The members of the Congressional Economic Commission continued this Wednesday with the analysis of initiative 6347, through which the approval of the Cybersecurity Law is sought.
During the meeting, which was held in a hybrid manner, the debate focused on the analysis of the proposed reforms to the Criminal Procedure Code included in the aforementioned initiative and related to illicit access to systems, data protection and the integrity of computer systems. This, with the purpose of preventing, investigating and punishing cybercrimes in Guatemala more effectively.
The provisions established in the initiative do not seek to modify the structure of the Criminal Procedure Code, but rather to adapt it to reality and the digital environment in which these activities are currently carried out. They also seek to complement it, by providing justice operators with modern tools to investigate and prosecute cybercrimes, the commission’s advisors stated during the meeting.
The members of the commission also reviewed the proposals that are related to the integrity of the data, as well as the criminal type called “attack on the integrity of systems”, through which sentences ranging between 6 and 10 years in prison are proposed.
Procedural aspects contained in the initiative
During the meeting, the main procedural aspects contained in the bill were addressed, including: urgent data security, order of access and delivery of data by service providers, registration and seizure of digital media, interception of communications, international cooperation, confiscation of instruments and objects of crime and creation of institutional capacities.
“In accordance with the Budapest Convention, there is a catalog of crimes that must be regulated and that Guatemala does not have any regulation in this regard. This, in relation to unauthorized access, the attack on that information, profit through the commercial exploitation of that information obtained illicitly, so they must be regulated and classified in the Penal Code,” stated Jorge Ayala, president of the aforementioned legislative commission.
In this sense, Dissuasive penalties must be imposed to prevent these practices from being committed, the congressman stated.
The Budapest Convention establishes its own classification organized into four types of crimes: crimes against the confidentiality, integrity and availability of data and computer systems; computer crimes; content-related crimes, such as those linked to child pornography; and crimes related to intellectual property infringements.
Under this catalog of crimes, the Economic Commission continues to carry out the analysis of sanctions and coercive measures in accordance with international requirements.
Institutional capacities
The initiative orders the Public Ministry (MP), the Institute of Public Criminal Defense (IDPP), the National Institute of Forensic Sciences (Inacif) and the National Civil Police (PNC) to immediately create and provide sufficient equipment and technologies to apply the law. Likewise, the Presidency of the Judicial Branch must promote the creation of jurisdictional bodies specialized in cybercrimes; Meanwhile, they will hear the ordinary courts and tribunals.
Another aspect that is addressed is the interception of communications, which will be authorized with a court order for the interception, recording and reproduction of oral, written, telephone, radio, computer or any other communications that use the electromagnetic spectrum. At this point, the initiative additionally refers to the Law against Organized Crime (Decree 21-2006), instead of the Criminal Procedure Code, given the special nature of this measure.
The bill also addresses the registration and seizure of digital media. In this sense, it is indicated that the judge, at the request of the MP, may order the registration of computer systems and storage devices.
The measure may include hijacking the devices—without affecting critical infrastructure—obtaining copies of the data, preserving its integrity, and even making it temporarily inaccessible. A novel provision is that it allows the registry to be extended to another computer system that can be legally accessed from the initial one, provided there is a new court order. For what is not regulated, the CPP rules on the seizure of documents and correspondence will be applied additionally.
In the coming days, the members of the Economic Commission will continue carrying out the analysis of the bill, which, as explained by the president of the room, will continue throughout August.