>(G) No person may fail or refuse to comply with any reporting or recordkeeping requirement of this Act, or any regulation, order, direction, mitigation measure, prohibition, or other authorization or directive issued thereunder.

You can plausibly use a VPN to commit fraud, but there isn't a "Fraud Investigation Secretary" who can arbitrarily decide how/what/when records need to be kept. The investigation for someone committing fraud on the VPN wouldn't give the "Fraud Investigation Secretary" the right to see any and all records that the VPN service has when a smaller subset of records specific to the instance of fraud would suffice. Oh and the "Fraud Investigation Secretary" can determine that this entire process can be handled secretly because it's classified. Oh and you're not allowed to ask the government through a FOIA request how it determined the fraud was committed through the VPN.

I reject the notion that the government wouldn't use this law as a dragnet. The Patriot Act remains expired after all.

And remember kids, the next time that somebody tells you "the government wouldn't do that"-- oh yes they would