Summary

SAI Brazil analyzed the protection of user accounts, risks of unauthorized access, and difficulties faced by users of the official platform of the Brazilian government gov.br. The gov.br account allows access to government digital services using a single identification, without the need to visit government agencies in person. The platform offers 4.6 thousand digital services and has more than 173 million users. Through the platform, citizens can access pension, labor, educational, and health services, use electronic documents, and sign documents with legal validity. According to the auditors' assessment, the low level of digital literacy among the population contributes to the unsafe use of passwords and increases vulnerability to online fraud. Auditors identified a risk of phishing attacks, in which criminals use social engineering techniques to obtain users' verification codes. SAI Brazil concluded that it is necessary to strengthen public awareness and implement more robust mechanisms to prevent unauthorized access. The audit also found that facial recognition systems experience failures at the stage of verifying that a real person is in front of the camera. Issues such as poor lighting, low camera quality, and difficulties with proper positioning can negatively affect the procedure. These limitations may increase the risk of unauthorized identity confirmations during sophisticated attacks that use artificial intelligence to exploit biometric vulnerabilities. SAI Brazil recommended that the Secretariat of Digital Government of the Ministry of Management and Innovation in Public Services (Secretaria de Governo Digital do Ministério da Gestão e da Inovação em Serviços Públicos) conduct a feasibility study on the implementation of alternative and secure multi-factor authentication methods, prioritizing modern technologies that are resistant to social engineering attacks. In addition, auditors recommended taking measures to identify and mitigate potential performance disparities across specific demographic groups, including those who use low-quality devices or reside in areas with limited infrastructure.