News | Digital Defense Initiative | Asymmetries and Power

Data Privacy Brasil participates in a hearing at the Federal Supreme Court (STF) that discussed the use of secret monitoring tools

The public hearing was called by Justice Cristiano Zanin, within the scope of the Claim of Non-Compliance with Fundamental Precept (ADPF) 1143. Proposed by the Attorney General’s Office (PGR), which intends to address the regulation of the use of government hacking tools, monitoring through spyware on personal communication devices by public agencies and agents. Thirty-three participants were heard over the two days of the hearing, including representatives of public and private institutions, lawyers, academics, experts, and independent professionals. The manufacturing companies (Cellebrite, Cognyte, Exterro, Magnet Forensics, Micro Systemation AB and OpenText) were also invited to the hearing, but all declined to participate.

In ADPF 1143, the PGR argues that, despite advances in legislation to protect privacy, private life, and the confidentiality of personal communications, such as the Internet Civil Rights Framework and the General Personal Data Protection Law (LGPD), there is still no specific regulation for the use of spyware programs. The STF will analyze whether there is a violation of fundamental precepts in the use of these tools and, if so, will decide how to overcome this scenario, banning the use of this technology in the national territory or proposing a regulation until the National Congress legislates on the subject.

Over the past few years, Data Privacy Brasil has investigated and documented the use of spyware in the course of the project on techno-authoritarianism, in addition to joining the Global Task Force on Digital Authoritarianism, an international research network based in Canada, on authoritarian uses of software. Currently, in partnership with InternetLab, Data has been researching and focusing on the topic through the Digital Defense Initiative, which seeks to deepen research into surveillance tools used in the national territory, producing technical reports to assist in the discussion of the safeguarding of fundamental rights by the judicial and legislative branches.

Pedro Saliba, Coordinator of Asymmetries and Power at Data Privacy Brazil, represented the institution at the public hearing, presenting the typology developed in the Digital Defense Initiative project to guide the Court’s legal construction. The classification highlights the characteristics of each category of spyware and its level of intrusion, which generate direct and indirect violations of several fundamental rights.

Absence of specific legislation

The representative of the National Union of State Intelligence Professionals of ABIN (INTELIS), Hugo Alberto Lazar, emphasized that the current law on intelligence services in Brazil is outdated and defended the creation of a mechanism for prior judicial control of operational actions, as occurs in other countries.

Representing the Brazilian Institute of Criminal Sciences (IBCCRIM), Carina Quito and Carlos Hélder Furtado Mendes argued that the matter should be debated in the National Congress. Heloisa Estellita, a professor at FGV, also defended the prerogative of the Legislature on the subject, agreeing with the presentation made by IBCCRIM, because, until there is a criminal LGPD to regulate the conditions of access, there is no legal infrastructure that authorizes the use of secret monitoring tools.

Bárbara Simão, InternetLab, and Raquel Saraiva, IP.rec, argued that if the STF deems new legislation necessary, it should be extremely restrictive, with measures aimed at transparency, investigation of contracted companies, impact reports, and limitation of use to more serious criminal offenses. The experts asked the Court to pay attention to the principle of proportionality, reflecting on the excessive use that violates rights.

Laura Schertel Mendes, representative of the Digital Law Commission of the Federal Confederation of the OAB and a law professor, gave several examples of how the topic is being discussed around the world. The highlight, present in other speeches, was the German experience, which initially prohibited the use of these technologies, building a reflection on a new digital right that was being violated by government hacking. After years of long discussion and debate, the country regulated the matter in a highly restrictive manner, in which the legislation for the use of these tools is directly linked to a concrete danger to life, creating mechanisms for transparency, proportionality, and external control.

Legislation is sufficient

On the other hand, representatives of the Ministry of Justice and Public Security, the Public Prosecutor’s Office, the Federal Police, and the Armed Forces argued that there is no need for new legislation on the subject, given that existing rules and laws already legitimize the use of these technologies by the state. Representatives of the Public Prosecutor’s Office and the Federal Police defended the use of spyware for forensic purposes in police investigations, while representatives of the Armed Forces (Army, Air Force, and Navy) argued that it is important to use these tools to defend the national territory, such as in border areas, in the Legal Amazon, and to combat international trafficking.

Data Privacy Brasil recommends that the Court examine the proportionality and reasonableness of the acquisition, development, and use of spyware by the Brazilian public authorities, considering the legal competences of the agencies, the technical capabilities of the tools, and the recognition of the multiple violations of fundamental rights that they can cause. The organizations present will be able to present memorials to the Court, in addition to amici curiae briefs with detailed points on the topic, assisting the STF in deciding this issue. Follow the Digital Defense Initiative for more details on the topic.