Government wants to tax all internet users – 07/13/2023 – Market

The GSI (Institutional Security Office) prepared a proposal for a National Cyber ​​Security Policy, which provides for the creation of an agency to improve the governance of the activity. To finance the project, with an estimated cost of R$ 600 million over five years, the body linked to the Presidency wants to charge users a fee for using the internet.

“This policy has already been studied for some time. We are, logically, refining it. We hope that, this year, it will still be presented to Congress”, he told the Sheet the GSI Minister, General Marco Antonio Amaro dos Santos.

“When a bill that generates expenses is presented, it has to present a source to cover that expense. to support the creation of this agency”, he added.

The text has already been presented to the Ministries of Justice, Finance, Planning, Science and Technology and Management. Now, it will pass through the Civil House’s legal scrutiny and, later, will be presented to President Lula (PT).

As it is the creation of a national policy, it will have to be approved by Congress, through a bill. There is still a period of one year for the agency to be installed, after the new rule comes into force.

According to the proposal, the cybersecurity fee –called TCiber in the project under study– will correspond to 1.5% of the amount paid by internet users to access the network, in a similar concept to public lighting and urban cleaning fees charged directly on the electricity bill.

According to the agency’s calculations, in the case of a user who spends BRL 70 per month on the internet, for example, the fee would cost BRL 1.05.

The GSI argues that the percentage corresponds to the sum of what is collected with Fust (Fund for the Universalization of Telecommunications Services) –1%– and with Funttel (Fund for the Technological Development of Telecommunications) –0.5%. In this new design, however, the creation of a background is not foreseen.

Charging the tariff would yield R$ 581.9 million per year to the public coffers, according to the agency’s estimate. To arrive at this amount, the GSI considers that Brazil currently has 157.7 million internet users, who spend an average of R$ 25 per month on the service.

In addition to taxing internet access, the proposal also includes a 10% charge on domain registration, that is, the name that will be registered so that a website can be found on the internet. Payment would be made at the time of renewal of these registrations, which have an average annual cost of R$ 35.

In this modality, the government expects to collect approximately R$ 12.6 million, which would also be used to fund the operation of the agency.

In both cases, there will be no distinction between natural and legal persons. “We would have some difficulty calculating this. Congress may have mechanisms and an interest in debating different things”, says the special advisor to the GSI, Marcelo Malagutti.

There is also, according to him, the fear of losing the support of entities such as, for example, Fiesp (Federation of Industries of the States of São Paulo).

“Unfortunately, everything the government does, the citizen has to pay. In this case, our perception is that we are charging relatively little for a relevant service for internet users”, says Malagutti.

According to the members of the GSI, despite the unpopularity of the measure, the reception to the project has been positive among parliamentarians. A hearing has already been held in the Federal Senate, as well as another public hearing to address the issue.

“Nobody in their right mind can be against cybersecurity, against an initiative that aims to provide security in the digital environment for every citizen and every company”, says the secretary of Information Security and Cybernetics of the GSI, Brigadier Luiz Fernando Moraes da Silva .

“What creates resistance is creating a structure with positions and not having revenue. Congress will not give carte blanche to anyone without us having a formula, without showing where the resources will come from”, he adds.

According to the report by government members, ministers Fernando Haddad (Finance) and Simone Tebet (Planning and Budget) also showed no resistance to the issue. The economic team only pondered the need to point out a source of revenue to support the project.

The amount collected from citizens and companies will be used to finance the agency’s estimated cost of R$594.1 million when it is fully installed after its fifth year of existence. The budget will be used for personnel and costing expenses.

Agency would be an autarchy like BC

Inspired by a model of a regulatory agency, ANCiber (National Cybersecurity Agency) was designed to have 800 servers at the end of five years. For each year of implementation, a portion of the workforce will be incorporated into the institution’s staff, with 81 employees in the first year of operation.

The first wave would integrate the agency by request, which is when the originating agency cannot deny assigning the employee to the Presidency, and by hiring temporary workers. According to estimates by the Ministry of Management and Innovation in Public Services, the average time for holding a tender and calling for approved candidates is at least two years.

Despite being under the umbrella of the GSI, the agency would be a special regime autarchy, as well as the Central Bank. That is, once the names of the directors and the president have been approved by the Senate and then appointed, they have mandates to fulfill and would be shielded from possible political changes.

The agency is a piece within a larger plan. The policy’s main objective is to provide a preventive guideline in the case of cyber-attacks and to create practical instruments for this. Today, according to members of the GSI, both state and private bodies have their departments and rules for safety, but there is no common protocol for all.

According to the GSI’s cybernetics secretary, the agency would not act in a hierarchical manner, but as a focal point to standardize and share best practices.

“It’s not enough to have institutionalized activity, it needs to be coordinated, because the threats are similar and appear everywhere. An entity detects something and the faster it passes it through a collaborative network, it will prevent it from spreading. The key word for the agency is governance,” said Silva.

What motivated the presentation of the bill this year –and with an urgent request, according to the GSI– is the vertiginous increase in cyberattacks in Brazil, with financial losses that could reach US$ 100 billion in the country in 2023, according to the consultancy Accenture specialist. This figure has been used as one of the main arguments for the establishment of the agency.

Malagutti also recalls the cyberattack on the STJ (Superior Court of Justice) system in 2020, which is considered by experts to be the worst ever in a public system in the country. At the time, the director of the court’s information technology department activated the cyber defense command, linked to the Ministry of Defense, and the Federal Police (PF) department for crimes of this order.

“Preventively, there is no one working. This is one of the situations that led to an increase in society’s perception of urgency for the creation of this agency”, he said.

If the agency already existed at the time, there would first be a minimum level of security requirement for systems like the STJ, in addition to a protocol and a chain of command to be followed in cases like this. The national policy also provides for the creation of a crisis office to act in these situations.

In addition, there is also the forecast of a committee, led by the president of the agency. Initially, the forecast was 27 members. But, after a public hearing, other bodies expressed interest in having their own seat, such as the PF’s cybercrime board, and the forecast increased to 55.

The proposal to create a National Cybersecurity Policy has existed since 2014, when the Senate established a CPI to monitor electronic espionage, after revelations in the Snowden case – which revealed details of US spying on Brazil.