The pros and cons of Mexico's cybersecurity bill

Mexico’s IT sector has raised concerns about alleged threats a cybersecurity bill congress is about to debate poses to human rights and international treaties.

Creating the bill took almost a year, and it was introduced at the end of the first legislative period in April. At the start of the second period, the science, technology and innovation, national defense, budget and public accounts committees are analyzing the bill.

But in a joint statement, the local chapter of the international chamber of commerce, IT chamber Canieti and sector associations Alai, Asiet, Amiti and Anatel highlighted some problems.

“The positive thing is that it is a highly necessary initiative for our country. We welcome the creation of a national cybersecurity agency, but here comes one of the problems and that is that it is given broad police powers,” Cindy Rayo Zapata, Asiet head of Mexico, Central America and the Caribbean, told BNamericas.

According to Rayo Zapata, the cybersecurity agency would be empowered to “order the removal of IP addresses, domains and internet sites at its discretion, without any type of procedure, guarantee of hearing or due process.”

The joint statement warned about the terms under which data must be delivered to authorities. Some elements “lead to the risk that the armed forces will deepen surveillance, espionage and intervention in the population's private communications” without authorization and judicial controls.

“In Mexico there is extensive legislation and regulations that include the highest international standards regarding the protection of personal data and this bill contains provisions or articles that in some way affect this data protection that is already contained in other regulations,” Zapata added.

“It could affect all the work Mexico has been carrying out to become a safe harbor in terms of personal data,” said Zapata.

The bill also establishes that user data must be stored in Mexico, which contradicts treaties with the US and Canada.

As a positive aspect, Rayo Zapata mentioned the spirit of collaboration and coordination among the public, private and academic sectors. “It is very important for the design of any type of comprehensive security strategy,” she said. However, collaboration could be affected or undermined by the negative aspects.

The statement suggests creating a citizen advisory council that participates in the cybersecurity agency to promote a “culture of cybersecurity among the population.”

To push for changes, the associations and chambers requested meetings with authorities. Although dates have not been agreed, Rayo Zapata is optimistic that lawmakers will respond because “there has always been a lot of openness.”

According to US-based cybersecurity firm Fortinet, Mexico registered most cyberattack attempts – 187bn – in Latin America last year, an increase of 20%.