In mid-December 2021, Brazil’s Congress ratified the Budapest Convention on Cybercrimes after an unusually fast process marked by little debate and almost zero transparency. Experts warn that the roll-out was problematic, not least because the treaty may put citizen data in general at risk and open the way to criminalizing the work of InfoSecresearchers and activists.