In July 2015 Brazilian National Congress established an Inquiry Commission with the purpose of investigating the scenario of cybercrime in Brazil and its social and economic effects. The final report of the Commission was released last week and the workgroup will function for 15 more days for conclusions and deliberation. On page 172 the report concludes that “E-commerce is a wide category of criminal practices (…).” The way the final text was written and presented, showing that there was not even enough time and attention to perceive and correct such an absurd statement gives a good idea of the inconsistency of the work, but in fact this is not the worst thing – not even by far.

Por Cláudio Lucena*
Claudio.Lucena@uepb.edu.br

Many of the propositions stemming out of the final report aim at amending Marco Civil and essentially dismantle it as the important, collectively constructed Bill of Internet Rights that it represents. These bills attempt to fill this important piece of legislation with substantive criminal and criminal procedure matters, instead of dealing with these questions in a different and more appropriate legal instrument or debate. This is also very bad, but it is still not the worst.

To me, what is truly scary is the unbelievably poor substance of the justification for the bills that affect individual liberties protected in Marco Civil. In the supporting texts that are expected to provide the grounds for the proposals, not a single statistic data is given that is directly connected to the intended policy intervention. How does one intend to justify relativization of chiefly fundamental values like freedoms without neither presenting consistent technical information that a solid diagnostics of what happened was made, nor that it exceptionally is the only possible way to find a balanced solution?

I am not overestimating more refined initiatives of data driven policymaking, because countries where this is currently a practice have developed and structured a tradition that cannot and should not be simply copied overnight without considering different local characteristics and limitations. Besides that, the possibility of data manipulation gives rise to the concern of policy driven data making in this realm, meaning interference with data so that biased results will serve to justify forwarding a certain agenda. This distortion is equally harmful and means that any solution will in the end face some kind of problem.

But in order to accept the undermining of values of citizenship, of individual guarantees and of essential liberties, it is necessary to show a minimum of coherence and to demonstrate sufficiently that the exceptionally proposed freedom and privacy restricting alternative is the only viable one. The bills brought to the table by the report display nothing even close to that. The Inquiry Commission heard a number of specialists. Correct. A lot of general data was collected. All right. A considerable debate was promoted. True. But the Congress neither commissioned, nor conducted, nor followed a single study that allows to justify, for instance, the extent to which the expansion of intermediary liability, with the consequent violation of the Manila Principles, tends to reduce speech crimes against honor, such as libel and slander; how a private takedown obligation without the need for a judicial decision could ease the workload of courts; or about the cost of storing IP addresses and the impact of the measure in the national economy. Where did the Inquiry Commission learn that an IP address is personal data? No one knows. The Commission does not even justify why it suggests the suppression of intent in the crime of invading a device. Yet, these proposals are all now bills on the table, aiming at changing what was formerly negotiated when Marco Civil was enacted.

It is impossible to sustain bills that affect essential guarantees under such poor grounds. In fact, arguments seem much more like guesses or hunches. It is necessary to recognize that we must still evolve a lot in Brazil in terms of representativity, legitimacy, technique and various other aspects, but the cost and the structure of our legislative houses, mainly the federal ones, where this debate is taking place and shapes a national position, already allows Brazilian citizens to demand a bit more. Hunch based policymaking is definitely no longer admissible.

And besides that, why would it even be necessary to amend Marco Civil and risk its core text, when there is an ongoing process of regulation of the Law, through which minor adjustments are possible without compromising the key issues, without a setback in the rights which are more difficult to guarantee and negotiate under a harder, more controversial legislative process? Marco Civil is not a space to detail strategies of Public Security. Marco Civil is a Bill of Rights for the Citizen. It is not a statute to ensure State prerogatives. It is an affirmation of individual rights and guarantees. Of course it should – and it does – contain general exceptions designed to reconcile the individual interests it protects with other public ones, should conflicts rise. But if this essential conception is not taken into consideration, each and every attempt to amend Marco Civil in Brazil will result in a distortion of its purpose, because of a lack of understanding of the very reasons why it exists.

Not to mention the imperfections it already contains. In spite of all the (earned) celebration around it, Marco Civil still permits fractures in the fundamental rights it intends to guarantee. It happens when it establishes, for example, a detailed legal framework for personal data collection and retention without setting – because there still isn’t – a similar framework for data protection in Brazil, not even an equivalent one in terms of the level of detailed legal treatment.

Anyway, it seems evident that changing Marco Civil will by no means help tackle the problem of cybercrime in Brazil. Federal Law number 12.735/2012, to give an instance, which was published on the same day of the Brazilian Cybercrime Statute, contained a mechanism that I always considered to be even more important than the ones which themselves defined the types of cybercrime. In this piece of legislation, a true Public Security policy strategy, paragraph four determines that police authorities should structure and regulate the establishment of special units to fight crime in digital environments. Now, in theory this presented a real possibility of developing a true national public policy to fight cybercrime, with prospects of establishing training standards, mechanisms of cooperation, intelligence and integration, in a strategy that put no undermining of any individual right at stake.

In practice, after almost 5 years, fellows in Brazil report that there are no more than 3 Special Cyber Police Units in operation in the States of the Federation, maybe some Federal Cyber Police Unit, and perhaps one or another isolated department within other structures that can give some help in the area. All of them work with restricted human, financial and technical resources and are severely limited in the scope of crimes that they are able to investigate. And that’s all. About the concentrated efforts to develop a regulation which organizes a way to combat criminality which is itself organized, not a word. Simply forgotten. The final Commission report suggests taking 3 or 4 kinds of crime to federal jurisdictions, while there are operational initiatives already provided by enacted law, as the one mentioned above, that can render police institutions much more efficient as a whole with less impact on individual rights. A bill that suggests that before insisting in creating and enhancing the conditions to put these efforts in practice shows a saddening lack of proper knowledge of the Brazilian reality.

I neither follow nor endorse the discourse that Inquiry Commissions are merely political, that politicians are bad people and therefore their only goal is to restrict freedoms and promote censorship. It is a foolish and simplistic discourse and the more qualified the voice that embodies it, the less responsible it seems, even if it is in the name of simplifying the facts for the purpose of communication and to reach the general public opinion. Simplifying the narrative is not an honest alternative if it is done at the cost of hiding the seriousness of the problems that lie precisely in the complexities. The problems of Public Security and the challenges of criminal investigation that police authorities face in Brazil are not simple, fantasy or just made-up from nothing. They do exist, they are serious, they are sources of concern, they harm Brazil and Brazilians and the population demands actual solutions exactly from these authorities. For that reason it is necessary to search for efficient and balanced mechanisms to combat this menace.

But it is crucial that these mechanisms are harmonized with individual liberties that were conquered through time, that they are reasonable, grounded on technical knowledge that is solid, wider, deeper and mainly better targeted, so that strategies offer better chances of success. Without knowing what the problem is, it is not possible to find a solution. And I mean really knowing, not just having a vague notion of the consequences. It is pointless to know general information about the use of Internet in Brazil, the number of mobile phones or the overall financial losses of banks in the country without an intelligent diagnostics of the situation. And none of these data justify amending a statute that does not address these issues in its scope. Neither does it make any sense to propose a hunch about new kinds of criminal conducts, without the slightest idea as to whether that is the real issue. Tools that are born through such a process tend to introduce wholesale prohibitions. It is never the best alternative for a country which means to follow the Rule of Law.

The report of the Inquiry Commission also presents bills concerning education for the use of ICTs, the expansion of IPv6, oversight mechanisms for public IT infrastructure and other more programatic conclusions, that are evidently positive, and which evidence that the oversimplification of the discourse of politicians against liberties does not reflect the actual complexity of what is at stake. But in order to admit that liberties and guarantees which are protected in Marco Civil will be affected by the proposed bills, the new measures need to have a close connection with the values and interests which this statute intended to protect. It needs to be clear that they are technically adequate, viable, proportional, restrict only enough to ensure their objective is attained without unnecessarily eroding individual rights. They must ultimately be constructed collectively, as it was the process of Marco Civil, and grounded not only on arguments, opinions, guesses or hunches, but on solid data that is reliable and legitimate enough to convince society that they are initiatives through which improvements and better results can be expected and clearly perceived.

The mechanisms that are proposed in the final report of the Inquiry Commission are still very far from all that.

*Professor of Law, Paraíba State University (UEPB), Brazil. PhD Researcher, Católica Research Center for the Future of the Law, Universidade Católica Portuguesa and Foundation for Science and Technology, Lisbon.

Image: CC-BY-SA AK Rockefeller / Flickr