Under A Watchful Eye: Cyber Surveillance in Cuba

Álvaro felt like a spy during his four years working as a network administrator at the state news agency Prensa Latina (PL).

“Part of my work was maintaining computers,” he explained. “But sometimes my boss ordered me to monitor what a reporter or worker was Googling or looking at.”

Although this was not among the duties that he had signed up for when he joined the country’s most important news agency, Álvaro never questioned his superior’s orders.

“Then, I’d see the people that I’d been monitoring in the lunchroom or on the street and I felt terrible,” he said. “I tried to act naturally but I couldn’t stop thinking about the personal things I knew about them.”

In an office behind closed doors, Álvaro accessed other people’s computers, taking screenshots that he then filed. Sometimes he accessed private emails or instant messages during the screening process. The assignments even included monitoring the private communications of journalists about to travel outside Cuba as PL correspondents.

“It was a way of making sure that they wouldn’t abandon the ‘mission’ or make contact with inappropriate people abroad,” he said.

Ahead of trips abroad, reporters had to go through a verification process that included interviews with the heads of whatever political organisations they belonged to, references from the leaders of their Committee for the Defence of the Revolution, and a final verification from the Ministry of the Interior (MININT). Once deemed trustworthy, the reporters still had to go through the final filter of cyber surveillance at their place of work.

“In political and social organisations, people are being constantly evaluating others and it’s taken into account for anything, from getting a university position to deciding if you can be trusted for a job,” said Jesús Adonis Martínez, the agency’s correspondent in Caracas for nine months. “In a totalitarian country everyone’s tracks are filed away.”

“There is even more surveillance for journalists who have collaborated with foreign or independent media,” added Álvaro, who asked to remain anonymous even though he no longer works for the agency.

 “What they made me do was wrong,” he concluded.

In Cuba, although public access to the internet has increased in recent years, the possibility of state surveillance is never far away. As well as monitoring people’s private communication, activists and journalists alike say that they are often targeted by trolls online.

Henry Constantín, the editor of the La Hora de Cuba magazine who has also been the Inter American Press Association (IAPA) representative in Cuba since 2016, said that he was frequently harassed by unknown parties on Facebook.

“False accounts in the social network, the most used in the country, are used very often by State Security,” he said.

Pastor Yoandry Díaz, an activist for religious rights in Havana, agreed that hacking Facebook was a favoured tactic.

“State Security writes things on your wall to make it seem like you regret your activism,” he said. “Something else that’s very common is monitoring your email through the state service Nauta. There are emails that I’ve sent that have never arrived.

“And in the case of SMS, during civil society’s campaign #YoVotoNo [I vote no] against the new constitution, the same thing happened with messages that had that hashtag or words like freedom or strike.”

EVADING RESTRICTIONS

In 2017, the Computer Networks Security Office (OSRI) registered more than 600 cyber security incidents. OSRI general director Miguel Gutiérrez Rodríguez said that most involved so-called counterrevolutionary activities via email “disguised as spam and the use of unauthorised proxies”.

However, as student Reinier Gómez explained, proxies are a vital way of circumventing the government’s internet censorship.

“Thanks to the proxies I can read independent news pages that I couldn’t enter because the state censors them for Cuban users,” said Gómez, who uses proxies like Hide.me. “But I’m not the only one doing it. It’s as common in my school as the wifi spots that have been set up around the country.”

Since 2005, the Reporters Without Borders NGO has included the Cuban government on its list of Internet Enemies. Non-state news portals such as Cubanet, 14yMedio, Diario de Cuba,  Cibercuba, ADNCuba, El Estornudo and Tremenda Nota remain blocked.

“So that’s how Havana denies its citizens the right to be informed and intensifies a tradition of attacks against freedom of the press and expression,” said Armando García, a law student.

His classmate Gretel Valle said that the computer technicians managing the network were the ones who blocked the proxies.

“The other thing I’ve noticed is that network administrators know everything you’re doing,” she continued. “It’s a serious violation of privacy. I have heard that they do it through a program called Ávila Link.”

This programme, produced by Desoft, the national software company based in Ciego de Avila, can monitor several locations at once, all connected to a central server, regardless of distance or location.

Even ten years ago, when the internet was much less easily available, it was used to spy on people surfing the web at post offices and the Cuban telecommunications company’s (ETECSA) centres. It also monitored hotel networks, the country’s 600 Joven computing clubs and the internet portal at the Cuban Journalist Union in Havana.

In a 2009 interview with the official weekly paper Opciones, Desoft’s assistant manager of development Yanelis Orozco said that they could “take total control” with Ávila Link. ETECSA obtained the software the same year.

According to the department of tourism, more than four million foreign tourists visited Cuba last year. Many of them stayed in hotel chains where Ávila Link operates, which means that any customer in these places who obtains and activates a card to access the internet is registered by the software - along with their online activity.

DATA THEFT

Amalia Toledo, projects coordinator and researcher at the Karisma Foundation, a Colombian organisation promoting rights in the digital world, argued that the Cuban government was accessing foreigners’ data without any major legal consequences.

“The problem is that there is no transparency, people don’t know that Ávila Link collects a lot of data,” she said. “That means that people aren’t going to stop using a device because the program is installed on it.”

“Perhaps,” she continued, “it is a good time to think about the need of a data protection law in Cuba. It won’t solve all of the potential problems with the use and abuse of personal data, but at least it can give some guidance on what is or isn’t allowed.”

She noted that businesses’ actions were also dependent “on the legal systems in the countries where they operate” because many entities store user information. In Cuba, the lack of independence between the legal, legislative, and executive branches means that citizens have little control over their own data.

In Europe, the Data Protection Directive ensures that businesses that handle personal information communicate what they do with it. There is no equivalent in the United States.

“However, this does not stop consumers requesting transparency not only from our governments but also businesses about what they do with our information,” Toledo noted.

Leandro Ucciferri, lawyer and researcher at the Argentinian Association for Civil Rights (ADC) NGO, led a 2017 study “The Identity We Can’t Change” on the development of the Federal System of Biometric Identification for Security (SIBIOS).

This  ncorporates technology created by the company Datys, belonging to MININT, and was used during Cristina Fernández and later Mauricio Macri’s governments.

Ucciferri described SIBIOS as “a centralised database that mainly stores fingerprints and photographs of the faces of all the people who live in the country, including foreigners who visit”.

The main way that biometric data is entered into the system is when national identity document and passports are issued through the National Registry for People (RENAPER) and the National Migration Department (DNM).

In the same way, the Centinel program used at Cuban airports brings up the statement “monitored citizen” or “lost documents” when the state has decided to prevent an individual from leaving the country.

Fernández’ government signed an agreement with Datys. According to the contracts accessed by ADC, the company acted as an “official representative of the Cuban Department of the Interior” for purchasing the software and hardware system they use in RENAPER and DNM.

“SIBIOS has several questionable elements,” Ucciferri explained. “Its use is compulsory, and it uses a centralised database [which puts stored information at greater risk].  The state is not transparent about how it works or how they use the stored information.”

While in Argentina ADC’s investigation made an impact politically and publically, in Cuba neither the exportation of the mass surveillance software or the new strategies adopted by the government to collect personal data have been discussed.

In 2017, the United Nations asked governments to develop a cybersecurity treaty. Venezuela, Iran, and Cuba stated that they were in favour of the agreement and they criticised international surveillance efforts.