20 ms·
Mullvad VPN was subject to a search warrant – customer data not compromised
- hacb 3y agoI'm glad they are so transparent about it.
- MPSimmons 3y agoI also appreciate the lack of US-style warrant canary that might be necessary here, where depending on who comes asking, you're not allowed to post about it.
- galleywest200 3y agoI was just thinking that if this was in the US then the law enforcement officers would have gone "smash and grab" on the company property anyways.
- pphysch 3y agoWhy wouldn't they? It's free marketing material.
- raverbashing 3y ago"They intended to seize computers with customer data. In line with our policies such customer data did not exist" But please tell me again how hard it is to comply with the GDPR
- 3np 3y agoMullvad is obviously running an illegal fly-by-night operation by not plastering their site in dark-pattern overlay banners. /s
- moffkalast 3y agoMullvad is 4 parallel universes ahead of NOA. This is the best kind of advertisement they could've ever gotten.
- unixgoddess 3y agothe problem is, if this starts to become common, countries will move to make it illegal not to store data...
- actionfromafar 3y agoAt least that forces legislators to be overt.
- unixgoddess 3y agounfortunately that's useless if you can't do anything about it... just think about the recent unfruitful millions-strong street protests in france, how powerless we are even in self-proclaimed democracies.
- actionfromafar 3y agoEven then, it's better to know you are being short-changed. Alas, France's problem is an old one, the executive has too much power. It was maybe good for people like de Gaulle, but most leaders can't burden the responsibility properly.
- em-bee 3y agodata retention laws have already been proposed, if not even enacted in some EU countries.
- moffkalast 3y agoWould be a shame if those hard drives failed accidentally on a regular basis. In unrelated news, Seagate stock rises to record high...
- filleokus 3y ago> But please tell me again how hard it is to comply with the GDPR I like Mullvad (and been a paying customer on-and-off for years), but perhaps it's easier to comply with GDPR when your whole business is essentially not storing data? Even if you are the most privacy conscious company ever, there is probably legitimate need storing more data than Mullvad in almost any other B2C scenario. (Although it would be exciting buying e.g a TV online by sending cash in an envelope and writing the shipping address inside, the novelty probably wears of once the postal service looses your package and you can't do anything about it. Or when you loose your paper note with the ASCII armored PGP proof-of-purchase and you can't do a warranty claim)
- lionkor 3y agoFull title: Mullvad VPN was subject to a search warrant. Customer data not compromised As a customer, I have no doubt about the "customer data not compromised". I'm a paying customer, yet I have never given them any PII. Great service.
- wepple 3y agoTechnically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name
- john_the_writer 3y agoAlso, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.
- raverbashing 3y agoTrue, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.
- zamnos 3y agoDns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
- raverbashing 3y agoI know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had (of course, it all depends on the DNS provider you choose)
- hnarn 3y ago
- colesantiago 3y agoThat is a shame. Is there an alternative VPN provider that wouldn't be subject to this? Huh? Why all the downvotes all of a sudden? this is a genuine question.
- Entinel 3y agoNo.
- duxup 3y agoI think one issue is, anyone who maybe could avoid the legal process would be located in the country and/or operate in a way …. where are you might not trust the business anyway. Mullvad and how they operate seem to be the best choice for consumer vpn.
- rgrieselhuber 3y agoI think you missed the entire point of the article.
- MPSimmons 3y agoTo a legal inquiry via search warrant? Probably not unless it's operated in a country that doesn't have search warrants, but that sounds more like a lawless wasteland.
- moffkalast 3y agoStill waiting for someone to convert an international waters oil rig to a lawless data center. Or like that submarine base that Microsoft did.
- bingobongodude 3y agoYou mean Sealand? https://en.wikipedia.org/wiki/Principality_of_Sealand https://en.wikipedia.org/wiki/Principality_of_Sealand
- Xylakant 3y agoYour a bit more than 20 years late with the oil rig idea https://en.m.wikipedia.org/wiki/Principality_of_Sealand https://en.m.wikipedia.org/wiki/Principality_of_Sealand
- hubraumhugo 3y agoOnce again this shows the huge disconnect between the government authorities and the tech industry. Basic knowledge and a quick investigation would make clear that Mullvad is not storing any customer data.
- dannyw 3y agoA service provider may claim to not store any user data, but they could be lying. From the article: "After demonstrating that this is indeed how our service works" Presumably, Mullvad employees showed this data does not exist live.
- rasengan 3y ago> service provider may claim to not store any user data, but they could be lying. As someone who ran a VPN in the past, this blog post is extremely strange as well as the purported described sequence of events. Police in any jurisdiction aren’t jokes - especially not Sweden where they can absolutely walk in and take your stuff according to mullvads website [1]. It’s 2023 - if a VPN is how you’re doing your privacy you’re probably doing it wrong. Don’t trust. Verify. [1] https://mullvad.net/en/help/swedish-legislation/ https://mullvad.net/en/help/swedish-legislation/
- gerbilly 3y ago> It’s 2023 - if a VPN is how you’re doing your privacy you’re probably doing it wrong. I'm honestly interested, how could one 'do privacy' the right way then?
- Izkata 3y agoI'm guessing they're thinking of VPN as OpenVPN, and are referring to WireGuard...? Mullvad also provides configurations for that.
- grvgr 3y ago[dead]
- jrootabega 3y agoI predict a bold new operational exercise/publicity stunt for Mullvad or some other provider: every week they randomly pick a server/storage pod and send it to law enforcement.
- Zuiii 3y agoThat's how you get illegally compromised hardware. Better send the bootdisk image (which should be small given that their servers are diskless (Netboot?)
- rasengan 3y agoI’m confused. You’re saying cops came to your office 6 deep and just left with nothing even though your privacy policy says you have data [1]? There was no court case or investigation of any kind? This blog post concerns me deeply for a number of reasons especially given a VPNs only actual differentiating value/proposition is trust. [1] https://mullvad.net/en/help/privacy-policy https://mullvad.net/en/help/privacy-policy
- cinntaile 3y agoIt's likely not the kind of data they were after so there was no point in seizing equipment.
- rasengan 3y agoPolice investigations regarding 6+ officers showing up at your office do not end with “oh have a good day.”
- colourgarden 3y agoMaybe not in the US. > We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. If this line is to be believed then the police would have been committing a crime by proceeding.
- rasengan 3y agoThis is not how police work anywhere. There would be an entire legal process for this.
- skjoldr 3y agoWhat legal process? The officers were pursuing some kind of case and got a warrant for a possible lead, the lead turned out to be cold, the officers moved on to other evidence. What's so complicated about that?
- InTheArena 3y agoThis makes me highly suspicious that they’re setting up a sting on mullvlad. There doesn’t seem to be much other reasons to serve a physical warrant other then to establish non-compliance with some law they may interpret differently.
- hnarn 3y agoYou don’t have a very rich imagination. It’s entirely possible this warrant was executed for no other reason than compliance, if requests come from foreign agencies for example obviously they have to be acted upon even if you are almost certain you will find nothing.
- qikInNdOutReply 3y agoIts funny, how the VPN providers basically become the avatars of the old anarchic web and the constant buisness and government overreach makes them ever stronger. Its basically a old "freedom" tax.
- quickthrower2 3y agoTor exists though fwiw
- Etheryte 3y agoTor exists, but realistically the overhead of using Tor is not acceptable to the general public. As long as Tor is sufficiently slow compared to everyday traffic it will remain a niche use case. A good VPN on the other hand gives you at least a little bit of privacy without much of a cost.
- 93po 3y agoI've looked at Tor recently just out of curiosity for the tech and I found browsing to be plenty fast. Admittedly it was plain text sites with no images or whatever. And the installation/use of the Tor browser was easy.
- quickthrower2 3y agoOne does not need to justify Tor usage :-)
- KyeRussell 3y agoThat’s incredibly generous. The VPN industry is deserving of its bad reputation. Collecting user data in clear contravention of their TOS. Using hacked boxes as VPN endpoints to get people onto residential IP ranges. And whatever else. I’m very confident in my completely baseless assertion that most people that use a “public” VPN are either bypassing geographical restrictions on a streaming service, or doing something outright shady. There’s a reason that it’s common for VPN providers to take cash and cryptocurrency, as this one does. It does precisely zilch to thwart the sort of tracking that affects the vast vast vast majority of Internet users. The VPN industry isn’t being propped up by nerds indulging their crypto libertarian / anarchism fetish but are just spending their time reading Hacker News (with JS off, obviously). There just aren’t enough of them.
- bingobongodude 3y agoMullvad has been very outspoken against the proposed "Chatcontrol" law. I suspect retaliation. Just my 2 cents. https://mullvad.net/en/chatcontrol https://mullvad.net/en/chatcontrol
- Ansik 3y agoIf it had actually been in retaliation they'd left with the severs no matter if they contained anything of value, as with pirate bay
- pedro_hab 3y agoI don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to hide?
- Kuinox 3y agoTo watch movies that are not licensed in your country, on legals platforms.
- peer2pay 3y agoWhen tunneling through a VPN ideally thousands of users will share the same exit IP. So even if all your apps "phone home" identifiable information there is no way to prove that whatever traffic "the law" is trying to pin you on actually originates from your machine. Unless of course if the VPN keeps detailed traffic logs which is why that’s generally frowned upon.
- sdrinf 3y agoBriefly, law requires establishing probable cause, that _one_ specific person has done specific things, to underwrite search warrant. VPN IPs are shared between users, meaning any one of the ~X00 users sharing a single ip could be doing any number of things at the same time.
- formerly_proven 3y agoBriefly, non-US jurisdictions are not US jurisdictions and have different standards and procedures.
- mthoms 3y agoI think the comment was made under the assumption the user lives in a place with a reasonably fair legal system. Of course all bets are off if you don't.
- GoofballJones 3y agoWith past experience with law enforcement, if they don't get what they want, they will continue to harass and needle and try to chip away at what they can until they get some semblance of what they wanted.
- asoneth 3y ago> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.
- WaitWaitWha 3y ago"Once is happenstance. Twice is coincidence. Three times is enemy action." - Ian Fleming, Goldfinger I find this to be a reasonable subjective measure.
- tsukikage 3y agoI did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?
- input_sh 3y agoThey've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.
- password4321 3y agoHotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/ https://wiebetech.com/products/hotplug-field-kit/
- 3y ago
- plasticsoprano 3y agoThat was my bad, y'all. Needed that full season of Milf Manor.
- blint_carton 3y ago"After demonstrating that this is indeed how our service works..." I'm curious how they demonstrated that. Did they just review their policies with them or did they some how technically demonstrate this? Latter seems not really possible to do, even if you had a technically-savvy member of the department there.
- H-2-O 3y agoJust a speculation - if the story was true then the search warrant was just an excuse to seize remote admin access control key to some other server(likely RAM server). Also any one else noticed mullvad has a socks relay in russia(check the browser addon for firefox or Mullvad Browser > Switch location) .... well that might explain why /b OR ... something more fishy is going on behind the scene.
- lnxg33k1 3y ago[misread the article]
- hnarn 3y agoYour comment is very presumptive. How do you know what the warrant was for, and that it wasn’t fulfilled?
- tejohnso 3y ago> Mullvad has been operating our VPN service for over 14 years. This is the first time our offices have been visited with a search warrant. Does a search warrant detail the reason and justification for the warrant, or are you left in the dark about what all the hassle and disruption was even about?
- hnarn 3y agoYes it does, but Mullvad may have good reasons for not sharing it. For example that it does nothing to improve their information to their customers (ie what exactly is being investigated is irrelevant for the public), while simultaneously damaging the investigation and therefore their relationship with the government.
- SV_BubbleTime 3y agoDoes anyone have a Nord vs Mullvad on speed of servers in the USA. I’m ending out my Nord and want to switch, but man, I’m actually surprised at how fast Nord’s servers are, I can get 500mbps on non-peak times.
- beltsazar 3y agoI've been a Mullvad customer for some time and I'm quite satisfied. But the main issue I have is that many of its servers are blacklisted by Cloudflare and other services. Because Mullvad provides the strongest anonymity a VPN can provide, it attracts not only normal users, but also malicious users (scammers, hackers, or less malicious but more numerous scrappers).
- Etheryte 3y agoI've run into this as well, but for what it's worth, this is a problem every VPN provider struggles with. The most colorful example I have is receiving an email from my bank telling me they've blocked access to online banking because someone tried to log into my account from a suspicious IP — yes, it was me. Luckily I use a fairly small local bank who cuts through issues like this swiftly with a short phone call.
- KomoD 3y ago> many of its servers are blacklisted by Cloudflare Can't relate, haven't had this happen when using Mullvad
- EduardoBautista 3y agoMaybe it’s not entirely obvious, but you should be seeing captchas more frequently while using Mullvad. Whenever I disable it, I don’t run into captchas as often.
- benmmurphy 3y agoIs this a warrant canary? Maybe the police seized machines but they were blocked from commenting so they published this implausible claim the police went away empty handed.
- kkielhofner 3y agoI'm an American (keep that in mind) but I have been to Sweden many many times throughout my entire life (my dad worked there). It's a great place and somewhat famously the "Swedish Subway Cops"[0] highlighted the difference between US and Swedish policing seven years ago. All of that said I find it highly, highly implausible that law enforcement anywhere in the world would show up with a warrant and just walk out with nothing saying "Oh ok, sorry for the confusion!" because a subject of the warrant told them "Oh we don't have that. Here's my logging configuration file - see line 45 where logs go /dev/null?" (or whatever). Sweden is not the US and maybe I can't picture this because of our issues here but still - this narrative and explanation really strains credibility to me. [0] - https://www.youtube.com/watch?v=izdfnHBMwSs https://www.youtube.com/watch?v=izdfnHBMwSs
- troad 3y agoWarrants generally have to be for something. It’s possible that the police officers showed up with a warrant for user names and addresses, etc, and Mullvad was able to demonstrate that they don’t possess any data responsive to the warrant. At that point there may not have been anything to (lawfully) carry away. It doesn’t necessarily mean that the cops won’t show up tomorrow with a more generic warrant, and Mullvad may have to hand over whatever information it does possess.
- hnarn 3y agoThe people that attend when these warrants are executed are highly technically skilled, and obviously Swedish surveillance agencies know Mullvad very well, probably intimately (ie it wouldn’t surprise me if they even have an understanding of their infrastructure). It’s not at all “highly implausible” that they showed up for a technical discussion to see if the data they wanted but were almost certain did not exist could be retrieved. If they are confident that this data does not exist, why would they start seizing hardware? As I said: they probably have a basic understanding of how their infrastructure works (especially since Mullvad is fairly open about it), and they likely understand that the second they power off those servers and move them, they are never booting up the same again. So yeah, what you describe as “look at line 45” is not a silly example, because it’s probably more access than they would ever get than if Mullvad met them with hostility.
- sebiandev 3y agoThis right here is why I use Mullvad.
- doodlesdev 3y agohttps://archive.ph/y7y9E https://archive.ph/y7y9E
- hnarn 3y agoThe summary of many comments so far seems to be: "I don't believe this is what actually happened when this warrant was executed in Sweden, because it doesn't sound like something that would happen when a warrant is executed in the US."
- iio7 3y agoExactly this! It's Sweden, not the US.
- AtNightWeCode 3y agoThe police have confirmed that they were at the location but there are no further details. Could be anything.
- aborsy 3y agoWhat if the law enforcement, instead of saying give me your logs, rephrase it slightly and says, start logging this IP address and then give me your logs? They can do whatever they want.
- gameshot911 3y agoA warrant can compel the seizure of existing evidence, but I don't know if it legally can compel the creation of new evidence by a 3rd party. At least in the US. I'm sure there are exceptions under various anti-terrorism laws, but in general it seems like the government can't compel corporations or individuals to assist in it's investigations.
- relatedtitle 3y agoRelevant: https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
- rodolphoarruda 3y agoWould it be possible that the warrant issued by Swedish authorities came via a prior request by the Interpol?