Luksic y Angelini recurren a tribunales contra inclusión en listado de ciberseguridad

A dozen companies filed legal challenges this month against Chile's National Cybersecurity Agency, arguing they should not be classified as vital infrastructure operators—a designation that imposes new compliance costs and exposes them to fines of up to 40,000 UTA, roughly $3.1 million.

The disputes center on a roster published July 24 by the Agencia Nacional de Ciberseguridad (Anci), which identified 239 entities across fuel, water, transport, electricity, telecommunications, and other sectors as operators of vital importance. Three mining operations from Antofagasta Minerals—Zaldívar, Antucoya, and Centinela, all controlled by the Luksic group—filed complaints with the Santiago Court of Appeals, as did Copec, the fuel distributor owned by the Angelini group, and UC Christus, which operates hospitals and clinics affiliated with the Pontifical Catholic University of Chile.

The companies contend the agency ignored their written objections during the consultation period and failed to provide individualized justification for their inclusion. Zaldívar argued that its internal electrical lines serve only its mining operations, not the general public, and that any cybersecurity incident would affect only its own production processes, not the national electrical grid. The other Luksic mines made similar arguments. Copec went further, noting that during the nationwide blackout on February 25, 2025, all of its storage plants, trucks, and stations continued supplying fuel manually and without incident, demonstrating that its operations do not depend on interconnected digital systems whose failure could cascade across the broader infrastructure.

The legal framework underlying these designations is the Cybersecurity Framework Law, approved two years ago. The Anci began operations on January 1, 2025, tasked with coordinating national cybersecurity policy and identifying entities whose failure could threaten national security. Once classified as a vital operator, a company must establish continuous information security management systems, develop operational continuity and cybersecurity plans, conduct training programs, and designate a cybersecurity delegate to serve as the agency's point of contact. Failure to comply with these obligations can result in the maximum fine.

UC Christus raised a broader complaint about the process itself. The agency, the health system argued, never explicitly stated the criteria or evidence justifying any company's inclusion, leaving the public consultation "materially blind." More fundamentally, UC Christus objected that the designation doubles the company's exposure to penalties and multiplies the grounds for violation, yet the agency applied a generic, standardized approach rather than conducting strict, individualized analysis with real consideration of necessity and proportionality. The company also noted an inequity: while private operators now face potential fines, public health facilities—which make up much of the network serving the population—were excluded from the penalty regime altogether.

Copec received a 374-page file on July 31 detailing its classification, but found it contained no analysis, memo, report, matrix, minutes, or working document from the Anci itself showing how the agency applied its methodology to the company, weighed its objections, or explained why it remained on the final list. The companies had 15 business days from July 24 to file their legal challenges.

When asked about the lawsuits, the Anci responded that the court challenges are a normal part of the legal process created by the Cybersecurity Framework Law, allowing institutions to contest their designation. The agency noted that the second stage of the roster included sectors with less mature cybersecurity practices, which may explain why companies feel they do not belong on the list. Whether the courts agree remains to be seen.