Revealed in 2023, the scandal involving the Brazilian Intelligence Agency’s (Abin, in Portuguese) use of the espionage software First Mile to indiscriminately track cellphones during the Bolsonaro government exposed the risks of a market for this kind of software used both by federal and state governments. Furthermore, it revealed that the topic isn’t debated much in the country. According to experts, the episode brought to light the need to discuss changes to the rules for using and monitoring these systems.
Rafael Zanatta, director of the NGO Data Privacy Brasil and expert in personal data protection, besides studying the risks of these espionage technologies, said the problem goes beyond First Mile and includes a culture change regarding the use and inspection of these software.
He argues that facing this scenario involves many public and private actors, and includes changes in Abin’s rules, hiring practices in public agencies and even possible changes in the Constitution to make it more explicit the role played by intelligence activities in the country. “The Constitution doesn’t mention intelligence [agencies]. It mentions the public security structure. However, since the Supreme Court (STF, in Portuguese) acknowledged that intelligence activities are under the Democratic Rule of Law, I think the Constitution could make it explicit. It would help a lot.”
An expert on the subject, Zanatta is a lawyer with a PhD from the University of São Paulo (USP) about the collective protection of personal data in Brazil. He is also a member of the Latin American Network on Surveillance, Technology and Society (Lavits). In an interview with Brasil de Fato, he talked about the scenario of technology use in Brazil, the challenges to overcome and how to find alternatives based on successful cases in developed countries.
Zanatta says the Federal Police Operation targeting First Mile was positive because it shed light on the debate and ignited discussions among authorities. The operation dubbed “Last Mile (“Última Milha”, in Portuguese) was launched in October 2023 and led to the removal of Abin’s then number three in the hierarchy, Paulo Maiurino, and four other employees, in addition to arresting two agents. Supreme Court Minister Alexandre de Moraes authorized the operation to happen, which is under secrecy.
Zanatta says that since the 2014 FIFA World Cup, Brazil has been increasing the purchase and use of espionage software. The Bolsonaro administration intensified these hirings, causing the intelligence structure to become hazier. He expanded Sisbin, Brazil’s Intelligence System, which reunites different agencies that share sensitive information among themselves. In parallel to this, the Bolsonaro government had supposedly expanded the cases of bidding exemption and decree of secrecy for contracts for these types of software, according to Zanatta.
He adds that in the Lula administration, the Brazilian Office of the Comptroller General has contributed to reverting this situation, and established norms providing for the disclosure of these kinds of hiring. Despite this, Zanatta states that the country needs to advance on many topics.
Democratic framework
To Zanatta, a good way out of this problem in Brazil would be to look at international examples and apply a recent understanding by the Supreme Court that denied authorization in 2021 given by the Bolsonaro government to Abin allowing the agency to indiscriminately access data of about 76 million Brazilian citizens who have a driving license. During the judgment, the Court ruled that the intelligence activity is part of the Democratic Rule of Law and should be subjected to democratic premises.
“The solution the countries found is that the intelligence system has to be within a democratic framework. That’s a fundamental pillar. There are no exceptions. This is non-negotiable. Its reasonableness and proportionality have to be constantly examined, and there has to be some political control over how technology hiring decisions are taken,” says the expert.
He explains that, with technological advancement, this kind of technology and software will increasingly have the capacity to collect and process large volumes of sensitive data about people. “Technology generates tons of new capacities. Therefore, we must be cautious about anticipating risks, which should be made through an administrative proceeding. There is no other way. The agencies will need to create internal rules that depend on these technologies, a protocol: who uses it, how they use it, under what conditions, with what access logins, with what internal controls etc.,” he explains.
Basic premises
In this regard, the NGO advocates considering four basic premises when hiring and using this kind of software. The first premise is the need, that is, the intelligence agency will have to prove that it tried to obtain information by other means, but didn’t get it.
The second premise is adequacy, which means showing that, for that specific investigation, certain software provide adequate conditions to support the needs of the intelligence agency. Third, it should be taken into account the proportionality principle, meaning that the degree of potential violation of the rights of several people has to be proportional to the risk Abin or other intelligence agencies are investigating.
Fourth, the NGO says that accountability is needed, that is, intelligence agencies must report about their activities to the due authorities. In Brazil, there is the Joint Committee for Control of Intelligence Activities (CCAI, in Portuguese), whose responsibilities include inspecting Abin’s actions.
According to Zanatta, however, the members of the committee don’t have enough knowledge of the many software and risks they present. The ONG even made a survey using the minutes of the committee meetings to assess the politicians’ work and concluded that, in general, they spend more time in political debates and exchange of accusations instead of making technical and deeper analyses about the use of these information search and espionage tools.
“CCAI could organize itself and decide ‘let’s do a year and a half of investigation, use public resources, bring in public security personnel, make an exemplary report [and] put guidelines on the use of these technologies’, but they didn’t do it. Instead, they engaged in more performative political speeches and debates”, says the researcher.
Espionage and sovereignty in other countries
As good references to Brazil on this topic, Zanatta mentions Germany and the United States, two developed countries that have been facing the challenge of balancing the use of modern technologies to guarantee public safety with preserving the population’s rights.
According to Zanatta, in Germany there were recent changes in the legislation, and a system was established through which intelligence activities are monitored by a committee of parliamentarians from different parties appointed to this end and who make the commitment not to speak about the intelligence activities they supervise. “This generates a kind of democratic accountability because the intelligence agency will know that, under conditions of trust, a group of parliamentarians will be watching what the agency does,” the NGO director explained.
In the United States, the initiative has been adopted by the federal government itself through executive orders issued by President Joe Biden to veto the hiring of technology companies that committed abuses in using these technologies. According to the director of the NGO, these measures Biden took were inspired by the country’s geopolitical reasons.
“If the United States government turns a blind eye and allows any type of software to be used by any government, this implies a much greater ability for governments that are not US friends to use very advanced espionage intelligence systems,” he said. “One of the ways to maintain a certain world order, so to speak, is to establish a legitimate market for this type of espionage. Because, under the “anything goes” rule, the United States loses”, he added.
He also cites studies carried out by American professor Steven Feldstein which show that, in recent years, the hiring of spyware – spying software – has grown more in authoritarian countries, such as the United Arab Emirates and Sudan.
In this scenario, he understands that agencies that use espionage software, such as the Ministry of Justice, could adopt a stance similar to that of the US when dealing with companies that produce and sell these technologies. “The Ministry of Justice needs to have protocols, indications like those the Biden administration has, to say ‘look, certain types of suppliers, certain types of software you cannot use’, because that means you will put national security and fundamental rights at risk,” he states.
“So everybody has some kind of responsibility. We have universities with researchers who need to do more research on the topic. The Ministry of Justice has to move by issuing protocols, and Congress has to reinforce legislation and put the CCAI to work,” he concludes.
Edited by: Rebeca Cavalcante
