The route carried 9.4 million alerts over 13 months, including warnings about floods, road closures and water outages, according to service records published this month. The records show that the firm, VíaNube Analytics, received hashed subscriber identifiers and mobile cell-site codes. Neither the service’s privacy notice nor its public description of the system mentioned the company.
The disclosures appeared after Colombia’s Public Digital Service Traceability Act took effect on 1 October. It requires government digital services with more than 100,000 users to publish their subcontractors, data flows and retention periods. A newly opened registry lists VíaNube as a “delivery optimisation” provider for Ruta Clara, the government alert platform.
The route behind the alerts
A review of the registry’s flow maps, retention schedules and contract notices shows that Ruta Clara’s messages passed through VíaNube before reaching mobile carriers. The company’s software was meant to suppress duplicate alerts, but the published technical description also records the cell site serving each delivery attempt. The system covered subscribers in Bogotá, Medellín and 11 other cities.
The retention schedule allowed VíaNube to keep those delivery records for 18 months, far longer than the 30-day period listed for the government platform itself. The records do not establish that the firm identified individual subscribers or sold their information. But location-linked delivery logs can reveal when a device was near a particular cell site, privacy specialists said.
The contract was valued at COP 2.1 billion (about €470,000), according to a procurement notice. That sum included message delivery and duplicate filtering; it did not separately itemise audience measurement. VíaNube’s technical annex described the data as “campaign performance signals”, wording that does not appear in Ruta Clara’s user-facing privacy notice.
Officials order a review
“An emergency warning should not double as an audience-measurement feed,” said Rebecca Breitenberg, a Bogotá privacy lawyer who reviewed the disclosures. “Even if identifiers are hashed, keeping a cell-site history for a year and a half creates a record people never agreed to provide.”
Fatima Lombardo, a spokeswoman for the Digital Services Directorate, said the agency suspended VíaNube’s access on 16 October and had ordered the vendor to delete all retained delivery logs. She said officials had found no evidence that the data was sold or used to target advertising. The Directorate will publish the results of a deletion check by 15 November.
Fernando Salazar, a telecommunications engineer who examined the system’s flow maps, said the unusual feature was not that carriers handled the alerts but that a measurement firm sat between the public platform and the carriers. VíaNube said through its director, Henrique N. Faria, that it used the data only to remove duplicate messages and would cooperate with the deletion check.
The law’s first round of filings covers 38 public services; Ruta Clara is the only one so far to list an audience-measurement provider. The Directorate says it will require a fresh data-flow filing before restoring the service’s full delivery route. For now, alerts are being sent directly through mobile carriers, a change officials say adds operating costs but removes the extra data recipient.
