MPSP avalia investigar vazamento de dados das câmeras do Smart Sampa | Em Ponto

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: MPSP avalia investigar vazamento de dados das câmeras do Smart Sampa | Em Ponto · Channel: globonews · 06:59 · Watch on YouTube

Topics: Cybersecurity and software security, Privacy and data protection

Summary

The report examines the leak of confidential data from São Paulo’s Smart Sampa camera system, which reportedly exposed images and access for 11 months. City Hall says a guard was suspended and is under internal investigation, while the Public Prosecutor’s Office is evaluating whether to open a formal inquiry. The discussion separates three unresolved issues: the leak, possible misuse of the data, and whether the system has security weaknesses, and also raises concerns about governance and privacy. The speakers stress the need for strong safeguards as the system expands and say they will follow the case.

Key points

The São Paulo Public Prosecutor’s Office has assigned the matter to a prosecutor to assess whether to open an inquiry; the report says there is not yet a formal investigation there.
A report said data and images from the Smart Sampa system were exposed for 11 months.
City Hall said it identified and suspended a guard, and that the Metropolitan Civil Guard’s Internal Affairs office is investigating him.
The speakers distinguish between the confirmed leak, possible misuse of the data, and potential weaknesses in the system’s infrastructure.
City Hall reportedly said there was no external attack and that access involved an insider’s password.
The discussion questions the claim that a vulnerability was deliberately left in place as bait, arguing that exposing people’s data raises governance concerns.
The report notes that the system has grown since 2024 and includes 58,000 cameras, with possible integration of cameras from businesses and other organizations.
The ANPD may assess the incident under data-protection rules, including a three-business-day deadline for a data controller to report an incident.
The speakers emphasize the importance of access controls such as two-step verification and warn that poorly protected data could threaten privacy.

Chapters

Start	Chapter	Summary
00:00	The reported Smart Sampa data leak	The presenters introduce the possible investigation and discuss concerns about password sharing and the system’s security.
01:08	What is known and what City Hall has done	The report describes the alleged 11-month exposure and City Hall’s suspension of a guard and internal investigation.
03:17	Possible misuse, system security, and governance	The presenters outline questions about misuse and infrastructure weaknesses, and criticize the idea of using exposed data as bait.
04:22	Potential inquiries and data-protection oversight	The report explains the prosecutor’s preliminary assessment and the ANPD’s possible role in reviewing the incident.
05:26	Testing systems, safeguards, and privacy	The discussion contrasts announced security testing with the case at hand, quotes the mayor, and closes with concerns about privacy and data protection.

Quotes

today with 58,000 cameras. — 01:08

A leak, we know it happened; misuse, which is very serious; did it happen and why? — 03:17

You cannot expose people’s data. — 03:50

there is a three-business-day deadline for the data controller to report an incident. — 04:53

It is good that it is investigated because it will give even more credibility to the system — 06:28

Concepts and entities

Smart Sampa, Ministério Público de São Paulo, ANPD, LGPD, Ricardo Nunes, Guarda Civil Metropolitana

Full transcript (original language)

00:00 The São Paulo Public Prosecutor’s Office is evaluating whether or not to open an investigation into the leak of confidential data from Smart Sampa, the capital city’s monitoring system. Léo is following this issue; what do we know at this moment, a very serious case, right? Because this is information that the state has to defend, right? It has to protect it, it can’t leave it in the hands of, well, of >> any smart aleck, yeah, of whoever it may be. And what impressed me most was the statement from Mayor Ricardo Nunes. >> No, he he people would pass a password

00:35 along and you would just enter and have access to the system. There was no dual verification, which is when you receive a number on your phone, things get registered. It, it was registered who logged in. >> Yes. >> But the mayor said: “No, but these security issues we will >> uh >> be adopting little by little, implementing little by little.” But it’s not security, it’s not about security that all this is, Léo. >> It is about security, yes. It’s people’s data. We are talking about a city like São Paulo, a system that has been growing since 2024, subscribing,

01:08 today with 58,000 cameras. But I think it is important for us to separate here what is known, what is still being clarified, and it is necessary that it be clarified because it is a very serious case. With the help of the big screen here, I will tell the story and bring all the context. My friends Vitor and Mônica will interrupt me so we can have everything very clear about what we have. about what we have gathered so far, information exposed for 11 months. This here is when the portal’s report is brought up, that this lasted for 11 months. And what is this here? The images from those 58,000 cameras with people having access. From here on we have the matter of the investigations.

01:42 When the UOL portal brings the news, what does the city hall say? We identified a guard, we already suspended him, and he is being investigated by the Internal Affairs of the Metropolitan Civil Guard. Let’s move on here, Rafa, put it here on the next screen, just so we can see. This is ongoing. Data removed from the internet, suspension of the guard, opening of an investigation by the Internal Affairs of the Metropolitan Civil Guard. This is important to highlight, okay? This, do you know what this third point is? An inquiry from an administrative point of view. >> For you to understand even better, the city hall, the city hall itself

02:12 investigating the civil servant. This is what we have today. >> But investigating, sorry, to know his motivations or simply to know why >> first he leaked the data. Then it will, yes. Why did it leak? From an administrative standpoint, what can happen, Vitor, besides the suspension, is that he could be fired for cause from the public service later on in a process, and will have to answer to the municipal attorney’s office. >> But did he pass the password on, did he sell the password? There are many variables. >> That’s why I think this issue today, this story has three different aspects. First, the leak. We don’t need to dwell

02:45 on this because the leak happened and the city hall admits it, right? >> Uh-huh. Another thing, was there misuse of the data, and why did that happen? The city hall says no so far, but there was misuse of the data. Why do people want camera footage from public and private institutions? Because the Smart Sampa system is advancing, integrating cameras from businesses, companies, anyone who wants to have an integrated camera will have it there. >> Why would they? Was there this misuse, yes or no? And another thing, is there a weakness in this system’s infrastructure? City hall denies that

03:17 too. So there are three things. A leak, we know it happened; misuse, which is very serious; did it happen and why? And is the system flawed? Does it have a mechanism? Did it, let’s say, suffer —the city hall is saying so far that there was no external attack, that it was a password from someone on the inside, >> right? But is this, in fact, a secure system? It has to be very secure. It has to be. >> It has to be secure. Now, this story that the city hall says it was used as bait—this weakness—to actually find someone. >> That’s not how things are done. That’s not how—that’s a matter where you have to add a fourth topic to the conversation, which is governance. That

03:50 is not governance. You cannot expose people’s data. Folks, we are talking about data and images of everyone who passes by a camera with facial recognition and communication to public security agencies. That is what we are dealing with. This isn’t something like , let’s say, “let me snoop on what Monica is doing.”“Monica, let me look at your computer.” That’s not what we’re talking about. We are talking about someone walking down the street, captured by a camera, including a facial recognition system. >> What could happen, just to wrap up here ? Because an administrative investigation is also important. At the Public Prosecutor’s Office of São

04:22 Paulo, the case was assigned to a prosecutor to evaluate whether to open an inquiry. It is already with the prosecutor. What happened at the Public Prosecutor’s Office is what’s called a notice of fact. Is there a formal investigation at this moment, subscriber? No, but then the city hall goes based on what is known so far, the UOL report, other media outlets, the city hall’s statement. And then, usually what happens here, Monica, Vítor, subscriber, the prosecutor makes an initial request for clarification to the departments involved in this. So, what is he going to do? He will send it to the Metropolitan Civil Guard to find out which guard this is, and what happened. Usually, based on the city hall’s

04:53 response, he says: “Wait, is this a case for opening an inquiry?” No. And here at the ANPD, there is a general coordination of security incidents that follows the case here according to the ANPD rule that oversees a law Monica likes a lot, the LGPD, the General Data Protection Law. >> It’s a non-existent law in Brazil. It exists, but it doesn’t exist. >> It has a rule here that says there is a three-business-day deadline for the data controller to report an incident. >> Then, based on that, with the city hall informing us, we will see if there will be a procedure here or not. But depending on both responses, my friends , we will have three investigations

05:26 into the same fact. >> But you mentioned here the bait system, right, as a justification. Like, leaving a vulnerability to see if a person can get in and then we fix the vulnerability. And I remembered that we saw in other city halls, I think it started in Fernando Haddad’s administration, they held gatherings of young hackers to test systems. They would all stay there doing hackathons. Yes, >> but it would bring everyone together. >> It was very interesting for testing the

05:58 official systems, the public systems, to see where the flaw was. And whoever managed to break it not only helped fix the flaw but also won, I don’t know, some prize, a >> Yes, but that is announced, right, published, it’s not after the crisis appears that you say it was an effort to test the system all along. >> We never heard about that again. You don’t discover a person entering the system who isn’t one of the main operators, there’s no verification >> in duplicate >> in duplicate

06:28 >> two-step, two-layer, right, is what it’s called. >> That’s important. And just to close, folks, I spoke with Mayor Ricardo Nunes , I continue to talk about this. He wrote me the following, that it is good that it be investigated. This is not yet a formal investigation, but there may be an investigation happening outside of this internal affairs office . He wrote the following to me: “It is good that it is investigated because it will give even more credibility to the system, in the case of Smart Sampa, as they will conclude its efficiency and security.” We will wait and we will stay on top of this because it is something very important. The main platform of Ricardo Nunes on public safety copied by Flávio Bolsonaro.

06:59 Flávio >> the moment you have a national network, right? It has to be well protected. The right to privacy has many loopholes. a bad system can also turn against the citizen, right? Because the commercialization of this data is when you start to be harassed. Man, I know where you were, you went to such a place. Data is the oil of our times, right? Information is the most valuable thing, so be careful.