4 ms·

Isn't that fairly standard amongst the privacy respecting VPNs? We store nothing / log nothing. We'll comply with law enforcement as far as we're able (ie not

Isn't that fairly standard amongst the privacy respecting VPNs? We store nothing / log nothing. We'll comply with law enforcement as far as we're able (ie not at all beyond billing, email and perhaps bandwidth used). So that seems to say they'll perhaps be able to tell when you were logged in, who you are + payment info, and perhaps volumes transferred. Where and on which ports? No clue officer. Private Internet Access seems similar: https://www.privateinternetaccess.com/pages/privacy-policy/ https://www.privateinternetaccess.com/pages/privacy-policy/

MasterScrat 10y ago
But what happens if law enforcement specifically ask them to start recording more information?
- EwanToo 10y ago
  I think this assumption is true of every VPN provider: If the courts or intelligence services tell them to capture a username's data, or access to specific websites from all users, they will do it. If the choice is between keep quiet and do it, or potentially get shutdown or arrested, you have to assume that almost everyone will do as they are told.
  - wahsd 10y ago
    Is that a fair assumption? I guess at that point you are simply biding time because if it ever comes out or there is even just a suspicion that you are lying your business is dead as word spreads across the internet
    - jameshart 10y ago
      As word spreads across the internet that... what? That you comply with the law? Isn't it worse if word gets out that you deliberately evade legal compliance frameworks? When a bank is found to be skirting regulations around money laundering, the reaction is not typically 'good on them, standing up for our rights against the man!'.
      - derefr 10y ago
        If all your customers are criminals, then yes, your reputation hinges on not complying (or not yet having to comply) with the law.
- anexprogrammer 10y ago
  Well IANAL, but I'm happy with that. Doesn't it then bring us to where we are with all other matters - wiretaps, breaking into a home with a search warrant? Law enforcement has to get suspicion of a crime, probable cause, a warrant or what have you and be subject to all the assorted checks and balances the justice system has evolved. That's vastly different to having all internet activity tied to an IP/account/person in vast, ever increasing, NSA/GCHQ/lots of other databases then going on a big back trawl every time a name comes up.
- halostatue 10y ago
  My information is a couple of years out of date (I left in August 2013), but that would be hard(ish) for SurfEasy to do, and doing so would affect the entire system (all users), because we didn’t user-level pen-tapping capabilities into the system. The proxy/VPN machines were designed to be disposable (to potentially cycle IP addresses for various reasons) and to record a minimum of information. It would have required non-trivial effort to make it so that we could do a pen-tap on just one individual given that they could end up on a different server each time. Additionally, I believe that the proxy/VPN machines had no information on the user's identity, just the device's identity (devices were given unique, derived identities when they were created; we could work that information backwards to some degree of accuracy with enough effort, precisely for LE purposes). I don’t always use a proxy or VPN, but when I do, I trust what my former employer wrote precisely because I know what we didn’t do then, and didn’t believe would be right for us to do. Nothing I have heard from the SurfEasy team since suggests that this has changed.

MasterScrat 10y ago

But what happens if law enforcement specifically ask them to start recording more information?

EwanToo 10y ago
I think this assumption is true of every VPN provider: If the courts or intelligence services tell them to capture a username's data, or access to specific websites from all users, they will do it. If the choice is between keep quiet and do it, or potentially get shutdown or arrested, you have to assume that almost everyone will do as they are told.
- wahsd 10y ago
  Is that a fair assumption? I guess at that point you are simply biding time because if it ever comes out or there is even just a suspicion that you are lying your business is dead as word spreads across the internet
  - jameshart 10y ago
    As word spreads across the internet that... what? That you comply with the law? Isn't it worse if word gets out that you deliberately evade legal compliance frameworks? When a bank is found to be skirting regulations around money laundering, the reaction is not typically 'good on them, standing up for our rights against the man!'.
    - derefr 10y ago
      If all your customers are criminals, then yes, your reputation hinges on not complying (or not yet having to comply) with the law.
anexprogrammer 10y ago
Well IANAL, but I'm happy with that. Doesn't it then bring us to where we are with all other matters - wiretaps, breaking into a home with a search warrant? Law enforcement has to get suspicion of a crime, probable cause, a warrant or what have you and be subject to all the assorted checks and balances the justice system has evolved. That's vastly different to having all internet activity tied to an IP/account/person in vast, ever increasing, NSA/GCHQ/lots of other databases then going on a big back trawl every time a name comes up.
halostatue 10y ago
My information is a couple of years out of date (I left in August 2013), but that would be hard(ish) for SurfEasy to do, and doing so would affect the entire system (all users), because we didn’t user-level pen-tapping capabilities into the system. The proxy/VPN machines were designed to be disposable (to potentially cycle IP addresses for various reasons) and to record a minimum of information. It would have required non-trivial effort to make it so that we could do a pen-tap on just one individual given that they could end up on a different server each time. Additionally, I believe that the proxy/VPN machines had no information on the user's identity, just the device's identity (devices were given unique, derived identities when they were created; we could work that information backwards to some degree of accuracy with enough effort, precisely for LE purposes). I don’t always use a proxy or VPN, but when I do, I trust what my former employer wrote precisely because I know what we didn’t do then, and didn’t believe would be right for us to do. Nothing I have heard from the SurfEasy team since suggests that this has changed.