In early November 2020, Brazil’s supreme court of justice (STJ) – the second-highest court in the country – was the target of a ransomware attack which forced the shutdown of its operations for several days. It rapidly emerged that the same week, the federal health ministry, websites linked to the government of the Federal District, and the national justice council (CNJ) had also been vulnerable to cyberattacks. Days later, the supreme electoral court (TSE) fended off a cyberattack on the day of the municipal elections. Taking place in quick succession, these incidents served as a reminder of Brazil’s persistent weaknesses where cyber security is concerned.
Cybercrime has long represented an important risk in Brazil. Although efforts have been made to shore up the country’s resistance to this threat – the international sporting events that Brazil hosted in 2014 and 2016 had, in particular, served as a driver for the government to better equip itself to respond to cyber incidents – Brazilian citizens, businesses, and government agencies remain very vulnerable to cybercrime, and institutional and legal structures responding to the issue continue to be lacking.
In international measures of cyber security efforts, Brazil tends to rank at a middling level globally, and in the top third at a regional level – its performance compared with other major Latin American countries such as Chile, Mexico, or Colombia varies depending on the ranking, but it is consistently outranked by smaller, poorer Paraguay.
In the United Nations’ (UN) latest Global Cybersecurity Index (GCI), from 2018, Brazil ranked 70th out of 175 countries surveyed (and sixth out of 33 in the Americas), with a score of 0.577 (where 1 indicates a high commitment to the GCI pillars – which include legal and technical measures to fight cybercrime – and 0 indicates no commitment).
In the more recently published National Cyber Security Index (NCSI), produced by Estonia-based think tank e-Governance Academy, Brazil ranks 61st out of 160 countries, with a score of 46.75 (with 100 being the maximum score). The country performs best in cyber threat analysis & information, and in military cyber-operations, but very poorly in cyber crisis management, protection of essential services, and protection of digital services.
According to Cyber-Edge, a consultancy which surveyed IT security professionals across 17 countries to produce its 2020 Cyberthreat Defense Report, 77% of respondents in Brazil had suffered at least one successful cyberattack (Mexico topped this vulnerability list, with 94% of respondents affected by a successful cyberattack). Overall, cyber security experts agree that Brazil remains particularly vulnerable to cyberattacks, with a number of factors – including the country’s size, the high level of internet and mobile penetration, and the lack of a national strategy and funding – contributing to the issue.
The past year has seen some efforts to remedy this, building on the national policy of information security (PNSI) which was published in the final days of former president Michel Temer’s mandate (2016-2018), and which enshrined the need for national policies around information security to include issues of cyber security, cyber defence, and protection against data leaks. In February 2020, President Jair Bolsonaro issued a decree which introduced a national strategy on cyber security, known as E-Ciber, to be led by the cabinet of institutional security (GSI), which is attached to the presidential office. A data protection law came into force last August, and there had been plans to present a cyber security law by end 2020, although the project remained pending at the start of 2021.
E-Ciber and the efforts behind it – it was the result of a months-long consultation process – were welcomed by cyber security experts, and said to be long overdue. The actual content of the E-Ciber document was, however, largely met with disappointment, criticised for its lack of substance. The E-Ciber document outlines a cyber security strategy for the period 2020-2023, with three main objectives: to make Brazil more safe and successful in the digital environment; to increase Brazilian resistance to cybernetic threats; and to strengthen Brazilian actions in cyber security on the international stage.
To this effect, the decree lists 10 strategic actions, which include setting up a centralised model of cyber governance at national level; increasing the level of protection to “Critical National Infrastructure”; improving the country’s legal framework on cyber security; and broadening cyber security partnerships between the public and private sectors, civil society, and academia.
The text’s failure to establish clear actions, timelines, or budgets, is one of the main points of criticism from cyber security experts. An analysis by the International Institute for Strategic Studies (IISS), a London-based research institute, brands the document as “exceptionally vague”, and declares E-Ciber to “lack focus and substance”. There are also worries that its vague wording could lead to content-regulation efforts (such as the fight against fake news [SSR-20-07]) being wrongly amalgamated into cyber security efforts.
Nevertheless, E-Ciber does outline Brazil’s needs where cyber security and cyber defence are concerned; it lays the first stone for later developing a legal and normative framework and introducing a cyber security bill; and it has opened space for more discussions around the issue in different areas. Alongside expectations that corporate investment into cyber security is picking up (it has tended to lag compared with the rest of the world, leaving Brazilian businesses more exposed), Brazil could be on track to making some important changes to its cyber security landscape.
The November 2020 cyberattacks
The attacks against Brazilian state agencies in November came at a time when ransomware attacks the world over were increasing, most likely as a result of the coronavirus (Covid-19) pandemic and the massive shift online that it has forced across society. Nevertheless, the vulnerabilities of the Brazilian systems raise important questions about the state’s responsibility when personal data is leaked, and also fuel mistrust in their safety and reliability.
As previously noted, the STJ had to stop all activities and trials – conducted via video due to the pandemic – for several days. The STJ president described it as the “worst-ever” cyberattack suffered by a government institution in Brazil. The ransomware attacks against the CNJ, Federal District websites, and health ministry also left websites down, and prevented civil servants from working.
In the case of the TSE, the deflected cyberattack on 15 November – the day of the municipal elections – came with other technological issues which contributed to delays in the usually very quick electronic vote-counting system. It took place in a context of rampant misinformation over the supposed unreliability of the country’s electronic voting system – doubts to which President Bolsonaro himself contributed.
The TSE – which for the first time had centralised all vote-counting efforts, rather than regional electoral courts counting votes at state level and then sending them to the TSE – successfully withstood an attempt to bring down the vote-tallying software through millions of simultaneous connections to the system, but did suffer a data breach. The president of the TSE, Luis Roberto Barroso, condemned the attack as a deliberate attempt to discredit Brazil’s electoral system. A police investigation had, at time of writing, reached no conclusion as to the source of the attack.
