Samarco's Fundão dam made tailings governance and river restoration a mining accountability test

Summary

• On 5 November 2015, Samarco's Fundão tailings dam failed near Mariana, Minas Gerais. A rapid liquefaction flowslide killed 19 people, destroyed Bento Rodrigues and carried mine tailings through tributaries and the Rio Doce toward the Atlantic. The technical record links the failure to a chain involving the dam's changing geometry, deposition of slimes in locations inconsistent with the original concept, saturated conditions, drainage limits and continuing raises. Those technical findings explain a failure mechanism; they do not by themselves decide criminal guilt, civil liability or the amount owed to any claimant.
• The disaster became a governance failure before and after collapse. Before it, design changes, water balance, drainage performance, liquefaction risk, monitoring, independent assurance and community warning did not combine into a barrier strong enough to stop operation or protect people downstream. After it, environmental measurement, emergency support, claimant identification, compensation and river restoration were divided among companies, a private foundation, federal and state bodies, prosecutors, courts and affected communities. Each produced evidence under different authority and on different timelines.
• The 2024 Rio Doce agreement replaced much of the earlier reparations architecture with public funds, defined corporate obligations and judicial monitoring, but an agreement is a delivery framework rather than proof of completed repair. Durable accountability requires claimant-level payment evidence, community participation, independently reproducible water and sediment data, completed resettlement, restored livelihoods, risk-based ecological endpoints and operating controls that can demonstrate no return to the pre-failure tailings model.

The collapse of Fundão is often summarized by three facts: a dam failed, 19 people died, and tailings travelled hundreds of kilometres through the Rio Doce basin. Those facts are indispensable, but they do not explain why the event remains an accountability test more than a decade later. A tailings facility is not only an embankment. It is a changing engineered system whose safety depends on deposition practice, water management, drainage, construction geometry, instrumentation, expert interpretation and authority to stop production.

Once that system fails, responsibility expands downstream into warning, rescue, water supply, health surveillance, habitat recovery, livelihood repair, compensation and the governance of evidence across many jurisdictions.

The official and technical records also demand disciplined language. “Cause” can mean the physical mechanism that transformed tailings into a flowslide, the operational conditions that made the mechanism possible, a management decision that allowed risk to continue, or a legally attributable act. “Damage” can mean an acute measured impact, a modelled ecological pathway, a claimed economic loss or a harm accepted in a settlement. “Repair” can mean an activity performed, an invoice paid, a habitat endpoint achieved, or a claimant who considers a remedy adequate.

Treating these terms as interchangeable hides the very controls that accountability must test.

A changing dam, not a single moment

Fundão was built to receive waste from iron-ore processing at Samarco's Germano complex. Its original operating concept depended on separating coarser sandy tailings from finer slimes and maintaining a sufficiently broad, unsaturated sand zone upstream of the retaining structure. In that concept, beach geometry, drainage and deposition were not secondary housekeeping matters. They were the means by which pore-water pressures and material behaviour were controlled as the dam rose.

The Fundão Tailings Dam Review Panel record preserves the panel's report on the immediate causes. The panel was commissioned through counsel retained jointly by Samarco, BHP Billiton Brasil and Vale, and its members conducted geotechnical and seismic analysis. It concluded that the failure initiated at the left abutment as a liquefaction flowslide.

Its causal account described a progression in which drainage problems and structural changes produced a setback in the dam alignment; slimes came to exist beneath parts of the sand embankment; the setback imposed additional loading; and saturated sand capable of brittle, undrained response was left in a critical zone. Small earthquakes on the day of failure contributed an additional increment, but the report did not describe them as an adequate explanation independent of the dam's vulnerable condition.

That commissioning history is a necessary boundary. The panel was expert and its methods and data are central to technical reconstruction, but it was not a Brazilian criminal court, public prosecutor or regulator. Its mandate concerned immediate physical cause. It did not allocate every corporate duty, decide whether a named person committed an offence, value losses or certify restoration. Conversely, describing it only as a company report would ignore the depth of its geotechnical testing and the convergence later visible in judicial and public records.

The appropriate use is to test its mechanism, assumptions and data against other evidence while retaining its scope and sponsorship.

BHP's contemporaneous release of the panel findings confirms that Samarco and its shareholders jointly commissioned the investigation and made the findings public after a ten-month process. It is reliable for what BHP said, how the investigation was constituted and what response it announced. It is not independent proof that every lesson was implemented, that governance responsibilities were fully discharged or that later legal claims were resolved. A corporate acknowledgement and a technical report are important evidence families, but neither substitutes for regulator records or adjudication.

The dam's design evolution matters because risk was created cumulatively. A toe drain that did not perform as intended, the need to address galleries, movement of the alignment, placement of tailings behind dikes, limited public evidence beach width, rising pore pressure and repeated raises were not isolated defects. Each changed the assumptions on which the prior stability case depended. When an engineered facility evolves materially, continued reliance on an original design intent is unsafe unless the as-built and as-operated condition is recharacterized.

That requires controlled drawings, deposition histories, survey surfaces, piezometric time series, drainage flows, material testing and stability analyses using credible undrained behaviour.

The Brazilian workplace-safety record adds an organizational lens. Fundacentro's account of the labour inspectors' accident-analysis report identifies the Fundão structure as part of a larger tailings-disposal system and reports that the analysis addressed organizational and managerial dimensions as well as physical events. An accident-analysis report serves prevention and labour enforcement. Its findings should not be converted into a criminal verdict, but they make a crucial control point: management of change is not complete when an engineer produces a new sketch.

It is complete only when changed geometry, drainage, operating limits, monitoring thresholds, emergency consequences and responsible approvals are integrated and independently challenged.

The national dam-safety system's 2016 annual report recorded Fundão as a mining-dam accident, listed 19 fatalities and described liquefaction as the probable collapse mechanism. It also situated the disaster within Brazil's regulatory reporting system. An annual safety report is a public-policy record, not a substitute for the full causal investigation. Its value lies in showing what the supervisory system recorded, how the event was classified and why declared safety information must be capable of challenge by regulators rather than accepted as an operator-owned truth.

The controls that should have interrupted the sequence

The first missing control was a living design basis. Every raise and deposition phase should have been traceable to a current three-dimensional model of sand, slimes, drains, galleries, water levels and foundation conditions. A redline drawing is limited public evidence when the material state determines stability. The assurance file should show the actual beach width, the location and thickness of low-permeability layers, the elevation and performance of drains and the pore-pressure response to loading. Uncertainty should be represented as a range that drives conservative operating limits, not buried in an average parameter.

The second was formal management of change. A setback created to address one problem can create another by placing new load over unexpected materials. The decision record should identify why a change was needed, which original assumptions it invalidated, the calculations required before construction, independent-review comments, hold points and the evidence needed for release. If a temporary geometry persists for years and receives repeated raises, it must be treated as the permanent safety case until removed. Labels such as “temporary” do not reduce loading or pore pressure.

The third was water and deposition control. Tailings operations should define a minimum beach width, permissible pond location, maximum rate of rise and drainage-performance thresholds. Those limits need direct measurement and reconciliation with production data. A daily mass and water balance should show what entered the facility, where it was deposited, what water was recovered, what drained and what remained stored. Exceptions should trigger engineering review automatically. Production targets cannot be allowed to redefine a geotechnical limit through repeated informal acceptance.

The fourth was liquefaction-specific analysis. Conventional static factors of safety can be falsely reassuring if contractive saturated tailings may lose strength rapidly under undrained loading. The design basis should state which zones are susceptible, what residual or post-peak strengths are used, how trigger mechanisms are evaluated and how progressive failure is modelled. Independent reviewers should reproduce critical analyses rather than review only inputs and conclusions. A finding that a dam is stable under one assumed drainage state is not transferable to a changed, wetter geometry.

The fifth was anomaly governance. Piezometers, survey monuments, drains and inspections do not protect anyone unless observations lead to decisions. Each instrument needs an expected range, trend threshold, data-quality rule and named action owner. A missing or implausible reading should be an exception, not a blank cell. Repeated seepage, cracking, blocked drainage or beach-width departures should be plotted across raises and design revisions. The review meeting must ask what evidence could disprove the current safety assessment and who can order deposition to stop.

The sixth was emergency protection. Communities downstream need warning that works faster than the failure mode. For a structure susceptible to a rapid flowslide, a plan dependent on visual confirmation at the dam is inherently weak. Inundation mapping, automatic detection, redundant sirens, direct civil-defence communication, marked evacuation routes, drills and support for people with limited mobility are engineering barriers. The test is not whether a plan existed, but whether an alert could be initiated, received and acted upon in the available time under loss of power or communications.

The seventh was board and shareholder assurance. A joint venture does not remove owner-level responsibility for material risk. Boards need a common, verified view of facility condition, unresolved technical disputes, changes from design, independent-review findings and emergency readiness. Reporting only a colour-coded risk rating strips away the evidence needed to challenge optimism. The assurance function should have direct access to underlying data and freedom to commission work outside the operating chain.

These controls are distinct from hindsight. They do not require predicting the exact minute or crack path of failure. They require recognizing that a high-consequence tailings facility with changing geometry, saturated contractive material and imperfect drainage must be governed against rapid loss of strength. Accountability attaches to whether those foreseeable control needs were assigned, funded, tested and escalated—not to a claim that every entity knew a collapse would occur on 5 November.

From Bento Rodrigues to a river-basin emergency

When Fundão failed, the physical event outpaced organizational boundaries. The flowslide overtopped or passed through downstream controls, reached Bento Rodrigues and continued through the Gualaxo do Norte and Carmo systems into the Rio Doce. People were killed, homes and community spaces were destroyed, infrastructure was damaged, water intakes were disrupted and sediment moved through freshwater, estuarine and coastal environments. The consequences varied greatly by place and time: burial and erosion near the mine; turbidity and water-supply crisis downstream; changes to sediment, habitat, fishing and livelihoods over a much larger area.

Ibama maintains an official document collection for the Fundão disaster, including impact reports, field operations and technical notes. The collection is important because river-basin accountability depends on a time series, not one post-event sample. It also reveals a data-governance challenge: reports produced by different teams, contractors and institutions must retain sampling locations, methods, detection limits, chain of custody, quality controls and version history. A portal proves that documents are available; it does not by itself prove that the dataset is complete, interoperable or sufficient to establish recovery.

Ibama's preliminary technical report on environmental impacts was prepared to support public action soon after the failure. It documented acute regional effects on ecosystems, fauna, flora and socioeconomic conditions and described destruction along the affected waterways. “Preliminary” is a substantive limitation. The report captures early observations and regulatory assessment; it cannot establish every chronic pathway, later concentration, ecological trend or individual exposure. Its value is strongest when used as a baseline of observed acute harm and as a map of questions requiring longer monitoring.

The difference between tailings presence and toxic effect requires care. Iron-ore tailings can cause severe physical damage by burial, abrasion, turbidity, altered channel form and smothering even when a particular sample is not classified as acutely toxic. Metals naturally present in sediment may change in mobility with pH, redox conditions and grain size. A measured concentration above a reference value may identify a need for investigation but does not automatically prove a health outcome. Equally, a result below one threshold does not prove that fishing, habitat or community confidence has recovered.

The relevant endpoints depend on the use being protected.

ICMBio's partial technical report on coastal and marine monitoring discusses observations before and after the plume reached the Rio Doce mouth. It supports the fact that the event required marine as well as river monitoring and that conditions varied with river flow and sampling campaign. A partial monitoring report should not be treated as a final basin-wide ecological verdict. Its proper use is to identify measured patterns, methods and uncertainty, then test whether later programs sampled the same stations and added biological, sediment and food-web endpoints.

Human-health evidence needs the same discipline. The Ministry of Health's Linhares health-risk assessment record provides an official location-specific study rather than a generic claim about all residents. Risk assessment combines hazard, concentration, exposure pathway, duration and population characteristics. It can identify contaminants and pathways needing management, but it does not diagnose every person's illness or support extrapolation to places not sampled. Health accountability therefore requires linked environmental surveillance, clinical access, transparent protocols and a way for communities to challenge sampling design.

River restoration cannot be audited with one basin-wide label. The basin should be divided into reaches and functional systems: tributaries near the source, reservoirs and depositional zones, main-stem river, floodplain soils, estuary and adjacent coast. For each, the plan needs baseline or reference conditions, stressor pathways, remedial actions and measurable endpoints. Channel stabilization may be appropriate in one reach while natural recovery and monitoring is less disruptive in another. Dredging may remove concentrated deposits but can also resuspend material and damage habitat.

Every intervention needs a comparative alternatives record and a criterion for stopping.

Data locality is central. Affected people need access to results tied to places they recognize, not only basin averages. Fishers need species- and area-specific information; water utilities need intake and treatment data; farmers need soil and irrigation evidence; Indigenous and traditional communities need assessments that respect territory, food practices and cultural use. Publishing a large spreadsheet without maps, methods or uncertainty transfers the burden of interpretation to the public. A legitimate system provides raw data, validated summaries and community-readable explanations at the same time.

Allegations, findings and remedies belong on separate tracks

The Federal Public Prosecutor's Samarco case portal describes the disaster, the companies involved and the scale of the public response. It also reflects the MPF's institutional position in litigation and negotiation. Prosecutorial allegations are not adjudicated facts merely because they are published by a public authority. The portal is authoritative evidence of what the MPF alleged, sought and did; technical and legal conclusions must still be tied to the relevant report, agreement or judgment.

This distinction is especially important because the disaster produced overlapping civil, environmental, administrative and criminal proceedings. A civil public action can seek restoration, compensation and collective remedies under standards different from a criminal prosecution. An administrative fine addresses a statutory violation under its own appeal process. A settlement can allocate money and work without a trial finding on every disputed issue. A technical panel can identify a failure mechanism without determining legal culpability.

Reporting should retain the verb appropriate to each: investigators “concluded,” prosecutors “alleged,” parties “agreed,” a court “held,” and an operator “reported.”

The first major transaction and conduct-adjustment agreement, the TTAC, created programs and a private foundation, Fundação Renova, to implement socioeconomic and socioenvironmental measures under oversight by an interfederative committee. That architecture created a centralized delivery vehicle, but it also raised questions about independence, participation, eligibility and the power of affected people within a system funded by the companies responsible for the remedy.

The MPF's TAC Governance questions and answers explains why later governance negotiations sought stronger participation by affected people, independent technical advice and greater control by prosecutors, defenders and public bodies. It records the MPF's criticism that the original TTAC structure lacked effective participation beyond a limited consultative role. This is an institutional account, not proof that every decision by Renova was defective.

It does establish the governance problem that later agreements attempted to correct: the entity implementing remedy could not be the sole judge of claimant recognition, program adequacy and completion.

Compensation systems create their own evidence risks. Eligibility rules need objective documents, but disasters often destroy documents and disrupt informal livelihoods. Fishers, small farmers, traders, care workers and traditional communities may have income and resource use that formal registries do not capture. A program designed only around pre-existing databases can be administratively consistent while systematically excluding real loss. The remedy file must therefore record documentary paths, alternative proof, reasons for rejection, appeal outcomes, demographic patterns and whether accepting payment requires a release.

Payment totals also require a denominator. “Billions paid” does not reveal how many eligible people remain, how long claims took, what categories were excluded, whether legal fees reduced receipts, or whether payment restored livelihood. A claimant-level audit should protect personal information while reporting cohorts: applications, approvals, rejections, appeals, time to decision, amount, release scope and unresolved complaint. The same standard applies to resettlement.

Houses delivered are not equivalent to a functioning community unless land title, water, transport, schools, religious and cultural spaces, livelihoods and resident acceptance are tested.

Criminal accountability remains a separate and unfinished public record as of the publication date. The TRF6's March 2026 case update says an appeal was under consideration against the November 2024 first-instance acquittal of 11 defendants, which had rested on limited public evidence proof of direct, individualized criminal responsibility. That source supports the procedural status, not a claim that acquittal erased the physical causes, civil obligations or environmental harm. Nor does the existence of an appeal establish guilt.

Criminal liability requires proof and individual attribution that cannot be inferred from a corporate role or an engineering failure alone.

The 2024 agreement is a new control architecture

After years of disputed implementation and negotiation, public bodies, justice institutions, Samarco, Vale and BHP entered a new Rio Doce agreement in October 2024. The official judicial agreement record provides the controlling instrument and its annexes. The agreement was later homologated by Brazil's Supreme Federal Court. It restructures responsibilities among companies and public authorities, addresses individual and collective measures, and sets long-term payment and delivery obligations.

Because the instrument is extensive, any statement about eligibility, release, deadline or responsible entity should be traced to its specific clause and annex rather than to a press summary.

The Attorney General's Office announcement of the agreement described a total framework of R$170 billion, including R$132 billion in new resources for repair and compensation. Those are official headline figures, but they are not a single cash account available immediately. They combine different categories, timelines, prior expenditures and obligations. Financial accountability must reconcile scheduled transfers, corporate work, public spending, inflation or adjustment provisions, recipient entities and completion evidence. Announcing a total is the start of that ledger, not the end.

The BNDES Fundo Rio Doce portal describes the fund created to receive resources for collective socioeconomic and socioenvironmental measures managed by the federal government. Moving significant implementation authority into public institutions changes the conflict-of-interest structure, but it also creates public-sector delivery risk. The fund needs project selection criteria, territorial allocation, disbursement records, procurement transparency, conflict controls and outcome reporting. A transfer into the fund is proof of payment by a company; it is not proof that a river reach or livelihood has recovered.

The new arrangement also assigns defined individual payments to categories such as professional fishers and family aquaculture or agriculture under specified criteria. The Ministry of Fisheries and Aquaculture's individual compensation guidance describes a R$95,000 one-time modality and its registry, residence and prior-claim conditions, as well as non-cumulation with certain other individual compensation routes. This page is authoritative for program instructions at the time checked.

It does not prove that every affected fisher was registered, eligible, informed, represented or paid, and a deadline or registry rule may itself be contested through legal channels.

A robust delivery ledger should separate five states. “Committed” means an agreement creates an obligation. “Funded” means money is transferred or reserved. “Contracted” means an implementing entity has authority and resources. “Delivered” means a defined output exists. “Effective” means an independently measured social or ecological outcome meets the agreed endpoint. Public reporting often collapses these states into “completed.” The Fundão record shows why that is misleading: a program can exist for years while an individual waits, a project is redesigned or a monitoring dispute remains unresolved.

The agreement's judicial supervision is therefore material. In July 2026, TRF6 reported a further monitoring hearing on the Rio Doce agreement covering environment, housing, repair works, transparency and compensation under authority delegated by the Supreme Federal Court. A hearing and progress presentation show active oversight; they do not certify compliance with every obligation. Effective monitoring requires a public exceptions list, due dates, responsible parties, evidence standards and reasoned dispositions when an obligation is changed or declared complete.

Restart is not restoration

Samarco's operations stopped after the failure and later returned under a corrective licensing process. Minas Gerais's environmental authority provides an official record of Rio Doce recovery and Germano licensing, including suspension of licences, the corrective process and the October 2019 operating licence with approved controls and conditions. A licence is a regulatory authorization based on a defined proposal and conditions. It is not a declaration that all historic damage has been repaired, that civil claims are satisfied or that future performance is guaranteed.

Restart assurance should be tested against the failure mechanism. A new tailings route must show how much material is filtered, its moisture and geotechnical properties, where it is stacked or confined, how contact water is managed and what happens during upset conditions. Capacity expansions must not allow a temporary disposal route to become overloaded. Independent engineers should verify construction and operating records, and the regulator should have direct access to instrument data, material balances and deviations.

Emergency planning remains necessary even when the new system is described as dam-free, because pits, stacks, water structures and process facilities still have failure modes.

Corporate funding and production incentives also need separation from safety decisions. The new agreement depends partly on Samarco's ability to fund obligations over many years, while operations create pressure to increase capacity. That does not mean production and repair are inherently incompatible. It means boards, regulators and courts need transparent rules preventing financial need from lowering geotechnical margins or delaying remedy. Dividend, capital expenditure, expansion and reparations schedules should be visible enough to test whether the responsible entities can meet both operating and restoration duties.

The English High Court's 2025 stage-one judgment in Município de Mariana v BHP provides a detailed judicial examination of technical history, corporate conduct and Brazilian-law issues in claims brought against BHP group defendants. The court found liability at that stage on grounds set out in the judgment, while leaving claimant-specific damage, causation, limitation and other issues for later processes. It is a foreign judgment applying Brazilian law in defined proceedings, not a Brazilian criminal verdict or a final damages schedule.

Its factual findings and legal conclusions must be reported with the parties, stage, issues and any later appellate status intact.

The coexistence of Brazilian agreement mechanisms and foreign litigation is not necessarily duplication in every legal sense. Different defendants, claimants, releases, limitation questions and heads of loss may be involved. Nor can one assume that participation in one scheme automatically extinguishes another claim. The controlling documents and judgments must be examined claimant by claimant. This is why release language, legal representation and informed consent belong in the compensation dataset rather than in inaccessible case files.

An audit framework for durable repair

The first audit domain is technical reconstruction. Preserve the complete design basis, change register, as-built surveys, deposition records, water balances, instrument data, inspection reports, expert reviews and board risk reports. Reconstruct the geometry and pore-pressure condition for each raise. Identify when original assumptions ceased to hold and whether each change received independent analysis. Keep competing hypotheses and sensitivity results, not only the adopted narrative. The goal is to make future safety decisions reproducible, not to create a document archive that only specialists retained by one party can use.

The second domain is emergency performance. Reconstruct the warning timeline from first anomaly or collapse indication to messages, sirens, civil-defence action and evacuation. Map who received an alert and who did not. For current facilities, run unannounced end-to-end tests: detection, decision, transmission, siren coverage, route clearance, transport and accountability at assembly points. Include workers, schools, visitors, night shifts and people with disabilities. Publish deficiencies and closure dates. A siren installation photograph is an output, not proof of warning effectiveness.

The third is environmental evidence. Create a basin-wide data standard covering coordinates, depth, medium, method, laboratory, quality flags and detection limits. Maintain immutable raw results and versioned interpretations. Pair impacted stations with reference sites and publish trends for water, sediment, biota and habitat. Define action thresholds and explain whether they are regulatory, ecological or health based. When methods change, run overlap sampling so that apparent improvement is not a laboratory artefact.

The fourth is health. Establish exposure pathways by territory and population, integrate environmental and health surveillance without exposing personal data, and fund independent review. Record access to testing and treatment, not only study publication. Distinguish diagnosed disease, elevated risk, reported symptom and community concern. Each deserves a response but supports a different inference. Long latency and mobility mean the program needs continuity beyond short project cycles.

The fifth is claimant remedy. Publish anonymized cohort statistics from first contact to final disposition. Measure outreach, documentation barriers, alternative proof, eligibility, amount, processing time, appeal, legal cost and release. Audit outcomes by municipality, gender, livelihood and traditional-community status to identify systematic exclusion. Affected people need independent technical and legal assistance funded in a way that does not allow the paying companies to select or control advisers.

The sixth is resettlement and community continuity. Completion criteria should be developed with residents and cover title, construction quality, utilities, transport, schools, worship, cemeteries and memorials, productive land, business restart and social networks. Inspect defects after occupation and track whether households remain. A building can pass a construction inspection while a community remains socially or economically nonfunctional.

The seventh is financial traceability. Map every agreement obligation to payer, recipient, schedule, adjustment rule, procurement, output and outcome. Reconcile corporate reports with bank receipts and public accounts. Separate prior expenditures from new money and cash from obligations to perform work. Flag late, disputed, reallocated and unused resources. Independent audit should sample underlying transactions and site delivery rather than certify totals alone.

The eighth is institutional independence. Record who selected, instructed and paid each expert; who owns the data; whether affected communities can propose questions; and how disagreements are resolved. A company-funded study is not invalid, and a government report is not automatically complete. Credibility comes from transparent methods, preserved raw evidence, conflict disclosure, peer challenge and a reasoned response to adverse findings.

The ninth is operating assurance. For every current tailings or waste structure, publish a concise safety case showing material flows, storage capacity, water controls, credible failure modes, monitoring thresholds, independent reviews and emergency readiness. Regulators should compare declared data with direct inspections and remote or automated evidence. Boards should receive unresolved exceptions and near misses, not only compliance percentages. Expansion approval should depend on demonstrated performance at the existing rate.

The tenth is closure and long-term stewardship. Mines and restoration institutions may change ownership, restructure or cease operating while environmental obligations persist. Financial assurance must cover monitoring, maintenance and intervention after production ends. Data and responsibilities need transfer provisions. River recovery endpoints should specify what happens if progress stalls, a contaminant remobilizes or climate extremes alter channels and deposits. “Final” settlement cannot mean that future evidence is ignored.

An eleventh domain is counterfactual testing. Auditors should ask not only whether a control now exists, but whether it would have interrupted the historical sequence at the point claimed. Would an updated survey and slimes model have stopped the next raise? Would the current independent-review mandate have covered the setback and undrained response? Could today's alert reach Bento Rodrigues within the available interval, including during a power or network failure? Would current claimant rules recognize the informal livelihood documented in a rejected historic file?

Would a restoration threshold trigger new work if sediment moved after a flood? This method prevents reforms from being credited merely because they use modern language. It ties each control to a decision, a measurable response time, a responsible person and evidence of successful execution. Where the answer depends on optimistic assumptions, the reform remains unproven and should stay on the public exceptions register.

The accountability standard

Fundão was not made inevitable by the general difficulty of tailings management. Its safety depended on identifiable controls: maintaining the separation and drainage assumed by design; understanding the materials actually placed; reassessing a changed alignment; testing liquefaction vulnerability; acting on seepage, pore pressure and geometry; independently challenging the safety case; and warning communities. The failure of those controls created a rapid physical event whose consequences could not be contained within the mine boundary.

Responsibility after collapse is equally concrete. Companies must fund and perform obligations, but cannot be the only arbiters of success. Public bodies must regulate, monitor and deliver without treating transferred money as restored outcomes. Prosecutors and courts must preserve the standards and boundaries of their proceedings. Scientists must make methods and uncertainty visible. Affected people must have the information, representation and decision rights necessary to challenge classifications that determine their homes, health and livelihoods.

The 2024 agreement is consequential because it reallocates money, work and authority after years of contested governance. Its legitimacy will be earned through implementation: people paid without avoidable exclusion, communities rebuilt as communities, transparent projects delivered by public institutions, ecological actions chosen from evidence, and judicial monitoring that exposes delay rather than merely recording meetings. The correct metric is not how many programs are labelled complete, but whether each obligation can be traced to a verified outcome and an affected territory.

Mining accountability also extends to the present operation. A corrective licence and a different tailings process are meaningful barriers only if their assumptions are tested continuously, exceptions are visible and production cannot outrun safe capacity. Technical learning must survive changes in executives, contractors, commodity prices and corporate structure. The safest evidence is not a promise never to repeat Fundão. It is a control system that detects when conditions diverge from the promise and has the authority to stop.

The Rio Doce will not provide a single date on which restoration becomes complete. Rivers move sediment, ecosystems respond unevenly, livelihoods adapt and new evidence changes priorities. That uncertainty does not make accountability impossible. It makes predefined endpoints, local data, independent review and adaptive obligations more important. A credible institution can say what has recovered, what has not, what remains uncertain and what it will do next.

Fundão therefore set two tests that must be passed together. The first is whether mine operators, owners and regulators can prove that tailings governance controls the physical conditions capable of rapid failure. The second is whether companies and public institutions can prove that a long, distributed remedy restores rights and ecological function rather than merely administers claims. Until both are supported by reproducible evidence, funded capacity and public challenge, the disaster remains not only a historic collapse but an active test of mining legitimacy.