A photo carries one date inside it, the device records another, and the service it passed through logs a third. Each belongs to a different owner, and each owner answers to a different law. That is why serious digital evidence is always correlation — and why serious correlation leaves a judicial paper trail.
Revolut handed over documents, verification selfies and customer statements to someone writing from a legitimate government domain. The request was fake. In Brazil, the law lets an administrative authority demand subscriber data without a judge, and the urgency exception widens that door further. What the Brazilian rule limits — and what it doesn't prevent.
Screenshot, file, timestamp, location: the reader calls all of it "evidence," while the law has a separate name for each one. Five of those names are defined by statute. The rest are forensic vocabulary. Knowing which is which is what separates what you present from what actually holds up.
On August 28 Take-Two went back to court: it sought a second subpoena to Discord with the target list under seal, and the same day withdrew its application against Google. One judge granted the new subpoena on August 31. Another had asked, days earlier, how the personas were identified. The question went unanswered.
The Banco Central promised that 2026 would bring a lookup showing whether your Pix key had been flagged for fraud — and warned, at the same press conference, that it would not include the reason. As of September 2026, neither exists. The report that does exist has a field called "Situação" (Status), and it answers a different question.
The flag can be created by a single institution acting alone, with no review by any other participant, under a standard the Banco Central itself put in writing that it has yet to define in objective terms. It circulates for five years among every institution — and access to the endpoint that exposes it is barred to the end user.
Brazil's tax authority has implemented the OECD's CARF, revoked the 2019 regime and changed who reports. Foreign providers are captured by how they advertise; anyone operating offshore or on a decentralized platform now reports on their own account.
Section 512(h) of the DMCA hands over a user's identity with no lawsuit and no judge. Brazil chose the opposite path and never built an equivalent. The gap between the two models is being measured right now, at the Supreme Court.
Three subpoenas filed in New York rely on a DMCA provision that requires no lawsuit and no judge. What they ask for goes well beyond the persona that signed the GTA VI leak.
A healthcare organization reported a data breach to the ANPD and posted a notice on its own website. The Authority opened a sanctioning proceeding anyway — because the duty to notify has content and a channel defined by regulation, and neither is the controller's to choose.
The hardware wallet maker has confirmed the exposure of names, phone numbers and home addresses belonging to 13,689 customers, Brazilians among them. The official guidance talks about phishing. The data that leaked is useful for something else — and Brazil ranks among the four countries with the most physical attacks on crypto holders since 2023.
What determines whether a case has anywhere to go is rarely what happens the following week. It's what gets preserved — or unwittingly destroyed — in the first hours, by someone who doesn't yet know they'll need it.