Brazilians’ love affair with tech leaves them vulnerable to data theft

Investing

I only realised how strongly I felt about facial recognition technology when it tried to scan my face. Following a stint working from home, I returned to the FT’s Brazil bureau to find the amiable security guard had been replaced by a bank of automated scanners deciding who could enter and leave the building.

Never mind that the tech does not work with masks, the one accessory that has defined the past year. Nor that — like Brazil more broadly — the building’s basic infrastructure is lacking. Most confounding was that nobody seemed to care. Within days of installation, the management had registered biometric facial data for the building’s hundreds of users, with the only peep of dissent coming from your correspondent.

“Brazilians are very early adopters — they have a trust in tech that is almost unique in the world. They are generally happy to have their face scanned” if it makes life easier, says Danilo Doneda, a data privacy lawyer.

Brazil has gone digital with gusto, with citizens spending on average nine hours every day online, second only to the Philippines. The country also has one of the highest rates of social media usage and was selected by Facebook’s WhatsApp last year for the launch of its digital payments service.

“[Handing over data] is accepted to be part of a system which recognises them. For example, tens of millions of Brazilians are on government assistance programmes. In order to keep those benefits, they have to hand over their data. This is a poor country that is getting poorer — you have to take that into consideration,” says Doneda.

But it goes beyond access to state assistance. Enter a bar and you may have to provide your CPF — a tax identification number. Purchase an item at a pharmacy and they may demand it.

Privacy advocates warn this casual approach to data makes Brazil vulnerable to spycraft and data theft from criminal groups and state-backed players. Countries are selling new technologies across the continent, dispensing the hardware relatively cheaply but reaping windfalls elsewhere, such as in the collection of data. The presence of China’s Huawei in Brazil’s telecoms infrastructure, for example, only become an issue when the Trump White House exerted political pressure on Brasília.

“The facial recognition industry is targeting here because they can’t sell it in Europe or the US. Brazil is a second grade market,” remarks Doneda.

Brazil’s vulnerability has been exposed in two security breaches since January. Data, including tax numbers, facial images and addresses, belonging to 223m people — the entire population plus 10m deceased — were leaked online and are now for sale on the dark web.

Data protection experts were aghast. But the wider reaction was muted. The sentiment was summed up by a wry newspaper cartoon: “The data of 200m Brazilians were leaked. Could they have discovered something about us?” says a homeless man to his partner. “If they discover that we exist, it would be great,” she responds.

Luca Belli, a data expert and law professor at the Getúlio Vargas Foundation, says Brazil is clearly vulnerable to data theft, and an epidemic of credit card fraud and identity theft is the most obvious sign of the problem. “Personal data is harvested at scale with little concern for protection. That all the population’s personal data were leaked gives us an idea of the state of play.”

There is cause for some optimism. Brazil’s Congress late last year enacted a data privacy law that sets out citizens’ legal rights, including regulations for facial recognition. Belli believes the law could give start-ups and consultancies opportunities to offer advisory services on the new rules. But he warns that for the law to be effective there needs to be a campaign educating the public about their rights. But this is unlikely to have the backing of either the government or the big tech groups.

Back at the FT office, the IT officer in charge of the facial recognition rollout is unimpressed by my concerns. For him, the physical security of the building outweighs concerns about data protection. My crusade against Big Brother — much like Brazil’s — looks set to be a long one.

bryan.harris@ft.com

Leave a Reply

Your email address will not be published. Required fields are marked *