4 ms·

Some terms from the SurfEasy, Inc company, which is the VPN provider for this service[0]: SurfEasy does not store users originating IP address when connected t

by zo1 11y ago

Some terms from the SurfEasy, Inc company, which is the VPN provider for this service[0]: SurfEasy does not store users originating IP address when connected to our service and therefore cannot identify users when provided IP addresses of our servers. Additionally, SurfEasy cannot disclose information about the applications, services or websites our users consume while connected to our services; as SurfEasy does not store this information. However, further down, you have this: SurfEasy is required to comply with law enforcement where subpoenas, warrants or other legal documents have been provided. We may collect and disclose personal information, including your usage data, to governmental authorities or agencies, including law enforcement agencies, at their request or pursuant to a court order, subpoena or other legal process, if there is a good faith belief that such collection or disclosure is required by law. At this point I'm not quite sure what to make of the above two combined together. [0]: https://www.surfeasy.com/privacy_policy/ https://www.surfeasy.com/privacy_policy/

anexprogrammer 11y ago
Isn't that fairly standard amongst the privacy respecting VPNs? We store nothing / log nothing. We'll comply with law enforcement as far as we're able (ie not at all beyond billing, email and perhaps bandwidth used). So that seems to say they'll perhaps be able to tell when you were logged in, who you are + payment info, and perhaps volumes transferred. Where and on which ports? No clue officer. Private Internet Access seems similar: https://www.privateinternetaccess.com/pages/privacy-policy/ https://www.privateinternetaccess.com/pages/privacy-policy/
- MasterScrat 11y ago
  But what happens if law enforcement specifically ask them to start recording more information?
  - EwanToo 11y ago
    I think this assumption is true of every VPN provider: If the courts or intelligence services tell them to capture a username's data, or access to specific websites from all users, they will do it. If the choice is between keep quiet and do it, or potentially get shutdown or arrested, you have to assume that almost everyone will do as they are told.
    - wahsd 11y ago
      Is that a fair assumption? I guess at that point you are simply biding time because if it ever comes out or there is even just a suspicion that you are lying your business is dead as word spreads across the internet
      - jameshart 11y ago
        As word spreads across the internet that... what? That you comply with the law? Isn't it worse if word gets out that you deliberately evade legal compliance frameworks? When a bank is found to be skirting regulations around money laundering, the reaction is not typically 'good on them, standing up for our rights against the man!'.
        derefr 11y ago
        If all your customers are criminals, then yes, your reputation hinges on not complying (or not yet having to comply) with the law.
  - anexprogrammer 11y ago
    Well IANAL, but I'm happy with that. Doesn't it then bring us to where we are with all other matters - wiretaps, breaking into a home with a search warrant? Law enforcement has to get suspicion of a crime, probable cause, a warrant or what have you and be subject to all the assorted checks and balances the justice system has evolved. That's vastly different to having all internet activity tied to an IP/account/person in vast, ever increasing, NSA/GCHQ/lots of other databases then going on a big back trawl every time a name comes up.
  - halostatue 11y ago
    My information is a couple of years out of date (I left in August 2013), but that would be hard(ish) for SurfEasy to do, and doing so would affect the entire system (all users), because we didn’t user-level pen-tapping capabilities into the system. The proxy/VPN machines were designed to be disposable (to potentially cycle IP addresses for various reasons) and to record a minimum of information. It would have required non-trivial effort to make it so that we could do a pen-tap on just one individual given that they could end up on a different server each time. Additionally, I believe that the proxy/VPN machines had no information on the user's identity, just the device's identity (devices were given unique, derived identities when they were created; we could work that information backwards to some degree of accuracy with enough effort, precisely for LE purposes). I don’t always use a proxy or VPN, but when I do, I trust what my former employer wrote precisely because I know what we didn’t do then, and didn’t believe would be right for us to do. Nothing I have heard from the SurfEasy team since suggests that this has changed.

by zo1 11y ago

anexprogrammer 11y ago

Isn't that fairly standard amongst the privacy respecting VPNs? We store nothing / log nothing. We'll comply with law enforcement as far as we're able (ie not at all beyond billing, email and perhaps bandwidth used). So that seems to say they'll perhaps be able to tell when you were logged in, who you are + payment info, and perhaps volumes transferred. Where and on which ports? No clue officer. Private Internet Access seems similar: https://www.privateinternetaccess.com/pages/privacy-policy/ https://www.privateinternetaccess.com/pages/privacy-policy/

MasterScrat 11y ago
But what happens if law enforcement specifically ask them to start recording more information?
- EwanToo 11y ago
  I think this assumption is true of every VPN provider: If the courts or intelligence services tell them to capture a username's data, or access to specific websites from all users, they will do it. If the choice is between keep quiet and do it, or potentially get shutdown or arrested, you have to assume that almost everyone will do as they are told.
  - wahsd 11y ago
    Is that a fair assumption? I guess at that point you are simply biding time because if it ever comes out or there is even just a suspicion that you are lying your business is dead as word spreads across the internet
    - jameshart 11y ago
      As word spreads across the internet that... what? That you comply with the law? Isn't it worse if word gets out that you deliberately evade legal compliance frameworks? When a bank is found to be skirting regulations around money laundering, the reaction is not typically 'good on them, standing up for our rights against the man!'.
      - derefr 11y ago
        If all your customers are criminals, then yes, your reputation hinges on not complying (or not yet having to comply) with the law.
- anexprogrammer 11y ago
  Well IANAL, but I'm happy with that. Doesn't it then bring us to where we are with all other matters - wiretaps, breaking into a home with a search warrant? Law enforcement has to get suspicion of a crime, probable cause, a warrant or what have you and be subject to all the assorted checks and balances the justice system has evolved. That's vastly different to having all internet activity tied to an IP/account/person in vast, ever increasing, NSA/GCHQ/lots of other databases then going on a big back trawl every time a name comes up.
- halostatue 11y ago
  My information is a couple of years out of date (I left in August 2013), but that would be hard(ish) for SurfEasy to do, and doing so would affect the entire system (all users), because we didn’t user-level pen-tapping capabilities into the system. The proxy/VPN machines were designed to be disposable (to potentially cycle IP addresses for various reasons) and to record a minimum of information. It would have required non-trivial effort to make it so that we could do a pen-tap on just one individual given that they could end up on a different server each time. Additionally, I believe that the proxy/VPN machines had no information on the user's identity, just the device's identity (devices were given unique, derived identities when they were created; we could work that information backwards to some degree of accuracy with enough effort, precisely for LE purposes). I don’t always use a proxy or VPN, but when I do, I trust what my former employer wrote precisely because I know what we didn’t do then, and didn’t believe would be right for us to do. Nothing I have heard from the SurfEasy team since suggests that this has changed.