Turning VPN use into a criminal aggravating factor means treating caution as proof of guilt, because it prioritizes control over individual protection. A Brazilian law reveals that digital anonymity is no longer treated as a given right. President Luiz Inácio Lula da Silva signed law PL 3066/2025. This statute turns proxies, IP-masking techniques, and similar tools into indicators of unlawful conduct when linked to crimes against minors. It also allows the tracking of files shared on P2P networks without prior judicial authorization.

At the same ceremony at the Presidential Palace, First Lady Janja da Silva demanded that Discord be taken offline by whatever means necessary. Attorney General Jorge Messias announced he would file a lawsuit against the platform. The legal text does not declare VPNs illegal. It does something more insidious. It positions them as a factor that can aggravate a sentence once someone is already a suspect.

Brazil's Internet Steering Committee asked Lula to veto precisely that section. It warned that its broad wording could turn users of privacy tools into suspects. Lula signed it anyway. This approach — turning a protective tool into evidence of guilt — is mapped out in The Generosity in the Doorway. It examines how systems that promise security expand their mandate once installed. The process turns out identical even when the contexts differ.

The trigger was tragic. A thirteen-year-old girl in Naviraí, Mato Grosso do Sul, died by suicide during a livestream after a group of minors incited her. Police detained five teenagers between thirteen and seventeen years old and arrested an eighteen-year-old man. All of them used Discord and Telegram.

Why does Discord face removal demands while Telegram receives less scrutiny, if according to the government both violated digital laws? The question remains unanswered by any authority. A judge already rejected the police request to suspend Discord in the country. The judiciary fulfilled its check-and-balance role here.

Millions of Brazilians who never committed a crime now see an entire communication platform under threat. Journalists protecting sources, abuse victims who need anonymity, and anyone who simply prefers not to be tracked by default are all exposed. It's like closing every street in a city because a crime occurred on just one of them.

The second provision, known as the "virtual patrol," generates fewer headlines but perhaps greater consequences. It authorizes police and prosecutors to obtain connection data directly from providers without prior judicial warrant, as long as a judge is notified within the following forty-eight hours. For now it is limited to cases of flagrante delicto or risk to a minor's life. An October ruling by the Superior Court of Justice backs the tracking of files shared openly on P2P networks.

What does a judicial notification really protect if it arrives forty-eight hours after the data has already been extracted? On paper, the procedural safeguard exists. It arrives late. By then the data has already been extracted, already analyzed, already served its purpose. A formality. Without substance. I've observed similar dynamics in other regulatory frameworks: after-the-fact oversight rarely restores what is lost at the moment of extraction.

The Generosity in the Doorway argues that transparent governance requires controls prior to the act, not mere after-the-fact notifications. Notifying a judge two days later isn't oversight — it's an informational courtesy. Bill PL 3066/2025 had been moving through Congress since before the death in Naviraí. Approved in the Chamber of Deputies on May 19, the tragedy gave it emotional cover and political urgency. History shows that emergencies don't create these infrastructures — they only accelerate their deployment without the necessary scrutiny.

The law explicitly protects the legitimate use of anonymization tools. In theory. The real question is who decides, at the moment of an arrest, what counts as legitimate. That discretionary power sets a precedent. Once the State establishes that a VPN can aggravate guilt, future laws in any country that copies the model will have the legal groundwork ready. Messias had not yet filed his lawsuit against Discord. The political noise may have been enough. The law, however, remains signed, and the tracking capabilities already exist.

Stones don't lie. How far will this logic go before anonymity becomes a privilege reserved only for those who can afford extra layers of protection?

Sources:

1. PL 3066/2025, National Congress of Brazil (Chamber of Deputies, approved May 19; Federal Senate)

2. Brazilian Internet Steering Committee (CGI.br), public statement on Article 226-A

3. Statements by Victor Fernandes, Secretariat of Digital Rights, Brazilian Ministry of Justice

4. Superior Court of Justice of Brazil, October ruling on P2P network tracking

5. Public statements by Janja da Silva and Jorge Messias, ceremony at the Presidential Palace