A security flaw left sensitive information exposed for about 11 months, allowing improper access to more than 58,000 cameras in Smart Sampa, the video surveillance system run by the city of São Paulo and described as the largest in Latin America. The breach was revealed on Monday (20) by an investigation from Artur Rodrigues' column at UOL, which alerted city hall. The data was taken offline after the warning.
The information sat in a public repository on the internet, something like hanging a building's master key on the front door along with the floor plan of every level. According to UOL, it included 181 logins and passwords of authorized users, data on more than 6,000 security agents and technical instructions that made it possible to reproduce the platform on any computer or phone.
To test the extent of the exposure, the reporters used an artificial intelligence prompt to build, from the leaked material, an interface that mirrored the system. With it, they could browse the city map, see pedestrians' faces and license plates, and even record their own waves in front of eight cameras on private totems linked to the program in Campos Elíseos, downtown. Access also reached sensitive locations, such as daycare centers, hospitals and addiction treatment units.
Asked about the case, São Paulo's city hall said there was "an illegal data leak by a civil servant", who was identified, removed from duty and is being investigated by the internal affairs office of the Metropolitan Civil Guard. The administration denied any "fragility in the platform's security mechanisms" and did not explain what controls would prevent a new leak.
A risk that goes beyond privacy
For Rafael Alcadipani, a professor at Fundação Getulio Vargas (FGV) who specializes in public security, the problem is one of national security. He reminded UOL that Israel used camera images from Tehran to map the routine of the security detail of Iranian leader Ali Khamenei, assassinated in February.
"I can find out where the authorities are, where the patrol cars are, where the city's defense equipment is moving. It is extremely serious. You take a structure the state has to fight crime, and it can possibly be used by crime to fight the state."
Political showcase and what we still do not know
The episode hits the main showcase of Mayor Ricardo Nunes' (MDB) administration, which installed a street panel nicknamed the "prison meter" to publicize the more than 3,000 arrests of fugitives made with the cameras' help. The system uses facial recognition and plate reading to alert, via an app, the officers closest to each flagrant. Growing fast yields political capital: the model inspired presidential candidate Flávio Bolsonaro (PL) to promise a Smart Brasil program. In the Band TV debate he spoke of more than 1 million cameras, according to Metrópoles; UOL records the promise as 2 million. The campaign has not detailed how the expansion would be financed or which databases would be integrated.
There are clear incentives at play. For city hall, each new camera becomes an arrest figure on the panel and a campaign argument. For private partners, who share images from their own equipment, integration expands the network at no direct cost to the city. What nobody explains is how much of the budget goes to protecting the system instead of expanding it. It is also unclear who accessed the data during the 11 months of exposure, whether the 181 passwords were changed, or why city hall counted about 50,000 cameras in April, according to a Metrópoles survey, while UOL managed to reach 58,000.
In practice, three things are worth watching: the outcome of the Civil Guard's internal investigation, a possible inquiry by ANPD, Brazil's data protection authority, since faces and license plates are personal data, and whether the Smart Brasil plan will include a specific security budget and rules. Meanwhile, São Paulo residents cannot do much beyond demanding answers: it is city hall, not the user, that holds the key to that door.