6 ms·

These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. ...and even if you think you can

These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. ...and even if you think you can convince a jury, it's still enough to issue a search warrant, whereby the prosecutor will find more than enough charges to force you into a plea deal. Your initial anonymity is your most important defense.

jtbayly 4y ago
But the benefit remains. Buy these cards from somebody (local?) who bought them from Amazon.
hnarn 4y ago
> These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. What exactly do you base this on? First of all, Mullvad (like any serious VPN operator) do not log IP:s and one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. But let’s assume for the sake of argument that they did: let’s assume they log IP:s and sales of gift cards down to the social security number of the person who bought it. Now assume that I’m running a corner store where I sell among other things these gift cards, that I bought from Amazon at a small markup. Someone uses these gift cards and the tracking (that doesn’t exist) leads back to my store. I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. The jury (in the US) or the judge (anywhere else) is informed that I buy these cards in bulk, I sell dozens of them a week, and the IP (that Mullvad doesn’t log) is a dead end. Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? This is almost exactly analogous to selling anonymous SIM cards (where they still exist). One is used for a drug deal. Me, the shop keeper, is prosecuted in this alternate universe because I’m selling the cards. Really?
- nickstinemates 4y ago
  Strawman arguments are weird. Especially owning the corner store piece. Nevermind the fact that you're at trial where a judge and jury is looking at this. Nevermind that the point the GP made was that if you have someone knocking on your door motivated to find something they will find something. I am assuming if you are a nefarious actor, the goal is to not have this kind of attention, ever. You do this in all of the traditional ways - insulate and delegate.
  - hnarn 4y ago
    How is it in any way a straw man argument? I was giving an example of exactly what the comment said was “not a thing”: plausible deniability when buying the cards. If you buy these cards and re-sell them, you have plausible deniability. If you buy them from a re-seller you have increased anonymity. Obviously the goal for a nefarious actor (or anyone, probably) is to not end up in court. But it’s objectively true that the idea of Amazon gift cards does in some scenarios actually give you increased anonymity compared to other payment options, if nothing else because of the timing offset if you want to disregard re-sellers.
    - deleted 4y ago
      [deleted]
    - nickstinemates 4y ago
      So you think that prosecution is going to go to court with just 1 piece of evidence and the entire case is going to hinge on the provenance of a Mullvad account? Sounds extremely unlikely.
      - hnarn 4y ago
        We’re talking about hypotheticals. If you want to make up a new hypothetical where tying the suspect to the VPN account is irrelevant, what is even your point?
- thaumasiotes 4y ago
  > I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. There are no such countries; that standard would make it impossible to get convictions for almost every crime that ever occurred. Compare this case from the United States: https://volokh.com/2014/01/02/wrongful-convictions-proof-beyond-reasonable-doubt/ https://volokh.com/2014/01/02/wrongful-convictions-proof-bey... > In October of 2007, Elizabeth P. Coast, then seventeen, reported that when she was ten years old a neighborhood boy named “Jon” sexually assaulted her while the two were alone in her grandmother’s backyard > [the trial court] tried and convicted Montgomery in a one-day bench trial for the assault of Coast. Coast testified under oath that Montgomery had sexually assaulted her in 2000. > no other witnesses to the incident testified at Montgomery’s trial. Neither was any corroborating physical evidence that an assault occurred ever presented. The trial judge categorized this case as a “word against word situation.” In reaching his verdict, the trial judge concluded that Coast was more credible then Montgomery because she had “no motive whatsoever” to lie. The trial court then found Montgomery guilty of forcible sodomy, aggravated sexual battery, and object sexual penetration. On April 10, 2009, the trial judge sentenced Montgomery to 45 years in prison, with 37 years and 6 months suspended… > On November 1, 2012, Coast voluntarily made a videotaped statement at the Hampton Police Department. After consulting with counsel and receiving Miranda warnings, Coast recounted how she had falsely testified that Montgomery had assaulted her. > Coast explained that immediately before she accused Montgomery, her mother caught her looking at “sex stories” on the Internet. Out of fear of her mother, Coast said that she was looking at inappropriate material because she had been molested when she was ten years old. After she reluctantly named Montgomery as her attacker, the lie snowballed. Coast felt like she could not admit that the assault never happened
  - mynameisvlad 4y ago
    An anecdote does not a system make. Generally speaking, "innocent until proven guilty" is a cornerstone in most legal systems. This has been the case, literally, for millennia, dating back to Roman times. It is also one of the UN's human rights, and is enshrined in several countries' constitutions.
    - 4y ago
- Bilal_io 4y ago
  > one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. You bring up a very good point. Unlike an electronic payment system [0], I assume the amazon gift card is not linked to your account on Mullvad's servers, so probably Mullvad marks the account as paid, but doesn't log the Amazon card number 0. Even that should be safe. Mullvad made a recent decision to get rid of subscriptions. Now that your account is never linked to your payment method, and we can assume that it's safe to use your personal credit/debit card. But I'd be careful, if someone is important, there is a possibility of someone tracking and logging their activities, credit card use, IPs before Mullvad purchase and after they connect.
- caeril 4y ago
- type0 4y ago
  > Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? In some jurisdictions, like Sweden (where Mullvad is based) there is such a thing as "help to commit a crime" that does get prosecuted
  - hnarn 4y ago
    The crime you’re referring to, like many crimes, requires intent. You can’t charge someone giving a murderer a ride if that person had no idea they had committed a murder. Unless you’re in an authoritarian regime where the courts simply follow the whims of the political leadership, selling SIM cards, gift cards for a VPN, knives or ski masks will hardly in separate cases by itself be considered obvious intent to assist criminal activity.
- mike_d 4y ago
  > What exactly do you base this on? The law and law enforcement are two different things. Law enforcement works roughly like this: they get an IP of a website, they go to an ISP, the ISP says its this reseller, they go to the reseller, the reseller says it is this customer, they go to the customer, the customer says this IP posted the bad thing, they take the new IP and go to the ISP, ISP hands over the original users details, they go knock on the users door. It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. At each step YOU are responsible for the bad thing that happened until you give them a new person to look at. If you think it works any differently, take a look at what happened to the "TheDonald" forum after January 6th. You can shout and scream about freedoms and rights all you want, but when your girlfriend has to explain to her boss why the FBI came around asking questions about you - you hand over the next guy down the line super quick.
  - TedDoesntTalk 4y ago
    > look at what happened to the "TheDonald" forum after January 6th. What happened? I missed it.
  - hnarn 4y ago
    > It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. You’re just making assumptions without referring to the facts. Mullvad is a Swedish company and falls under Swedish and EU jurisdiction. ISPs in the EU are indeed required to keep track on what subscriber had what IP at what point in time. Some do this gladly and some try their absolute best to sabotage the process (like Bahnhof). However, Mullvad is a VPN provider. They are not an ISP. If you claim that Mullvad is legally required to log IPs, then source that claim, because they clearly are not and if that claim is true that would mean they are breaking the law, which I doubt they would be willfully doing. In your example, the buck stops with the VPN provider (which again, is not an ISP) because the info they provide is of no use. In some cases, the buck even stops with the ISP without a VPN, because in many jurisdictions there are demands placed upon the seriousness of the alleged crime to allow personal data to be supplied to law enforcement.
samatman 4y ago
This goes beyond plausible deniability, unless I'm missing something. Buying a Mullvad gift card makes you at most a Mullvad customer. The cards are presumably one SKU, none of Amazon nor Mullvad know which one is sent to a given person. I'm not sure what the connection might be to warrants here? Surely if a judge will sign on "hey this guy uses a VPN can we grab his laptop?", that judge would sign on any other flimsy excuse.
- vineyardmike 4y ago
  Step 1. You’re suspected of a crime Step 2. They start looking for evidence Step 3. They find uncommon actions you took to make your browsing history harder to track. Step 4. Judge Step 5. https://xkcd.com/538/ https://xkcd.com/538/ No one will prosecute you for using Mullvad but using it may be a red flag that you have something to hide if you’re already under investigation
  - SturgeonsLaw 4y ago
    This is exactly right. Commenters here seem to think that the prosecution needs an airtight sequence of steps to prove guilt. Doesn't work like that. They will say things like "we detected that Mullvad VPN was used to cover the perpetrator's tracks. Two days before the incident, the defendant bought a Mullvad VPN subscription over Amazon". They will then move on to the next piece of evidence. Legal cases are not code, they are often fuzzy and loose, and rely on human interpretation, with all its biases and emotions, to draw a conclusion.
foobiekr 4y ago
This. Honestly, these arguments for plausible "you can't technically prove it" deniability defenses are bizarre and comical. Prosecutions are based on circumstantial evidence all the time, these aren't going to fool anyone. They're the nerd version of Trump's rando cures for covid like bright light and bleach.
- selcuka 4y ago
  What can they technically prove in this case, though? That you bought a Mullvad card in the past? Big deal. Nobody knows who used which card, so they can't track it to you unless you are the only customer who has ever bought a card.
noodleman 4y ago
I will always assume that any kind of plausible deniability is lost just by design of the law unless they really can't pin it on an individual. The computer misuse act of my country is vaguely defined for this reason, as I imagine the same laws are in the US. For example, "It wasn't me. A friend used my Wi-Fi!" and similar arguments will not fly as you can be seen as responsible as bill payer. Those kind of defenses could even be considered admissions of guilt. It's concerning to see how many people suggest you claim your Wi-Fi was unprotected if accused of something. This will more likely be used against you if anything.
refurb 4y ago
Indeed, it’s a “reasonable doubt” requirement not “100% undeniable proof”. If the cops confiscate your computer and Mullvad is installed, and your Amazon account has a purchase history of Mullvad gift cards, your claim of “ive never used it before. Those cards were for someone else and I never used the software” won’t get you very far.

jtbayly 4y ago

But the benefit remains. Buy these cards from somebody (local?) who bought them from Amazon.

hnarn 4y ago

> These sort of plausible deniability arguments only work in people's heads. Judges and prosecutors never buy these arguments. What exactly do you base this on? First of all, Mullvad (like any serious VPN operator) do not log IP:s and one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. But let’s assume for the sake of argument that they did: let’s assume they log IP:s and sales of gift cards down to the social security number of the person who bought it. Now assume that I’m running a corner store where I sell among other things these gift cards, that I bought from Amazon at a small markup. Someone uses these gift cards and the tracking (that doesn’t exist) leads back to my store. I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. The jury (in the US) or the judge (anywhere else) is informed that I buy these cards in bulk, I sell dozens of them a week, and the IP (that Mullvad doesn’t log) is a dead end. Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? This is almost exactly analogous to selling anonymous SIM cards (where they still exist). One is used for a drug deal. Me, the shop keeper, is prosecuted in this alternate universe because I’m selling the cards. Really?

nickstinemates 4y ago
Strawman arguments are weird. Especially owning the corner store piece. Nevermind the fact that you're at trial where a judge and jury is looking at this. Nevermind that the point the GP made was that if you have someone knocking on your door motivated to find something they will find something. I am assuming if you are a nefarious actor, the goal is to not have this kind of attention, ever. You do this in all of the traditional ways - insulate and delegate.
- hnarn 4y ago
  How is it in any way a straw man argument? I was giving an example of exactly what the comment said was “not a thing”: plausible deniability when buying the cards. If you buy these cards and re-sell them, you have plausible deniability. If you buy them from a re-seller you have increased anonymity. Obviously the goal for a nefarious actor (or anyone, probably) is to not end up in court. But it’s objectively true that the idea of Amazon gift cards does in some scenarios actually give you increased anonymity compared to other payment options, if nothing else because of the timing offset if you want to disregard re-sellers.
  - deleted 4y ago
    [deleted]
  - nickstinemates 4y ago
    So you think that prosecution is going to go to court with just 1 piece of evidence and the entire case is going to hinge on the provenance of a Mullvad account? Sounds extremely unlikely.
    - hnarn 4y ago
      We’re talking about hypotheticals. If you want to make up a new hypothetical where tying the suspect to the VPN account is irrelevant, what is even your point?
thaumasiotes 4y ago
> I’m defending myself in court in a democratic western country where people are assumed innocent until proven otherwise. There are no such countries; that standard would make it impossible to get convictions for almost every crime that ever occurred. Compare this case from the United States: https://volokh.com/2014/01/02/wrongful-convictions-proof-beyond-reasonable-doubt/ https://volokh.com/2014/01/02/wrongful-convictions-proof-bey... > In October of 2007, Elizabeth P. Coast, then seventeen, reported that when she was ten years old a neighborhood boy named “Jon” sexually assaulted her while the two were alone in her grandmother’s backyard > [the trial court] tried and convicted Montgomery in a one-day bench trial for the assault of Coast. Coast testified under oath that Montgomery had sexually assaulted her in 2000. > no other witnesses to the incident testified at Montgomery’s trial. Neither was any corroborating physical evidence that an assault occurred ever presented. The trial judge categorized this case as a “word against word situation.” In reaching his verdict, the trial judge concluded that Coast was more credible then Montgomery because she had “no motive whatsoever” to lie. The trial court then found Montgomery guilty of forcible sodomy, aggravated sexual battery, and object sexual penetration. On April 10, 2009, the trial judge sentenced Montgomery to 45 years in prison, with 37 years and 6 months suspended… > On November 1, 2012, Coast voluntarily made a videotaped statement at the Hampton Police Department. After consulting with counsel and receiving Miranda warnings, Coast recounted how she had falsely testified that Montgomery had assaulted her. > Coast explained that immediately before she accused Montgomery, her mother caught her looking at “sex stories” on the Internet. Out of fear of her mother, Coast said that she was looking at inappropriate material because she had been molested when she was ten years old. After she reluctantly named Montgomery as her attacker, the lie snowballed. Coast felt like she could not admit that the assault never happened
- mynameisvlad 4y ago
  An anecdote does not a system make. Generally speaking, "innocent until proven guilty" is a cornerstone in most legal systems. This has been the case, literally, for millennia, dating back to Roman times. It is also one of the UN's human rights, and is enshrined in several countries' constitutions.
  - 4y ago
Bilal_io 4y ago
> one can probably safely assume they do not log who bought which gift card. They are also under no obligation to do so, as far as I’m aware. You bring up a very good point. Unlike an electronic payment system [0], I assume the amazon gift card is not linked to your account on Mullvad's servers, so probably Mullvad marks the account as paid, but doesn't log the Amazon card number 0. Even that should be safe. Mullvad made a recent decision to get rid of subscriptions. Now that your account is never linked to your payment method, and we can assume that it's safe to use your personal credit/debit card. But I'd be careful, if someone is important, there is a possibility of someone tracking and logging their activities, credit card use, IPs before Mullvad purchase and after they connect.
caeril 4y ago
type0 4y ago
> Do you seriously believe that a judge or jury anywhere would sentence me for the crime brought forward, or that this would even hold water enough to be prosecuted in the first place? In some jurisdictions, like Sweden (where Mullvad is based) there is such a thing as "help to commit a crime" that does get prosecuted
- hnarn 4y ago
  The crime you’re referring to, like many crimes, requires intent. You can’t charge someone giving a murderer a ride if that person had no idea they had committed a murder. Unless you’re in an authoritarian regime where the courts simply follow the whims of the political leadership, selling SIM cards, gift cards for a VPN, knives or ski masks will hardly in separate cases by itself be considered obvious intent to assist criminal activity.
mike_d 4y ago
> What exactly do you base this on? The law and law enforcement are two different things. Law enforcement works roughly like this: they get an IP of a website, they go to an ISP, the ISP says its this reseller, they go to the reseller, the reseller says it is this customer, they go to the customer, the customer says this IP posted the bad thing, they take the new IP and go to the ISP, ISP hands over the original users details, they go knock on the users door. It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. At each step YOU are responsible for the bad thing that happened until you give them a new person to look at. If you think it works any differently, take a look at what happened to the "TheDonald" forum after January 6th. You can shout and scream about freedoms and rights all you want, but when your girlfriend has to explain to her boss why the FBI came around asking questions about you - you hand over the next guy down the line super quick.
- TedDoesntTalk 4y ago
  > look at what happened to the "TheDonald" forum after January 6th. What happened? I missed it.
- hnarn 4y ago
  > It is basically a turd rolling down hill that nobody wants to touch and everyone wants to pass on to the next person. You’re just making assumptions without referring to the facts. Mullvad is a Swedish company and falls under Swedish and EU jurisdiction. ISPs in the EU are indeed required to keep track on what subscriber had what IP at what point in time. Some do this gladly and some try their absolute best to sabotage the process (like Bahnhof). However, Mullvad is a VPN provider. They are not an ISP. If you claim that Mullvad is legally required to log IPs, then source that claim, because they clearly are not and if that claim is true that would mean they are breaking the law, which I doubt they would be willfully doing. In your example, the buck stops with the VPN provider (which again, is not an ISP) because the info they provide is of no use. In some cases, the buck even stops with the ISP without a VPN, because in many jurisdictions there are demands placed upon the seriousness of the alleged crime to allow personal data to be supplied to law enforcement.

samatman 4y ago

This goes beyond plausible deniability, unless I'm missing something. Buying a Mullvad gift card makes you at most a Mullvad customer. The cards are presumably one SKU, none of Amazon nor Mullvad know which one is sent to a given person. I'm not sure what the connection might be to warrants here? Surely if a judge will sign on "hey this guy uses a VPN can we grab his laptop?", that judge would sign on any other flimsy excuse.

vineyardmike 4y ago
Step 1. You’re suspected of a crime Step 2. They start looking for evidence Step 3. They find uncommon actions you took to make your browsing history harder to track. Step 4. Judge Step 5. https://xkcd.com/538/ https://xkcd.com/538/ No one will prosecute you for using Mullvad but using it may be a red flag that you have something to hide if you’re already under investigation
- SturgeonsLaw 4y ago
  This is exactly right. Commenters here seem to think that the prosecution needs an airtight sequence of steps to prove guilt. Doesn't work like that. They will say things like "we detected that Mullvad VPN was used to cover the perpetrator's tracks. Two days before the incident, the defendant bought a Mullvad VPN subscription over Amazon". They will then move on to the next piece of evidence. Legal cases are not code, they are often fuzzy and loose, and rely on human interpretation, with all its biases and emotions, to draw a conclusion.

foobiekr 4y ago

This. Honestly, these arguments for plausible "you can't technically prove it" deniability defenses are bizarre and comical. Prosecutions are based on circumstantial evidence all the time, these aren't going to fool anyone. They're the nerd version of Trump's rando cures for covid like bright light and bleach.

selcuka 4y ago
What can they technically prove in this case, though? That you bought a Mullvad card in the past? Big deal. Nobody knows who used which card, so they can't track it to you unless you are the only customer who has ever bought a card.

noodleman 4y ago

I will always assume that any kind of plausible deniability is lost just by design of the law unless they really can't pin it on an individual. The computer misuse act of my country is vaguely defined for this reason, as I imagine the same laws are in the US. For example, "It wasn't me. A friend used my Wi-Fi!" and similar arguments will not fly as you can be seen as responsible as bill payer. Those kind of defenses could even be considered admissions of guilt. It's concerning to see how many people suggest you claim your Wi-Fi was unprotected if accused of something. This will more likely be used against you if anything.

refurb 4y ago

Indeed, it’s a “reasonable doubt” requirement not “100% undeniable proof”. If the cops confiscate your computer and Mullvad is installed, and your Amazon account has a purchase history of Mullvad gift cards, your claim of “ive never used it before. Those cards were for someone else and I never used the software” won’t get you very far.