3 ms·
Without any additional information, the story, as presented, is fishy. 1. The “counter-terrorism” package to which they seem to point has only been enacted las
by ogurechny 10y ago
Without any additional information, the story, as presented, is fishy.
1. The “counter-terrorism” package to which they seem to point has only been enacted last month. The details and dates for its impossible requirements for ISPs, hosting providers, services, etc. (to save up to three years of connection metadata and up to half a year of content of all — vaguely defined — “transmissions”) hasn't yet been set.
2. Current law also states that ISPs have to save metadata for 6 months and all traffic for 12 hours (numbers and details can probably be optimized by one-on-one deals with local authorities). This has been in effect since 2014, and the VPN providers seem to didn't have problems with that.
3. I highly doubt they were registered as an ISP and got a license. Compliance to these laws was mostly their hosting provider's headache.
4. Failure to comply is punished by enormous fines, not property seizure.
5. Russian law enforcement can seize your servers “without notice or any type of due process” if they think they have a reason with or without those laws. ISPs do have formal and informal contacts with various agencies to prevent collateral damage and assist in evidence gathering. Maybe they didn't care in this case or it was too important.
6. Haphazard reactions like revoking all their certificates (if they didn't actually have their master server with all the keys in Russia) and boasting snake oil solution of pushing key widths to their limits without a valid cryptographic cause is actually a reason to seriously reconsider whether your own cloud VPN instance would have more competent administrator. (Offtopic rant follows further down.)
So, while it is not impossible that Russian government sent them off with a noticeable brazen in order to scare other companies providing tunneling services (that have been seen as uncooperative and allowing access to content censored by government), there is still no official statement for what happened of any kind. AFAIK, censorship agency, who has always been pretty vocal about its noble citizen protecting activities, didn't comment that accident at all.
Offtopic rant: Let me remind you that all these VPN services are made by people greedy for a quick buck who don't even understand how to setup NAT without side effects for outbound traffic that should return inbound to the same network, and that “anonymity” and “not keeping logs” claims are unenforceable. Traditional ISPs are limited by strict laws in most countries, and they still spy on traffic and sell “depersonalized” (yeah, yeah) data on ad market. VPN server is even tastier way to spy on browsing habits of each of the clients, the temptation is too high to resist if you are not ideologically solid (which, despite all the website speeches, they are not).