4. The Marco Civil da Internet
By Geoffrey King
The fate of freedom of expression in Brazil hinges in part on the implementation of the country’s landmark law on Internet rights, the Marco Civil da Internet.
Originally hailed as a model for how governments should approach Internet legislation in order to protect privacy, security, and the free flow of information, the Marco Civil’s shining example became tarnished as soon as it entered the political arena. The political jockeying was particularly fraught because it came on the heels of revelations that the United States’ National Security Agency had spied on Brazil’s leader and its flagship energy company.
HALFTIME FOR THE
BRAZILIAN PRESS
• Table of Contents
In print
• Download the pdf
In other languages
• Português
The Chamber of Deputies, the lower house of Brazil’s Congress, finally approved the Marco Civil on March 25, 2014—minus its most problematic provision, which would have required that data be stored in Brazil, but with other flaws intact. Despite dozens of amendments added while in committee, the Senate passed a version nearly identical to the lower house’s on April 22. President Dilma Rousseff signed the bill into law on April 23, 2014.
The journey of the Marco Civil is instructive for how governments and civil society should approach Internet regulation—and which legislative outcomes are in the best interest of Internet providers and users, including journalists.
The Marco Civil began as an open source project. Launched from the imagination of a young law professor, and built collaboratively by Internet users and the Brazilian government, the Marco Civil represented from its inception an alternative approach to Internet regulation. Rather than relying on a pernicious model of cybercrime legislation, the Marco Civil began with the premise that it would encode free speech, privacy, and net neutrality—equal treatment for different types of data—directly into Brazilian law.
“The future of democracy depends on the future of the Internet, on net neutrality and on freedom of expression,” said Alessandro Molon, congressional deputy with the governing Worker’s Party and the rapporteur of the bill. “Our future also depends on the freedom we have to download things from the Internet, what we can say and express online, and also on our ability to share with our friends. All these are extremely important issues for the future of our society, and that is the reason why it was so difficult to pass in Congress.”
Yet some journalists remain concerned about how the law will be implemented. “Some articles in the legislation were written as a guide to facilitate the removal of content from sites, blogs, portals,” Fernando Rodrigues, journalist and founder of the Brazilian Association of Investigative Journalism, told CPJ in an email. “The government argues that that does not apply to news items, but many lawyers and experts see a very dangerous loophole, since today everybody claims to be a reporter or a journalist.”
On March 12, 1989, in a short proposal that soon became the World Wide Web, Tim Berners-Lee encouraged the development of “a universal linked information system” that would “allow a place to be found for any information or reference which one felt was important, and a way of finding it afterwards.” The proposal would soon change the face of journalism by placing vast amounts of the world’s information at reporters’ fingertips. The Web has become a research and publication platform that allows news to be gathered and disseminated at low cost, facilitating the free flow of news even in repressive countries. Further, hyperlinking allows journalists to connect directly to primary source information, as well as to the work of their peers, thus giving readers a clearer picture of the world around them.
The interconnectedness envisioned by Berners-Lee has taken root in few places as rapidly as in Brazil, which boasts about 100 million Internet users, according to the research firm eMarketer. Brazil has the second-largest market share of Facebook users and YouTube viewers outside the U.S., as reported by The Wall Street Journal; the same can be said for Twitter, according to the consumer research company Semiocast. According to the research group Nielsen, overall mobile use stands at 84 percent among Brazilians 16 years and older. Smartphone penetration, at 23 percent, is second in Latin America only to Mexico, according to the marketing publication Portada.
Globally, the Internet has an estimated 2.7 billion users, but Berners-Lee is sounding a warning cry. Issues related to privacy, free speech, and anonymity “have crept up on us,” he told the Guardian in March of 2014. “Our rights are being infringed more and more on every side, and the danger is that we get used to it.” His solution? “We need a global constitution—a bill of rights.”
The original Marco Civil “was definitely a bill of rights similar to what Tim Berners-Lee is now proposing in the sense of creating a Magna Carta for the Internet,” said Ronaldo Lemos, director of the private Institute for Technology and Society in Rio de Janeiro and a professor of law at the prestigious Rio de Janeiro State University. Lemos conceived of the Marco Civil in 2007 and served as one of the legislation’s strongest advocates.
Part of what made the original Marco Civil so strong, Lemos told CPJ, was that it applied open source principles to democratic self-governance. After Lemos and a group of lawyers helped defeat a first-of-its-kind cybercrime law in Brazil, the government engaged them in a surprising way. “The Minister of Justice approached us—myself and a group of other researchers and professors—and basically said, ‘So, how about we develop a platform so we can write the Marco Civil collaboratively online? It’s a law about the Internet, so it makes sense that it’s collectively constructed.’ And that’s what we did. We created a platform. We received a lot of contributions in a very transparent way, and based on those contributions, the original draft was basically produced. The government undertook it, transformed it into a draft bill, and sent it to Congress about two years and a half ago.”
In the open-source phase, any Internet user could critique the text, which received more than 2,000 direct comments from civil society, government entities, universities, corporations, bloggers, and other individuals.
Among the improvements made possible by this approach was a key modification to an early provision that would have imposed liability on website hosts for their users’ content if they failed to immediately censor material after a complaint from a third party that the content was defamatory or otherwise objectionable. As CPJ pointed out at the time, the provision would have incentivized widespread censorship by Internet companies. After CPJ and many others objected to the provision, a requirement for a court order to remove content was added to the bill.
After the bill was transmitted to Congress in 2011, political realities quickly set in. The bill languished in Congress without a vote for nearly two years due to political and industry opposition to its net neutrality provisions.
“In terms of net neutrality, there was great pressure exerted by the Internet service providers,” Molon, the congressional deputy, said. ISPs in many countries have consistently opposed steps that would limit their ability to charge different prices, slow, or even block certain data on their networks.
Although the bill was eventually amended to include concessions that would help it move forward, it remained largely intact. All the while, civil society pushed for its Internet Bill of Rights. Among the voices championing the Marco Civil was Berners-Lee. At a May 2013 news conference in Rio de Janeiro, he stated, “This draft bill preserves the Internet as it should be: an open and decentralized network, in which users are the engine for collaboration and innovation.”
Three weeks later, the Guardian ran its first headline based on disclosures from the former National Security Agency contractor Edward Snowden. Then on September 1, Brazil’s TV Globo reported, citing Snowden’s documents, that the NSA had spied on Brazilian President Dilma Rousseff and her top aides. On September 9, the station reported that the agency had also spied on Petróleo Brasileiro S.A., or Petrobras, the national oil company.
Suddenly, the government invoked “constitutional urgency” for the bill. “That means that Congress cannot vote on anything until it votes on the Marco Civil, and as a result of that, things started to become really politically agitated,” Lemos told CPJ. “What started to happen was a lot of compromises being achieved in order to protect net neutrality,” a core principle of the Marco Civil. Amid the chaos, the government introduced the data localization provision, Article 12.
The provision would have empowered the president to require that Internet data infrastructure be physically situated in Brazil, rather than in decentralized locations intended to maximize network efficiency and security, or in jurisdictions with strong civil liberties protections. If implemented, this provision would have begun a process of corroding the Internet’s interconnectedness, and might have led to technological divestment from Brazil. If widely emulated, it could even have led to the catastrophic fragmentation of the Internet itself.
The Snowden revelations were “definitely the turning point,” Lemos told CPJ.
As reported by ZDNet, Berners-Lee called the new data localization provision an “emotional reaction” that would not have the practical effect of protecting Brazilians’ data from spy agencies like the NSA. Lemos agreed. In his view, the impact of localization on international espionage is “basically zero.” It has been widely reported that the NSA has access to the so-called Internet backbone connecting data centers to the rest of the Internet. In addition, companies based or operating in the U.S. would still be legally bound to comply with NSA orders, and experts agree that the NSA can hack into databases that are outside the U.S.
Instead, Lemos said, financial incentives drive localization efforts. Noting that data centers represent “investments and jobs,” he said that Brazil could instead “attract data centers if it invested in infrastructure,” which he sees as the better approach. And Richard Clarke, the former White House special adviser on cybersecurity and a recent participant in President Barack Obama’s intelligence review group, said in a February speech, according to news reports, that governments “want localization so local companies can do better against international companies.” Clarke continued: “When you think of data localization, don’t buy the argument that is being pushed by privacy considerations—it’s being pushed by the bottom line. If you think passing a law making data localization a requirement in the EU or Brazil … stops the NSA from getting into those databases, think again.”
In fact, increased localization would make it far easier for the Brazilian government to surveil or censor its own citizens, and civil litigants could find localization similarly useful.
Brazil already makes more requests to take down Internet content than most other governments around the world, according to Google’s figures. In September 2012, the director of Google Brazil was arrested for failing to remove two videos critical of Alcides Bernal, a candidate for mayor of Campo Grande in southwestern Brazil. In a historic 23-6 vote in March 2014, Bernal was removed from office amid allegations of public corruption—the first impeachment in the municipality’s history.
“If you have a data center located in Brazil, it’s very likely there would be a big line of court officials trying to serve injunctions to the data center operators, because the data would be very easy to be both obtained, and also taken down,” Lemos told CPJ. “Until we have better laws in terms of data protection and other civil rights protections, it actually harms these rights to have them located in Brazil.”
Furthermore, as security expert Bruce Schneier told The Associated Press, such efforts would encourage “some of the worst countries out there to seek more control over their citizens’ Internet. That’s Russia, China, Iran, and Syria.”
In remarks before the U.S. Senate Judiciary Committee in November 2013, Google’s director of law enforcement and information security, Richard Salgado, testified, “If data localization and other efforts are successful, then what we will face is the effective Balkanization of the Internet and the creation of a ‘splinternet’ broken up into smaller national and regional pieces, with barriers around each of the splintered Internets to replace the global Internet we know today.” Such a situation would prove antithetical to the “interconnectedness” that Berners-Lee described; governments could conduct surveillance and block content within their countries with ease, allowing them to restrict or even stop the flow of news into and out of their countries.
The arguments against forcing the data centers to be kept to Brazil ultimately prevailed; the provision was struck from the version of the Marco Civil approved by the Chamber of Deputies, and omitted from the final law.
Though the data localization provision was scrapped, other problematic provisions remain. The law mandates that companies retain user data not only at the level of Internet service providers for one year, but also at the application provider level—a broad term that includes websites such as YouTube and Twitter—for six months. Data retention is problematic even at the ISP level, as it creates a detailed record of users’ activities to which the government may refer. As CPJ reported in the 2013 edition of Attacks on the Press in achapter on NSA storage capabilities, such retention casts a chill on journalists, especially those who report on government. On April 8, 2014, the European Court of Justice invalidated the European Union’s mandatory data retention directive, saying it interferes with the right to privacy.
Joana Varon, a researcher and project coordinator at the private Center for Technology and Society of the Getulio Vargas Foundation in Rio de Janiero, finds the retention of application-level data to be the most troubling of all the Marco Civil’s provisions. In an email to CPJ, she said it is “the worst part” of the law, “as it imposes mandatory data retention for the big Internet application providers (not the ISPs that provide connectivity, but the ISPs that provide online services).” This can be a threat to new business models of ISPs focused on socially positive innovations by placing additional financial burdens on them, she said.
Moreover, a person with knowledge of discussions around the Marco Civil, who asked not to be named because he was not authorized to speak to the media, told CPJ that plans were underway to extend the time period for both ISP and application-level data retention to three years, which he noted may be beyond the current data retention practices of any major information and communications technology company.
The experts with whom CPJ spoke also expressed concern about Article 21 of the Marco Civil, which deals with the rights of those whose privacy has been breached. As Varon noted in a February 11 coalition letter to the Brazilian government, an early draft of Article 21 allowed anyone objecting to nudity or sexual content “of a private nature” to demand its removal from the Internet; an Internet application provider that failed to comply could be held liable for the content in court. Because the original draft of Article 21 allowed anybody to make and enforce such a complaint, not just the person depicted in the image or video, the provision if passed would have facilitated the suppression of any content containing nudity, regardless of whether the alleged victim objected to its publication. Although the provision targeted a relatively narrow type of speech, it did so poorly: by empowering unconnected third parties to force liability on Internet companies, the provision had the potential for widespread abuse against critical commentary and other newsworthy speech.
The provision was modified prior to passage of the Marco Civil so that only the persons depicted in a “private” video or image can demand its removal from the Internet. Nonetheless, even constrained “notice and takedown” regimes often damage free expression. Public figures and officials in Brazil frequently abuse existing privacy and defamation laws to silence the media. As CPJ has consistently documented, vague or overbroad privacy laws often end up being applied in a manner that threatens press freedom.
The privacy provision, “will certainly pose a threat to the freedom of expression,” said Rodrigues, the founder of the investigative journalism association.
Deputy Rubens Bueno, leader of the opposition Popular Socialist Party in the House of Representatives, told CPJ he voted against the Marco Civil because of mechanisms allowing the president to control the media and social networks. Although the law prohibits the blocking, monitoring, filtering, or analysis of content, Bueno argues that the government can do so in an emergency by presidential decree, and his party does not see any guarantees preventing the government from trying to control media that criticize the executive branch.
Despite the Marco Civil’s flaws, the majority of its provisions are highly protective of user privacy and speech. In many ways, the law is a high point in how governments approach Internet legislation, and sets an example for technologically-facilitated, participatory democracy. The law still enjoys high levels of support from civil society. And it is possible, as several of the experts with whom CPJ spoke pointed out, that one or more the law’s most problematic provisions could be found unconstitutional and thus rendered unenforceable.
Lemos was buoyed by the process. “The process in itself is quite amazing, because it has taught to a lot of people how democracy works … While it was transparent, and open, and collaborative and so on, it was pretty much a rational debate, in which the best arguments would win.”
Said Molon, “The bill was built from the bottom up.” Although professional politicians played a role, “it is important to emphasize that this is an initiative that began with civil society urging the government to do something about rights online. This is a people’s bill, built by the people. And the process by which it was drafted produced a great change in the way that Congress works.”
Carlos Lauría contributed to this report.
San Francisco-based CPJ Internet Advocacy Coordinator Geoffrey King works to protect the digital rights of journalists worldwide. A constitutional lawyer by training, King also teaches courses on digital privacy law, as well as the intersection of media and social change, both at UC Berkeley. Follow him on Twitter at @CPJInternet. His public GPG encryption key can be found here.