know and take their own security precautions.|
|Courtesy of Access Now.|
Under President Daniel Ortega, Nicaragua introduced a series of new laws limiting free speech and other freedoms. A sweeping “Special Cybercrime Bill” passed in October broadly punishes anyone who spreads “fake and/or misrepresented information, which causes alarm, fear, anxiety,” with up to four years in prison.
Many of the candidates and activists who were arrested have been charged under a different provision passed in December, which prohibits Nicaraguans from committing any acts that “undermine the independence, sovereignty, and self-determination” of the nation. “This set of laws is mostly aimed at disincentivizing, inhibiting, and dividing the opposition,” says Breda.
Tech companies like Apple and Google allow users to remotely wipe their devices, but experts say preventative measures are the best defense if your cellphone is seized. Access Now recommends vulnerable groups — such as activists, journalists, and researchers — only use communication apps with disappearing messages. You should also set complex passwords for your phone lock screen, as opposed to using biometric options, such as fingerprints or facial recognition.
Gaspar Pisanu, the Latin America policy manager for Access Now, says that tech companies like Apple and Google could take additional measures to better protect users in the region from having their data seized. For example, he says, they should prioritize quickly responding to people in authoritarian countries who request their information be deleted. But ultimately, the problem lies with governments, which often aren’t motivated to protect people’s privacy. “There is no real defense for people,” says Pisanu, “because it is the state who should be the one protecting them.”