Serpro - the federal government's data processing

Serpro was created by Law 4.516 of 1 December 1964 and reorganised by Law 5.615 of 1970, which contains the sentence that shaped it: it would carry out the services of the finance ministry priority and with exclusivity. A supplier that cannot be replaced by its principal customer is a different institution from a supplier that can, and every strength and weakness that followed descends from that clause.

The work began with tax. From 1965 it built the collection systems for income tax, and the state's ability to see what it was owed grew with the computing rather than ahead of it. That is the general shape of public computing in this period and it is easy to state backwards: the systems did not automate an existing capability, they created one.

Six decades on it is among the largest public technology companies anywhere, headquartered in Brasilia with eleven regional offices, and in 2021 reported 2.78 billion reais of revenue with 7,822 employees. It holds identity, tax and vehicle records for the whole country.

That concentration has consequences, and one of them became public. In June 2020 The Intercept Brasil revealed that the national intelligence agency had asked Serpro for full access to the national register of licensed drivers - the records of 76 million Brazilians, about 36 per cent of the population, refreshed monthly, for a little over 330,000 reais. The request was not a breach and did not need to be one. When a single organisation holds the country's records, the interesting risk stops being intrusion and becomes access: who may ask, on what authority, and whether anyone outside would ever know. That is a governance property of the architecture, not a failure of it, and it is the reason data concentration is a security topic rather than an efficiency one.