Login credentials for Smart Sampa, Brazil's largest facial recognition surveillance program, were exposed on the internet as early as 2024, according to information security researcher Davi Mikael, interviewed by Folha de S.Paulo. The finding suggests the flaws in São Paulo's city hall system are older and deeper than previously known.
The case surfaced last week, when a UOL investigation revealed that 181 logins and passwords for the program had been exposed for 11 months, allowing improper access to images from more than 58,000 cameras spread across the city. Mikael, who has 13 years of experience in digital security and goes by the handle Penegui, started probing the system after that story ran. In a video posted on his social media on Tuesday (27), he says he found 15 access credentials leaked since 2024. Folha received part of that data and reports it points to leaks at least from October 2024, only three months after the program's official launch in July of that year.
To grasp the scale of the problem, think of the credentials as the master key to an entire building left under the doormat. Whoever finds it does not need to break anything: they just open the door and walk the hallways. In Smart Sampa's case, the hallways are the images and biometric data of millions of São Paulo residents captured without warning by the cameras. According to Folha, Mikael and other sources indicate the problems went beyond passwords, with signs of other vulnerabilities, including an open data repository that allowed access to camera images.
City hall's response and the interests at stake
Asked by Folha about the signs of leaks since 2024, São Paulo's city hall did not respond. The week before, the administration of Mayor Ricardo Nunes said in a statement that "there is no weakness in the security mechanisms of the Smart Sampa platform" and blamed the episode on an illegal data leak by a member of the Metropolitan Civil Guard, who was removed from duty and is under internal investigation. City hall also says the exposed repository was taken offline and that it adopted unique passwords and two-factor authentication, according to g1.
It is worth looking at each side's incentives. Smart Sampa is run by a consortium that includes Sentinelx, a company whose business is precisely selling the platform that identifies people, manages incidents and dispatches patrol cars. For the company, admitting a structural flaw threatens contracts. For city hall, the program is a political showcase for public safety results, and acknowledging a design problem is expensive. Blaming a single employee is the cheapest way out for both. Experts interviewed by g1 dispute that version: lawyer Luiz Augusto D'Urso says the case amounts to a violation of Brazil's General Data Protection Law (LGPD) and that responsibility lies with city hall, which owns the system. Pablo Nunes, from the Center for Security and Citizenship Studies, and Fernanda Rodrigues, from the IRIS internet research institute, warn that a system of this size, this easy to access, puts the daily routines of millions of people who never consented to being monitored at risk.
What we still do not know
Mikael's findings were reported by a single outlet and have not yet been independently verified. We do not know whether the credentials exposed since 2024 were actually used by third parties, how many people accessed the images during that period, or whether Brazil's data protection authority (ANPD) will open an investigation. City hall has also not explained why the leak would have started months before the case revealed by UOL.
In practice, there is no password for citizens to change, because we are the ones on the other side of the cameras. What can be done is to watch whether the ANPD and public prosecutors demand an independent audit of the system, and to press city hall to publish its security reports. Until that happens, the promise that more cameras mean more safety deserves a healthy dose of skepticism.