Cybercrime policies/strategies
Panama has a National Cyber security Strategy since early 2013, which is an instrument that stipulates, on the one hand, a consensus between government authorities and, on the other hand, it is used as a guide for the implementation of public policies for cyber security and the protection of critical infrastructure. It also shows a commitment of the Republic of Panama for the protection of cyberspace and the institutional collaboration at the national and international level.
The National Cyber Security Strategy of Panama contains the following pillars:
- Promote the development of telecommunications and connectivity nationwide;
- Protect the privacy and fundamental rights of citizens in cyberspace;
- Prevent and stop criminal conduct in cyberspace from any type of crime or wrongdoing;
- Strengthen the cyber security of the national critical infrastructure;
- Encourage the development of a strong national business network for cyber security that could be used as reference for the Latin-American region;
- Develop a culture of cyber security through training, innovation and adoption of standards; and
- Improve cyber security and incident response capability of public institutions.
According to the Report from 2016 “Cybersecurity. Are we ready in Latin America and the Caribbean” from Inter-American Development Bank and the Organization of American States (OAS), there are still some issues to improve regarding cybersecurity: “While some security standards are in place, there is currently limited coordination among operators for CNI protection”.
The government of Panama has actively participated in the various activities of the Council of Europe concerning the fight against cybercrime. Panama was the second country in the Caribbean and Latin America to ratify the access protocol of the Budapest Convention on 5 March 2014.
On the other hand, the government of Panama has also actively participated in the framework of the Inter-American Strategy to Combat Cyber security Threats of the Organization of American States (OAS). As part of the awareness activities on cyber security in that country, the government of Panama has conducted drills and exercises on cyber attacks, practical workshops on cyber security and various awareness campaigns with national institutions to inform citizens on cyber risks and to foster the use of best practices related to information security and the fight against cybercrime.
Cybercrime legislation
State of cybercrime legislation
Panama does not have an independent law to investigate, prosecute and punish cybercrime. The legal framework for the investigation and prosecution of cybercrime is mainly contained in the Criminal Code of 26 April 2010.
Draft Cybercrime Bill 2017 was prepared with CoE assistance and includes the criminalization of conducts and crimes committed through information technologies under the substantive provisions of the Budapest Convention. The current bill is still pending to be passed by the National Assembly of the Republic of Panama.
Substantive law
The offenses related to the use of information and communication technologies that are sanctioned and punished under Panama’s Criminal Code of April 26, 2010 are the following:
Seize or improperly reporting the content of a letter, email, statement or telefax (Art. 164 of the Criminal Code)
Removing, destroying, concealing, misleading, intercepting or blocking a letter, statement or telefax (Art. 165 of the Criminal Code)
Publicly disclosing correspondence, recording or private documents and personal information without the corresponding authorization and not intended for marketing purposes and resulting in damages (Art. 166 of the Criminal Code)
Interception of telecommunications or use of technical devices for listening, transmitting, recording or reproducing conversations not directed to the public without authorization of the judicial authority (Art. 167 of the Criminal Code)
Facilitating, instigating, recruiting or organizing any form of sexual exploitation of children or persons with disabilities (Art. 180 of the Criminal Code)
Facilitating and promoting sexual tourism with children in national territory (Art. 181 of the Criminal Code)
Manufacturing, producing, offering, trading, publishing, broadcasting or distributing pornographic material via the Internet or any mass media or national or international information where children are shown engaging in real or simulated sexual activities (Art. 184 of the Criminal Code)
Possession of pornographic material pertaining to children (Art. 185 of the Criminal Code)
Using, consenting or allowing children to engage in acts of indecent exposure or pornography photographed, filmed or recorded by any means, as well as inciting or promoting online sex with minors through the Internet (Art. 187 of the Criminal Code)
Theft and computer fraud (Art. 220 of the Criminal Code)
Identity theft of a person in order to turn a profit (Art. 221 of the Criminal Code)
Consuming or receiving signals of telecommunications, video, computer terminal cable, satellite, or altering or manipulating any element of measurement or control (Arts. 224 and 225 of the Criminal Code)
Amending, modifying or manipulating programs, databases, computer systems or networks in the detriment of a third party
Seizing or making unduly use or cause the illegal transfer of money, securities, property or financial resources of a bank, finance company or any other entity dealing or intermediating with public financial resources of the public through information, fraud or technological media manipulation. (Art. 243 of the Criminal Code)
Destroying, concealing or misrepresenting accounting books and records and financial statements of individuals or companies in order to obtain, maintain or extend a credit facility or capital from a bank or financial entity or any other dealing or intermediating with financial resources from the public. (Art. 244 of the Criminal Code)
Transfer, storage and trading of securities, property and financial resources arising from illegal activities. (Art. 254 of the Criminal Code)
Crimes against intellectual property. (Art. 262 to 266 of the Criminal Code)
Crimes against industrial property rights. (Art. 267 to 273 of the Criminal Code)
Misuse, forgery, modification or cloning of credit and debit cards including the transfer for illicit purposes. (Art. 287 of the Criminal Code)
Disclosure of business secrets through the seizure of data, information and computer support (Art. 288 of the Criminal Code)
Illicit access to databases, computer systems or networks. (Art. 289 of the Criminal Code)
Copying, using or modifying, interfering with, intercepting or hindering databases or information systems of public, private or mixed institutions, banks, insurance companies and other financial and securities institutions and the aggravation of conducts when the acts are committed by individuals in charge of the database or the computer system. (Art. 290, 291 and 292 of the Criminal Code)
Damage to critical infrastructure, including telecommunications signals, cable, Internet and fiber optic. (Art. 298 of the Criminal Code)
Conduct or join a global organization devoted to trafficking of persons (Art. 442 of the Criminal Code)
Procedural law
Judicial Code of Criminal Procedure so far does not address specific procedural powers required by the Budapest Convention, except for limited implementation of search/seizure and interception provisions.
General rules of criminal procedure of public and private action and powers and duties of the parties in criminal proceedings (Arts. 110 to 125 of the Criminal Procedure Code and Arts. 1941 to 1968 of the Judicial Code)
General rules for the registration, search and seizure of places, objects and people and the authorization orders by the Judge of Safeguards Control (Arts. 293 to 317 of the Criminal Procedure Code and Arts. 2178 to 2196 of the Judicial Code)
Procedure to conduct the wiretapping of conversations and interception of online communications, satellite tracking, electronic surveillance and telephone communications in order to prove the offense and the involvement of certain persons at the request of the Public Prosecutor (Art. 311 Criminal Procedure Code)
Seizure of computer equipment or data stored in any other media by the Public Prosecutor (Arts. 314 Criminal Procedure Code)
Conduction of disguised operations by the Public Prosecutor for the purpose of gathering evidence to determine a criminal offense (Arts. 315 Criminal Procedure Code)
Safeguards
The protection of human rights and safeguards contained in the legislation of the Republic of Panama are the following:
Due judicial process (Arts. 1 to 3, 8, 9, 15, 18, 22, 24, 25 of the Criminal Procedure Code and Art. 1944 of the Judicial Code)
Double jeopardy prohibition (Arts. 7 of the Criminal Procedure Code and Art. 1945 of the Judicial Code)
Right to defense (Arts. 10 Code of Criminal Procedure)
Right to freedom of movement and personal security (Art. 11 Code of Criminal Procedure and Art. 1942 Judicial Code)
Judicial control of the breaching of fundamental rights (Art. 12 Code of Criminal Procedure)
Right to privacy of the body, property and communications of individuals (Art. 13 Code of Criminal Procedure)
Respect for human rights in criminal proceedings (Art. 14 Code of Criminal Procedure)
Right not to incriminate oneself (Art. 16 Code of Criminal Procedure)
Procedural equality of the parties (Art. 19 Code of Criminal Procedure)
Rights of victims, complainants and collaborators (Art. 20 and 80 Criminal Procedure Code)
Inviolability of correspondence, private documents and telephone calls (Art. 29 Political Constitution of the Republic of Panama)
Right to request extradition (Art. 516 to 552 Criminal Procedure Code)
Related laws and regulations
The following laws contain provisions relating to offenses committed through the use of computer systems and Internet, as previously mentioned in the sections of substantive and procedural law:
Political Constitution of the Republic of Panama https://web.oas.org/mla/en/Countries_Intro/Panam_intro_textfun_eng_1.pdf
Law 121 of 31 December 2013 which amends the Criminal Code, the Judicial Code and the Criminal Procedure Code and adopts actions against activities related to organized crime
https://www.organojudicial.gob.pa/uploads/wp_repo/blogs.dir/cendoj/tf12o28vxd-ley-121-de-2013.pdf
Law 35 of 23 May 2013 which amends the Criminal Code on the extradition proceedings and other provisions
https://www.organojudicial.gob.pa/uploads/wp_repo/blogs.dir/cendoj/ley-35-de-23-de-mayo-de-2013.pdf
Criminal Code of the Republic of Panama https://www.supervalores.gob.pa/files/Ley/TEXTO_UNICO_CODIGO%20PENAL.pdf
Criminal Procedural Code of the Republic of Panama
Judicial Code of the Republic of Panama http://200.46.254.138/legispan/PDF_NORMAS/1980/1984/1984_017_2011.PDF
National Strategy on Cyber Security and Critical Infrastructure Protection
Executive Decree No. 709 of 26 September 2011 establishing the National Computer Security and Incident Response Team of Panama (CSIRT-Panama) http://www.gacetaoficial.gob.pa/pdfTemp/26880/34793.pdf
Law No. 51 of 8 September 2009 establishing rules for the preservation, the protection and disclosure of user data of telecommunications services and adopting other provisions https://docs.panama.justia.com/federales/leyes/51-de-2009-sep-23-2009.pdf
Law No. 24 of 22 May 2002 regulating the service of providing information on the history of consumer credit and other users
http://www.oas.org/es/sla/ddi/docs/P7%20Ley%2024%20de%202002.pdf
Specialised institutions
The institution responsible for the supervision and direction of matters related to information security is the National Authority for Government Innovation (AIG) that operates under the Computer Security and Incident Response Team of Panama (CSIRC). There are two agencies responsible for the coordination and judicial investigation of cyber crime. These agencies are the Deputy Prosecutor for Crimes against Intellectual Property and Information Security of the Attorney General's Office conformed by the Public Prosecutor (Ministerio Público) and the Directorate for Judicial Investigation of the National Police. A specialized investigating unit on computer crime was recently created within the Directorate for Judicial Investigation and it is under current development. Such specialized investigating unit will provide capacity and training to conduct investigations and digital forensics activities.
The Computer Security and Incident Response Team of Panama (CSIRT) is the national entity in charge of facilitating security incident response information nationwide. Among its main objectives are fostering, preventing, identifying and resolving security incidents attacks to and against computer systems that are part of the national critical infrastructure, and provide access to information for national citizens. Its activities also include coordinating, collaborating, and proposing rules aimed at increasing the efforts to raise the levels of security related to information and communication technologies in the government sphere. The CSIRT of Panama maintains a close collaboration with other national CSIRT’s of the region and worldwide.
International cooperation
Practical guides, templates and best practices
Jurisprudence/case law
The Supreme Court of Justice of the Republic of Panama has issued judgments and case law related to child pornography and interception of private communications. The national judgments and case law can be consulted directly in the section of National Jurisprudence of the website of the National Congress of Panama at: http://www.asamblea.gob.pa/legispanweb.
Sources and links
- CSIRT-Panama https://cert.pa/
- Judicial Branch of the Republic of Panama http://www.organojudicial.gob.pa
- Supreme Court of Justice of Panama http://www.organojudicial.gob.pa/tribunales/corte-suprema-de-justicia/
- Public Prosecutor of Panama. Attorney General's Office http://www.ministeriopublico.gob.pa/minpub/
- National Congress of Panama http://www.asamblea.gob.pa/
- Ministry of Foreign Affairs of Panama http://mire.gob.pa/
These profiles do not necessarily reflect official positions of the States covered or of the Council of Europe.
Are you aware of the latest legislative or policy developments on cybercrime and electronic evidence?
Share this information with us helping to keep this platform up to date.
- Cybercrime website
- Template: Mutual Legal Assistance Request for subscriber information (Art. 31 Budapest Convention). English and bilingual versions available.
- Template: Data Preservation Request (Articles 29 and 30 Budapest Convention). English and bilingual versions available.