The Rio Olympics may be over, but it’s likely that the invasive surveillance equipment that Brazil purchased to monitor the influx of people for the events will be around for a long time.
The Olympic games have long attracted heavy surveillance. In 2012, on top of carrying out extra screening for travelers and monitoring of internet traffic, London purchased additional closed-circuit television cameras (a feat to add to what is already known as the “ring of steel”) and biometric scanners. A series of reports by Andrei Soldatov and Irina Borogan highlighted the unprecedented level of surveillance at the 2014 Winter Olympics in Sochi, Russia, which included monitoring of communications and internet traffic as well as advanced location tracking. At the time, the U.S. State Department warned Sochi travelers that they should expect no privacy during the Russian games, and security experts demonstrated that devices could be hacked within minutes of being powered on. There was a focus on increased surveillance even at the 2000 games in Sydney, Australia — a year before the 9/11 terrorist attacks.
Unfortunately, surveillance technology for the Olympics doesn’t often just go away. Instead, it’s re-purposed for “law enforcement” or other domestic uses.
The 2016 games are likely to be no different. This year we have once again seen an increase in the host country’s investment in mass surveillance authorities and technologies, and Brazil had already hosted several large-scale international events in the past years — becoming in the process a privileged market for international surveillance companies. Since the 2014 FIFA World Cup, Brazil has significantly increased the number of cameras installed on city streets, with several integrated command centers that can track conditions in real time and allow for coordinated responses by different municipal, state, and federal departments. The most ambitious effort, the Rio Operations Center (COR), together with the Center for Integrated Command and Control (CICC), coordinated the security operations for this year’s Olympic games. It was the biggest surveillance investment in time and resources Brazil has ever seen, with as many as 20-30 departments representing different levels of the government (including the Army) working with private contractors.
Below we discuss three of the surveillance technologies that were used at the Rio 2016 Olympics and their potential long-term impact in Brazil and the surrounding areas.
Eyes in the sky
One of the most celebrated technologies acquired for the Olympic Games were four surveillance balloons equipped with a monitoring system that cost Brazilians around $8 million.
The sensor consists of a system of 13 cameras called Simera, which is installed in balloons that from up to 200m in the sky can monitor the movements of vehicles and pedestrians in high definition and in real time. Together, the balloons can cover an area of 160 square kilometers, around 13% of the whole Rio de Janeiro. When infra-red cameras are activated, the system can detect people from up to 13km distance during day and night. The balloons can stay up to 72 hours in the air.
The surveillance system was originally developed for military use by a company called Logo Technologies and is being deployed by a Brazilian startup called Altave. Approximately 100 police officers and municipal guards from Rio de Janeiro received training to operate it.
It is the first time such technology has been used in a civilian event. Public declarations by the Ministry of Justice indicate that after the Olympics, the surveillance balloons will be used for daily security operations in Rio de Janeiro. This places one of the most invasive physical surveillance technologies partially in the hands of one of the most violent police departments in the world — a department that hasn’t received training regarding the privacy implications of using these technologies. It’s not clear which public departments or private entities will have access to the images and data that are captured, nor what the procedures might be for processing, retaining, or sharing the collected data.
The U.S. government purchased similar balloons for military use, and has tested them over U.S. cities. One balloon that was stationed just north of Washington, DC, broke free of its tether and floated away, causing significant damage and leaving a trail of power outages. The balloon traveled more than 100 miles before it was brought down in pieces in Pennsylvania. This week, there were reports that police in Baltimore have secretly been capturing images of the city from an airplane, without letting the public know about it.
In Chile, a similar — though less powerful — technology was implemented by the municipality of Santiago where citizens raised objections. After a judicial dispute initiated by the NGO Derechos Digitales and other human rights organizations resulted in an initial prohibition of the surveillance balloons, the Chilean Supreme Court authorized their use, but recognized that the way they were being deployed could lead to abuse and recommended establishing limits for their use. The recommendations say, for instance, that the system should only target public spaces or “open private spaces” (such as a backyards) and that all unnecessary images should be destroyed after a 30-day period. While the recommendations may have limited effect, they show that other countries are appropriately concerned about the use of such invasive technology.
Eyes on the ground
The security measures for the Rio Olympics also included the installation of 2,000 new high-resolution cameras to monitor the Olympic Village and the sites where the competitions took place. They add to what are at least 2,500 existing surveillance cameras already installed in different places of the city.
The images are accessible by both the COR and the CICC. The CICC is considered to be a legacy from 2014 FIFA World Cup. Different host cities have their own centers, all coordinated by a National Integrated Command and Control Centre (CICCN) located in Brasília. For the Olympic Games, four new Sectoral Integrated Command and Control Centres were installed close to the main areas where the competitions took place.
The CICCs allow for the access and exchange of information in real time from entities at the municipal, state, and federal levels dealing with public security, national defense, intelligence, among others and emergency services. These entities included everyone from the State Security Department, to the Federal Police (PF), to the Rio de Janeiro Fire Department, to the Brazilian Intelligence Agency (ABIN), to the Olympic Government Authority, among many others.
The COR is an initiative from Rio de Janeiro City Hall that integrates around 30 entities among municipal and state departments and private contractors. Besides its own surveillance cameras, Rio’s Operations Center monitoring system includes the ones installed by 400 contractors. For the Olympic Games, the system was supplemented with a mobile unit (UM-COR) provided by Cisco (one of the sponsors of the event), which was equipped with a high-definition camera. All images are available in a 65-square meter screen with 104 FullHD monitors. Developed by IBM, COR also integrates technology from companies like Cisco and Motorola.
In addition to the advanced camera-monitoring system, COR also processes data obtained from Google Maps, Twitter, and Waze to monitor the traffic conditions of the entire city.
So what happens to the data?
For government authorities, the promise of this major surveillance unit is that it will improve municipalities’ response to emergencies such as natural disasters or accidents, prevent crime, and make Rio de Janeiro a “smarter” city. However, while Rio continues to suffer from major traffic jams and floods, it is unclear whether there are meaningful privacy protections in place to limit the COR’s collection and retention of information.
For instance, the agreements the government has made with internet companies for sharing data have never been made public. Although public officials say that they only receive anonymized data and that they don’t have access to any personal information from the users of these platforms, several studies indicate that the proper de-identification of these data is an exceptionally difficult task.
To make the situation even more complicated, Brazil does not yet have a unified data protection act. Despite the existence of sparse sectoral norms guaranteeing some basic rights and principles, there is still a wide margin of discretion for data processors when dealing with citizens’ personal data. At the same time, while the use of street surveillance cameras increases each year — and significantly increased during the Olympic games — Brazil lacks proper legislation to regulate how images are protected and safeguarded after they are used.
Tracking you through your cell phone?
Brazil has a long history of abuse when it comes to surveillance of social movements and activists. The Inter-American Court of Human Rights condemned the country for its illegal use of wiretapping against land rights organizations in 2009, and during the recent 2013 demonstrations, police and intelligence forces were monitoring the social media accounts of people who participated in protests.
It is not surprising, then, that civil liberties groups have raised the alarm about how new surveillance technologies acquired for the mega-events hosted by Brazil will be used. Despite the complete lack of transparency on this, a recent report indicates that the Brazilian Armed Forces have access to Harris Corporation’s cell-site simulators, the Stingray.
Harris’ Stingray is the most popular version of a cell-site simulator, or “IMSI catcher,” which is a fake cell phone tower that can be used to track cell phones in a given geographic area. Some catchers are also able to intercept text messages and record cell phone conversations. By their nature, Stingrays are a tool for mass surveillance, impacting everyone within their area of operation.
The use of Stingrays and other IMSI catchers in the United States has been mired in controversy, largely due to the secrecy with which they are deployed and the lack of clarity about protections for privacy. Documents have surfaced showing that there has been a coordinated effort to cover up their use, with police departments even receiving instructions to lie about how evidence derived from Stingrays was uncovered. Only this year did the first court hold that a warrant was required before a Stingray could be deployed, though it’s not clear whether courts in other jurisdictions will follow the same procedures.
Olympic investment could pay long-term dividends — for the surveillance industry
If the 2016 Olympic games in Brazil are viewed as a “success,” it may hide an even greater success for the international surveillance industry. As part of its already dubious legacy, marred by police brutality in poor neighborhoods and the eviction of thousands of families, the Rio Olympics will leave in its wake a more-equipped police and Armed Forces and a completely monitored city, which may become a national standard. The lack of transparency and proper regulation for limiting the use of the newly acquired technology is a perfect recipe for more human rights abuses.
At the same time, while Brazil approved its landmark Civil Rights Framework for the Internet (the “Marco Civil”) in 2014, lawmakers have been working this year to undermine the bill’s protections and increase the authority to conduct surveillance while removing human rights safeguards. This would make these tools even easier to use in the future.
The Olympics will be held in Pyeong-Chang in 2018 and Tokyo in 2020, and these host cities should be wary of replicating the over-broad surveillance reach of their predecessors. If surveillance technologies are purchased and laws passed in anticipation of the games, they should come with human rights protections that put their use within the bounds of international law.