Between May 29th-31st 2017, the I International Congress On Fundamental Rights and Criminal Process in the Digital Age, promoted by InternetLab, took place at the School of Law of the University of São Paulo (FDUSP). Several topics on the intersection between criminal process and technology were discussed, addressing the guarantee of due process and the tutelage of the constitutional rights to privacy and to the secrecy of communications in face of new technologies. The Congress had three solemn lectures by international guests and three discussion sessions with representatives of different sectors.

DAY 1 – May 29th 2017

In charge of the opening of the Congress, Dennys Antonialli, InternetLab director, and Marta Saad, Professor at FDUSP, addressed the transdisciplinarity and the importance of the topic in the context of technology’s more and more central role in people’s lives in Brazil and in the world. “The purpose of this congress is to discuss guarantees in a moment in which evidence is generated and collected all the time in a digital context”, said Antonialli.

The opening day was also marked by the release of the second edition of the “State Surveillance on Communications in Brazil 2017” (link in Portuguese) report, whose goal is to offer an overview of the normative framework of the capacities and prerogatives of communication surveillance by state authorities in Brazil, as well as analysing cases, news articles, bills and judicial decisions that illustrate the main controversial issues of the theme. The report also offers recommendations based on the International Principles On The Application Of Human Rights To Communications Surveillance.

After the opening talk, the retired professor of the Department of Philosophy and General Theory of Law at FDUSP, Dr. Tércio Sampaio Ferraz Junior and Professor Juliano Maranhão (FDUSP) talked about “Secrecy of data, the right to privacy and the limits of the State Power: 25 years later”. The landmark is Professor Tércio’s article on the secrecy of data which influenced the Supreme Federal Court’s decision on the subject.

Aside from revisiting positions which he defended on the text and contextualizing them, Sampaio approached the issue of virtuality of information on the current context, where information seizes being a “thing” — or, in legal terms, a res — without completely losing its materiality, to the point where it becomes a “non thing”. It does not belong to the world with which we are used to dealing, while the way of perceiving things before the virtuality has completely shifted. The Professor questions: how do we do this from a juridical point of view, then? This teasing and Ferraz Jr.’s interpretation are commented and counterposed by Professor Juliano Maranhão.

DAY 2 – May 30th 2017

The second day of the congress began with the themed session “Challenges of digital evidence collection and international cooperation for access to data”, moderated by Francisco Brito Cruz, InternetLab director, with the participation of Carolina Yumi de Souza, Attorney General, and Jacqueline Abreu, coordinator of InternetLab’s Privacy and Surveillance area. The session presented and discussed the framework of the functioning of MLATs in the case of requests by authorities for the access to user data, as well as the main juridical issues involved in judicial processes that deal with the identification of users, breaches of data secrecy and content removal, specially those related to the jurisdiction of Brazilian courts. The speakers also commented on the obstacles to get foreign companies to comply with court orders, once they’re headquartered in countries with specific legislations and requirements, which can facilitate, limit or even hinder Brazilian requests. See below the full session held on the morning of the 30th:

The second session of the day approached the theme “Search and seizure of electronic devices”, and had the presence of Marcos Zilli, judge of the 15th Criminal District of the São Paulo Court of Justice and FDUSP Professor, Stênio Santos Sousa, Federal Chief of Police and author of several books on search and seizure, and Carlos Roberto Isa, Public Defender of the State of São Paulo and director of IBCCrim. The guests presented an overview of the diverse understandings of the case law on the topic of “virtual searches” incident to arrest and of the differences and similarities of search and seizure of ordinary objects and digital data in face of the home inviolability concept.

On the night of the 30th, two solemn lectures were held. We began with the talk “The American debate on surveillance and cryptography”, by Riana Pfefferkorn, Fellow at The Center for Internet and Society at Stanford Law School, who offered a history of how the American legislation and case law have been dealing with this topic, approaching what were and are today the “Crypto Wars”, the discussions on the expansion of the Communications Assistance for Law Enforcement Act (CALEA) and the controversial use of a gap-filling legal provision — the All Writs Act — to ground requests for breaching of secrecy by authorities, as it happened on the Apple vs. FBI case.

In Riana’s vision, this is a debate fundamentally about power: the investigation authorities feel a discomfort with the growing access to popular technologies — such as cryptography — which empower people to exercise their right to privacy in an effectively secure way. And how do authorities deal with this discomfort? By pressuring congressmen and courts to get legal and case law grounds which would enable them to obtain means to go around the protection that cryptography offers to stored and in traffic data, at times using reckless practices. Riana also commented on the WhatsApp block episodes in Brazil and the discussion about cryptography at the STF, urging the court to not interfere with this technology. Check it below:

Closing the night, our second foreign guest, Greg Nojeim, lawyer and director of the Center for Democracy and Technology, discussed the theme “MLAT reform between privacy and efficiency: the dilemmas of transnational access to user data”. Nojeim highlights that today, with the technological revolution which we went through, our data is stored outside of the physical and jurisdictional reach of authorities, in third party servers, instead of drawers in our homes, which are more easily accessed. This has challenged authorities who still need information in order to solve crimes.

Nojeim talked about the bureaucratic functioning of the international cooperation requests received by the US, which force any of these foreign requests for breach of secrecy to go through the Department of Justice for it to be assessed and then, after the fulfillment of the American legislation requirements, it can be carried out by the companies headquartered in that country — a process that takes, on average, 10 months.

In his analysis, Nojeim also highlighted a very polemical issue: under the American law, if there is a request for the access to data on traffic data — such as who emailed who –, and it comes from Brazil or any other country, an American provider can reveal this information voluntarily, according to the company’s policy; there are no other requirements imposed by law. But, if this request comes from the US government, companies cannot reveal this kind of data as they please. They should necessarily demand a court order. In practice, this allows companies to be more “flexible” in other countries in the world, not being so rigorous — and protective when it comes to privacy — as they should be in the US. See the video below:

DAY 3 – May 31st 2017

The last panel of the congress was a round table with several experts of different sectors to debate the topic “Access to electronic communications and cryptography: guarantees, prerogatives and due legal process”. Among the present we had Gustavo Badaró (FDUSP); Diego Aranha (Unicamp); Carina Quito (Sica & Quito Advogados); Paulo Marco Ferreira Lima (MPSP); Elias Abdala Neto (Microsoft) and Dennys Antonialli (InternetLab).

The criminal procedure aspect of the topic was presented by Gustavo Badaró, who emphasized the importance that the evidence, in the procedural scope, fulfills its epistemic role of presenting elements that can better link the formulated hypothesis to what is true. In this sense, he highlighted the importance of circumscribing the interceptions of communications to the necessary scope for the production of proof, avoiding the collection of excess data, thus, decreasing the risks of violating constitutional guarantees related to the secrecy of communications, privacy, and intimacy. Next, Diego Aranha, Professor of Computer Science at Unicamp, brought a more technical perspective on encryption, approaching the challenges of implementing mathematical algorithms based on complex problems from our reality in software that work in flawed platforms filled with vulnerabilities, aside from depending on a juridical system that is not hostile to this technology.

Public Prosecutor Paulo Marco Ferreira Lima, expert on digital crimes by the University of Rome and chief of the Committee for Cybernetic Crimes of the São Paulo Public Attorney’s Office, emphasized that even in the state of São Paulo, which has over 44 million inhabitants, there is only one police station for cybernetic crimes, where only two technicians on the subject work.

The practical aspects of breaches of data and electronic communications secrecy were discussed by lawyer Carolina Quito, of Sica & Quito Advogados. She brought the perspective of defending companies that receive orders for breach of secrecy, whose legality can many times be questioned. The lack of a specific legislation on the access to stored communications, in the lawyer’s understanding, allows the Judiciary to have access to a very wide range of information, since that, differently from telephonic communications — which are marked by ephemerality –, electronic communications, which today are predominant in society, generate logs for years on end.

Elias Abdala Neto, a representative of Microsoft’s juridical team, dealt with the concept of cloud computation, whose fundamental premise is, once that a device is online most of the time, it can use the computational power of a machine specialized in that specific tasks, instead of depending on the resources of its own device. Elias also highlighted the importance of protecting personal data.

The complete list of videos can be accessed on InternetLab’s YouTube channel.

Team responsible for the content: Pedro Lima (pedro.lima@internetlab.org.br) and Jacqueline Abreu (jacqueline.abreu@internetlab.org.br).

Translation: Ana Luiza Araujo