In order to visualize the changes, we elaborated a timeline bringing together the changes in the legal-institutional system that allows surveillance practices and that have been approved in the space of time referring to the series of mega-events. The timeline makes evident an intensification of this institutional framework.

In addition to the Criminal Code and Criminal Procedure Code, even before the announcement of the mega-events, this was basicaly the legal-institutional framework that enabled surveillance practices in the country.

But in a few years, the complexity of the system is clearly noticed in the image below.

The table below also summarizes which agents have competence for surveillance and information control practices in accordance with current legislation, and also demonstrates some expansion of its powers, due to, for example, the Anatel Decree of 2016, which allows use of signal blockers in Law and Order Assurance operations (GLO) and even determinations of the Marco Civil da Internet (Internet Bill of Rights – 2014).

Legal changes related to the investigation process were also implemented, and based on this we would like to outline the changes in the Criminal Organizations Law, approval of the Anti-Terrorism Law, outline the Law and Order Assurance Operations, as well as the approval of laws that enable digital investigation (such as the storage of logs in the Marco Civil da Internet, the approval of the cybercrime law, and the law that addresses the infiltration of agents in the digital realm).

But in addition to the change in the jurisdiction of these bodies, we observe that new institutions have also been created to support the public security of these mega-events. Observing the infographics sessions that only concerns the institutional provisions, we would like to highlight the creation of the Special Secretariat Security for Major Events (SESGE/MJ), the construction and implementation of the Integrated Command and Control Centers (CICC) and the National Integrated Command and Control System (SICC), the creation of CDCiber.

Emphasis on the new institutions created quickly after the announcement of the World Cup and the Olympics

Next, we will outline how some of these changes contributed to the expansion of the scope of the surveillance system in the country.

SESGE/MJ

Most of the institutional changes are related to a major integration of databases of the several security organs. In this sense, considering the experience obtained during the Confederations Cup in 2013 and the World Youth Day, with the intent to coordinate Public Safety actions during the World Cup and Olympic Games in 2011, the Special Secretariat Security for Major Events (SESGE/MJ) was created under the responsibility of the Ministry of Justice. Amongst the actions of this body, we can highlight the drafting of legislative proposals in conjunction with the Secretariat for Legislative Affairs; the promotion of integration and equipment upgrade for the Public Security, Defense, Intelligence, Civil Defense and traffic management bodies; and being an actions interface in the area including in liaison with entities overseas. Under the auspices of the SESGE, several cooperation agreements were conducted for the training and expertise development of agents. In addition to this, according to the assessment of the Agência Pública, who was given a SESGE list on training done through international cooperation, the "FBI and other US agencies have trained 837 police from the 12 host cities in several courses, which also include digital investigation and media relations."

SICC

In order to assist SESGE's assignments, in 2012, the National Integrated Command and Control System (SICC) was created, integrating the entire government system apparatus focused on Public Security and Civil Defense. According to Ordinance No. 88, of March 26, 2014 which structures the SICC in view ofbased on the World Cup, the system comprises the following centers:

• A National Integrated Command and Control Center, located in Brasilia. This is the strategic center of public security and civil defense actions, which oversees and supports the actions of the host cities and maintains up-to-date information that can be used by the Federal Government;

• An Integrated National Command and Control Center - CICCNA: located in Rio de Janeiro

• A Center for International Police Cooperation, located in Brasilia;

• Twelve Integrated Regional Command and Control Centers - CICCR;

• Twenty-seven Centers of Mobile Integrated Command and Control— CICCM;

• Twelve Integrated Command and Local Control Centers -  CICCL

• Twenty-two High Observation Platforms— POE

Centers created to comprise the Integrated Command and Control System

This complexification of the system resulted in more data exchange between several public and private agents that became part of the Integrated Command and Control Centers.

Never before in the country had a system been built which integrated so many public agencies, without any privacy considerations regarding the flow of data between all of the public and private institutions that constituted this Command and Control System. And the cost was high, according to an investigation by Agência Pública. The highest expense of the Special Secretariat Security for Major Events (SESGE/MJ) was with the implementation of the CICCs, for a total of R$637 million. The most expensive of which, in Rio de Janeiro, cost 64,1 million. Another great expense for the SESGE, of R$97 million, went toward the Integrated Centers for Mobile Command and Control (CICCMs).

Law of Criminal Organizations

Regarding the creation of laws, it is worth noting the approval of the new law of criminal organizations (Law no. 12,850, of August 2, 2013). The Law, which amends the Criminal Code and repeals Law 9,034/95, establishes the concept of a criminal organization and provides for criminal investigation and the means of achievement of evidence. Even though its approval is not directly associated to the mega-events, it has been implemented during the major demonstrations that took place in 2013, and is now one of the most powerful instruments for surveillance and criminalization of social movements, activist groups and political dissidents.

The Law provides for a number of monitoring and intelligence mechanisms as a means of evidence achievement that even within the scope of legislation, are unsettling. The mechanisms are as follows: plea bargaining; environmental collection of electromagnetic, optical or acoustic signals; controlled action; access to records of telephone and telematic calls, registration data contained in public or private databases and to electoral or commercial information; interception of telephone and telematic communications, in accordance with specific legislation; breach of financial, banking and fiscal secrecy, in accordance with specific legislation; infiltration, by the police, in investigation activities; cooperation between federal, district, state and municipal institutions and agencies for the perusal of evidence and information of interest to the investigation or criminal investigation.

In addition to this, in 2015, Law 13097 was approved to amend the Law on Criminal Organizations and Article 158 exempts the need for a bidding in the case of "hiring specialized technical services, acquiring or leasing equipment for the judiciary police for tracing and achievement of evidence "to be obtained by means of" environmental capture of electromagnetic, optical or acoustic signals"; and the "interception of telephone and telematic communications", as long as there is a justified need to maintain secrecy about the investigative capacity. The Law also provides for the waiver of the publication of the summary of hirings in the official press and the amendment of bidding waiver. Therefore, it is even more difficult to control this kind of expense which is perceptibly less transparent.

Apparently, the inclusion of this article enabled the sale of malware from the Italian surveillance company Hacking Team to the Federal Police. According to the company's e-mails, which were leaked in 2015, negotiations with the Federal Police only moved forwards after the legislation changes.

Antiterrorism law

Another law that raises some concern is the Law No. 13,260 which is used to criminalize social movements and indicate cases of terrorism. Sanctioned in March 2016, the passing of this law took place in a context of a lot of international pressure, with the support of the G20 and, unofficially, according to El País, the International Olympic Committee, demanded the compliance with an agreement signed with the Financial Action Task Force (FATF), a body associated to the G20, and more legal certainty to deal with eventual problems that could arise during the conduction of the Olympic Games. In addition to this, the context was of social turbulence: since 2013 the country has been shaken by major demonstrations and, at that time, the political and economic crisis started to deepen, with movements pro and against the impeachment of President Dilma, student and teachers demonstrations against the closing down of schools, and movements against fiscal adjustment.

Although it is difficult to reach a consensus on this topic and it requires broad social debate, the proposal had a fast pace in Congress and was approved in no more than 9 months. Throughout the process, however, it was harshly criticized by Brazilian civil community and even by the United Nations (UN). The main criticisms concerned the generic character of the text, which may give rise to distorted interpretations; to the fact that the law provides for very severe penalties; and to the fact that the actions comprised in the law already have legal connotation in Brazil.

During the statement give in November 2015, after the approval of the bill in the Senate, four UN rapporteurs said they were concerned about the definition depicted in the text, which could "result in ambiguity and confusion in the establishment about what the state considers to be a terrorist crime, hindering the exercise of human rights and freedom."

In the Chamber of Deputies, the bill was amended before its approval, excluding "political extremism" as a characterization of terrorism and including in Art. 2 the additional point that the Law would not apply to an "individual or collective conduct of persons in political demonstrations, social, union, religious, class or professional categories movements, aimed at social purposes or even public actions, aiming to contest, criticize, protest or support, with the purpose of defending rights, assurances and constitutional freedoms." For Amnesty International, however, the text does not protect movements, and, according to a public note issued by the institution, in the "Brazilian context in which laws that are totally unsuitable to the context of the demonstrations (such as the National Security Law and Law 12,850/2013 on criminal organizations) were used in an attempt to criminalize protesters in public demonstrations since 2013, hence, the approval of an anti-terror bill that could further enhance the context of criminalization of these demonstrations in a general sense." According to Rafael Custódio, of the NGO Conectas, "If a protester is arrested in a public demonstration and indicted for an act of terrorism, the latter will have to prove that he/she is innocent during the process. This safeguard foreseen in the project, in practical term, will not result in anything. By the end of the case, this person will be seen as a terrorist, not as a social activist, for example."

Now, the Bill 5,065 of 2016, proposed by the Congressman Edson Moreira (PR-MG), threatens to make the Law even more dangerous for social movements and dissident groups. The project intends to reinsert in the text "ideological, political, social and criminal motivation" as reasons that can characterize a terrorist practice. In addition to this, the intention is to repeal §2, of article 2, which excludes "political manifestations, social movements, trade unions, religious, class or professional category from that framework."

In addition to these new legal provisions, the mega-events series was also paved with the use of the Armed Forces for public security purposes by means of the conduction of several Law and Order (GLO) operations. As foreseen in Article 142 of the Constitution and regulated by the Complementary Law 97, of 1999, and by Decree 3897, of 2001, GLO operations should be established by a decision of the President of the Republic, and may be initiated on its own or by requests from other authorities and when security forces are insufficient to ensure "the preservation of public order and the safety of persons and properties". In other words, when the manifested patrolling that is conducted by the Military Police does not suffice, the Army, the Navy and the Air Force can be called to make sure that the streets are safe and the reinforce the security.

According to the results of Coding Rights' freedom of information request from the Ministry of Defense, from April 2000 to May 2017 91 Law and Order Assurance operations were carried out. The maintenance of Law and Order operations were conducted during Rio+ 20 in June 2012; at the Confederations Cup in June 2013; on the World Youth Day and during the visit of Pope Francis in July 2013; in the World Cup games draw, in February 2014; during the World Cup in May 2014; and at the Olympic and Paralympic Games in 2016. But perhaps the most relevant case is the military occupation of the Maré favela complex in Rio de Janeiro, during the preparation for the World Cup. Even though Decree 3892 establishes that the use of the Armed Forces in this situation must be "occasional" with the "shortest possible duration", the occupation lasted for more than one year, beginning on April 5, 2014 until June 30, 2015. In addition to this, the operation, which involved around 3,000 heavily armed military personnel and the use of the navy's armored equipment made area look like a battlefield and the costs amounted to R$ 1,7 million reais per day.

The occupation also caused serious violations of rights. In February 2015, a car with five friends that were returning home was shot at the entry of the Salsa and Merengue favela. One of the persons in car, Vitor Santiago Borges, was seriously injured and became paraplegic after a period in coma. The other four friends were arrested for contempt immediately after the firing episode. A year after the event, Vitor was still not receiving any assistance from the Government and Ponte Jornalismo verified that no inquiry case was opened by the Military Public Prosecutor's Office regarding the matter. Another example is lawsuits filed against civilians by military courts. According to the investigation conducted by the NGO Justiça Global and the newspaper O Dia, during the military occupation in Maré, 39 cases were filed against 42 civilians. According to Sandra Carvalho, from Justiça Global, "We verified an intensification of the daily activities that were conducted by the Armed Forces', performing tasks that were not inherent to their jurisdiction such as in the favelas. The consequence of these actions is a significant increase in the number of civilians that are prosecuted and tried by military courts, most commonly as a result of cases of contempt. Many of these cases results from arbitrariness and violations."

In 2013, the Ministry of Defense published the Law and Order Assurance Manual, prepared by the Armed Forces Joint Staff (EMCFA). The manual is a compilation of existing norms on the subject in order to standardize procedures among the Armed Forces, and according to the former Minister Celso Amorim, this manual is supposed to indicate "what the person at the end of the line should do. That persons need instructions to act swiftly. The person must know who is their chief. That is the purpose of the Manual." However, the first version of the test depicted ludicrous scenarios such as the inclusion of "movements or organizations" such as opposing forces, alongside criminal organizations and gangs. Also, among the main threats listed in the first version are: blockade of public roadways; depredation of public and private property; invasion of rural or urban properties and facilities either of public or private nature; disruption of productive activities considered as critical or essential services to the population or productive sectors of the country. Questionable situations for the employment of the full power of the Armed Forces. The text also provides for the use of intelligence techniques in manner sufficiently vague to be used to target social movements.

The operational plan template, attached to the manual, also provides for the implementation of "Electronic Attack Measures". According to the text, "if repressive actions are triggered, GE's should be used primarily for interference, in order to silence the channels of communication of the Opposing Forces, especially cell phones and radios."

Curiously, is was only in 2016 that Anatel published the resolution authorizing the use of Radiocommunication Signal Blockers (BSRs) by the Armed Forces during the "Rio 2016 Olympic and Paralympic Games, in dummy events and similar, as well as Law and Order Assurance Operations". In any case, another legacy has emerged: after the mega-events, the use of the equipment in GLO operations is officially authorized. A disturbing legacy when one takes into consideration the huge number of requests and the increase in the duration of operations since 2010 (see infographic), according to information uncovered by means of the Freedom of Information Act; and its implementation in operations conducted in favelas, indigenous land conflicts and demonstrations. The use of blockers in situations such as these may violate the right to freedom of expression, violate the right to demonstration and hinder the registration and publication of any violations committed against demonstrators.

This year, after Michel Temer authorized the use of GLO to suppress demonstrations in Brasilia, many debates were conducted about the use of this type of resource against protests and social movements. However, this type of practice is not a novelty. The Ministry of Defense's response to our FOI request proves, for example, the use of the armed forces during Libra Field's bid in 2013 to prevent protesters from accessing the site. Another example is Operation Tucuruí, of May 2007, when a GLO was assembled after the occupation of the Tucuruí Hydroelectric Power Plant, in Pará, by the Movement of People Affected by Dams (MAB), MST and Via Campesina.

As stated by President Michel Temer, the Law and Order Assurance "is very fashionable". So much so that despite the army commander, General Eduardo Dias da Costa Villas Bôas, asserting in a public hearing in June this year that the use of military personnel in public security activities is "exhausting, dangerous and innocuous," Temer signed a decree that puts the military back on the streets of Rio de Janeiro until December.

Protesters in Rio de Janeiro, the Landless Workers' Movement (MST) and the Criminal Organizations Law

Although it has been the Antiterrorism Law that has sparked fear amongst the Brazilian population over its potential for criminalising social movements, in practice it has been the Criminal Organizations Law that has been playing this role.

Soon after the Law was sanctioned, during the second half of 2013 – in the midst of large demonstrations led by education professionals in Rio de Janeiro – the Civil Police stated, according an article by the Estado de S. Paulo newspaper, that demonstrators detained for practicing acts of vandalism would be charged under the new law. Days later, during another protest led by teachers in the Downtown area of Rio, twenty-seven people were convicted of organized crime. Most of them were arbitrarily detained, while they sat together peacefully on the steps of the City Council after the protest.

Even known social movements that have a long history of resistance in Brazil have been criminalized from the Criminal Organizations Law. This is the case of the Landless Rural Workers' Movement (MST).

In 2016, on the basis of the Law, members of the Landless Rural Workers' Movement began to be investigated and two people were arrested after a complaint was filed by the Public Prosecutor's Office. As a result of the same operation, in November of 2016, fourteen preventative arrest warrants were issued, along with ten search-and-seizure warrants, and two others for coercive conduct against members of the MST in Paraná, Mato Grosso do Sul and São Paulo. At the time, armed police, without a court order, invaded the National School Florestan Fernandes, an important centre for the education and training of militant MST.

When the Law starts being used as an instrument of criminalization, such mechanisms prove even more damaging. In the case of the MST, even if the investigation is directed at a specific group of people, the whole Movement may be under surveillance, through means such as intercepted telephone and online communications and infiltrating agents.

The case of the "World Cup’s 23"

Between 2013 and 2014, after the protests against the bus fare increase, against the Confederations Cup and mega-events, as well as the protests that took place after the education professionals' strike, several activists in Rio de Janeiro became the target of a police investigation carried out by the Precinct for the Prevention of Computer Crimes (DRCI), which culminated in the arrest of 23 people by criminal association (Article 288 of the Brazilian Penal Code, which was amended by the Law 12.850 on August 2^nd, 2013). With more than 2,000 pages, containing testimonies, wiretapping transcriptions and screenshots of social networks, the trial reveals how the criminalization and monitoring of political movements in Brazil operates.

A significant part of the trial is based on reports of "virtual patrol" procedures, a term used by police to describe the monitoring of public information on social networks (OSINT – Open Source Intelligence). This practice was used in the investigation to build a quasi-romanesque narrative, in which activists and protesters are portrayed as criminals largely because of their Facebook interactions. Profile analysis, friendship networks, likes, photo tags and comments appear as screenshots in the investigation, and are tailored in the narrative to support denunciations and to indicate leadership. Other types of information were collected as part of this "virtual patrol", including telephone numbers, location, home and workplaces, profession, and to trace the profile of the persons investigated.

In addition to the "virtual patrol", police also asked service providers to intercept more than 40 telephone lines, including lines belonging to the mothers and relatives of the people under investigation. The Institute of Human Rights Defenders (DDH), which provides free legal advice for demonstrators, also had their mobile phones and landlines intercepted. In the trial there is an attempt to criminalize the Institute, which the police perceived as a "kind of mother-ship that welcomes and supports the actions" of the denounced people and groups. The text also describes the DDH lawyers as "political activists ideologically aligned with extreme actions" and includes several photos of these professionals at meetings and demonstrations, as well as screenshots of their profiles and activities on Facebook.

Along with the telephone interceptions, telephone companies were issued court orders to provide registration data and a reverse account of several numbers and possible interlocutors; the IMEIS of the devices related to the lines; the real-time delivery of location data (AUDIT/ERBs, AZIMUTEs, RAIOS MÉDIOS) of the phones investigated and that of any numbers that contacted them. Service providers are also requested to report on the possibility of activating the GPS of intercepted phones, and to do so immediately if so; to not block or cancel intercepted lines regardless of the payment of bills; that whenever requested by the police authorities, the service providers were to send text messages containing offers or promotions in order to identify the location of the devices monitored; that the companies were to grant police authorities direct access to the technical area of ​​the company responsible for the interceptions, or provide the telephone numbers of the technicians in charge so as to ensure immediate assistance in case of an emergency.

Also included in the trial is a court order sent to Facebook for the "complete breach of confidentiality" of at least thirty user profiles and nineteen pages and groups, with registration data (all access logs along with their date, time, IP addresses, emails, telephones and credit cards) and message communications (text, images, files, audios, location) collected in real time "by creating mirroring accounts"; as well as the retention of the all of the accounts' data for the period of ninety days. Through the analysis of the trial, it was not possible to confirm whether or not the company delivered the data. The police even mention Facebook's "reluctance and procrastination" to comply with court orders of this kind.

In relation to Facebook, what stands out the most is the request for account mirroring, which would grant real time access to all activities a person performs on their profile: likes, comments, posts, etc. The interception of the flow of communications in telematic and IT systems is in accordance with Law No. 9.296/96, but in the trial, it is not clear what this "mirroring" constitutes: would the police have control over the profile and be able to post, initiate or interact with message conversations? Would they be able to comment and like posts, or add other profiles? This is concerning because it opens up wide range of possible violations including the access to older communications outside the period covered by the court order, or, for instance, the planting or fabrication of evidence.

In the trial, it is also unclear whether instant messaging apps were targets of the investigations, since the breach of telephone confidentiality report states that several people under investigation requested access codes to use the Telegram and WhatsApp apps and had the text messages containing these codes intercepted by the police. Another similar case was that of an activist who, in a telephone conversation, revealed his Facebook password while his line was being intercepted. In this case, another violation could happen, such as the illegal access to the Facebook, WhatsApp and Telegram accounts without a court order.

In addition to the whole surveillance apparatus already mentioned, the investigation also contained the testimony of a Sergeant with the Federal District Military Police, also in the National Force. Maurício Alves da Silva says, in his testimony, that he acted as an "observer" of the demonstrations since March 2014, when he arrived in Rio de Janeiro with the objective of collecting data to support the National Force's performance in the World Cup. In fact, more than an observer, the Sergeant acted as an infiltrator. He started by streaming the demonstrations using the twitcasting app, and relaying data in real time to the Integrated Command and Control Center (CICC). This data included the identity of the protesters, actions that occurred during the demonstration, location information and possible leadership. According to the testimony, the CICC would have made decisions "based in part on the live broadcasts made by the declarant". After having been approached and questioned by demonstrators several times at the protests, Maurício began to use, as he reports in his testimony, a cover story: he was a public management student who attended the demonstrations to do field research for his final project. When he gained the trust of the demonstrators, he began attending bars, parties and even joined a closed group on Telegram. According to an article by Agência Pública, the Sergeant even formed relationships with some activists.

Questioned by the defence of the persons accused, the Sergeant states, in a new testimony, that he went to the police station to testify because he was ordered to do so by his commander, and that he did not know "whether there was specific judicial authorization for his mission". Additionally, Maurício confirms the infiltration of other intelligence agents, and declares that, in his four and a half months of work, he produced several intelligence reports.

The argument accepted by Judge Siro Darlan to legally support the actions of the Sergeant was that there was no infiltration, but rather, "the collection of information by the police officer in places open to the public, that is, during acts in which the attendance of any person was permitted, and there was no need for the aforementioned police officer to pose as a member of any of the criminal groups investigated".

Another very alarming fact in the investigation is the use of a Google email account to receive sensitive data. In the court orders it is stated that the delivery of information such as personal data, breach of confidentiality and telematic interception (passwords of mirror Facebook accounts), and information regarding telephone interception, for example, should be forwarded to the authorities via email opfirewall@gmail.com

Balta Nunes case

Another important case involving infiltration, in many ways similar to the "World Cup's 23", is the Balta Nunes case, which happened in São Paulo and culminated in the arrest of 21 people in September of 2016. Willian Pina Botelho – the captain of the Army's intelligence unit – infiltrated leftist movements in the city of São Paulo and helped the Military Police plan a mega operation, with buses, helicopters and several other vehicles, to arrest a group of young demonstrators as they prepared to go to protest against Michel Temer and the Impeachment of Dilma Rousseff.

The scale of the operation and the fact that Botelho was not arrested along with the group caught the attention of the young people, who identified him as a possible infiltrator. Botelho then completed his activities, erased his accounts on social networks and told some people he was withdrawing from the groups. But the captain's tactics did not keep him from being exposed. An article by Ponte Jornalismo revealed his infiltration and tactics, which included using social media networks and even the dating app Tinder as a tool to infiltrate activists. In fact, it was through a Tinder contact that Botelho obtained access to the group of demonstrators, who organized themselves via WhatsApp.

Receiving extensive media exposure, several investigations were opened to inspect the case: one by the Army (Southeastern Military Command), one by the Military Justice's Attorney's Office, one by the State of São Paulo's Public Prosecutor's Office, and two by the Federal Public Prosecutor's Office. Two of these investigations were archived – the Army's and that of the Military Prosecutor's Office – both of which considered the operation legal. According to these bodies, Captain Botelho's participation was not to be characterized as an act of infiltration, but as an "Intelligence observation activity employing the corresponding operational techniques" foreseen in the Law and Order Maintenance operations (GLO). Therefore, the captain's actions were deemed legal based on the understanding that he was acting, for intelligence purposes, in the GLO operation linked to the Paralympic Torch ceremony in São Paulo on September 4^th, the same day of the demonstration and arrests.

Indeed, a Government Decree published in 2016 authorised the implementation of GLO operations to ensure the Olympic and Paralympic events were held. However, what the Army and the Attorney General's Office completely overlooked is that the captain was already infiltrated long before the decree, since Balta Nunes' Facebook profile was created in December 2014, according to an article by Ponte Jornalismo. Another fact ignored by these investigations is that the Government of São Paulo stated that it did not request the Armed Forces' assistance for the Torch ceremony.

The Balta case is significant. It reveals, on the one hand, the use of GLO as a backdrop for the monitoring of activist groups and social movements carried out by Armed Forces' agents – albeit under the (increasingly recurring) claim that it is not infiltration, but instead "Intelligence observation activity", as in the case of the "World Cup's 23". On the other hand, the case shows that this practice of surveillance also occurs on the Internet, through social networks and messengers, which in turn makes it more difficult to be officially recognised and treated as infiltration – thus making it an increasingly common practice.