The Costa Rican legislature has just passed Law 9048, which includes reforms to the country’s Criminal Code to create new cybercrime offences. Some of these bring the country in line with anti-hacking provisions present in international standards like the Convention on Cybercrime, such as rules against illegal access and interception of communications. However, the most controversial part of the law is that it modifies the existing type of espionage to include a digital element.

The old Criminal Code defined Espionage in Art. 288 as follows:

“Espionage. [A person] Shall be punished with imprisonment of one to six years, if they improperly procure or obtain secret political information, or security policies concerning the means of defense or foreign relations of the State.”

The new law has modified the article to read:

“Espionage. [A person] Shall be punished with imprisonment of one to six years, if they improperly procure or obtain secret political information, security policies concerning the means of defense or foreign relations of the State, or affects the fight against drug trafficking or organized crime.

The sentence is five to ten years’ imprisonment where the conduct takes place through computer manipulation, malicious software or use of information and communication technology.”

This has rightly created a bit of a stink with the local press and blogosphere, as they see it as a possible affront to freedom of the press and freedom of speech. However, I think that journalists miss the real point behind the law, this is evidently an attempt to criminalise leaking information to whistle-blowing sites like Wikileaks. The law in its present form was discussed and approved in a legislative commission in 2010, at the time that Wikileaks was front page news across the world. The inclusion of this reform makes no other sense whatsoever, as it enhances existing penalties for espionage just by adding the digital element. There is no other justification that I can think of to make incarceration for leaking political information through electronic means almost twice as harsh as “analogue” leaking.

This article is a worrying development, and hopefully it will be either struck down by the Constitutional Court, or reformed given the political heat that it is receiving.

Interestingly, another element of the law has passed almost unreported. The law includes the following provision against electronic impersonation. Art. 230 reads:

“Impersonation. [A person] Shall be punished with imprisonment of three to six years if they impersonate a person in any social network, website, electronic or information technology medium. The same penalty shall be imposed upon persons who, using a false or in-existent identity, causes damages to a third party.”

This would come to criminalise any sort of unauthorised impersonation in social media. Fabulous mock accounts like Queen_UK, Chuck Norris, or Nick Nolte are outlawed in Costa Rica. Moreover, the wording is ambiguous enough to suggest that if someone causes any damage using an avatar, pseudonym, or other online in-existent identity, that person will be subject to criminal sanctions as well.

That makes this fictional llama sad… time to leave the country.