Despite widespread complaints about its effects on free expression and privacy, Brazilian Congress is moving forward in its attempts to hastily approve a “Fake News” bill. We’ve already reported about some of the most concerning issues in previous proposals, but the draft text released this week is even worse. It will impede users’ access to social networks and applications, require the construction of massive databases of users’ real identities, and oblige companies to keep track of our private communications online. It creates demands that disregard Internet key characteristics like end-to-end encryption and decentralised tool-building, running afoul of innovation, and could criminalize the online expression of political opinions. Although the initial bill arose as an attempt to address legitimate concerns on the spread of online disinformation, it has opened the door to arbitrary and unnecessary measures, that strike settled privacy and freedom of expression safeguards.
You can join the hundreds of other protestors and organizations telling Brazil’s lawmakers why not to approve this Fake News bill right now.
Here’s how the latest proposals measure up:
Providers Are Required to Retain the Chain of Forwarded Communications
Social networks and any other Internet application that allows social interaction would be obliged to keep the chain of all communications that have been forwarded, whether distribution of the content was done maliciously or not. This is a massive data retention obligation which would affect millions of innocent users instead of only those investigated for an illegal act. Although Brazil already has obligations for retaining specific communications metadata, the proposed rule goes much further. Piecing together a communication chain may reveal highly sensitive aspects of individuals, groups, and their interactions — even when none are actually involved in illegitimate activities. The data will end up as a constantly-updated map of connections and relations between nearly every Brazilian Internet user: it will be ripe for abuse.
Furthermore, this obligation disregards the way more decentralized communication architectures work. It assumes that application providers are always able to identify and distinguish forwarded and non-forwarded content, and also able to identify the origin of a forwarded message. In practice, this depends on the design of the service and on the relationship between applications and services. When the two are independent it is common that the service provider will not be able to differentiate between forwarded and non-forwarded content, and that the application does not store the forwarding history except on the user’s device. This architectural separation is traditional in Internet communications, including web browsers, FTP clients, email, XMPP, file sharing, etc. All of them allow actions equivalent to the forwarding of contents or the act of copying and pasting them, where the client application and its functions are technically and legally independent from the service to which it connects. The obligation would also negatively impact open source applications, designed to let end-users not only understand but also to modify and adapt the functioning of local applications.
It Compels Applications to Get All Users’ ID and Cell Phone Numbers
The bill creates a general monitoring obligation on users’ identity, compelling Internet applications to require all users to give proof of identity through a national ID or passport, as well as their phone number. This requirement goes in the opposite direction to the principles and safeguards set out in the country’s data protection law which is yet to enter into force. A vast database of identity cards, held by private actors, is in no way aligned with the standards of data minimization, purpose limitation and the prevention of risks in processing and storing personal data that Brazil’s data protection law represents. Current versions of the “Fake News” Bill do not even ensure the use of pseudonyms for Internet users. As we’ve said many times before, there are myriad reasons why individuals may wish to use a name other than the one they have on their IDs and were born with. Women rebuilding their lives despite the harassment of domestic violence abusers, activists and community leaders facing threats, investigative journalists carrying out sensitive research in online groups, transgender users affirming their identities are just a few of examples of the need for pseudonymity in a modern society. Under the new bill, users’ accounts would be linked to their cell phone numbers, allowing — and in some cases requiring — telecom service providers and Internet companies to track users even more closely. Anyone without a mobile number would be prevented from using any social network — if users’ numbers are disabled for any reason, their social media accounts would be suspended. In addition to privacy harms, the rule creates serious hurdles to speak, learn, and share online.
Censorship, Data Localization, and Blocking
These proposals seriously curb the online expression of political opinions and could quickly lead to political persecution. The bill sets high fines in cases of online sponsored content that mocks electoral candidates or question election reliability. Although elections’ trustworthiness is crucial for democracy and disinformation attempts to disrupt it should be properly tackled, a broad interpretation of the bill would severely endanger the vital work of e-voting security researchers in preserving that trustworthiness and reliability. Electoral security researchers already face serious harassment in the region. Other new and vague criminal offenses set by the bill are prone to silence legitimate critical speech and could criminalize users’ routine actions without the proper consideration of malicious intent.
Become an Activist Post Patron for $1 per month at Patreon.
The bill revives the disastrous idea of data localization. One of its provisions would force social networks to store user data in a special database that would be required to be hosted in Brazil. Data localization rules such as this can make data especially vulnerable to security threats and surveillance, while also imposing serious barriers to international trade and e-commerce.
Finally, as the icing on the cake of a raft of provisions that disregard the Internet’s global nature, providers that fail to comply with the rules would be subject to a suspension penalty. Such suspensions are unjustifiable and disproportionate, curtailing the communications of millions of Brazilians and incentivizing applications to overcompliance in the detriment of users’ privacy, security, and free expression.
EFF has joined many other organizations across the world calling on the Brazilian parliament to reject the latest version of the bill and stop the fast-track mode that has been adopted. You can also take action against the “Fake News” bill now, with our Twitter campaign aimed at senators of the National Congress.
Source: EFF.org
Veridiana coordinates EFF’s activities with local organizations and activists in Latin America and the Caribbean, where we work together to reinforce the defense of digital and human rights. Veridiana has been involved with telecommunications, media, Internet and human rights issues since 2009. She has been a member of Brazilian Internet Steering Committee (CGI.br) as one of the civil society representatives (2010-2013) and worked in Brazilian civil organizations such as Idec and Intervozes. Veridiana is a lawyer and holds a Masters degree in Economic Law from the University of São Paulo Law School, where she is currently a PhD candidate in Human Rights.
Subscribe to Activist Post for truth, peace, and freedom news. Send resources to the front lines of peace and freedom HERE! Follow us on SoMee, Flote, Minds, Twitter, and HIVE.
Provide, Protect and Profit from what’s coming! Get a free issue of Counter Markets today.
Brazil’s Fake News Bill Would Dismantle Crucial Rights Online and is on a Fast Track to Become Law