Power Analysis
Governing Through What?
Rodrigo Paz is governing from New York today under a decree that lets him exercise his office through technological means of communication. The decree does not say which. No platform, no security protocol, no record of what is decided. It came out in under two months. The data protection law has been missing for ten.
By Violeta Ayala — Tecnóloga
Today, from New York
President Rodrigo Paz is in New York for the 81st session of the United Nations General Assembly. His spokesman explained that it is an official mission and that the president can govern from the United States by digital means.
That has been legal in Bolivia since January 1, 2026, thanks to a decree a few lines long. That decree does not say through what.
What the decree says
Supreme Decree 5515 was issued at the end of December 2025 and made public on January 1. It amends article 9 of Decree 4857, which organises the executive branch, to read as follows: the President of the State holds the powers set out in article 172 of the Constitution, and shall exercise them through technological means of communication when temporarily outside the national territory.
If those means cannot be used, the president must inform the vice-president, expressly, in writing and with precise dates, of the actions to be carried out while standing in.
The decree was approved for a specific trip, to the World Economic Forum in Davos, from January 19 to 23. In the end Paz did not go.
It also cut the functions of vice-president Edmand Lara, which became to manage and assist actions within the government's general policy, always in coordination with the Ministry of the Presidency. Lara and part of the opposition argue that the rule clashes with article 169 of the Constitution, under which the vice-president takes over the presidency during a temporary absence.
What it does not say
The decree says technological means of communication and defines none of them.
It does not say which platform. It does not say which security protocol. It does not say how anyone verifies that an order comes from the president and not from someone else with access to his phone. It does not say where the record of what is decided is kept. It does not say who can audit it afterwards.
A constitutional analysis published in January explains what the rule is for: it allows cabinet sessions to be held, administrative decisions to be taken and acts of government to be signed at a distance.
Cabinet sessions, administrative decisions and acts of government. All of it travels through some channel, is stored on some server and falls under some jurisdiction. The decree does not say which.
Six questions and what the decree answers
Tap each question.
The answers correspond to the text of Supreme Decree 5515 made public on January 1, 2026, and to coverage by Los Tiempos, Brújula Digital, Unitel and ANF.
What happened elsewhere
Asking whether a government decides by WhatsApp sounds like a joke until you look at what happened in other countries.
In the United Kingdom, much of the government's discussion during the pandemic took place in WhatsApp groups. The official public inquiry into the handling of covid demanded those messages, and the government went to court to avoid handing them over in full. It lost.
In the United States, in March 2025, senior national security officials discussed plans for strikes in Yemen in a Signal group chat to which the editor of The Atlantic had been added by mistake.
Both cases teach the same lesson. When state decisions travel through commercial apps with no rules, records get lost, information leaks, and holding anyone to account afterwards becomes almost impossible.
The decree does not forbid WhatsApp or any other commercial app, does not regulate them and does not mention them.
Whether the president uses them, only the government can say, and in what has been published so far it has spoken only of digital signatures and technological platforms, without naming any.
A country's security
When a head of state decides at a distance, every link in the chain is a door. The phone he uses, the app, the encryption, the way of checking that the person giving the order is really him, the archive where the decision is kept, and the country where the servers sit.
A security protocol is the document that says how each of those doors is closed. Without one, every door stays the way the last person to use it left it.
A head of government's phone is one of the most sought-after targets in the world, and there is proof. On May 2, 2022, the Spanish government announced that the official phone of Prime Minister Pedro Sánchez had been infected in May 2021 with the Pegasus spyware, and that around 2.6 gigabytes of information had been extracted from it.
Spain found out because it had a National Cryptologic Centre that checked the devices. To this day nobody has officially established who did it.
Bolivia has an Information Incident Management Centre inside AGETIC, the state's e-government agency, which offers free services to public institutions and coordinates with their information security officers.
In August 2026, AGETIC's director, Carlos Rodrigo, explained that a strategy was being pushed to build the national incident response team, the National CSIRT, and sectoral teams, so as to provide protection, in his words, at least for critical institutions. Almost eight months after the president became able to govern at a distance, the system that would have to detect an attack on that channel was still under construction.
Other governments settled this in writing. On November 22, 2023, France's prime minister, Élisabeth Borne, signed a circular requiring ministers and members of their cabinets to remove, before December 8, any messaging app not certified by the national cybersecurity agency, ANSSI.
WhatsApp, Telegram and Signal were out. In their place came Olvid and Tchap, the latter developed in 2019 by and for the French public administration. Even that solution had its problem: in December 2023 it was reported that Olvid ran on Amazon Web Services servers, which left it exposed to US law. With a written protocol, at least, the question was asked and debated in public.
If a presidential decision passes through WhatsApp, which belongs to Meta, or through Teams, which belongs to Microsoft, that decision passes through the company's servers before the Plurinational Legislative Assembly knows it exists.
On WhatsApp the content travels end-to-end encrypted and Meta cannot read it, but it does record who writes to whom, when and from which connection. On Teams, by default, conversations are stored encrypted in Microsoft's data centres and the service itself can decrypt them, which is what makes recording and transcription possible. End-to-end encryption has to be switched on, requires an extra licence for meetings and even then does not cover chat.
It is extraordinary that Meta or Microsoft could know, before Bolivia's own legislators, who the president decides things with, and when.
In the middle of a technological revolution, it is inconceivable for a state to take decisions of government at a distance without a published security protocol. A state that governs this way leaves its most sensitive decisions in the hands of whoever controls the channel: the company that owns the app, the country where its servers sit, or anyone who manages to get into the president's phone. A country's security starts with that phone.
Two months and ten months
Rodrigo Paz took office on November 8, 2025. Decree 5515 was ready before the end of the year, for a trip he ended up not making. In August 2026, governing digitally from abroad was also written into Decree 5675, the one that cut the cabinet from 14 to 12 ministries.
In other words, the state took care twice, in less than a year, to give the president a legal framework for governing by digital means.
In that same time no personal data protection law was passed.
The state took less than two months to give the president a decree to govern by digital means when he travels. It has gone ten months without giving citizens a law to protect their data. Neither rule, the one that exists and the one that is missing, says where any of it travels or where it is stored.
What we would need to know
Governing at a distance is not wrong in itself, and the president's argument makes sense: public administration should not freeze because of where its authorities happen to be. Many governments do it.
What sets apart those who do it well is a written protocol, like France's. Decree 5515 has none, and no public document takes its place.
While the president governs from New York, the decisions of the Bolivian state are travelling through some channel. We have a right to know which one.
It is the same question we have been asking about citizens' data, applied to the government itself. In both cases the answer is the same: nobody is obliged to give it, because no rule requires it.
Sources
- La Razón, September 21, 2026: statements by the presidential spokesman on the president's attendance at the 81st session of the United Nations General Assembly and his ability to govern from the United States by digital means.
- Los Tiempos, Brújula Digital, Unitel and ANF, January 1 and 2, 2026: text of Supreme Decree 5515 amending articles 9 and 10 of Supreme Decree 4857, including the wording on exercising presidential powers through technological means of communication, the procedure when they cannot be used, the new functions of the vice-president and the link to the trip to the World Economic Forum in Davos.
- Informe Exclusivo, January 16, 2026: the president's decision not to travel to Davos, and objections from the vice-president and the opposition over the constitutionality of governing from abroad.
- ANF, January 19, 2026: the president's defence of Supreme Decrees 5515 and 5519 and of the use of digital signatures and technological platforms.
- eju.tv, January 2026: constitutional analysis of Supreme Decree 5515, which lists among its purposes holding cabinet sessions, taking administrative decisions and signing acts of government at a distance, and its relation to article 169 of the Constitution.
- teleSUR, August 15, 2026: Decree 5675, which cuts the cabinet from 14 to 12 ministries and incorporates new forms of government management, including digital management from abroad.
- DPL News, Urgente.bo and El Deber, August 2026: launch of the Bolivia Cibersegura 2026 initiative by Entel, AGETIC and the ATT, and statements by AGETIC's director, Carlos Rodrigo, on the strategy to build the National CSIRT and sectoral CSIRTs.
- Information Incident Management Centre (CGII), part of AGETIC's technical and operational structure: free services for public entities and coordination with institutions' information security officers.
- Pegasus espionage against the Government of Spain and EFE, May 2, 2022: the Spanish government's announcement that Prime Minister Pedro Sánchez's official phone had been infected with Pegasus in May 2021, the extraction of around 2.6 gigabytes of information, and detection based on reports from the National Cryptologic Centre.
- elDiario.es, December 5, 2023, and Express Diario: French prime minister Élisabeth Borne's circular of November 22, 2023, the requirement to remove messaging apps not certified by ANSSI before December 8, and the adoption of Olvid and Tchap. On Olvid's use of Amazon Web Services servers, Olvid (software), with references to coverage from December 2023.
- Microsoft, end-to-end encryption for Teams calls, for Teams meetings and admin guide: encryption in transit and at rest in Microsoft data centres by default; optional end-to-end encryption that must be switched on, requires Teams Premium for meetings and does not cover chat; and the loss of recording and transcription when the service cannot decrypt content.
- WhatsApp privacy policy: end-to-end encryption of message content, and the usage, log and connection information the company collects.
- On the international precedents: coverage of the United Kingdom's public inquiry into the handling of the pandemic and the British government's legal dispute over handing over its senior officials' WhatsApp messages, decided against it in 2023; and coverage from March 2025, following The Atlantic's report, of the Signal group chat of senior US officials to which that magazine's editor was added by mistake.
This piece does not claim that President Rodrigo Paz or any official of the Government of Bolivia uses WhatsApp or any other commercial messaging app to carry out government functions. It points out that Supreme Decree 5515 does not define the technological means it enables, nor the applicable security, authentication or archiving protocols, and raises those questions as information of public interest. This piece does not claim that no internal security protocol exists for presidential communications; it points out that the decree does not define one and that none has been published. The precedents from the United Kingdom, the United States, Spain and France are cited to illustrate the risks of governing through digital channels without rules and how other governments dealt with them, and do not imply equivalence with the Bolivian case. The references to WhatsApp, Meta, Teams and Microsoft describe how those platforms are documented to work and do not imply that the Government of Bolivia uses them.
