The personal data of 5.1 million Salvadorans, their high-definition photographs, thousands of court files, police and army emails, and information on public officials were exposed after one of the largest data leaks the Central American country has ever suffered.
Although there is a law that punishes computer crimes, the Salvadoran state is considering toughening the penalties for these crimes. The ruling party Nuevas Ideas proposed up to 12 years in prison for those who extract data from third parties or use and have access to this data illegally.
“When personal data is leaked, it is normally used by groups of cybercriminals to try to impersonate and access bank accounts, access photographs or people’s privacy to extort them, among other things,” explained Carlos Palomo, a cybersecurity specialist, to the Voice of America.
“There is also a risk that, using this data, people may try to purchase services or products that could then be used for criminal activities,” he added.
So far, the identities of those who are believed to be behind the breaches of official computer systems are unknown. No arrests have been made public in this regard, but According to the morning newspaper La Prensa Gráficathe hacker group called CiberinteligenciaSV would be behind the leaks.
CiberinteligenciaSV has claimed responsibility for several attacks on Salvadoran state servers. One of the most recent cases was the leak of a database containing information on Congress employees, which broke the information blockade that had been in place until then in that state body.
In El Salvador, the Law on Access to Public Information mandates that the entire Congress payroll be published on a transparency portal, but so far, the portal does not contain information on all Congress employees.
The leak and the demand for transparency by citizens prompted several legislators to share information about their work teams with names, positions and salaries. The Salvadoran president commented on the matter.
“In the first presidential term, they gave us absolute confidence (…) For this second term I asked for confidence again… many said they would give it. And many did, but only for 35 days…,” said the president on August 7, amid the controversy over the leak of public places.
In May 2024, the new Congress was installed with total control of Bukele’s party, occupying 54 of 60 seats. At least half of the legislators have made public the information of their work teams after this leak.
The leaks
In October 2022, the hacker group “Guacamaya” published a large number of emails and other materials from police and military agencies in Central America, Mexico, Chile, Colombia, and Peru. This leak impacted El Salvador, as thousands of emails from the National Civil Police and the Army were released.
This year, another group of hackers released 5.1 million Salvadoran identity documents on the dark web, including their photographs, names and surnames, dates of birth, telephone numbers and residential addresses.
The group also breached the servers of the Salvadoran judicial body and the Attorney General’s Office, leaking approximately 40 gigabytes of information that contains not only institutional files but also employee credentials to access the systems.
The leaks have also reached banking institutions.
Although the government has not made any statements on the matter, Congress has begun to take action.
The reform proposals
In El Salvador, there is a special law for cybercrime approved in 2021 under the name Special Law against Computer and Related Crimes. It could be amended this Thursday, August 15, after a commission studied possible reforms.
The new prison sentences could range from 10 to 12 years in prison for those who misuse information and communication technologies to manipulate computer systems, their components, data, metadata and any other information to the detriment of others.
For specialist Palomo, tougher penalties do not serve to reduce or prevent crimes, either in the computer or physical fields.
“The technical capacity, methods and resources to investigate computer crimes are a determining factor to avoid impunity and, therefore, reduce the occurrence of this type of conduct. To date, little has been seen on this: there has been no talk of policies to strengthen digital investigation capabilities, among other things that are essential to punish and combat this,” he told VOA.
The possible reforms could also penalize those who use this access to databases either only to consult or to extract information illegally.
According to the deputies of the ruling party, it is necessary to have a legal framework that provides legal security to the entities that control and safeguard the data of Salvadorans.
The reforms are expected to be discussed in plenary session on Thursday, August 15.
Connect with the Voice of America! Subscribe to our channel YouTubeand activate notifications, or follow us on social networks: Facebook, Twitter and Instagram.
Add Comment