The Nym Dispatch: X blackout in Brazil

Brazilian authorities last Friday ordered the blocking of X/Twitter throughout the country, affecting over 20 million X users in a country of more than 215 million people.

And this weekend, the blackout rolled out to worldwide surprise.

Brazil’s decision is a stunning turn of events, but it did not come out of nowhere. It was the result of a concerted political and legal campaign in Brazil since 2022 to neutralize the spread of socially damaging “misinformation” online. Despite these efforts, “digital militias” attacked the capital of one of the world’s largest and youngest democracies in 2023.

For months, the X platform has been in the crosshairs. And Elon Musk, X’s CEO, has gone out of his way to make a spectacle of pushing back against Brazil’s effort.

Lurking behind Brazil’s banning of X, however, is another legal decision which prohibits the use of Virtual Private Networks (VPNs). VPNs are estimated to be used by 37% of the Brazilian population (almost 3x the amount of X users in the country). Now, they face a fine of almost $9,000 a day (half the average annual salary for Brazilians) for any Brazilian citizen caught using a VPN to access X.

In this installment of the Nym Dispatch, we will first delve into how this conflict between X and Brazilian authorities originated and recently escalated. But we will also try to complicate the prevailing narrative behind the conflict. How does a ban on VPNs work exactly, and how can this affect the privacy of and access to information for VPN users in Brazil?

This threat against VPN users may have been nothing more than a scare tactic which was quickly backtracked on, and may ultimately be completely rescinded. However, it does raise awareness about how VPN service providers might be coerced to cooperate with state authorities, democratic or not.

Brazil v. X (2024)

So far the media focus has largely pitted X’s CEO, Elon Musk, as a “defender of free speech” against “authoritarian” censorship measures being taken by Brazil’s highest court. There is some truth to both of these takes, but the situation is much messier than this narrative lets on. In the end, the focus on the conflict between two ideological egos obscures too many real questions.

Can large tech companies claim immunity from jurisdictional laws? How should these companies navigate between democratic laws vs. authoritarian ones across the world? Should protections of freedom of speech online also include hate speech, incitements to violence, state propaganda justifying military invasions of sovereign countries, or deliberate misinformation campaigns to sway democratic voters? If not, who should decide what kinds of content gets to circulate on digital platforms? What is the line between “moderation” and censorship?

These are questions that so far remain unanswered: neither by Musk’s sensationalist and largely self-serving antics, nor the wholesale censorship of a platform as widely used as X. They are problems we need to think deeply about and discuss democratically as members of a digital society that is increasingly polarized into extremes.

The addition of VPNs to the equation, however, is a clear case of unnecessary governmental overreach. It ultimately undermines Brazil’s potentially legitimate case for some content “moderation,” giving fodder to its critics’ accusations of being authoritarian.

Brazil is not wrong about the threat of political misinformation. But to be at the forefront of combating it, it need not resort to draconian measures against the privacy tools of its own citizens. Targeting ordinary people for the use of VPNs, which have many legitimate and wide use-cases, is doing nothing to help the cause of digital democracy.

But first things first: how did this whole thing get started?

A row long in the making

At the center of this story is, perhaps disconcertingly, one man: Alexandre de Moraes, a Justice for Brazil’s Supreme Court and the nation’s elections chief. Moraes’ appointment and rise to power in Brazil is a complicated one, with close ties to the political right prior to the rise of Jair Bolonsaro.

As the New York Times reported in October 2022, Brazil’s Supreme Court made an unparalleled decision granting Moraes “unilateral power to order tech companies to remove many online posts and videos — one of the most aggressive actions taken by any country to combat false information.” While unusual for a democracy, it was seen as an urgent effort to curb the flood of misinformation on social media platforms in the middle of a pivotal election.

At the time, the right-wing populist Bolsonaro was seeking reelection against the returning candidacy of Luiz Inácio Lula da Silva (“Lula”). But as early as before the first round of voting, unfounded accusations of voter fraud began circulating from Bolsonaro’s camp through social media, priming supporters to reject the outcome whether it was democratic or not. As later criminal charges against Bolsonaro alleged, this was a concerted effort to contest the democratic results of what would become his demise and ultimate banning from seeking political office until 2030.

Despite Bolsonaro’s clear defeat, the trouble continued. In an reiteration of the violent reaction of Trump supporters to the 2020 election in the U.S., these disinformation bubbles online also led to the storming of the capitol by Bolsonaro supporters in 2023 in an effort to reverse Lula’s inauguration.

Since then, Moraes has been given a nearly unilateral mission: to save the democratic institutions of Brazil by ridding the Brazilian web of posts and whole accounts that spread political misinformation. In addition to removing particular contents deemed to be politically harmful, it has also targeted the accounts of social media influencers, politicians, and business people.

And now access to X has gone down following an extended battle between Moraes and X regarding the latter’s refusal to comply with these requests. As Moraes’ legal decision charges X, the social media platform

“allow[s] the massive spread of disinformation, hate speech and attacks on the democratic rule of law, violating the free choice of the electorate, by keeping voters away from real and accurate information.”

The bigger picture

This weekend’s escalation is the result of a months-long spat between Moraes and X’s chief executive Elon Musk. While certain media are portraying Musk as a victim of free speech infringements, the series of events in Brazil’s legal jurisdiction complicates his public self-victimization.

First, X refused to comply with orders from Brazilian authorities to take down content and accounts, ultimately threatening to jail X employees in response. Musk then closed X offices in Brazil. In reaction, Moraes summoned X to produce legal counsel in Brazil, as per Brazilian law for foreign companies. X failed to do so despite the ultimatum. Moraes then unilaterally announced the banning of X and began coordination with Brazilian ISPs to roll out the blackout.

Update: Four additional Supreme Court Justices have today upheld Moraes’ decision.

This is certainly not a cut and dry case for Musk and X, and it’s certainly not just about free speech. More than that, it’s a serious dispute over jurisdictional authority for foreign companies and the effects of information on a country, let alone one coming out of the authoritarian politics of Bolsonaro.

And yet Moraes’ program is by far from democratic, as many commentators are noting. He has so far maintained unilateral power to decide what content, accounts, and perspectives are permissible. While this may be politically justifiable today for one democratic society in turmoil, what does it mean for tomorrow, or elsewhere? Ultimately what is more important than a legal decision is the precedent it sets.

And with the targeting of civilians with interdictions on the use of privacy technologies like VPNs, the issue gets messier for a country struggling to defend democratic institutions against authoritarian threats.

So let’s assume that Moreas’ threat against VPN users in Brazil is a serious one, even if it will soon be, if not already, fully rescinded. How does VPN censoring work in the first place, not just in Brazil but everywhere?

How will Brazil censor VPNs?

When you use a VPN, all of your internet traffic is encrypted and routed directly from your device to the VPN’s servers via your Internet Service Provider (ISP). Keep in mind that an ISP is what provides you access to the internet in the first place, so it is always a first point of contact.

Whether you’re in Brazil or elsewhere, your ISP will see with whom you are immediately connecting, whether it’s a web service like X or an intermediary proxy like a VPN. But while using a VPN with encryption, the ISP cannot see the content of what you do, nor will they see who you are connecting with on the web. They will only see that you are connecting with the VPN.

So how can a country like Brazil enforce a law that regulates who accesses a web service like X with the use of a VPN if they can’t see the destination after the VPN proxy?

There are two possibilities:

• Rather than blocking access to X via a VPN, Brazil is actually ordering all ISPs in the territory to block known VPN access wholesale.
• The only other way is for VPN services to report a user’s X connection to the Brazilian government. In most cases, this would require the government to subpoena the VPN provider to hand over account and traffic records, if they have them, for users behind the specific connection. Or they do it of their own accord through government pressure.

Both of these possibilities underscore an infrastructural problem of traditional VPNs when it comes to protecting users’ privacy.

The VPN data problem

Most Virtual Private Networks, despite their name, are not really private. They are predominately centralized infrastructures fully capable of maintaining records not only of clients’ payment information, but also the metadata of all their traffic (encrypted content exempted).

While many commercial VPNs claim to keep “no logs” or “zero logs” of user traffic, this is ultimately a matter of faith for clients. And metadata records are likely kept in any case for “operational” network purposes.

VPN data leaks have exposed the extent to which client data is kept by many VPNs, and especially free ones. Government interventions like what is happening in Brazil further show the possible cooperation between legal surveillance orders, ISPs, and complying VPN companies.

One way around this privacy dilemma is to choose a VPN that is structurally incapable of keeping records because of its decentralized design.

But this may not solve a big problem for the censorship of information and access to via VPNs worldwide.

VPN censoring

This is certainly not the first time that VPNs have been the target of legal interventions and censorship at the state level.

One important function of VPNs is the ability to circumvent unjust censorship laws in certain countries. Their prohibitions, it shouldn’t be forgotten, are being used to block people’s access to any information which deviates from state propaganda. Privacy messaging apps like Signal have also become targets in an effort to interfere with people’s ability to maintain private contacts with dissident communities.

And even in democratic countries, Web3 services are increasingly becoming the targets of new legal and policing strategies in the name of combating social problems like the dissemination of child pornography, narcotics, and “terrorist” recruitment. The arrest of Pavel Durov, CEO of Telegram, in France is one case in point, but there are and will be others.

The digital information problem

There is definitely something rotten in the state of social media. Information bubbles generated by algorithmic surveillance, foreign bot farms inundating markets with targeted propaganda, and increasingly hostile ways of relating to one another: this is less free speech than it is information hijacking.

What these new battles surrounding access to expression and information on social media show is how powerful, and dangerous, information can be. In one context it may provide people the means to speak out against their own social oppressions. In another, it might just add foreign fuel to fascistic and authoritarian sentiments in sovereign countries so people don’t even understand what’s at stake where they live.

But to say there is one global problem of digital “misinformation” is a dramatic oversimplification. First, states and government-sponsored media laid the groundwork for mass propaganda campaigns long before the internet. US intelligence services used to have to drop propaganda leaflets over foreign cities to try to convince people to support a government favored by the West. Now similar things are happening with lightning speed through digital technologies.

And targeting VPNs in a round-up sweep against the refusal of some false “free speech” messiah is not going anywhere. Let’s have a real conversation about what it means to be citizens of the web, with our feet planted in diverse soils across the world. But doing so requires online privacy as a default.