Costa Rica is moving forward with preparations for its 5G spectrum auction, a year after a cyberattack caused chaos in its government computer systems. As a protective measure, the government approved a decree banning firms from countries that have not agreed to an international cybercrime convention, leaving tech companies from China and Russia, among other countries, out.
“The discussion about the possible presence of vulnerabilities and backdoors in a country’s critical infrastructure is crucial. We are currently living in an era marked by traditional wars, cyber wars, and enormous tensions between great powers,” José Adalid Medrano, a Costa Rican lawyer and expert in computer law, told Diálogo on October 29. “These circumstances force us to consider this type of decision as something that transcends the fight against cybercrime.”
“We Costa Ricans have to make sure that we are not brought to our knees […],” Costa Rican President Rodrigo Chaves said on October 18. “Whoever comes to install 5G equipment has to give us the certainty that this country is not going to be subject to cyber hijacking.”
The Regulation on Cybersecurity Measures Applicable to Telecommunications Services Based on Fifth Generation Mobile Technology and Above — published in the Official Gazette on August 31 — identifies the existence of risks to the cybersecurity of telecommunications networks and services. Some of these relate to the 5G supply chain with low-quality products, or dependence on a single supplier and lack of national diversity.
“All cybersecurity actions, applied to telecommunications and the fight against cybercrime, obey technical recommendations and correspond to issues of public order and national interest,” Costa Rica’s Minister of Science, Innovation, Technology, and Telecommunications Paula Bogantes told the press. “We have focused on establishing preventive measures against cybercrime in the development of 5G and higher networks, to guarantee access to services, protect the privacy and personal information of Costa Ricans, our industrial park and public institutions.”
This becomes critical when considering the main threats from hostile countries or terrorist organizations, which seek to destroy or abuse critical infrastructure, threaten national security, disrupt the economy, and cause physical harm to citizens, technology news site Silicon Week reported.
“China’s National Security Law in Article 7 states that all organizations [including firms and parent companies] and citizens shall assist and cooperate in national intelligence work in accordance with the Law […]. They shall share the secrets of the national intelligence work they know,” Costa Rica’s Deputy Minister of Telecommunications Hubert Vargas told the International Relations Commission of the Legislative Assembly. “This is a piece of information to better serve, because our new regulation incorporates certain limitations on economic blockades to institutions that are not being loyal partners in their relationship with others.”
Among the risks the cybersecurity measure takes into account are companies susceptible to pressure from a foreign government, or that are subject to the requirement of a foreign government, as in the case of China, that they share information of end users of the telecommunications services provided.
“Do you not remember when the treasury could not give appointments because it had been hacked? Do you not remember when we could not pay teachers and educators? We had to give them payroll advances because the National Treasury had no payment systems,” Chaves said. “If we had caught the people who did the Conti [Russian group] attack against us, we would not be able to sue them at the criminal level in Russia, because Russia does not adhere to international standards of cybercrime prosecution, which is the Budapest Agreement.”
The Chinese Embassy in Costa Rica called the assumption that its country shows a higher cybersecurity risk “absurd and unfounded.”
According to Spanish news agency EFE, Chinese telecommunications company Huawei filed in early October an appeal for legal protection before the Constitutional Court of Costa Rica, due to its potential exclusion from 5G contracts in the Central American country.
“The discussion in the country has been deep, vast, and extensive,” Juan Manuel Campos, general director of Costa Rican telecommunications consulting firm Ciber Regulación Consultores, told Diálogo. “It is expected that by the first or second quarter of 2024 the 5G tender could be duly awarded.”