I recently saw that in Brazil, people who use VPNs to access X/Twitter after the ban could apparently be fined. I’m no expert whatsoever, but isn’t the whole point of VPNs to encrypt all of your activity? If so, how would the offenders, so to speak, even be caught and fined??
In: Technology
Simply monitor traffic to known-VPNs. Anyone sending/receiving traffic from there is a VPN user. They likely cannot track anything inside the VPN, but that is probably enough for a country that is censoring its peoples.
VPNs are still companies. A Brazil based one may comply with a court order to turn over customer info to the police.
Depending on the local laws (I’m not from Brazil), you can examine the person’s electronics.
VPNs only encrypt the traffic en route and hide the traffic origin and destination if intercepted. They don’t clean your device. It’s not impossible to remove all information about your internet traffic from a device, but it does take some know-how and effort.
Or the person may just confess.
VPNs have known locations, even things like the TOR network have known entrance nodes. If you’re sending packets to the Surfshark entry point in Brazil, then everyone knows you’re using a VPN. That said, this sort of cat-and-mouse battle is very, very hard to win. It’s also hard to do at scale, particularly since some programs “phone home” through VPN connections. It’s going to be hard to show that you’re using X and not some other app.
They would have to check logs at the VPN provider, unless the VPN provider has provided them with backdoor access for other reasons.
VPNs keep your traffic hidden between you and their entry point (encrypted), and then you’re anonymized at the exit point, so only the VPN provider knows what you’re looking at. If they don’t keep logs then no one will know what you’re doing.
Unless the government has spyware on your machine, or just checks with Twitter to see which Brazilian users are still logged on, they’re not going to know what’s up.
Like most criminal law the laws don’t care about how to implement detection. The laws only outline punishment.
A lot of laws are like this if you think about them.
They’re not going to snoop every computer but by blocking VPN software and firewalling their IPs they should stop most people. Then catching people becomes easier because those people need to take actions to illegally find a new VPN. heck the govt could set up a Brazilian honey pot.
But theoretically if you have access to the outside internet and enough money to set up arbitrary servers you can tunnel encrypted traffic without anyone knowing what it is.
You’re putting the cart before the horse.
Twitter is banned in Brazil and cannot be accessed.
If it is known you are in Brazil (and are notable enough to be noticed; such as a company or a celebrity) and are accessing Twitter; then you had to be using a VPN to be accessing it.
If all you’re doing is lurking; then yeah you can probably get away with it. But if you’re big enough and you’re liking, commenting and making your own posts then you’re going to get caught and fined.
It’s like a musician hiring a transportation company to drive them to a surprise public concert in an abandoned building.
The company doesn’t have to tell anyone that they drove someone there; it’s everyone seeing your concert that’s going to logically say “they had to have been taken there.”
One can tell a VPN is accessing a site, but they can’t tell who is using it. Unless the VPN company keeps logs and can be subpeona’ by the government that wants it.
This is obviously a very oversimplified explanation, but think of a VPN like this: If you’re wearing a neon striped shirt, everyone can easily see who you are at a glance. But if you wear a really boring black hoodie (a A VPN), just like a thousand other people nearby, then you’ll be nearly invisible. But, if you do something to draw attention, people can still look closely and find out who you are, and the guy who sells the black hoodies knows and could rat you out if asked.
So in this example, only one group of people is banned from going into the shop. With your hoodie on, they can’t see that you are a part of that group. The shopkeeper doesn’t question you. He doesn’t care about the ban, he just wants to sell stuff, so he’s putting minimal effort into enforcing it.
~~~
With very careful monitoring and surveillance of an individual, patterns can be found and traced, but it’s not realistically enforcable and it can’t be done en masse. For example if a VPN is always accessed at the same place, and at the same time as a notorious dealer is active, then now you can figure out who they are.
Some high-profile criminals have been caught like this, but only because they were dangerous or stupid enough to draw attention.
More likely is people will give away they’re using twitter by their posts and conversations, and they might get in trouble.
It’s a connective game. They know you used Twitter before, they know this account is you, that account is still active and they can see you’re using a VPN.
It’s not hard proof but it might be good enough for a court order to search your devices.
You don’t have to, just prove that a Brazilian living in Brazil made a tweet while they’re in Brazil. That means you just need to have their twitter account that is undeniably theirs and have their travel records that prove they’re within the country when the tweet is made.
No need to catch every last one of them, just the few dumb enough to get caught doing so. Most people won’t climb a low fence just because they can
Generally speaking, don’t overestimate the privacy protection you get from VPN usage. A lot of VPNs comply with subpoenas and court orders, and there may be technical vulnerabilities in some cases.
Latest Answers