Brazilian President Dilma Rousseff is staking out a leadership role for Brazil on the contentious issue of Internet governance. She has prioritized certain legislation amid revelations of widespread electronic espionage by the U.S. National Security Agency (NSA). Rousseff is also promising to introduce an international Internet governance proposal at the United Nations, for which India has voiced support [Note: Some sources are in Portuguese]. A bill introduced in 2011, known as Marco Civil da Internet (Civil Rights Framework for the Internet), has been slowly making its way through Brazil's National Congress, undergoing an extensive public consultation process. Some main provisions include privacy protections, net neutrality, and the non-liability of Internet platform providers for content posted by users (unless ordered removed by a judge). On September 11, Rousseff formally requested that the National Congress treat Marco Civil with constitutional urgency. The request came three days after Brazilians learned that the NSA spied on Petrobras. Under the urgency procedure, each chamber has 45 days to vote on the bill; otherwise, all pending legislation must be halted in that chamber until it is addressed. It is currently in the Brazilian House of Representatives (Câmara de Deputados) and a vote is expected by October 28. Should it pass the House, Marco Civil continues to the Senate, where it will have another 45 days to be addressed. Now that it is on a fast track to becoming law, multiple Brazilian interests are rushing to insert new provisions in the bill, which risk distorting the framework that has been thoroughly debated by multiple Brazilian stakeholders since 2009. Provisions under debate include the duration of data storage, which agencies will regulate different portions, legal protections, and net neutrality. Rousseff has come out strongly in favor net neutrality, which is the principle that Internet providers should treat all data equally, not discriminating or charging differing amounts for transmission. President Obama also supports net neutrality. Flawed Data Logic Rousseff's effort to include a provision that would require that Brazilians' data be stored on servers located in Brazil is especially controversial. This proposal is being touted as a way to protect Brazilian citizens and Brazilian sovereignty. However, such a requirement is unlikely to make Brazilian data more secure and some experts fear it could lead to Internet Balkanization. Concerns about online security are understandable. The NSA is not only collecting massive amounts of data, but it has systematically undermined data encryption across the entire Internet. It has done so by working in concert with software and systems developers to build "back doors" into their products, in addition to intentionally introducing weaknesses into global encryption standards. As a result, everyone's data and privacy are more vulnerable to hackers, governments, terrorists, and criminals of all kinds. Nevertheless, many experts note that requiring that all Brazilian data be stored in Brazil will carry costs. All governments engage in spying and surveillance, including Brazil's. Criminals and terrorists will seek to exploit weaknesses for their own nefarious ends. Any computer connected to the Internet is vulnerable. Malware and spyware can penetrate defenses no matter where the computer or server is located. Whenever messages and data travel over the Internet, they could be intercepted and decoded, even if Brazil develops its own national email system, as Rousseff has proposed. Pedro Henrique Ramos, a lawyer and a researcher at Brazil's world-renowned academic institution Fundação Getúlio Vargas, argues that forced data localization could have grave consequences. From an economic perspective, he says that Brazil's relatively expensive servers would harm Brazilian companies by significantly increasing the already-high costs of doing business in Brazil. From a civil liberties perspective, forced data localization could make surveillance of Brazilians even easier for Brazil's police and intelligence services. Ramos notes that, according to a Google transparency report, Brazil is already the country with the second most judicial and government requisitions for user data, after the United States. One author of the original Marco Civil bill, Ronaldo Lemos, argues that requiring companies such as Google and Facebook to build new data centers in Brazil will scare Internet companies away and make them less likely to offer their valuable services to Brazilians. A better way to bring more data centers to Brazil would be to invest in Internet exchange points, Lemos argues. More and better exchange points in Brazil would naturally lead to an increase in data centers. Demi Getschko, adviser to Brazil's Internet Management Committee (CGI.br) and a pioneer of the Internet in Brazil, recently argued that Marco Civil should be passed without any new provisions. Other members of CGI.br have said that issues of data protection should be addressed in a separate Personal Data Protection bill that is set to be introduced after Marco Civil is passed. Brazil is doing much to put Internet governance high on the global agenda. President Rousseff's speech at the UN General Assembly in September helped bring attention to the risks posed by an anarchic Internet. Fadi Chehadi, head of the U.S.-based Internet Corporation for Assigned Names and Numbers (ICANN), praised Rousseff for her support of net neutrality and for planning to host an Internet governance summit in Rio de Janeiro in April 2014. But, as Getschko said in July regarding Marco Civil, "now is the time to approve that which is widely known and debated. Last-minute changes, apart from not having gone through the scrutiny of public debate, tend to be imprecise and, many times, incoherent."
A Global Challenge Data security and online privacy are global problems. As long as Brazil and other countries remain connected to the Internet, they will be vulnerable. Unless Brazil wants to cut itself off from the global information society and the opportunities for prosperity, learning, and advancement that it offers, Brazil will have to find a way to address security concerns without forced localization of Brazilian data. Many Brazilians are essentially saying, "It's a good law; don't ruin it. We'll deal with other issues in separate legislation." In the United States, many are seeking to rein in the NSA, led by Senator Ron Wyden. Despite President Obama's lackluster leadership on the clear need for U.S. intelligence reform, he has ordered an intelligence posture review that will take months to complete. Moreover, the National Institute of Standards and Technology, a U.S. federal agency, last month announced it would take steps to restore confidence in encryption standards. The top two officials at the NSA will soon be gone, presenting a chance for the United States to reform its intelligence apparatus. American society is slowly mobilizing around better solutions to the threats we face.
Liberal democratic nations struggle with the issues presented by modern information and communications technologies. Not utilizing these new tools for law enforcement and to defend national security would be foolish, but trying to control and monitor everything risks eroding the civil liberties that make these societies so vibrant. Brazilian and American societies are natural allies and should be working in concert with other like-minded societies to build an international Marco Civil. Restricting the global free flow of data and ideas on which commerce, growth, and opportunity increasingly depend would harm everyone's prosperity, but countries that introduce protectionist Internet policies would suffer the most. That so many Brazilian stakeholders are pushing back against the hasty inclusion of ill-conceived provisions is a positive sign. The impulse to exert greater control in an effort to protect one's citizens is understandable, but such laws should be introduced cautiously and with input from all segments of society, not rushed through in times of anger and paranoia. The Patriot Act is a prime example.
We're all worried about privacy and security in our deeply interconnected world, whether we most fear criminals, terrorists, governments, or hackers. Given the nature of the Internet as a global network, it would make sense to work together to strengthen it and to restore trust in its integrity, instead of building walls.