5 ms·

An important thing to note here is that they were served with a "Summons for Records," not a warrant. With a warrant the DHS has to provide probable cause, it h

An important thing to note here is that they were served with a "Summons for Records," not a warrant. With a warrant the DHS has to provide probable cause, it has to be signed off on by a judge, and cannot be refused. A summons has none of those things; it can absolutely be refused, at which point they would have to get a warrant. I'd also like to add that I don't have an ethical problem with a VPN company that keeps logs and turns them over to law enforcement with a valid warrant. Lying about keeping logs, though, I do find unethical, as well as not requiring a warrant for access. I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. If law enforcement has a valid warrant, I don't have an issue with providing them with the data they need to find and prosecute.

SlowRobotAhead 8y ago
Agree with first half, but second half is an appeal to authority, which is a fallacy. By not keeping logs, a VPN would take themselves out of a situation where corrupt authorities could exploit their power.
- openasocket 8y ago
  But they'd also take themselves out of a situation where non-corrupt authorities could use their power appropriately. You have to do the ethical math on the likelihood of either possibility and the consequences, which is subjective.
  - gsich 8y ago
    Don't advertise with "no logs" then.
    - detaro 8y ago
      The parent explicitly said that would be unethical, so you agree with them.
    - openasocket 8y ago
      I completely agree, and said so in my original comment.
      - deleted 8y ago
        [deleted]
  - SlowRobotAhead 8y ago
    >But they'd also take themselves out of a situation where non-corrupt authorities could use their power appropriately. Oh, well, if we're limiting the conversation to hypotheticals... How about the idea that your bad behavior doesn't forfeit my right to privacy? I don't care if every other VPN user starts money laundry drug money by selling child porn - when it comes to my VPN logs, you can get lost, and I do nothing unusual or illegal. I have a very American attitude about personal freedoms and privacy. I don't believe that every opportunity for data collection should be implemented just because an authority says it's for "the greater good".
    - openasocket 8y ago
      > I don't care if every other VPN user starts money laundry drug money by selling child porn ... If I require a valid warrant for a carefully scoped query, law enforcement would have to have probable cause, demonstrate that in a court, and get approval from a judge. Note the "carefully scoped" part: they can ask "who was using this IP address at this time to visit this site" but they don't get unlimited access to the logs data. The only way they would be able to get data about you is with probable cause that you are doing something illegal. Even if everyone else using that service is using it for illegal things, that does not constitute probable cause for them to get your data. > I don't believe that every opportunity for data collection should be implemented just because an authority says it's for "the greater good". I agree.
- daveFNbuck 8y ago
  Logical fallacies are mistakes in logic. The appeal to authority fallacy is when you say something of the form "X is true because authority Y says so". I don't see how supporting warrants falls into that. What statement do you think is being fallaciously supported here, and which authority is being used to support it?
  - SlowRobotAhead 8y ago
    >I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. If law enforcement has a valid warrant, I don't have an issue with providing them with the data they need to find and prosecute. That statement. That because it's an authority they will be just, law abiding, and acting in everyone's best interest. That op has no problem with it because surely no one would ever abuse that power! That's a logical failure if you don't have your head in the sand. But, I'm sure it makes no sense if you've been raised to believe the "government is here to help".
    - openasocket 8y ago
      I said "valid warrant." If I found the warrant to be an over-reach, was on a flimsy pretext, or the request is not properly scoped I wouldn't consider that valid, and would appeal.
      - Nadya 8y ago
        "Your appeal has been denied." You're still considering a just and fair government/system, you've just moved the "just and fair" bit from "the police" to "the judge issuing the warrant". There are a fair number of people who have absolutely no trust in their (or any) government and consider the potential for government overreach. The best way to prevent government overreach is to make sure there is nothing they can reach for. Some people have no issue with the government knowing their "harmless personal activities". While another group of some people believe the government has absolutely no right to know what's going on in their personal lives no matter how mundane.
    - 8y ago
sandworm101 8y ago
>>> I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. I guess that depends on which law enforcement you are talking about. An FBI agent going after someone distributing child pornography is a rather sympathetic police action. What about a Chinese officer going after someone for "treason"? What about a Russian cop looking for someone who tweeted pics taken at a protest rally? Or what about a Canadian cop asking questions about a teenager in Sweden, someone well outside Canadian jurisdiction? Or what about the FBI agent asking for some celeb's home address? Rather than pick sides, the best answer is to just not collect the data in the first place. VPN companies operate at an international level. The cops from some countries cannot be trusted. Cops in all countries make mistakes. A few of them our there are corrupt. And often times the person claiming to be a cop is either well outside their authority, or just lying about being a cop. I tell my client's to not even respond to communications from any sort of law enforcement or intelligence agency. Pass it to your lawyers. Let them first verify who and what authority is making the request. Do not leave such determinations to engineers and support staff.
- openasocket 8y ago
  I agree that it depends on who the law enforcement is. I think operating a VPN service for Chinese citizens to evade censorship and not doing logging to protect those users would be ethical, for example. Like I said in another comment, you have to think about the odds of dealing with an LE request you consider unethical, and balance the consequences of providing logs or not providing logs. Personally, I trust the US justice system enough that I wouldn't have a problem with complying with a valid warrant (after legal due diligence, of course). But that's subjective and I understand others may not feel the same way. > VPN companies operate at an international level. The cops from some countries cannot be trusted. Cops in all countries make mistakes. A few of them our there are corrupt. And often times the person claiming to be a cop is either well outside their authority, or just lying about being a cop. I tell my client's to not even respond to communications from any sort of law enforcement. Pass it to your lawyers. Let them first verify who and what authority is making the request. Do not leave such determinations to engineers and support staff. Totally agree with everything here.
pmiller2 8y ago
What’s unethical about not keeping logs? I explicitly don’t have external security cameras at my apartment: is it unethical because I can’t provide law enforcement with video in case something happens on my block?
- openasocket 8y ago
  I didn't say not keeping logs is unethical, I said " explicitly not keeping logs to protect users from law enforcement" is unethical. The difference is subtle. If you just happen to not keep logs that's fine, or if you don't keep logs because you don't want to have to pay for storing them or something that's also fine. But explicitly saying, "I could have logging here, but I don't want to because I don't want to provide evidence to law enforcement serving a valid warrant" is, in my view, unethical. Not tremendously unethical, mind you, but unethical. The morality is about the intent rather than the result.
  - pmiller2 8y ago
    I could have cameras, but I legitimately don’t want to provide footage to law enforcement. Am I now acting unethically? And what the difference if I simply don’t have them because I don’t want to spend money on them (or any other reason)? This is not entirely a rhetorical device. I really don’t want to provide the government with a video feed of my neighborhood.
    - openasocket 8y ago
      I'll start by saying that intent can matter a lot in ethics. Intent is the difference between a tragic accident and cold-blooded murder. I'll also add that I think your scenario is ethical, you don't have any obligation to put cameras around your house. What's the difference between your scenario of a house with cameras vs. a VPN service not logging things? I'll be honest here, I could list out a bunch of differences between those two scenarios (houses tend to have a reasonable expectation of privacy while internet services may not, the likelihood of catching criminals and the severity of their crimes, the potential for abuse, in the case of your house you could always serve as a witness to a crime so cameras might be overkill, etc.) but I honestly don't know which one of those differences is the reason why I find one scenario to be ethical and the other unethical, or if it's some difference I haven't thought of (or I might be wrong!). I'll admit my opinion here isn't fully fleshed out. Another thing is that I consider Tor to be ethical, even though that's essentially a VPN that doesn't log anything (from the perspective of not being able to respond to law enforcement requests, I know there are significant technical differences). In that case, I think the distinction is that Tor is meant to help fight censorship in authoritarian countries, and the fact that it can be used for nefarious purposes is an unfortunate side effect that doesn't outweigh the benefits. Anyway, I do think there is a line between valuing the privacy of users and shielding them from legitimate law enforcement requests, but I'm open to discussion on where exactly that line falls.
_jal 8y ago
> I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. "Law enforcement" covers a variety of entities, from Mr. Friendly offering fatherly advice to fresh-scrubbed teens in Neverwas, IN to the people who brought us COINTELPRO and other folks throwing journalists out of windows in Russia. I think it is more accurate to talk about "not keeping logs to protect users from entities who routinely traffic in violence" (among other things). Ethics is hard.
pasbesoin 8y ago
Many people in the U.S. see nothing wrong with "logless access" as a way of avoiding law enforcement, when it is practiced in other countries whose law enforcement can -- including within the scope of their laws -- be quite abusive. What makes you think your law enforcement is different? And, with data potentially held in perpetuity, any past action may become grounds for prosecution, depending upon how law at the time of prosecution is defined. People in the U.S. -- mainstream, as opposed to "minorities" -- have spent that past couple of decades waking up to the fact that laws and law enforcement are tools, not paragons of virtue. And those tools can be and are used for evil and harm. This may not mean turning your back on the system -- nor even having the opportunity to. But it can mean being proactive to limit your exposure to potential abuse. Not to mention all the commercial interests, who would love to have those logs. And, if your VPN company gets sold, including if it goes bust, all those logs become "assets" that will be monetized, regardless of any "promise" that was made. If there's enough value in them, lawyers will spend time and energy breaking any contractual obligations to same. And it's not like the company itself is around anymore to take the other side in such a dispute. -- P.S. A bit of personal perspective: I've taken to using a VPN all the time -- as opposed to just while on public WiFi, like I once did -- to a) Keep Comcast out of my browsing, both their monitoring and their JS injection; b) Keep Verizon out of my mobile data use, again both monitoring and injection (that header they keep wanting to inject for tracking/advertising, among other things). HTTPS is finally becoming widespread enough to prevent some of this, but that change has come years after the above abuses started. And it still doesn't mask domains, nor inappropriate GET's. Good security isn't just reactive. It's pro-active. Another precept is to always provide minimal information to get the job done. Anyway...

SlowRobotAhead 8y ago

Agree with first half, but second half is an appeal to authority, which is a fallacy. By not keeping logs, a VPN would take themselves out of a situation where corrupt authorities could exploit their power.

openasocket 8y ago
But they'd also take themselves out of a situation where non-corrupt authorities could use their power appropriately. You have to do the ethical math on the likelihood of either possibility and the consequences, which is subjective.
- gsich 8y ago
  Don't advertise with "no logs" then.
  - detaro 8y ago
    The parent explicitly said that would be unethical, so you agree with them.
  - openasocket 8y ago
    I completely agree, and said so in my original comment.
    - deleted 8y ago
      [deleted]
- SlowRobotAhead 8y ago
  >But they'd also take themselves out of a situation where non-corrupt authorities could use their power appropriately. Oh, well, if we're limiting the conversation to hypotheticals... How about the idea that your bad behavior doesn't forfeit my right to privacy? I don't care if every other VPN user starts money laundry drug money by selling child porn - when it comes to my VPN logs, you can get lost, and I do nothing unusual or illegal. I have a very American attitude about personal freedoms and privacy. I don't believe that every opportunity for data collection should be implemented just because an authority says it's for "the greater good".
  - openasocket 8y ago
    > I don't care if every other VPN user starts money laundry drug money by selling child porn ... If I require a valid warrant for a carefully scoped query, law enforcement would have to have probable cause, demonstrate that in a court, and get approval from a judge. Note the "carefully scoped" part: they can ask "who was using this IP address at this time to visit this site" but they don't get unlimited access to the logs data. The only way they would be able to get data about you is with probable cause that you are doing something illegal. Even if everyone else using that service is using it for illegal things, that does not constitute probable cause for them to get your data. > I don't believe that every opportunity for data collection should be implemented just because an authority says it's for "the greater good". I agree.
daveFNbuck 8y ago
Logical fallacies are mistakes in logic. The appeal to authority fallacy is when you say something of the form "X is true because authority Y says so". I don't see how supporting warrants falls into that. What statement do you think is being fallaciously supported here, and which authority is being used to support it?
- SlowRobotAhead 8y ago
  >I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. If law enforcement has a valid warrant, I don't have an issue with providing them with the data they need to find and prosecute. That statement. That because it's an authority they will be just, law abiding, and acting in everyone's best interest. That op has no problem with it because surely no one would ever abuse that power! That's a logical failure if you don't have your head in the sand. But, I'm sure it makes no sense if you've been raised to believe the "government is here to help".
  - openasocket 8y ago
    I said "valid warrant." If I found the warrant to be an over-reach, was on a flimsy pretext, or the request is not properly scoped I wouldn't consider that valid, and would appeal.
    - Nadya 8y ago
      "Your appeal has been denied." You're still considering a just and fair government/system, you've just moved the "just and fair" bit from "the police" to "the judge issuing the warrant". There are a fair number of people who have absolutely no trust in their (or any) government and consider the potential for government overreach. The best way to prevent government overreach is to make sure there is nothing they can reach for. Some people have no issue with the government knowing their "harmless personal activities". While another group of some people believe the government has absolutely no right to know what's going on in their personal lives no matter how mundane.
  - 8y ago

sandworm101 8y ago

>>> I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. I guess that depends on which law enforcement you are talking about. An FBI agent going after someone distributing child pornography is a rather sympathetic police action. What about a Chinese officer going after someone for "treason"? What about a Russian cop looking for someone who tweeted pics taken at a protest rally? Or what about a Canadian cop asking questions about a teenager in Sweden, someone well outside Canadian jurisdiction? Or what about the FBI agent asking for some celeb's home address? Rather than pick sides, the best answer is to just not collect the data in the first place. VPN companies operate at an international level. The cops from some countries cannot be trusted. Cops in all countries make mistakes. A few of them our there are corrupt. And often times the person claiming to be a cop is either well outside their authority, or just lying about being a cop. I tell my client's to not even respond to communications from any sort of law enforcement or intelligence agency. Pass it to your lawyers. Let them first verify who and what authority is making the request. Do not leave such determinations to engineers and support staff.

openasocket 8y ago
I agree that it depends on who the law enforcement is. I think operating a VPN service for Chinese citizens to evade censorship and not doing logging to protect those users would be ethical, for example. Like I said in another comment, you have to think about the odds of dealing with an LE request you consider unethical, and balance the consequences of providing logs or not providing logs. Personally, I trust the US justice system enough that I wouldn't have a problem with complying with a valid warrant (after legal due diligence, of course). But that's subjective and I understand others may not feel the same way. > VPN companies operate at an international level. The cops from some countries cannot be trusted. Cops in all countries make mistakes. A few of them our there are corrupt. And often times the person claiming to be a cop is either well outside their authority, or just lying about being a cop. I tell my client's to not even respond to communications from any sort of law enforcement. Pass it to your lawyers. Let them first verify who and what authority is making the request. Do not leave such determinations to engineers and support staff. Totally agree with everything here.

pmiller2 8y ago

What’s unethical about not keeping logs? I explicitly don’t have external security cameras at my apartment: is it unethical because I can’t provide law enforcement with video in case something happens on my block?

openasocket 8y ago
I didn't say not keeping logs is unethical, I said " explicitly not keeping logs to protect users from law enforcement" is unethical. The difference is subtle. If you just happen to not keep logs that's fine, or if you don't keep logs because you don't want to have to pay for storing them or something that's also fine. But explicitly saying, "I could have logging here, but I don't want to because I don't want to provide evidence to law enforcement serving a valid warrant" is, in my view, unethical. Not tremendously unethical, mind you, but unethical. The morality is about the intent rather than the result.
- pmiller2 8y ago
  I could have cameras, but I legitimately don’t want to provide footage to law enforcement. Am I now acting unethically? And what the difference if I simply don’t have them because I don’t want to spend money on them (or any other reason)? This is not entirely a rhetorical device. I really don’t want to provide the government with a video feed of my neighborhood.
  - openasocket 8y ago
    I'll start by saying that intent can matter a lot in ethics. Intent is the difference between a tragic accident and cold-blooded murder. I'll also add that I think your scenario is ethical, you don't have any obligation to put cameras around your house. What's the difference between your scenario of a house with cameras vs. a VPN service not logging things? I'll be honest here, I could list out a bunch of differences between those two scenarios (houses tend to have a reasonable expectation of privacy while internet services may not, the likelihood of catching criminals and the severity of their crimes, the potential for abuse, in the case of your house you could always serve as a witness to a crime so cameras might be overkill, etc.) but I honestly don't know which one of those differences is the reason why I find one scenario to be ethical and the other unethical, or if it's some difference I haven't thought of (or I might be wrong!). I'll admit my opinion here isn't fully fleshed out. Another thing is that I consider Tor to be ethical, even though that's essentially a VPN that doesn't log anything (from the perspective of not being able to respond to law enforcement requests, I know there are significant technical differences). In that case, I think the distinction is that Tor is meant to help fight censorship in authoritarian countries, and the fact that it can be used for nefarious purposes is an unfortunate side effect that doesn't outweigh the benefits. Anyway, I do think there is a line between valuing the privacy of users and shielding them from legitimate law enforcement requests, but I'm open to discussion on where exactly that line falls.

_jal 8y ago

> I also think that explicitly not keeping logs to protect users from law enforcement is shady to say the least. "Law enforcement" covers a variety of entities, from Mr. Friendly offering fatherly advice to fresh-scrubbed teens in Neverwas, IN to the people who brought us COINTELPRO and other folks throwing journalists out of windows in Russia. I think it is more accurate to talk about "not keeping logs to protect users from entities who routinely traffic in violence" (among other things). Ethics is hard.

pasbesoin 8y ago

Many people in the U.S. see nothing wrong with "logless access" as a way of avoiding law enforcement, when it is practiced in other countries whose law enforcement can -- including within the scope of their laws -- be quite abusive. What makes you think your law enforcement is different? And, with data potentially held in perpetuity, any past action may become grounds for prosecution, depending upon how law at the time of prosecution is defined. People in the U.S. -- mainstream, as opposed to "minorities" -- have spent that past couple of decades waking up to the fact that laws and law enforcement are tools, not paragons of virtue. And those tools can be and are used for evil and harm. This may not mean turning your back on the system -- nor even having the opportunity to. But it can mean being proactive to limit your exposure to potential abuse. Not to mention all the commercial interests, who would love to have those logs. And, if your VPN company gets sold, including if it goes bust, all those logs become "assets" that will be monetized, regardless of any "promise" that was made. If there's enough value in them, lawyers will spend time and energy breaking any contractual obligations to same. And it's not like the company itself is around anymore to take the other side in such a dispute. -- P.S. A bit of personal perspective: I've taken to using a VPN all the time -- as opposed to just while on public WiFi, like I once did -- to a) Keep Comcast out of my browsing, both their monitoring and their JS injection; b) Keep Verizon out of my mobile data use, again both monitoring and injection (that header they keep wanting to inject for tracking/advertising, among other things). HTTPS is finally becoming widespread enough to prevent some of this, but that change has come years after the above abuses started. And it still doesn't mask domains, nor inappropriate GET's. Good security isn't just reactive. It's pro-active. Another precept is to always provide minimal information to get the job done. Anyway...