Brazil is becoming a new flashpoint for digital rights after a series of actions against WhatsApp, the Facebook-owned messaging service. On May 2, a judge in the northeastern state of Sergipe ordered mobile phone operators to block WhatsApp for 72 hours because it refused to turn over user information to authorities, even though the company says it doesn’t have access to the data. Although the order was quickly overturned on appeal, the case is a worrisome sign for privacy in a post-Snowden era.
While many details of the WhatsApp case remain undisclosed, the company’s quandary may stem from its decision to encrypt all chat messages "end-to-end," which means that only users can access their unencrypted messages, and not the company. How Brazil responds to the growing use of encryption will set an important global precedent. Brazil was once in the vanguard of digital rights, but recent actions risk setting the country back.
This isn’t the first mishap for WhatsApp in Brazil, which has been installed by 100 million Brazilians, over 90 percent of mobile phone users, making it one of the primary means of mobile communication in the country. In December, a different judge ordered service providers to block WhatsApp for 48 hours because the company failed to turn over user data. That order was also overturned as unreasonable.
And federal police arrested a senior Facebook executive on March 1 after WhatsApp failed to turn over user data that a judge had requested for a drug trafficking investigation related to the Sergipe state case, though the executive was released the next day.
Like WhatsApp, many technology companies, including Apple and Google, have begun to incorporate end-to-end encryption and better security features into their products. As a result, even companies themselves can’t always access user data, even at a government’s request. Some US firms rolled out these features in a bid to regain user trust after Edward Snowden revealed their role in enabling mass surveillance by the US National Security Agency.
Brazilian law enforcement agencies have a responsibility to investigate crime. In these cases, however, WhatsApp has stated that it was willing but unable to comply because of its encryption protections.
Digital security experts have said that this may be better for security and digital rights overall. For WhatsApp's users in closed societies, where regimes pervasively monitor social media and crack down on dissent, encryption shields communications and may be critical for people’s safety. But even for ordinary users in Brazil and elsewhere, strong encryption is increasingly essential for protecting privacy and thwarting cybercrime and abusive intelligence agencies.
Similar high-profile clashes between US tech companies and governments over encryption are playing out worldwide. Apple’s inability to unscramble data stored on iPhones led to hearings and litigation in the US over whether the government can conscript tech companies into undermining security features that protect users. Social media companies are under pressure in China and some European countries to weaken encryption to enable mass surveillance.
After the Snowden revelations, the Brazilian and German governments led a global coalition that condemned US surveillance abuses and helped to advance the right to privacy at the UN. In 2014, Brazil passed the “Marco Civil” rights framework for the Internet, affirming that users had the right to communicate privately and securely online. The country has also hosted key global meetings on Internet governance.
Over the last year, however, the government hasn’t practiced what it preached. In addition to the WhatsApp cases, a raft of regressive cybercrime bills are being discussed in Congress. If passed, these bills could expand the government’s surveillance and censorship powers while rolling back protections for rights even though it is not clear that they would effectively address the country’s cybercrime problems.
Brazil should reclaim the mantle of leadership on digital rights it once embraced. Its judges should cease all wholesale blocking of Internet services. Such disproportionate actions should never be acceptable and are wholly incompatible with the principles and guarantees embodied by the Marco Civil framework. Federal prosecutors and the courts should ensure privacy and encourage strong encryption in applications like WhatsApp, not punish companies for taking steps to shield users from abusive spying or to protect them from cybercrime.
