There is a comforting story people tell themselves about the VPN icon in the menu bar: that it makes them anonymous. It is one of the most widely held and most wrong beliefs in everyday security. A VPN is not an invisibility cloak that removes you from view. It is a curtain across one window, and anyone who can get a court to ask what is behind it just has to ask. Two recent cases show exactly where the curtain ends, and they are worth understanding whether you are defending a network or simply trying to grasp what these tools do and do not do.
The core idea is simple once you see it. Your identity online is not one thing, it is three layers stacked on top of each other, and a VPN only touches the top one. Miss that, and you can do everything the privacy guides tell you and still be named.
Three layers, and a VPN only covers one
Picture your presence on a network as three layers. The network layer is where your traffic comes from and where it goes: your IP address, the route your packets take, what your internet provider can see. The account layer is who you are signed in as: the Microsoft, Google, Apple or Discord accounts logged in on that same machine. The device layer is the machine itself: the persistent identifiers your operating system and hardware generate and report home, quietly, as a matter of routine.
A VPN operates entirely on the first layer. It genuinely does useful things there: it hides your IP address from the websites you visit, and it hides the content and destination of your traffic from your internet provider. If your goal is to stop a website seeing your home IP, or to stop your ISP building a profile of the sites you browse, a VPN is the right tool and it works.
But it does nothing for the other two layers, and this is the part the marketing never mentions. If you are logged into your Google account while using a VPN, you are still logged into your Google account. The tunnel changes the address your traffic appears to come from; it does not log you out, and it does not stop the service knowing exactly who you are. And underneath both, the device carries on reporting the identifiers baked into it, over that same VPN connection, to whichever vendor built the operating system. The curtain covers the window. It does not cover the nameplate on the door, or the device broadcasting its serial number through the wall.
The device layer: ran a VPN, still got named
The clearest illustration this year came from the case of a 19-year-old accused of belonging to Scattered Spider, the social-engineering crew behind a long run of high-profile intrusions. By the standards of operational security, the alleged operator did the textbook things. He used a VPN during the intrusion. He used proxy and tunnelling tools. He operated across several countries. On paper, a ghost.
According to the unsealed US complaint, none of that mattered, because investigators did not need to defeat the VPN. Every Windows installation generates a persistent identifier that Microsoft calls a Global Device Identifier, or GDID, used for telemetry, licensing and update services. It is tied to the operating-system install rather than to any account or IP address, and critically, it does not change when you switch IP addresses or turn on a VPN. Microsoft records reportedly showed the device carrying that identifier hitting a tunnelling-service signup page at the exact minute the attack account was created, and then the same identifier surfacing alongside personal accounts, on home IP addresses in the cities his own travel records placed him in. The VPN rotated the address the traffic came from. The device identifier stitched every session back to one machine anyway, and legal process to Microsoft did the rest.
I have written separately about the mechanics of this kind of Windows device identifier and how it rides along on telemetry, so I will not repeat the plumbing here. The point for this article is the layer it operates on. The VPN did exactly what a VPN does, at the network layer, faithfully. The identifier that named him lived a layer below, at the device, where the VPN has no reach and never claimed to.
The account layer: they do not break it, they subpoena it
The second case, unfolding as I write this, comes from the hunt for the person behind a wave of Grand Theft Auto 6 gameplay leaks, operating under the name Cyberleek. Rather than attempt any technical de-anonymisation, the publisher went to a federal court and filed subpoenas compelling Microsoft and Discord to hand over identifying records. Reading what was reportedly requested is the fastest education in what the account layer actually holds: account IDs, registration and login IP addresses, phone numbers, linked Google and Xbox connections, Windows device identifiers, and the contents of cloud storage referencing the leaked material.
Notice what is absent from that list. Nobody is trying to crack the VPN. They do not need to. If the person behind the alias logged into a Microsoft or Discord account from the machine that handled the leaked files, the link between the account and the device already exists in a company's logs, and a lawful order turns it over. A VPN changes none of this, because the VPN was protecting the network layer, and the request is aimed squarely at the account and device layers, where the tunnel offers nothing.
This is the pattern worth internalising, and it generalises well beyond hackers and game leakers. Serious de-anonymisation, the kind that ends in a courtroom, rarely involves breaking encryption. It involves correlation and legal process: matching a persistent identifier across sessions, then compelling the company that holds the records to connect that identifier to a person. The encryption is left standing. It was never the obstacle.
Tor has the same blind spot, one layer up
It is tempting to conclude that Tor, or a decentralised VPN, closes the gap. It raises the bar at the network layer, but it does not change the shape of the problem, and it is important to be honest about why.
Tor's own well-documented weakness is traffic correlation. An adversary who can observe both ends of a connection, the traffic entering the network near you and leaving it near the destination, does not need to break any encryption. They line up the timing and the size of the packets at each end and match them. That is a network-layer attack that sidesteps the cryptography entirely. But even setting that aside, Tor does nothing for the two layers a VPN also misses. Log into a named account over Tor and the account still names you. Run it on a device that reports persistent identifiers and the device still reports them. You have hardened the layer that was already the strongest and left the two weaker layers exactly as exposed as before.
Encryption, whether from a VPN or Tor, protects the content of your traffic and, to a degree, its destination. It does not protect the fact of who is talking, which is precisely what account logins and device identifiers give away.
What real separation would take, and why almost nobody achieves it
If the three layers are the problem, then real anonymity means covering all three at once, and that is far harder than installing an app. It means a separate device that has never touched your everyday identity, signed into separate accounts created and only ever used for the separate activity, over a network path that cannot be correlated back to you, with the discipline never to cross the streams even once. A single login to a personal account on the anonymous device, a single reuse of a phone number, one session where the timing lines up, and the separation collapses. The identifiers are persistent and the correlation is cumulative; you have to get it right every time, and the investigator only has to find one crossing.
Almost nobody sustains that, which is the honest reason the cases above end in arrests and subpoenas rather than dead ends. Most people install a VPN and consider the matter closed, and for the everyday threat they actually face, a website tracking them or an ISP profiling them, that is a reasonable and sufficient choice. The failure is not the tool. It is the belief that the tool does more than it does.
The honest summary
A VPN is a genuinely useful tool aimed at one layer of a three-layer problem. It hides your IP and shields your traffic from your ISP, and for the ordinary privacy most people want, that is enough. What it does not do is log you out of your accounts or silence the identifiers your device reports home, and those two layers are where serious attribution actually happens, not by breaking encryption but by correlating identifiers and asking a company, with a court order, to connect the dots. The two cases this year, one resting on a device identifier that outlived every VPN the operator used, the other on subpoenas aimed straight at account records, are the same lesson from two directions.
It is not an invisibility cloak. It is a curtain, and anyone with a subpoena just has to ask what is behind it.
If your organisation is thinking about attribution, insider risk, or what your own endpoints and accounts reveal, that is the kind of work I do through Cyber Spartans.