The Federal Audit Court (TCU) authorized, on Wednesday (8), the resumption of a contract by the Ministry of Justice and Public Security for the acquisition of an intelligence solution in open sources, social media, deep e dark web. Minister Bruno Dantas, rapporteur of the case at the TCU, overturned a precautionary measure from 2021 and authorized the resumption of the contract with the adoption of some measures, among them making the security features and auditability of the system appear in the contract.
The process began with an action presented by the organizations Conectas Human Rights, Instituto Igarapé, Instituto Sou Da Paz and Transparency International. In January, the TCU kept one previous decision, of November 2021, in which it suspended the electronic trading that contracted the system from Harpia Tech. The entities pointed out that “there were serious irregularities in the bidding process, including the very illegality of contracting a system capable of monitoring and profiling citizens without any prior justification, the absence of control and inspection mechanisms and the very type of bidding adopted, which was absolutely inadequate. for the type of service intended”.
According to the NGOs, despite being a distinct technology from Pegasus – software that allows the invasion of cell phones and computers -, the platform marketed by Harpia Tech is also “problematic”. One of the points questioned is the hiring of the system by the Secretariat of Integrated Operations (Seopi) of the National Secretariat of Public Security (Senasp), linked to the Ministry of Justice and Public Security. Since its creation in 2019, the agency has functioned as the “intelligence arm of the Ministry of Justice”.
:: Article | Pegasus: Cyber Espionage, NSO and the Israeli Government ::
the dossier Defending Brazil from Technoauthoritarianismproduced by researchers on the subject, points out that Harpia’s platform “is a tool whose operation serves to constantly monitor people, especially in relation to their online activities. Such monitoring, it should be noted, is not restricted to attention for criminal activities , but, as seen, it extends, worryingly, to activities that translate the free exercise of civil and political rights, such as hacktivism and academic research”, says the material.
“In this way, it can be said that the Solution whose purchase Seopi intends to purchase delivers a broad surveillance capacity and, consequently, can directly interfere with the exercise of fundamental rights and facilitate activities that deviate from the democratic and constitutional order, such as the gathering of data that can allow sensitive inferences and the production of dossiers on any citizen, regardless of well-founded suspicion and court order”, explains the dossier.
Public notice was born to buy Pegasus
According to a report published by the portal UOL, the electronic auction that hired Harpia came about because the government was interested in contracting the Pegasus spy software. Developed by the Israeli company NSO Group, the service has already been used by dozens of governments in different countries to invade the cell phones of opponents, journalists and human rights defenders. The company, however, left the negotiations with the government after repercussions in the media.
:: Spy program wanted by Bolsonaro was used to invade Polish opponents’ cell phones ::
As the bidding continued with other companies, Harpia Tech was therefore chosen by the federal government to deliver services. According to the NGO Conectas, one of those that mobilized against the hiring, even with the withdrawal of the Israeli company, the TCU pointed out “the illegality of hiring a system capable of monitoring and profiling citizens without any prior justification” and “the absence of of control and supervision”.
Arguments for and against
O Brazil de facto spoke with two sources with opposing views on the subject: the director of Associação Data Privacy Brasil de Pesquisa, Rafael Zanatta, and the executive director of Harpia Tech itself, Filipe Soares. The two commented on this week’s TCU decision and explained their differences on the matter.
For Zanatta, “the TCU missed an opportunity to identify an illegality in the object of the contract”. “That was the point of the NGOs: to question the kind of damage that software like this can cause, if it is used without due precautions and legal administrative procedures”, she said. The director of DataPrivacyBR was the author of a text, published this Friday (10), entitled What do we know about Harpia Tech?. In the publication, it gathers information about the company.
In the opinion of Soares, owner of the system purchased by the government, the public notice is about “hiring an OSINT (Open Source Intelligence), that is, an open source intelligence”, and not spy systems. “It’s a common service, which several other public institutions have,” he said.
Read the interview with Rafael Zanatta, from Data PrivacyBR
Rafael Zanatta, Director of DataPrivacyBR: “Revocation of the precautionary measure is bad” / Disclosure
How did the entities working on the subject receive the measure?
The decision to revoke the injunction is bad. The TCU positively signals that the government can continue to use this type of software that has the ability to build a profile of people. The TCU missed an opportunity to identify an illegality in the object of the contract. That was the point of the NGOs: to question the kind of damage that software like this can cause, if it is used without due precautions and legal administrative procedures.
What are the potential dangers of the system?
Once the Harpia software license is distributed, you can do relational analysis very easy. It has 5,000 data points that feed the software. From what we saw in the proposal, in the demo video and in the documents that were presented by the company, when you target someone, all the Telegram groups that the person belongs to, public mailing lists that the person belongs to, all appear the academic publications it had, all public links. It is information extracted from the web that gives you the power to mount relational analyses. That is, check which people you relate to, what your circle of association is.
It is a very powerful instrument for surveillance and association analysis, which allows for the neutralization of conduct that may not be illegal. It is necessary to be very careful with an instrument of this size in the hands of Seopi, which is not responsible for carrying out a criminal investigation with due process, with the typical structure of a criminal investigation. Seopi is working on the topic of intelligence. It was the body that monitored anti-fascists and there is a suspicion that it also monitors counterintelligence of government opponents. This enables the government to create a legacy. The decision advances a signal that later is difficult to return. It will require more work on the part of civil society to demonstrate the types of risk that exist.
Read the interview with Filipe Soares, from Harpia Tech
Filipe Soares, owner of Harpia Tech, to the left of Fábio Faria, Minister of Communications, at a meeting in Planalto, on May 3, revealed by Brasil de Fato / Reproduction/Twitter
How did Harpia Tech receive the TCU decision?
The decision of the Federal Court of Auditors, in my view, made the obvious prevail. What happened was that this Israeli software narrative emerged concomitantly with the publication of the auction. There was a misinterpretation of the person who launched the narrative when reading the edict. The public notice, for those interested in reading it, makes it clear that it is about hiring an OSINT (Open Source Intelligence), that is, an open source intelligence. It is a common service, which several other public institutions have. There have already been several trading sessions in just the last three years that Harpia Tech has been on the market.
The first half of the process at TCU served to really prove that our software was not the one mentioned (Pegasus). In the second part of the process, the TCU said: “Prove to me that this tool will not be used to collect information out of context”. What we call out-of-context is the use outside the authority and legal mandate of the authorities. We demonstrate in the TCU all the tool’s auditing requirements. The use of the tool by different users always generates records, generates logs. The use is auditable and is susceptible to an internal control by the institution itself and, perhaps, even to an external control through the control bodies of police activity and intelligence activity.
:: Fábio Faria held a meeting at Palácio do Planalto with a spy system company vetoed by the TCU ::
What is the difference between Harpy and Pegasus?
The big difference between it and an interception tool is that it is not entering machines, computer terminals, cell phones, or anyone’s private sphere. If a person publicizes something in a closed profile on the social network, the tool does not see it. If a person has a Twitter account that has access restriction, the tool does not see it. Evidently, WhatsApp groups in which you need to be invited or validated by the administrator, the tool does not see.
However, she sees some environments – as you can infer even from reading the notice itself –, which are environments designed to be public. We saw some articles this year from reporters who put users in Telegram groups in which various subjects and controversial topics are discussed. This is because they are public forums. These are groups where people freely share access links and there is no validation to enter. What the tool does is collect information from these environments, from public forums, where everyone is fully aware that it is a public environment. This is very different from a malware attack or an intercept.
What does the Harpy system do?
Harpia is superior to others in its ability to find and structure quality information. The challenge of this type of tool is to find the information at different points, in different places, and to structure that information. As requested in the public tender in question, to structure this information in different layers so that an investigator saves time when searching when searching for a name, for an email, for a username. It is a process that a human being could do, but it would take a lot of time. The idea of the tool is, as much as possible, to automate this process.
Editing: Rodrigo Durao Coelho
