The route of the Cybersecurity Law

The hacking of the Mexican Army, which occurred a few days ago, accelerated the work of the commissions of the Senate of the Republic and the Chamber of Deputies, which review the 19 bills on cybersecurity presented in the Congress of the Union in recent years. , and forced them to draw a critical path that aims to approve reforms to the legal framework, before next December 15.

According to the president of the Science, Technology and Innovation Commission of the Chamber of Deputies, Javier López Casarín, in the coming days it will be put to the consideration of the members of the Science and Technology Commission of the Senate and of which he chairs , the first draft of the Cybersecurity law initiative.

It is a pre-opinion that consists of 11 titles, 82 articles, and seven transitory articles.

The document, which they identify as version zero, includes a title for cybersecurity authorities with five chapters in which the institutions that are intended to be created are appreciated:

1. National Cybersecurity Agency
2. Intelligence and Cybersecurity Incident Response Team
3. Cybersecurity Units
4. From the Investigative Authority
5. Of the Specialized Prosecutor’s Office in Cyber ​​Crime.

One title is dedicated to public policies on cybersecurity, with two chapters: one on general cybersecurity policy and another on sectoral cybersecurity policies.

Another title that talks about index, reports and exercises on cybersecurity, with three chapters:

1. Cyber ​​Security Index
2. Annual Reports on Cybersecurity
3. Cybersecurity Exercises.

One more is dedicated to external technology providers with three chapters:

1. Providers in Cybersecurity
2. Providers of Information and Communication Technologies
3. Guarantees for the State.

The other chapters are on structural security obligations; obligation of cooperation; cybersecurity information; national and international assistance and cooperation; cybersecurity responsibilities; crimes related to cybersecurity and security of the nation, in addition to transitory articles.

The federal deputy stated that he is concerned about attacks on companies, which may affect their assets, as well as cyber attacks on government entities that may be part of attacks for political purposes.

“You have to ask what are the purposes behind it, if it is not to generate destabilization (…) that we have not seen it physically does not mean that we have not suffered an attack as a nation. That is what we are dealing with,” she remarked.

He mentioned that the information extracted from Sedena’s computer systems makes evident the danger posed by cyberattacks and the risk involved in the context of national security. “We cannot leave aside the visualization of this matter with the character of national security.”

One of the coincidences between representatives of companies in the sector and legislators is the creation of a National Cybersecurity Agency, which would also have the mission of maintaining close collaboration with international bodies.

Now there is a sense of urgency

For his part, the president of the Political Coordination Board of the Chamber of Senators, Ricardo Monreal Ávila, said: in Congress “we want to make an effort because in this session we can agree on advanced legislation.”

In an interview, he stated that the theft of information from the Ministry of National Defense (Sedena) is not minimized in the Senate. “That is why we are urgently meeting to agree, deputies and senators to legislate on this matter.”

What happened to Sedena, he added, is a sign of the urgent need for the country to have special legislation on cybersecurity.

In his opinion, the legislation must have a national scope, which grants responsibilities to the different government bodies.

“Regulatory regulations are required for the sixth constitutional article; a law of general application that provides advanced regulations to protect the digital and computer activity of the institutions of the Mexican State, the exchange of information and social of people.

In addition, since cybercrimes are often committed from outside borders, a law that meets international conventions is required to achieve effective cooperation, he said.

For the coordinator of the Morena faction in the Senate, the legislation must establish the bases for the integration and coordination of the institutions in charge of preserving cybersecurity: it must classify crimes against the confidentiality, integrity and availability of data and systems computer systems, as well as illicit access to systems and illicit reproduction of information contained therein. In addition, guarantee institutions and the population secure access to information and communication technologies. he exposed him.

The Zacatecan legislator stressed that more severe penalties should be imposed for crimes such as child pornography and more severe penalties should be imposed for illegal access to computer systems of financial institutions.

He stressed that public institutions are the backbone of any nation, therefore, they cannot remain unprotected against any threat against cyber attacks.

A National Cybersecurity Center is necessary: ​​Miguel Ángel Mancera

In this sense, Senator Miguel Ángel Mancera, who presented a reform initiative on the matter since September 2020, drew attention to the fact that what is currently in place in the country to prevent this type of attack are separate efforts in some dependencies and in the private sector, but there is no single legal framework, nor a consistent institutional effort. That allows for violations.

He stressed that what is needed is to have a National Cybersecurity Center where efforts are concentrated and federal and local authorities are coordinated, as well as collaboration with foreign countries.

The operation of a center like that will mark the chiaroscuros and the guidelines to act, where there are more capacities and the guidelines to act.

The legislator stressed that the reforms made in the matter must contain, at a minimum, issue the General Cybersecurity Law; amendments to the Criminal Code to classify crimes committed in the area of ​​cybersecurity; have a General Law of the National Public Security System; create the Cybersecurity Commission, as part of the National Public Security Council and create the National Cybersecurity Center of the Executive Secretariat of the National Public Security System.

For the legislator, it must be determined how big the gap between technology and legislation is, because systems develop at great speed, societies within their governmental and legislative ecosystems take a long time to react to generate legal frameworks and processes. adequate judicial procedures, which is generating legal gaps within the legal framework that leave users defenseless against cybercrime.

diego.badillo@eleconomista.mx