On September 16, 2024, the Municipal Court of Cienfuegos sentenced José Manuel Barreiro Rouco, a 52-year-old barber, to two years and six months in prison. The crime: some memes about Miguel Díaz-Canel, Fidel and Raúl Castro, shared in a WhatsApp group of eleven people, all of them his own family: brothers, cousins, aunts.
His defense argued the obvious: it was a private conversation, with no intent of public distribution. It made no difference. According to the sentence, he had committed “degrading and offensive actions affecting the honor and integrity of relevant figures of the Cuban Revolution”. Before the trial he had already spent six months in pretrial detention.
There is one detail I will not hide, because here accuracy matters more than effect: alongside the contempt charge they added one for illegal possession and sale of dollars. It is the usual pattern: a common crime is bolted onto a political file so the sentence looks ordinary. But what the sentence itself identifies as the offense are the memes.
Four months later, in January 2025, the Provincial Court of Santiago de Cuba sentenced Félix Daniel Pérez Ruiz to five years for “propaganda against the constitutional order”. He had written on Facebook that he was fed up with the government, called for a demonstration, and asked people to share it. The court itself recorded that the demonstration “did not materialize due to the actions of the authorities of the Ministry of the Interior”. He was convicted, in other words, over a protest that never happened.
And alongside him they sentenced Cristhian de Jesús Peña Aguilera, aged 22, to four years in prison for sharing that call: for “making it his own and increasing the number of followers”, according to the file.
Four years for a share.
What this means technically
I work in networking and information security, and for that reason I want to say this as plainly as I can: none of these three sentences would have been prevented by a VPN.
There was no traffic interception. No encryption had to be broken. WhatsApp is end-to-end encrypted and it made no difference whatsoever, because the state did not read that message on the wire: it read it on a phone. Someone in that group of eleven, or someone the conversation was forwarded to afterwards, handed it over. In the Facebook case not even that was required: the content was public.
The threat model assumed by almost every security tutorial, an attacker watching your connection, is not the one that sends people to prison in Cuba. The real vectors are three others:
1. The device
Decree-Law 370, known as the “Whip Law”, authorizes in its article 68 the confiscation of phones, computers and equipment, along with fines of 3,000 pesos for “spreading information contrary to social interest”. There are documented cases of activists whose phones were seized. Put plainly: your phone is not only your tool, it is the evidence against you, and the law already provides for taking it from you.
2. The people
Eleven relatives were too many. Not because family is disloyal. I have no idea who talked in that case and it is not mine to speculate. It is pure arithmetic: in a system that has spent sixty years rewarding informers, every person who knows something is one added probability. The privacy of a closed group is not a technical property of the group; it is the sum of the discretion of all its members.
3. The law
The 2022 Penal Code provides for up to fifteen years in prison for “propaganda against the constitutional order” and for “dissemination of false news”. Decree-Law 35, of 2021, classified using social networks to call a march or criticize the government as “social subversion”. They do not need to prove concrete harm: the text you wrote is enough.
The right order of priorities
All of this points to something that runs opposite to the usual advice. If someone in Cuba asked me where to start, I would not talk about tools. I would say, in this order:
- First, what is on your phone. Starting from the assumption that one day it will be searched. What is not stored cannot be confiscated.
- Second, who knows. Every person added to a conversation multiplies the risk, and no application corrects that.
- Third, and only third, what you connect with. It matters, but it is the link that has cost the fewest people their freedom.
I am not going to publish a recipe of specific tools here: doing it properly requires an entire article, written carefully, and doing it badly is worse than not doing it. I would rather say one true thing than ten comfortable ones.
The most uncomfortable conclusion
I want to be precise here, because it is easy to read what I am not saying. I am not telling you to keep quiet. What comes out from inside cannot be replaced by anyone outside: without it there is no case file, no news story and nothing to bring before a court the day there are courts. Every one of the sentences I describe in this article is known because someone over there told it.
What I am saying is a different thing, and it is about who signs. Get the material out and let someone beyond the reach of that court publish it. How to do it with less risk is what I work through in another article. You remain the source, not the author: the complaint goes out just the same, the world sees it just the same, and the name on it is not on the island.
That is exactly what I do with this blog, and I am not embarrassed to say so: I can write this because I am in Tampa and not in Sancti Spíritus. The distance does not make me right: it gives me impunity. And using it to amplify what others cannot say without going to prison strikes me as the only decent way to spend it.
Barreiro Rouco was fifty-two and cut hair. Peña Aguilera was twenty-two and hit share. Neither was a journalist, nor a famous dissident, nor a threat to anything. And that is precisely what makes this worth telling: they were not punished for being dangerous. They were punished so that everyone else understands the price.