To understand why a message can put you in prison in Cuba, you have to understand that it is not one law that allows it: it is three stacked layers, built over three years, each covering what the previous one left out.
Layer one: punishment without trial (2019)
Decree-Law 370 turns publishing “information contrary to social interest” into an administrative offense: a 3,000 peso fine and, frequently, confiscation of your phone. No court is needed, no lawyer. I wrote about it in another article.
It serves for quick, silent punishment. It is the layer that touches the most people.
Layer two: infrastructure and the “incident” (2021)
In August 2021, barely a month after 11J, the Official Gazette published Decree-Law 35 on telecommunications alongside Decree 32 and Resolution 105/2021.
That resolution is the piece worth looking at closely, because it does something unusual: it turns speech into a technical incident. It defines seventeen “cybersecurity incidents” and assigns them a danger scale of very high, high, medium or low. And among those of high danger is the “dissemination of false news, offensive messages and defamation with an impact on the country’s prestige”.
Look at the language. In the same list where you expect to find viruses, intrusions or service outages, there is publishing something that annoys the state. It is catalogued as a security failure, just like a cyberattack. The regime does not need to call it censorship: it calls it incident management.
Layer three: prison (2022)
The 2022 Penal Code supplies the prison sentences. Amnesty International described it as a terrifying prospect, and that is not rhetorical exaggeration.
Its article 143 punishes with four to ten years of imprisonment anyone who “supports, promotes, finances, provides, receives or holds funds, material or financial resources, for the purpose of funding activities against the State and its constitutional order”, whether on their own behalf or for non-governmental or foreign organizations.
Let me be precise: that article is not about what you publish, it is about money. And there lies its usefulness to the state. Any independent journalist receiving payment from abroad, any activist with outside support, anyone whose emigrant relative sends a remittance later spent on something a prosecutor considers “activity against the State”, fits inside a text drafted with exactly enough ambiguity to cover almost anyone. Human rights organizations have pointed out precisely that: the vagueness is not a drafting flaw, it is the function.
The Code also contains the speech offenses now being used to convict people for posts, such as “propaganda against the constitutional order”, for which Félix Daniel Pérez Ruiz received five years over a Facebook post.
Why three layers and not one
Because they do different jobs and they cover for each other.
- 370 punishes fast and quietly, reaching many people and leaving no judicial trace.
- 35 and Resolution 105 provide the administrative cover and the vocabulary: this is not repression, it is cybersecurity.
- The Penal Code keeps prison in reserve for when they want to make an example.
A citizen is not facing a rule they can read and comply with. They are facing a graded system in which the authority chooses, case by case, which layer applies to you. That discretion is the product.
What this means in practice
It means that in Cuba there is no clear line you can avoid crossing. There is no list of forbidden topics you can consult. There are elastic concepts: social interest, good customs, the country’s prestige, constitutional order. They are defined by whoever is judging you.
And it means something else, which interests me most as an engineer: none of these three layers requires breaking encryption. They do not attack the technology. They attack the person, with a fine, a confiscated device or a sentence. That is why I keep insisting throughout this series: the problem is not in the cable.