The Only Thing the Lula Government Has to Get Right This Time in DPI

Nobody votes for a 1st place ranking

Lula has just won a fourth term, starting in January 2027 and running to the end of 2030. Brazil runs much of its public life online, a shift COVID accelerated. So the question for the next four years is simple: what will people remember?

Spoiler: it won't be awards. Brazil has collected plenty of them for digital government already. The World Bank, for example, ranked the country second in the world in its GovTech Maturity Index 2022, the leader in the West. I have used this in many talks I gave. Ministers love to quote that number at international conferences. Well, no citizen has ever cared.

What citizens care about is whether they can log in securely. Scroll TikTok, Instagram or YouTube and you will find countless videos mocking gov.br: the selfie that fails ten times, the account locked for no reason, the "silver" and "gold" levels nobody understands, and so on. Those videos are the real ranking, so the government needs to stop looking outward for applause and look inward at what breaks every day.

The one thing: access control

Make access control the government's number one priority, now. Not one priority among many: the first one, owned at the top of tops.

In public digital infrastructure that has existed for at least a decade, security is not a cost centre that competes with privacy and service quality. It is the thing that delivers them. Get access control right and three problems shrink at once:

Fraud. Most fraud against citizens and the state is not clever hacking (yet). It is someone getting access they should never have had, to an account or a database.
Privacy. Data that only the right people can reach, for the right reason, is private. Data that anyone with a login can query is not, whatever the privacy policy says.
Trust. People use what they trust. A login that works and a state that can't be impersonated are what make digital services reach everyone.

The INSS scandal showed the political cost of getting this wrong. In one scheme, associations used forged authorisations to take deductions from pensioners' benefits; investigators estimated up to R$ 6.3 billion between 2019 and 2024. That was access, granted and never properly checked. (I wrote about this last year on my Substack in pt-Br)

Then there is the free-for-all of access to state data by people who should never see it. The Banco Master case is the starkest example: according to a Federal Police report sent to the Supreme Court, a group linked to banker Daniel Vorcaro obtained information from confidential prosecutors' files using the work logins of public servants. Investigators describe recurring, irregular access to ongoing cases at the prosecutors' office, the Federal Police, the Civil Police and the Central Bank, carried out by an operator reportedly hired for that job alone.

Read that again: nobody had to break any encryption. Someone used other people's credentials, across several institutions, repeatedly, and no alarm went off. A banker under investigation could follow his own investigation. If that is possible for the most sensitive files in the state, imagine what is possible for a pensioner's benefit record. That is an access control failure, and it is exactly the kind that passkeys, per-person credentials and access logs are designed to stop.

Start with the front door: Gov.br has 166 million users; only WhatsApp and Pix reach more Brazilians. Its login is the most important security control in the country, and it should feel like it. I know the work has started, as a February 2026 update lets people enter the app with the same method they use to unlock their phone: passkeys, in practice, but it is too slow and incomplete. The gov has to finish the job:

Passkeys everywhere, by default. Every federal service that sits behind gov.br, on web and app, not only the main app. Phishing-resistant login should be the normal path, not an option hidden in settings.
Lock down staff access, digital and physical. Public servants should log in with phishing-resistant credentials (passkeys or hardware keys tied to one person), with their role proven by a verifiable credential, not usernames and passwords that can be shared or borrowed. Use the same credential at the door: unify access control for federal buildings and federal systems. Today it is so easy to walk into a federal building with a fake identity that I don’t even want to start. Fix your identity and access management (IAM): every access, to a system or a room, tied to one person, one purpose, and a log.
Fix account recovery. Attackers rarely beat a strong login. They go around it, through recovery, re-enrolment and help-desk resets. Recovery deserves as much engineering as login.
Retire the weak fallbacks. SMS codes and repeated selfie checks are where both the scams and the TikTok jokes come from, and so where distrust runs highest.
Measure failure, not just adoption. Publish how many people fail to log in, and why, every month. That number tells you more than any user count.

Let citizens show credentials, not their faces

The reflex in Brasil is to answer every fraud with more biometrics, because we lack an Identity Framework that responds to technical failures with policy and governance. So, in 28 October 2026, Anatel (our national telecoms regulator) made facial recognition mandatory to activate and keep a mobile line. The goal, stopping lines opened in other people's names, is right, but the method is wrong and won't stop fraud.

Mandatory biometrics turns every phone shop and every app into a collector of faces. It spreads the most sensitive data we have across hundreds of companies, each one a new place to leak or abuse it. And a face, unlike a password, cannot be changed after it leaks. There is a better design, and Brazil has already built most of it (i was there leading the work). The state already holds verified identity data. Let citizens carry it as a verifiable credential in their gov.br and other wallets and share only what a service needs: "this person is the holder of this CPF", "this person is over 18". The operator gets a cryptographic proof from the state. It never gets the face, and it doesn't need to build a database of its own.

I get that biometrics really is needed in some use cases. When it is, it must be done to the highest standard and in the open, not handed to whoever wins the cheapest tender. If the state hires companies to do it, those companies should sit in a public trusted list, a list of accredited verifiers anyone can check, and earn their place there with:

No reuse, no hoarding. Faces captured for one check are not kept, sold or used to train anything else.
Real liability. A leak or a fraud that gets through costs the vendor its accreditation, not only a fine. Maybe aprove a law that condemns its owners criminally?
Certified security, tested independently. Liveness and anti-spoofing checks, including against deepfakes, audited by labs the vendor doesn't pay for.
Published accuracy. Error rates made public, including how often the system fails people of different ages and skin tones.

If a company can't meet that bar, it shouldn't be touching citizens' faces on the state's behalf. That is what fixing identity means: giving people a credential they control, not making their body the password.

Data domains, not a data lake

Each agency should keep its data in its own domain and answer narrow, logged questions from others, instead of pouring everything into one central lake. On paper, the government kinda agrees. Discussing the National Data Infrastructure, one official said they no longer think in terms of data lakes with everything gathered in one place. However, the same plan makes the new national ID card, the CIN, the single key for integrating data across the federal administration. That a the trap!! Separate domains that can all be joined on one universal identifier are a data lake in practice. Also the CPF is basically public. The test is who can link data, for what purpose, and whether anyone can see that it happened. So:

Share answers, not records: "eligible: yes", not the whole file.
Log every cross-agency query, and let citizens see who looked them up in gov.br.
Treat bulk access to a domain as an exception that needs a named owner and an expiry date.

AI changed the game, so leaders must understand it

This is not an argument against AI, especially when I know Brazil's AI plan commits R$ 23 billion through 2028, and that money will be spent. The question is whether the people deciding how to spend it understand what has changed - they don't.

In the past year, AI models went from writing snippets of code to building, testing and deploying working applications from a plain-language request, even if the quality is uneven. Building software used to take a team and months, but now it can take one person and an afternoon. My point is: the same tools that let a civil servant build a service in a day let a criminal produce a thousand convincing fake gov services.

That is why security comes first. AI deployed on top of weak access control does not modernize the state. It scales up whatever is already broken.

Most directors, presidents, Ministers, chiefs etc who will sign AI contracts have never built anything with these tools. So here is a modest proposal:

One day, one room, one app. Every director in the federal government spends a day with an AI model and has to build an app. Any app.
It must be deployed (not a slide!!)
They must maintain it. For a year. Bugs, updates, a user who can't log in.
Real users, no personal data. Build for colleagues or for the public, using open data: a tool your own team uses every day, a service that answers questions from public information, I don't know. Users tell you what works; keeping citizens' personal data out means the exercise can't become the next breach.

A director who has done this will read the next AI procurement differently. They will know what is easy, what is hard, and what the vendor is not saying.

Maintenance is where security lives

The most important word in that exercise is "maintain". Launching is the easy part, and It gets the ribbon-cutting, the instagram post, the press release, the award entry. Maintenance gets nothing but it is where security fails.

AI makes this more urgent, because if anyone can now build an app in an afternoon, the state will soon have many more systems than it has people to look after them, I can bet money in this. Every app you can build in a day is an app someone has to patch for years. So budget for maintenance as a first-class line, not leftover money. Give every system a named owner who is accountable after launch, and reward the teams that keep things running quietly, not only the ones that launch something shiny.

This is why architecture comes before AI! Before any AI decision, the government has to answer a simpler question: does our architecture hold security when the number of systems multiplies? If every new app needs its own logins, its own copy of citizen data and its own patching team, AI will multiply the attack surface faster than anyone can defend it. If apps plug into shared, well-guarded building blocks (one way to authenticate, data that stays in its domain, logs by default), each new app inherits security instead of eroding it. Get the architecture right first, and AI becomes an accelerator. Otherwise AI becomes the fastest way to build tomorrow's breaches.

Why it won't happen by itself

I have worked inside this machine, so let me be honest: none of this is easy. Budgets are locked years ahead and procurement law turns every purchase into a legal case, I know. Political appointees rotate every 4 years and take their priorities with them. Anyone who ignores these constraints is writing fiction. But the constraints also reveal the real problem, which is the machine rewards. You can win an award in one cycle; you can't finish a migration in one. A launch gets a press release; a patch gets nothing. So the easy path is always the same: quote the ranking again, announce the plan again, and leave the system exactly where it was.

The constraints are real and they have also become the excuse. A government that treats standing still as a strategy will keep collecting awards while its citizens keep getting scammed.

The first 100 days

Four years is not long enough to do everything that is needed in DPI in a country the size of Brazil, but it is long enough to fix access control. The first 100 days should show the direction:

Passkeys as the default for gov.br and every federal service behind it, with a published plan to retire SMS codes.
Publish login failure rates: how many people fail to get in, where and why.
Pause new biometric mandates, Anatel's included, until a trusted list of accredited verifiers exists and verifiable credentials are offered everywhere.
Turn on query logs that citizens can see: every cross-agency lookup of a person, visible to that person in gov.br.

Next: build for older people

Older Brazilians are the ones mostly locked out by failed selfies, confused by security levels, and targeted by the scams (challenge me with data). They were also the main victims of the INSS deductions. Security that only works for the young and digitally fluent just moves the risk onto the people least able to carry it (children and older people).

So the next priority after the first 100 days is accessibility for older people, built into access control rather than added later:

Recovery that works without a smartphone. A verified, in-person or assisted channel that can't be hijacked by a phone call.
Plain language and accessible design. Large text, simple steps, no jargon about "gold" accounts.
Test with real older users before every change, and publish what you learn.
Delegated access done properly. A son or a neighbour helping a pensioner should get their own credential with limited, visible permissions, not the pensioner's password.

Finally, work with people, for the people. Let people analyse the systems, suggest fixes, read the code and send commits, through a secure process with proper review (and, I’d recommend, no AI-generated code in the core systems). Technologists of all kinds are backing this government, me included, because we believe it can build technology that works well and protects people. So far, what we have is technology that works, but not well, and that doesn’t really protect us.

Do this, and this last Lula government will be remembered for something every citizen can feel. It will be the government that fought fraud at its root, made public services work for the people who were locked out, and made Brazilians safer in the digital world. No ranking needed.

Yasodara Córdova thinks and builds at the intersection of digital identity, fraud ecosystems, privacy, security and why systems break in ways nobody planned for. She has developed work with Harvard University, the World Bank, W3C, the World Economic Forum, and SXSW, among others.