São Paulo Smart Sampa surveillance system faces investigation over data leak

A coalition of ten organizations, including Direitos na Rede, has petitioned Brazil’s National Data Protection Authority (ANPD) to investigate the Smart Sampa surveillance program. The petition follows reports that access credentials for the system were exposed in a public internet repository for approximately 11 months.

The security breach allegedly allowed unauthorized access to 181 user logins and passwords, potentially exposing sensitive data from 58,000 cameras. These cameras are located in public spaces, schools, daycare centers, and hospitals, potentially compromising the privacy of children, patients, and residents through the exposure of names, tax IDs (CPFs), and police reports.

In a related legal development, a court has ordered an independent technical audit of the system. Civil society groups, including the Laboratório de Políticas Públicas e Internet (Lapin) and the São Paulo Public Defender's Office, are seeking to annul the program's contract and bidding process, citing privacy risks associated with facial recognition technology. While the São Paulo municipal government and the Smart City SP Consortium challenged the appointment of the University of São Paulo’s Violence Studies Center (NEV) to conduct the audit, the magistrate upheld the necessity of the evaluation.