Latest / Computer Says Maybe / The Vaporstate: Brazil is Banking on Apps

Transcript

The Vaporstate: Brazil is Banking on Apps · Computer Says Maybe

• Astha: [00:00:00] DPS like a way of life. You just have to adopt it. Mila: Each person needs a unique id. Each land person needs a unique id. It's super easy. It's for free. Somebody else with her identity was opening telephone accounts. Beatriz: Oracle is in so many different government systems. Dan: You build an entire tech stack on big tech products, and then you put a union jack on the top of it, and you wave it intensely in the hope that nobody will look at what it's sitting on. Alix: This is Vapor State. A new series from us here at Computer says maybe welcome to episode two of the Vapor State. Uh, in this episode, we are headed to Brazil. We are first gonna hear about digital ID in Brazil. From someone who had a dramatic and informative experience with it. And then we're going to explore a totally different kind of government platform called Pix, which is a financial transaction system that the government set up. And boy, it changed Brazil and basically every transaction anyone in [00:01:00] Brazil makes. Any time of day, well, actually not any time of day, which we'll learn more about. It changed all of that overnight and uh, to wild results. Um, so we recommend, uh, to go back and listen to the first episode if you haven't, because it's a great grounding in digital ID systems in India, which is kind of where. A lot of this started. Um, so if you haven't listened to that one, please do. If you thought troubleshooting for your parents when they forget their apple ID password, which I don't know, not saying it's ever happened to me before. How about when hackers get access to their government id? So that's where we're gonna start in this episode. Here is Rafael Zanatta from Data Privacy Brazil, walking us through what happened when this happened to his mom. Rafa: I'm Rafael Zanatta . I'm one of the directors of Data Privacy Brazil. And I've been an activist in digital rights in the past, uh, 15 years. Worked in different MGOs and research organizations. Also, I'm a lawyer and I'm doing my postdoc research in the University of Sao [00:02:00] Paulo in the faculty of law. This was, uh, nine months ago, so this was early February. She called me really desperate and said, there's something horrible happened. I just realized that somebody called me from. A small city in the Northeast. It's a neighborhood of Rin, which is in the city of Natal, and this is like more than 3000 kilometers from her city, which is K Chiba. So if you go by cards more than two days, traveling, Brazil is pretty huge. And she told me that the manager of the Bank of Kodo, Brazil, which is the Bank of Brazil, it's a state enterprise, a public bank, was saying that there was an attempt to withdraw. Something like 80,000 US dollars from a bank account that she did not have, but it was in her name, and she was desperate because she got this telephone call saying that there was a bank account in her name. [00:03:00] Like a legitimate bank account, and there was one withdrawal of a thousand dollars and there was a second attempt to withdraw $80,000 from her bank account. She discovered that after some days of investigation and trying to get in touch with gov.pr, and so Gavi, which is another platform which is integrated with Gov PR because, so Gavi is a platform for the public servants. My mom is a professor at the Federal University, so she's a public servant for the union, for the Federation, so she discovered that. During her vacations, which this happened in January, so in January, all the Brazilians, they usually, they go to the beach, they stop working. January's the holiday for Brazilians February as well because we have Carnival, so January and February. It's a long period of vacations and they used like strategically this first weeks of January to break into her account. It was this insane [00:04:00] story in which a person in the northeast went to the. Like the local office of ENE ssi, which is a Social Security Department of Brazil, and the person based on the data of my mom probably was an internet thing in which they got her data from data lakes or people who sold information that she was a public servant. So probably there was this origin of organized crime selling. Data of public servants for this kind of targeted, uh, attack. But this person, based on this information, the person went to the office and said, well, my name is, you know the name of my mom I was born in this day. I'm from the city and I need a new password for my gov pr. So this all Alix: started after the initiation of a password reset for her primary digital ID issued by the Brazilian state. Rafa: Yeah, after the person got a new password to reset, the person was able to access some of the information that was [00:05:00] already in in gov pr and in Brazil you have like layers of access. So what the government says is that if you wanna have better services. Or if you wanna access all the public services, then you must have like a gold account, which is you must provide your biometric data and you must also allow the integration of some data from driver's licenses and bank accounts and so on. Because all the Brazilians are pushed to go from the silver to the gold layer, or you know, from the zero to the third level. Sounds Alix: like an airline like Miles. Yeah, yeah. Thing. Rafa: Yeah. Pre game gamification. Yeah. Approach in which, like you, you must go to the upper level. I think her account was already in gold, which means that it was already integrated with data from Thera, which is the. Driver's license department. So based on that information, the person was able to access the driver's license and the person [00:06:00] basically downloaded the driver's license, which is possible you can export A PDF of your driver's license. Based on that information, the person was able to print in like on a high quality figure or or image of the driver's license and went to the. Team store to open up a new telephone account, what we call prepaid, which is like a cheap telephone account in which you pay just like $2 and has some credit and you can start making calls. So based on this information of the new number, the person changed the telephone number in gov pr. So the criminal would be in the control of the two factor identification if there was like a SMS or a new message sent to the phone. He would go to the criminal's phone, which was the case because, you know, because the person was accessing from different ips, the system was trying to send messages to this new telephone, which was already in the system, which was in, in the possession of the criminal. So it was very clever in a way, and based on the telephone account, [00:07:00] like the official account in my mom's name, and also the driver's license, the criminals selected a woman. The age of my mom and kind of the same hair and the same physical structure, so to speak, in order to be like the closest to her. Alix: Like a doppelganger. Rafa: Yeah. And then this person was the one sent by the group to set up the bank account in Natal. So that person went to the bank to Brazil and presented as my mom and said. I am this person. I want to open a new bank account. I moved here and so on. I have this new telephone account, this new address. There was a major flaw in the bank because the bank basically authorized a new bank account. Based on those fake documents, and this was one of the biggest mistakes that we could perceive in this whole chain of events. After the person was able to set up this new bank account, they made like an interopability between Gov VR and so [00:08:00] Gavi. And here comes the interesting part because one of the approaches of Lula and the Workers party to boost the economy is to provide easy access to credit to public servants. Because public servants are stable. So they're trying to boost the economy with those easy ways to access credits for the public servants. And they made a system in which it's ridiculously easy to get this new form of credit, which we called impressed, which means you instantly make it and then they will withdraw from your bank account in the following months for like five years. Alix: So it's like an advance. Rafa: Yeah. On your, yeah. Yeah. And the idea is that public servants, they can build houses and if they are building houses, they will hire workers and the construction sector and they will buy sofas and, you know, paint their houses and Alix: they're likely to repay it back because their employer is the government who is not gonna not, yeah, basically. Yeah. Okay. Yeah. [00:09:00] Rafa: So that was a scam. You know, they wanted to reach Sogo and make this loan. In a very high amount, which was the highest allowed for the government, uh, more than 360,000 Hays, which is something like 80 to 85,000, uh, US dollars. They attempted to withdraw everything in the second time they went to the bank. So in the first time, they went to the bank and said, I just wanna withdraw like a small installment of a thousand dollars, and they approve it. And I suppose they did that because they wanted to have like a track record. Withdrawals in the city. Alix: Yeah. So you have like a history of Rafa: financial activity in the place where you're Yeah. Yeah. And then in the second one, 'cause it was a big amount, a huge amount and, and they needed to handle the money to this person. The bank account manager was kind of suspicious and he started paying attention and the way the person was speaking and he realized that the way the person [00:10:00] spoke, the accent that the person had was a local accent from Natal. And my mom is from the state of Para nine, the south, so we have a different accent. So he was suspicious and, and he went to the Google and typed the name of my mom and the place she worked, and he found some videos of classes that she was given online. And then he was like, oh, oh, this is not the person. And then. He refused the withdraw and he tried to call the police, but the woman went away. She was very smart and she ran away. They never cut them, the whole group, and here comes like the really sad part of it because we were in a very privileged position, so to speak, because I'm an activist of data protection and I've been working in this field for 15 years. I know the people of the government and I was able to send them messages saying, this is really serious. What should we do? What is the correct point of communication? Is there like a data protection officer or a security officer? We should get in touch, but. The [00:11:00] scarcity of information is pretty big. So for somebody else to try to do something, it's almost impossible. You know, the person feels paralyzed and my mom felt paralyzed and she felt she was in this like nightmare without any kind of solution. Was almost like a Franz Kafka novel in which there were so many. Blockage and, and no goals and no responses. Basically they were just telling her that, you know, somebody else with her identity was doing all those stuff, you know, opening telephone accounts, opening bank accounts, and then we had like a nightmare to convince the bank that they needed to cancel the accounts and not continue with the withdrawal 'cause they were saying that the account was legit and so on and so on. So after a week of fighting and writing petitions, they canceled and we wanted to sue the federal government. So we wanted to file a civic action or a popular action to sue the Brazilian government for those mistakes because we think that the harm that she had, which was pretty [00:12:00] intense, I mean, she, she did not sleep for five days and she almost went mad. She was really disturbed, and she told me that she felt a new kind of harm that she never felt before. Which you describe it something as existential harm, which is you are into something so crazy that you doubt that this is reality and you doubt about yourself because they're using all your information and actually you don't belong to yourself anymore in a way. So there was this double ger, as you said, or this, this double of yourself, which is pretty insane. And the lack of control about it, she felt like. A harm. A very strong harm. So we tried to get in touch with some public interest lawyers and do a litigation against the government, but they were saying that courts did not buy this kind of argument. And judges are really conservative. They only care about financial concrete harm. And if we were going to take this case [00:13:00] about the government, probably we were gonna lose 'cause they would not recognize this new category of existential harm. Or social harm. So we did not file the action as we wanted some months ago. Alix: It's so wild that a series of digital mistakes or like vulnerabilities in a digital system were basically only prevented from becoming a much bigger problem by human instinct. Like I love the idea that it was a person being like, this accent doesn't sound Yeah, yeah, yeah. Right. Was not, it was not an automated system. And also as you said, like the odds were stacked against her. Like once all of this was set into motion, it feels like the most obvious outcome is that your mom is fighting not just an open bank account and a thousand US dollars of loss, but a hundred thousand or $80,000 of loss, and having to explain why she doesn't owe that money to this. Bank and I feel like most other people wouldn't have been, I don't wanna say lucky 'cause it still sounds like it was a really horrible experience. [00:14:00] So does she like, I don't know, like do we, do we know like how common is this now? Do we have a sense? Rafa: I think when this happened in February, I think this was this peak of similar cases regarding public servants and they set up like a crisis committee inside and gov vr. To deal with those cases because they were like starting to appear like dozens of them. And I know they changed the structures of so gov and gov vr. Do Alix: you wanna describe, like when did gov br become a thing? Was it around the time data privacy? Brazil started as an organization? Rafa: Uh, yeah. It was launched in this period. I think the design of Gov PR comes from early, I think the first attempt to set up a national civic registration system that is the backbone of Gov PR started in 2007 with Lula, and this is something that really bothered Democrats since the Constitution of 1988, which [00:15:00] is we gotta overcome the system and set up a unified system in which. A single Brazilian can be identified as a citizen in the whole country. The problem was that the government was never able to build a solid and robust database of citizens. The things that really changed stuff between 2014 and 18 was the reforms on the electoral system, because the electoral court went through a huge process of transformation and they introduced biometrics. First started as voluntary and then became mandatory, and a citizen in Brazil must, in order to vote, must be registered with the electoral superior court and you must provide your picture. And they take a picture of you, of your fingerprints and so on. The revolution of gov dot vr started when the federal government was able to do a partnership with the electoral court to use the data of [00:16:00] elections. To do authentication of the citizens. So this is when the draft VR really launches and begin to be something almost as if a foundational id. I think it is not in the concept of the World Bank. If you see the documents of the World Bank and the way they describe foundational digital ideas, I wouldn't describe. Go PR as a foundational digital IDs in a way, but it's closely related to, because in practical terms now it became, it really became the foundational ID system. It did not start it like this. It started as a pilot in a way, to organize some of the public services. And then year after year, they started integrating different databases into kado vr. And using the power of law to also define that Gov VR should be the [00:17:00] default system when you're using some public services. And of course when the pandemics came, they had a huge incentive to speed it up. Gov VR, because you needed an online platform, should access public service. And I think it's only getting bigger now. They, they reached almost 165 million of Brazilian users. I think adults who are able to vote is 180 media, and I almost complete because Gov PR also uses your social security number as the main number of identification. The helpful thing was that every Brazilian that is born already has a social security number, so it's a number that you already have. You must not ner a new ID to use Gov vr. And I think the strategy of the government was to offer you easy ways to solve things. So for instance, if you wanna update your driver's [00:18:00] license, you can go directly there, or if you wanna download a certificate that you took, the vaccines of COVID, it's there. The government also announced a National Alliance against Fraud in early this year. So they were trying to coordinate also with telephone companies, bank accounts, banking companies, and so on. 'cause. One of the problems is, as you said, criminals are really clever to explore small vulnerabilities and to build a chain of events that will lead to the scam, and it's very hard to point like a single entity, which is fully responsible for what happened. So there is this distribution of the liability, so to speak, many small mistakes, which is also hard in terms of executing a public policy that can deal with that. 'cause in a way you need to coordinate so many gaps and so many vulnerabilities, which is, I guess that's, that's what's going on. But what we see also in Brazil is that there [00:19:00] is like a tremendous amount of scams, which are not like this one, but it's based on the illegal access of personal data. And we are seeing that. Criminals are trying to explore digital public infrastructure to do these kind of activities, not only using peaks and golf vr, but this week in Brazil we just got a tremendous case of a surveillance system which tracks all the cars in the country. So it's called Alta Brazil, which is integrated with Cartex, which is a fed system of surveillance by the federal police, which theoretically only police officers must access if they are investigating one crime. And then they can search for your, your CPF, your social security number. And then the platform will show you all the information about, you know, which cars you have, where you've been traveling, if you took a federal road, if you have bank accounts, if you voted, has more than 160 databases integrated into this one. And it was discovered that, you know, police [00:20:00] officers in hill, in Hi Janero, they had a vulnerability and organized crime, was using cortex. To access information about people they wanted to target in order to do scams, you know, so, Alix: so organized crime was using real time surveillance data from the Brazilian state because they accessed it via vulnerability in systems. Rafa: Yeah. Alix: That's wild. Rafa: It is, Alix: and I feel like because you know this now, that means that the government knows what does the government. Have they done anything? Rafa: We've been investigating Cortex in data privacy, Brazil in the past four years and three years ago we sent a petition to the federal prosecutor's office saying that there was evidence from journalists that worked with us like IO and other. Investigative journalists that heard stories of criminal activity going on inside Cortex, and they were 'cause of the lack of like logout sessions and other architectural fixtures that allowed those vulnerabilities to occur. We asked [00:21:00] the federal prosecutor's office to get a, a judicial order to stop Car Tex and do like a civic auditing, uh, with the technical community, but they. Simply ignored us and they told us that everything was fine and the federal government said that they were already audited by the ology counters, which is the accountability office in Brazil. And last year we also participated in this campaign asking Cortex to be stopped once again because there was this story about, in real part of the militia and criminals were using access from police officers to, you know, use. They were not only using, but they were selling the access on telegram groups. A journalist that worked with us bought the access and tried and it worked. So if you type my CPF, you could get all the information about myself and also if I have a car, if I went to the beach, which time, which road, and so on and so on. So. For organized crime, this is tremendous because they can, you know, do so many, uh, not only mafia activities, but also they [00:22:00] can do social engineering camps. Like for instance, if you know your daughter got to her car and traveled to the beach and she's without the cell phone signal, you can simply call the person and say, there is a robbery, or she was kidnapped and asked for money and because the architecture of the information will make you believe. So we were saying, this is absurd. We, we should not allow. And November 20 uh, one, there was this new report by the federal police saying that they discovered that yes, there are problems and yes. Police officers in real, were using CAR Tex illegally and they used random CPF numbers of Brazilians to log in because of the mandatory login session that you must provide a CPF in order to access the system. They used 67 million sepe. Randomly distributed. So what the organized crime did was that they automated like a robot, [00:23:00] like a prompt or a machine to randomly change the CPF of the user session. Every like one day and or I don't know. Two hours and 67 million people in Brazil citizens are registered as users of Cortex. Alix: No way. So they were cycling through random user IDs of normal everyday people who had no idea they were to be the infiltrators of because Rafa: they wanted to cover up who was the real user. Alix: We're gonna hear more from Rafa later, but for now, I wanna take us to Luã Cruz. Who's gonna explain picks? Lua: My name is Luã Cruz. I work at the Brazilian Institute for Concern Protection ec. I'm a lawyer and I coordinate the digital rights and telecommunications team and. I'm also, I was born and raised in the Amazon region. Pix is a instant payment system. It [00:24:00] was created before the DPI agenda model came to life like strongly after India and 20 instant payment system so you can transfer money to your account to another account really fast, really easy, and for free. It started in November, 2020. So we in Brazil started to discover about ps like starting to find out about it. Mainly during this year, like during 2020, especially because of the pandemics. Like people are not, were not exchanging money anymore, and there was this new feature or this new technology that was coming, it was being developed, so it was. On the public radar and I'm from additional rights background, so I wasn't so aware of like financial services [00:25:00] or payment systems. So I had read something about it but was not so into it. But it went live on 2020 and the discussions in Brazil starting to to show up not only because of. The PS launch, but also because WhatsApp pay was about to be launched in Brazil. Alix: Before you get into WhatsApp, can you, can you like describe, like when did you first find out about it? Was it like there was like a news report or like someone was like, Hey, have you seen this new thing? Or like what, how, when did you actually first encounter it? Lua: It was mainly through banks advertisement. So they hired these huge celebrities, former reality show members to say, Hey, Pix is coming, and you have to find out about it. You have to find about it. Not only that, because when you register in PS, you have to register, for instance, your social security number or your email. Or [00:26:00] your cell phone number. It's like your ID on the pick system. So if someone wants to send you any amount, they ask for your Brazil call. Pick key. What's your key? And then your key could be like your phone number, your email address, your social security number. So what the banks were trying. To raise awareness was register your pick key, like your social security number or your cell phone in our bank. So that's where it became like well known. There was this kind of system where you should register and there was this run. The banks running for you to register. You mostly know identifications points, you know, because if you. Register, for instance, your phone number, it's super easy to say your phone number and if you attach your phone number to a specific bank account from a specific bank, this bank will lead more [00:27:00] transfers to, to its own system, paying tariffs or having new customers and so on. So there was this running and there was like kind of prizes, you know, so if you register your tech key in our bank, you, you be part of this. Lottery prize award, you know, so this was the first time that I see I, I had heard about it, but I wasn't aware of what was it. But with this mass media campaign from banks trying to convince people to register their main ID points on their banks was the first time they heard of, so PS was a main driver for people to create their own banking accounts because. Most of the people in Brazil, before PS, they didn't have a bank account and with the pandemics, people needed to transfer money without like physical, uh, interaction. So it, it was mainly that. Alix: So banks do this big push and they [00:28:00] say, if you are willing to set up a bank account, there's this cool new transaction technology that'll allow you to send money really quickly, freely. And is it like an overnight success or is there like a November, 2020 kind of slow trickle and then like how, how did, how did it go? Lua: It was a huge success. People starting to use it in a daily basis. I don't think even the banks was aware of that. You know, they didn't thought that it was gonna be such a hit at some point. There was also this kind of instability on the system. Because there were so much transactions and they wasn't prepared for like a little Black Friday or Christmas or you know, these kind of huge events when people buys a lot of stuff and transfer a lot of money in four years, like it was the main payment system in Brazil, more than credit cards or debit cards or checks. It's bigger than. All of that combined, like just in four years. So it was really a [00:29:00] huge success. Before PIX was launched, WhatsApp pay was about to be launched in Brazil also, and WhatsApp. It's a huge thing in Brazil especially because all the mobile plans are zero rated, so you don't use your cap to, to access WhatsApp and other meta apps. So everybody has a WhatsApp account in Brazil. Even the executives from WhatsApp says that Brazil is the country that uses the most WhatsApp features, for instance, audio message and all other features. But the central bank and the Brazilian government was developing this instant payment system, the peak one, and they said, well, if the WhatsApp pay, if, if it's launched before our system. I think we could have a problem like of people going through WhatsApp pay and not using peaks. Alix: So it's like Greenfield. Whoever comes first is gonna [00:30:00] capture the market share of this. And then if that is meta WhatsApp first, then the government alternative is gonna be like the dorky government alternative to like the slick cool. Like whatever thing. Yeah. Okay. So then what happened? Lua: The competition authority started an investigation. And said to WhatsApp and Mattan said, Hey, you are under investigation and you can only launch your feature after our investigation. It's done. And then was like, stop right there. Then let me launch picks. And picks was a like a success as I was talking. And then I said, no, now you can launch it. We analyze here, everything's good, you can go. Alix: Okay. So the presumption is that the government knew it could use its legal power to stop the rollout of the WhatsApp option, and then by time using this legal. Argument that maybe wasn't about [00:31:00] actually the legal argument. Jump in with picks. Everyone starts using picks and then WhatsApp, they're like, yeah, sure. Come on. We've already captured the entire market, but like, good luck. Yeah. Okay. Okay. Do we know if there were a negoti? I assume there were negotiations between Meta and the government who was president at the time. Lua: It was Bolsonaro. They were really convincing that this is gonna be huge and it comes way before Bolsonaro. You know, this is a discussion that have been happening in the central banks since the 2012, and there's another stuff, well, big techs are really powerful, but banks are also really powerful. It was mainly a clash between financial system. The big tax and the financial system basically won. They were de developing with the central bank, all these features, and they were discussing that for like 80 years. It was that like the financial system was stronger and they are really more well related to, to the government and to officials way more than the big tech.[00:32:00] This is changing in the last five years, you know. But banks are too powerful, you know, in the capitalist society. So, Alix: yeah. Um, that's so interesting. I hadn't really thought, I thought of it as government v big tech, but it's interesting to think of it as financial institutions lobbying government to protect them. 'cause they have, they have power. Okay. So they prevent what? Hey, from getting that early leader position, but then did WhatsApp roll out anyway after picks? Lua: Yeah, and it was a failure. Yeah. Okay. No one use it. Alix: Okay. So now like there's so many different like political battles happening here. One is the like American company versus the rest of the world. Another is like. Big tech versus big banks. Another is like government, v, government, another is like people versus financial institutions. Like after the defeat of meta, then the question I think [00:33:00] becomes okay, so you have this dominant system that like takes over all transactions. That obviously introduces other. Issues that like draw your attention maybe more now that Big tech has been defeated. So then when pick started catching on so much, what did you start seeing or noticing or worrying about? Lua: So there was like the good side and the bad side. It was like super easy, super nice, super cool and there was no fees. So it was like instant. Just for you to understand like before peaks you have to pay for transfers. And it was not an instant system, so I have to wait until the next day, or if you wanted to send the money in the current day, you have to transfer until 6:00 PM and you have to pay an extra fee. So it was horrible. Even if it was like, I don't know, $5, it was an amount, like five. No one wants [00:34:00] to like lose $5 each time they make a transfer. Specifically if feel like it's an urgent one. So people in Brazil love speaks because of that. Because it's super easy. It's for free, it's instant, it works, you know, it doesn't take like a minute to arrive at the other account and it's super reliable, you know, on that matter, like on the technical side of function. But as I was saying, Brazil had a, it still has, but it, it had at that time a really high rate of street crimes, you know, robbery and so on. And everybody went like as everything in the pandemics, the scammers, and all the criminals. And fraudsters went online also and saw peaks as an opportunity and different, for instance, for credit card systems when you can have like refunds when you make, [00:35:00] like when you got into a scam, there was nothing like that in picks. If you transfer the money, it's gone and that's it. There is nothing you can do about it and the amount of money. That was being lost in these transfers, like through scams because it's so easy. And that's the problem of like the frictionless discourse. Like, wow, it's so easy. You don't have friction, that's the problem. Right? Once it's gone, it's gone. So we started choosing as a cons. I, I work at the customer NGO. So we started to see like this ray of P scams. And there was no way to get the money back. And just one year after Peaks was launched, like in 2021, they created this new teacher when you could flag a transfer and then the bank could start to roll out an investigation. You could freeze the account of the Peaks receiver of the [00:36:00] scammer, and then they could do some analysis and give your money back. But like it was just like one year after Peaks was launched. So. It was not like, uh, as we say, so privacy by design or consumer rights by design. They just like discovered that one year after, and it was like, man, Brazil's a paradise for fraudsters, for instance, like just in the last year, 2024, it was like $6 billion in P scams. Alix: All right, so we've got this. Quasi-public, uh, payment processing that has unified digital payments and has made it easier for people to transact digitally. How does this connect with like, the broader agenda of Lula? Because obviously you've got like a progressive government now that isn't like overtly pro capitalist, let's maximize the number of private transaction happening as a proxy for wellbeing in an economy. [00:37:00] Um, like how, how does it, like what, what do they think as an administration about picks and how have they engaged with it Lua: after five years of existence? Picks is a national symbol, you know? Like people have not only use it a lot and have trust on it, but also we, the Brazilian people, the Brazilian government created this kind of magnificent system. You know that everybody loves it. You have like, there is a lot of memes. For instance, there is this really good meme of Dexter's lab and there is a picture of Dexter showing like an under top, like all the. New stuff, new technologies, and you have a many in Brazil where they put the peak system. We have, uh, electronic voting system. Also, we have a public, uh, health system. So all the good things that we have in the US doesn't, so it's like a national pride stuff. We [00:38:00] have a good payment system, we have a good health system, we have a good voting system, so it's kind of. National pride, you know, and the government really uses this kind of thing saying, well, this is what happens when you put someone in charge that cares for sovereignty, national industrial policies, and. National science development and technology development, you know, and although Peaks been launching during the Bolsonaro government was really a gift from Destiny, you know, for him. And people started to ask questions and there was these journalists asking Sana, Hey, what do you think about Peaks? And Bona started, starts to talk about planes and like. Other stuff because he didn't know what was peaks at that time, you know? So people don't see Brazil, people don't see like peaks as ARI things. They, they see it [00:39:00] as a thing that started in a left government and it was developed and now we have it. And when Trump is starting to put the tariffs and saying that the national policies in Brazil. We're undermining like US companies. It was like the really, the call for Lula to, to put out these arguments and put it out strongly, you know, because this time was not only big tax was also Visa, MasterCard, because that's it. In the beginning it was WhatsApp and Matter going against PS or trying to compete with Ps. But what happened, and as I mentioned to you. Peaks use, like went like skyrocketed and people stopped using credit cards or debit cards and Visa, MasterCard was like going crazy and they couldn't do anything about it because as I mentioned, it was a [00:40:00] success. And now they don't know what to do. They, they lost it. Rafa: In the case of picks the government. Responded to some of the critiques that were made by e DAC and other consumer protection organizations that were identifying many potential harms in the way PS was operating. So for instance, what was happening in PS was that you could do any kind of transaction 24 hours per day. And criminals, they were specialized in like robbing people's cell phones like 1:00 AM when somebody was. Getting the Uber after a party when the cell phone was open and probably the bank account was also open because the person recently paid something. So they were robbing people in bars in, you know, just after somebody paid something so they could try to do another picks right [00:41:00] after, or they were kidnapping people. So people, you know, if, if somebody comes to you and say, do Apics right now, otherwise I will kill you, transfer everything you have. It was the kind of stuff that was happening. There were some even bizarre cases of people who got killed and. They use the person's face to do like the picks during the, the nights Brazil can happen. Some really serious stuff in terms of violence and what the government said was, okay, um, we need to introduce some friction after 9:00 PM. There is a limitation of how much you can transfer. It's impossible to transfer high amounts. You must wait for the other day. And this is good because you know, if it's a system that is for everybody, then the criminals will know and they will not kill you basically, because they will know you're not lying. If you're saying, Hey man, I cannot transfer this amount for you. It's blocked you. If they believe you're lying, you can get killed in some violent cities in Brazil. So that's the problem, you know, so they [00:42:00] introduce that kind of friction to reduce, uh, the amount and, and the volume of transfers. I think you can only do that if you have a biometric identification and some kind of signaling through WhatsApp. So you must do two things to increase the amount. But anyway, it's not unlimited. This was something that they did, but based on the pressure by civil society and you know, consumer protection organizations, 'cause for them it was. Flowing really nice and, and, and, and for them, it's like if you present a problem like this, some technicians from the central back, they'll say, oh, this is a problem for the police. It's not our problem. So they have difficulties in recognizing that is a problem that they created because they think that their only goal is to make it functional. To make it work. You know, this is the part. The problem of the technocratic ideology behind those uh, bureaucracies. I think because of social solidarity and the values of our constitution, we should protect a 75 year person who lost everything [00:43:00] in a fraud like this. At least the person should got it back like $15,000. And this should be distributed by the big players in society. Banks in Brazil are profiting billions of dollars. It's not a problem for them at all. They have a lot of tax incentives, so I think part of the solution is about. Tax reform and distribution to somehow support those victims. This is one pillar, and the second pillar is to adopt this more preventive approach and slow down and introduce frictions which are posed by society when they want to introduce frictions in those systems in order to avoid this maximum that you know what only matters is efficiency. And I think This's gonna be, uh, Alex in my opinion, this is gonna be a really long conversation, like a 10 years conversation, because in order to change the proxies and the indicators of success for policymakers, there's a lot of work to be done. 'cause as I said, right now, they're just using the OECD standards, which is, you know, how many people you included, how many people [00:44:00] are using your digital service, what is the increase of speed and velocity that you have in your, in your delivery of the service. So the metrics in a way, are purely, uh, efficiency ones. What we've been investigating in the past five years in data privacy, Brazil, is that they do not use a more preventive approach or a precautionary approach on those projects. So. They believe everything's gonna be fine, and there is not enough time to study the affordances of those technologies and the unintended consequences and also some of the chilling effects that might occur. So what is going on is that they're just using a quantitative approach to describe success in terms of numbers. So basically if you see the press releases from Brazilian governments, they're just claiming, let's celebrate because we have 160 million users of golf vr. You know? Or let's celebrate because we have 200,000 millions users of picks.[00:45:00] And Pix is the greatest digital public infrastructure for online payments that Brazil invented, and so on and so on. So there is a celebratory approach, which is very mixed with this quantitative analysis of celebrating the number of users. The success is the number of users, basically. And what we're saying is that, wait, wait, wait. Hold your horses, because now we are starting to see emergent problems. Which are different from the ones that we had suspicious four years ago, because four years ago we were afraid of the exclusions of vulnerable groups such as the elderly or transgender community and others who would have problems in the way that the state classifies the citizen and uses the biometric information to recognize that somebody exists. And I think they were able to say, yeah, we have. Been dealing with that. And we recognize that the social [00:46:00] name can be used so this transgender community can be safe because it's not gonna be a problem for them. And we also have tests of accuracy to say that the elderly people would not be affected by the technology, but now we're seeing something different, which is okay, this is not the kind of harm that is going on in Brazil, actually. So the kind of harm is a different one. I think it's this diffuse harm of France. And this harm of organized crime, taking advantage and hacking the whole infrastructure for their own benefit. And also a, a third kind of harm, which is there might be huge corporations pressuring the state to advance that in fast pace because they want to provide solutions and be integrated in this business model in a way that they can, they can set up the prices as high as they can and they can just, you know, rip it off. Citizens' money because basically it's citizens paying taxes to support this enterprise. And I think the, the conversation is now moving to this more. Critical approach, which is problems of the [00:47:00] state and corporations relationship and frauds and those unintended consequences which might turn against us because in terms of organized crime in real, this is really serious. If you have such a system, which has great capacity for communication with citizens, it's really fast. It's really integrated with surveillance data. If this goes to the wrong hands. It's a weapon. Alix: So some of the ambitions of gov br have come to pass. Like it does make life easier. It makes it easier to do more things administratively and it like saves you ti There are benefits. Rafa: Yeah, for sure. Because you know the problems that, for instance, gov VR does not have any kind of participatory approach on understanding qualitative data of what is going on. They don't have like a civic council in which citizens can present cases in which something is going wrong. They don't have a unit dedicated to preventive approaches and. Trying to understand and map emerging problems or emerging trends. So they don't have, like, the [00:48:00] state capacity for a preventive approach is completely missing. And also in terms of participatory approach is also completely missing. Gov PR does not have, uh, institutional structures in which citizens can be represented and say, this is working for me. This is good. This is not working. I'm being harmed. So. It's pretty weird because Brazil has a tradition of participatory rights since 1988 and the end of dictatorship. But when you introduce something as a public policy, which is somehow disguised as technology, then. They just abandon, you know, the democratic approaches. That that's, that's my problem with it, because they say it's a technological program. You know, it's, it's, it's something provided by technology. It's not a public policy anymore. And I think it's a completely flawed argument. It is a public policy. I mean, technology generates the architecture and the affordances. In order for it to [00:49:00] exist, but it's purely a public policy that should be democratic and I think gov we, in a way, it's still undemocratic in terms of the way it is being executed and the inputs from society upon it. That's my bane critique. Lua: When we were discussing, when Trump put the tariffs in Brazil and said it was because for another several reasons, one of that was fixed because it was competing against Visa, MasterCard. It was also an open door for Meta who was like suffering like from five years ago, saying, Hey, we lost that battle five years ago. And they come back saying, Hey, yeah, this big stink is also awful. You know? Go side to side with Trump and Visa, MasterCard. So they took advantage of the situation to come back and complain about what they lost five years ago. That's the [00:50:00] thing. There's another thing, uh, with a case that we had. When you do a peaks transfer, you can send a message, you know, and this is also a problem in Brazil for several reasons. The main one is former boyfriend. And a lot of harassment of guys who are not that good as most of them are. But it is like, Hey, can you come back? Hey, I still love you. Alix: You're blocked on all their messaging. Um, but not picks because no one can block picks. So you're getting, you can, you can, okay, Lua: now you can, after that you can like, you can say, I don't wanna receive more transfer from this account. But it was only after that. Alix: I feel like you also told me once about, um, that messaging field being used for advertising. Lua: Burger King did that last year and they had like this database of emails and phone numbers, which are peak skis. You know, they [00:51:00] run a code with a, a company. Trying to match. If the database of emails and phone numbers that they had was related to a PS account. Once it got the match, they sent 1 cent with a message saying, Hey, here's a 1 cent for you helping you buy a Burger King nugget. Alix: It's pretty smart. It's like advertise. You're paying for advertising. Yeah, but like am I? Is it illegal? Lua: We don't think so. Alix: Do you think it should be? Lua: Yes. Because you, first of all, consent as I was discussing, like with the guy saying messages, it's the same if people, well, I didn't consent to that to receive like messages on my banking map. Like you can send to my mail to, I don't know, SMS, but to my banking map, there's also next year have elections. Imagine like, and in Brazil, everyone knows. Like all the data, all the emails addresses, all the phone numbers [00:52:00] are already leaked. They are already leaked. So imagine if someone goes to buy a list of email addresses and starting to send election messages for 1 cent because it's the small amount that you can send. So there's a lot of problems regarding this kind of innovative ways of using pigs Alix: innovation. One person's innovation is another person's really irritating, uh, marketing experience. Next up is episode three of The Vapor State, and this time we're talking to Daniel Howden and Beatrice Ramo de Silva. Two journalists that work with Lighthouse Reports. And they have spent the last year or so doing really interesting investigative journalism into the Tony Blair Institute and its relationships with Larry Ellison, uh, the guy who owns Oracle and the UK government. And it is a very meaty trio. So next week we're gonna be turning more towards big tech and how these tech billionaires are trying to get their claws into government infrastructure because it is. Pretty [00:53:00] sweet once you get in there and Daniel uses a term land and expand that. We'll talk more about next week. I hope you have a great weekend this weekend. I am traveling to Utah of all places, um, to go to Sundance, where I'll be moderating a panel with filmmakers who are responsible for two new documentaries on ai. And we are gonna have more to say on that soon. Um, but thank you to Rafa Annetta and Luann Cruz, and to the editors and producers of this episode, Georgia Iacovou and Sarah Myles. Uh, who, you know, edit it all and we will see you next [00:54:00] week.