Between the Law and the Protocol: An Overview of Blocking Orders on the Brazilian Internet#

Pedro de Botelho Marcos, with Thiago Ayub and Vinícius Anselmo (NIC.br, per slides)

• Why: Court-ordered blocking has become a routine operator workload with measurable collateral damage — relevant both operationally and to any DNS/security product with filtering features.
• What: Brazil is estimated to have blocking orders covering roughly 135,000 Internet resources. One ISP received 733 orders between December 2022 and October 2026 (period growth: 16 → 150 → 295 → 272). Motivators: piracy, cybercrime, fake news. The mechanics are walked through end-to-end: ISP-resolver blocking vs public resolvers vs the registry sinkhole, IP/TCP-SYN interception at the AS border; and the evasions: VPNs, domain re-registration, IP changes. Collateral effects: shared-IP hosting takes down unrelated domains, indefinite IP blocks strand addresses as infringers move, and secret orders leave users unable to distinguish blocking from outages.
• How: Measurement over a single ISP's order corpus plus public data; the presenters explicitly do not question the validity of the orders themselves. Caveat from the slides: no guarantee all ISPs received the same order set.
• Where applicable: Brazil-specific dataset, but the overblocking mechanics and evasion patterns generalize to any jurisdiction with blocking regimes. A companion LACNIC/MARYVA study elsewhere in the program ("Site Blocking in Latin America and the Caribbean") covers 18 countries and finds reactive blocking now dominant, with dynamic IP lists and growing ISP obligations trending region-wide.