There is a Cuban law that does not talk about politics. It talks about “computing”. It is called Decree-Law 370, it came into force in 2019, and on the street everyone knows it by another name: the Whip Law.
Its article 68, subsection i), defines as a violation “spreading, through public data transmission networks, information contrary to social interest, morality, good customs and the integrity of persons”.
Read that again slowly. It does not define what “social interest” is. It does not define “good customs”. No judge is needed, no trial, no lawyer: it is an administrative sanction. An official decides that what you published goes against social interest, and that is that.
What it costs you
The usual sanction is a fine of 3,000 pesos. And it often comes with something that hurts more: confiscation of your phone.
That second detail is the one that interests me as an engineer, because it changes the problem completely. A fine gets paid. A confiscated phone is something else: it is your contact list, your conversations, your photos, your groups, the list of every person you talk to and what you talk about with each one. They are not taking a device. They are taking your entire network.
How many, and who
The data journalism project Inventario compiled the most complete registry that exists: 68 fines imposed on 58 people, across nine provinces and the special municipality of Isla de la Juventud.
The first known person fined was the reporter and activist Iliana Hernández Cardosa. The list also includes journalists such as Camila Acosta Rodríguez and Mónica Baró Sánchez, activists such as Nancy Alfaya Hernández, opposition figures such as Ovidio Martín Castellanos and José Díaz Silva, and even a youtuber, Yander Serra Palomares. Independent journalists and activists are by far the hardest hit.
And now the warning Inventario itself makes, which should not be skipped past: that registry does not capture every sanction, only those the affected people chose to report publicly. In other words, 58 is the floor, not the ceiling. How many paid in silence, out of fear or exhaustion, nobody knows.
The case that sums it all up
Among the documented cases there is one that stays with you: an activist convicted for breaking his own phone rather than handing it to the police.
Think about what that means. That man calculated, on the spot, that it was cheaper to destroy his device and face the consequences than to let State Security read what was inside. He knew the problem was not losing the phone. It was everything else the phone handed over with it.
Why this matters more than any VPN
Here is the technical conclusion, and it is uncomfortable.
The whole public conversation about digital security revolves around protecting transit: encrypting the connection, hiding the IP, stopping anyone from spying on you along the way. That is fine and it is needed. But Decree-Law 370 does not attack transit. It attacks storage, and it does so legally.
They do not need to break your WhatsApp encryption if they can ask you for the unlocked phone. They do not need to intercept anything if the law authorizes them to take away the device where everything is already decrypted and waiting for them.
That is why in the first article of this series I said the order of priorities is backwards in almost every tutorial. First, what is on your phone. Then, who knows. And only at the end, what you connect with.
Because the day they ask you for it, the question will not be which app you were using. It will be what they found inside.