A Breakdown of the Current Version of Brazil’s Cybercrimes Bill · Global Voices
Taisa Sganzerla

Brasil's national congress. Photo by Mario Roberto Durán Ortiz via Wikimedia. Released to public domain.
After much pressure from Internet rights advocates, proponents of new cyber crime legislation in Brazil removed some of the most controversial elements of the bill on April 11. Critics of the draft amendments also managed to secure a postponing of the preliminary vote to the end of the month.
The amendments form an integral part of a report from the parliamentary Inquiry Commission on Cybercrimes (CPI dos Crimes Cibernéticos), released on March 31, and would modify key aspects of Marco Civil, Brazil's globally celebrated ‘bill of rights’ for the Internet — a first of its kind in the world when it comes to protection free expression online, network neutrality and data protection.
The Commission was established in August last year with the objective of proposing legislation to better tackle online crimes.
The report has prompted widespread criticism from digital rights defenders, from Brazil and elsewhere. On April 11, Tim Berners-Lee, creator of the World Wide Web, released an open letter to Brazilian legislators asking them to “reconsider the report.” A petition released by the Institute for Technology and Society, from Rio de Janeiro, a digital rights group, has more than 18,000 signatures so far.
Following criticism, federal deputy Espiridiao Amin, who is the rapporteur of the commission, released on April 11 a new version of the report, with slight changes to the most controversial elements of the legislation. But for many critics, this was not not nearly enough to protect Marco Civil's very founding principles.
Among the proposals expressed in the report, free expression advocates find three matters particularly worrying: when and how Internet applications should be obliged to remove content; whether law enforcement agencies can request ISPs to reveal users’ IP addresses without a court order; and whether courts can demand that ISPs block traffic to applications in some circumstances.
The first matter was the most significantly modified in the new report. In the first version, a proposed change to the Marco Civil would require websites and social networks to take down defamatory content — i.e. posts that prove “harmful to personal honor” — within 48 hours of receiving notification from a claimant or person affected by said content — that is, without a court order.
In the new version, web applications would only be required to remove copies of the content already deemed illegal by a judge, without the need of new court order. The deadline of 48 hours was also removed.
The new text of Marco Civil's article 21 read as follows:
Os provedores de aplicação deverão tomar as providências técnicas, nos limites de suas aplicações, para assegurar que o conteúdo infringente, objeto da ordem judicial ou da notificação de que trata esta Seção, continue indisponível em caso de cópia, dispensada a necessidade de nova ordem judicial ou notificação para a retirada desses novos materiais.
Internet providers will have to take the technical measures, within the limits of their capabilities, to assure that the infringing content, subject of a court order or notification referenced in this Section, remains unavailable in case is has been copied, eliminating the need for a new court order or notification to remove those [reproductions] of said content.
In its justification, the report states that the current stipulations in Marco Civil make it difficult to remove criminal content when they are replicated — Marco Civil expressly mentions the “undeniable location of the material” when referring to the removal of a content. According to the report, the current system is “unfair to the victim, who is obligated to request a new court order against each occurrence of said content.”
For Internet rights advocate Oficina Antivigilancia, this still has some worrying aspects:
Nos preocupa o modo como esta obrigação será implementada, principalmente no que tange conteúdos em que o público intencionalmente deseja subverter o bloqueio, uma vez que técnicas sofisticadas (e outras até nem tanto, como “flipar”/espelhar a imagem de vídeos ou acelerar sutilmente a velocidade da reprodução) podem ser muito difíceis de se detectar tecnicamente, ainda mais dado o volume de novas postagens nas principais plataformas como Youtube, Facebook e Twitter.
It worries us the way in which this obligation will be implemented, mainly when it comes to content in which the public intentionally wants to subvert the blockade, once sophisticated techniques (and others not so much, like flipping/mirroring the image or accelerating the reproduction of videos) could be very hard to technically detect, especially considering the volume of new posts in the Internet's main platforms like Youtube, Facebook and Twitter.
Despite this apparent step forward, the new version has maintained the other two controversial proposals. Another modification of Marco Civil would allow law enforcement agencies to request ISPs and application providers to reveal users’ IP addresses without a court order in the case they're being subjected to a criminal investigation.
Article 10 of the Marco Civil, which treats of the protection of user data, will gain the following amendment:
A autoridade policial ou Ministério Público poderão requisitar ao provedor de conexão ou aplicação de internet, independentemente de autorização judicial, o endereço IP utilizado para a geração de conteúdo específico objeto de investigação criminal.
The police authority or the public prosecutor could request to the Internet access provider or the Internet application provider, regardless of judicial authorization, the IP address used for the generation of specific content object of criminal investigation.
The report says that “it's important to reinforce that what is being proposed is not to liberate access of police forces to the data of any internet users…Internet users that haven't committed any crime will have the guarantee of the preservation of its intimacy. But those that make use of the internet to practice crimes will be identified quickly.”
For Internet rights advocates, the problem with this idea is that it eliminates the accountability that is brought to the system by the court system. Many policies around the world state that only a judge is qualified to determine whether a content infringes the law or not, and if the user that created it is a criminal or not.
Twitter user @diegorrcc said:
Novo relatorio da #CPICiber sugere acesso s/ necessidade de ordem judicial a IP de autor de “conteúdo criminoso”. quem define isso? (1/2)
— diegorrcc (@diegorrcc) 12 April 2016
New report of #CPICiber suggests access without the need for a court order to the IP of the author of ‘criminal content’. Who defines this? (1/2)
Só ord judicial é capaz de definir se conteúdo on line é ilícito. Ñ basta mero arbítrio de policiais e procuradores. (2/2) #CPICiber
— diegorrcc (@diegorrcc) 12 April 2016
Only a court order is capable of defining if said content is illegal. Not enough mere will of police officers and prosecutors (2/2) #CPICiber
Finally, the report also maintained that the judicial system could demand that ISPs block entire Internet applications and websites. Language is vague on what circumstances such blocking could be used — it merely says that applications ‘related’ to criminal conduct could be subjected to censorship.
The amendment also would effectively open up an exception on the principle of net neutrality.
The report justifies the proposal as the only way the Brazilian judicial system would be able to remove applications that are hosted on foreign servers, in the case they violate rights guaranteed by the Brazilian law — such as websites that provide child pornography or copyrighted material.
In its justification, the report says:
A solução possível é se determinar aos provedores brasileiros de conexão, que obedecem à jurisdição brasileira, que neguem tráfego ao destino que tenha sido considerado ilegal no curso do processo judicial. Desta forma, ainda que o hospedeiro estrangeiro não possa ser obrigado a apagar o conteúdo ilegal de seus servidores, o acesso a esses será prejudicado pela medida técnica implementada por provedores brasileiros de conexão.
One possible solution is to stipulate that Brazilian Internet providers, those that follow the Brazilian law, deny traffic to the destination that has been considered illegal in the course of the judicial process. That way, although the foreign host cannot be obligated to remove the illegal content from its servers, access to it will be hampered by the technical measure implemented by the Brazilian Internet providers.
It also says that the practice is current in the European Union, United States and Chile, which is contested by some Internet advocates. It is also unclear whether such a disposition could trigger the blocking of applications that do not provide an illegal service, but could be used for criminal practices — this is what prompted the blockade of WhatsApp last year in Brazil.
Among other proposals questioned by Internet rights advocates are the broadening of the concept of the crime of “invasion” or unauthorized access to electronic devices and the allocation of 10% of the resources of Fistel — a fund that finances ANATEL, Brazilian's telecommunications regulation agency — to Brazil's Federal Police to improve its capacity of investigating online crimes.