With the advancement of technology, cryptography has significantly evolved to become a pillar of information security and an important tool in guaranteeing the privacy of communications, as well as in securing financial transactions and authenticating digital documents. Due to its relevance, cryptography has become the focus of regulatory debates, particularly concerning topics such as privacy, national security, and criminal investigation.
In an increasingly interconnected society, the use of cryptographic tools is even more important, particularly considering the variety of actors with the potential to threaten individual and collective rights, such as authoritarian governments, malicious actors in the private sector, and criminals. A growing number of these actors have systematically started to use encryption-breaking tools such as First Mile and Pegasus, leading to an increase in the number of cyber surveillance cases and the targeting of cyber activists in Latin America, where digital protection legislation is still in its infancy.
Within this context and as part of LACNIC’s Líderes Program, I developed the project “Among Keys and Codes: A Map of Cryptography Legislation in the Southern Cone.” The study mapped and analyzed 144 laws, decrees, and resolutions adopted in Brazil, Argentina, Chile, Paraguay, and Uruguay for the purpose of understanding how each country defines, regulates, and encourages the use of cryptography. We examined key issues such as the scope of the use of cryptography, legal provisions regarding cryptographic mechanisms, acknowledgment of the right to cryptography, incentives for its development, and the circumstances under which restrictions may be imposed.
The project adopted a methodological approach, with a qualitative analysis of regulatory instruments collected in official journals, use of keywords, and literature review as a supplementary tool.
The research mapped and analyzed 144 regulatory instruments in the countries mentioned above, including laws, decrees, and resolutions, with the aim of understanding how cryptography is defined, regulated, and promoted in each country. The data revealed that, although cryptography is widely acknowledged as a means for ensuring security and privacy, few countries have clear mechanisms in place to promote its adoption or robust regulations addressing its applications in specific sectors.
The analysis revealed a diverse regulatory landscape, with Chile emerging as the leader, Brazil and Uruguay in intermediate positions, and Argentina and Paraguay facing significant challenges. Chile has the most robust regulatory framework, as it recognizes the right to encryption in its Law No. 21.663/2024, an innovation at the regional level that guarantees the protection of citizens’ communications. Additionally, the country has 20 regulatory instruments governing the use of cryptographic mechanisms in strategic sectors, including cybersecurity and the digital economy. Chilean legislation also provides clear definitions for concepts such as encryption and decryption, which reduces ambiguities and facilitates its application.
In Brazil, on the other hand, progress has been fragmented. Although the country lacks specific legislation on encryption, the topic is addressed by various public policies, including the National Cybersecurity Policy. With legal definitions included in presidential decrees, Brazil regulates the use of encryption in areas such as data protection and electronic transactions. Despite significant progress, there are gaps in consolidating a unified regulatory framework which could enhance its application in emerging sectors.
The research mapped and analyzed 144 regulatory instruments in the countries mentioned above, including laws, decrees, and resolutions, with the aim of understanding how cryptography is defined, regulated, and promoted in each country. The data revealed that, although cryptography is widely acknowledged as a means for ensuring security and privacy, few countries have clear mechanisms in place to promote its adoption or robust regulations addressing its applications in specific sectors.
The analysis revealed a diverse regulatory landscape, with Chile emerging as the leader, Brazil and Uruguay in intermediate positions, and Argentina and Paraguay facing significant challenges. Chile has the most robust regulatory framework, as it recognizes the right to encryption in its Law No. 21.663/2024, an innovation at the regional level that guarantees the protection of citizens’ communications. Additionally, the country has 20 regulatory instruments governing the use of cryptographic mechanisms in strategic sectors, including cybersecurity and the digital economy. Chilean legislation also provides clear definitions for concepts such as encryption and decryption, which reduces ambiguities and facilitates its application.
In Brazil, on the other hand, progress has been fragmented. Although the country lacks specific legislation on encryption, the topic is addressed by various public policies, including the National Cybersecurity Policy. With legal definitions included in presidential decrees, Brazil regulates the use of encryption in areas such as data protection and electronic transactions. Despite significant progress, there are gaps in consolidating a unified regulatory framework which could enhance its application in emerging sectors.
By contrast, Uruguay adopts a more structured approach, with laws governing the use of encryption in sectors such as e-commerce and data protection. However, the country also faces certain challenges, such as the absence of clear incentives for large-scale adoption and the lack of legal definitions for basic concepts, such as decryption.
Meanwhile, the regulatory frameworks in Argentina and Paraguay are in their very early stages. In Argentina, the only relevant regulation is Law No. 25.506/2001, which addresses digital signatures but does not directly refer to encryption as a right or a strategic technology. In Paraguay, while some basic definitions exist, there are no structural incentives or public policies dedicated to promoting and strengthening encryption. These gaps undermine the ability of these countries to promote the digital economy and protect fundamental rights.
One of the key outcomes of the project is the interactive legislative map, a practical tool for policymakers, researchers, and organizations interested in promoting a safer digital future.
It also opens up avenues for future research and developments. One of the most promising areas is research into the economic impact of cryptography, exploring how public policies that encourage its use can boost sectors such as e-commerce and financial services. Another significant avenue is analyzing the intersection between cryptography and human rights, exploring how various regulatory approaches affect privacy, freedom of expression, and access to information.
The project highlights that, while encryption is widely acknowledged as an essential mechanism for digital security, many countries in the Southern Cone still lack robust regulations and clear incentives for its adoption. By proposing an integrated and coordinated approach, it seeks to provide technical support to policymakers, researchers, and organizations interested in building a safer and more inclusive digital future.
Ultimately, participating in LACNIC’s Líderes Program was an exceptionally enriching experience. The program not only offers the opportunity to develop a relevant project, but also provides access to a network of experts and leaders in the region, promoting collaboration and learning. I strongly recommend participation to anyone interested in Internet governance and development in Latin America.
