8 ms·

Full title: Mullvad VPN was subject to a search warrant. Customer data not compromised As a customer, I have no doubt about the "customer data not compromised"

Full title: Mullvad VPN was subject to a search warrant. Customer data not compromised As a customer, I have no doubt about the "customer data not compromised". I'm a paying customer, yet I have never given them any PII. Great service.

wepple 4y ago
Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name
- john_the_writer 4y ago
  Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.
  - raverbashing 4y ago
    True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.
    - zamnos 4y ago
      Dns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
      - raverbashing 4y ago
        I know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had (of course, it all depends on the DNS provider you choose)
- hnarn 4y ago
  > Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.
  - bragr 4y ago
    That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
    - nabla9 4y ago
      There is no such laws in Sweden.
      - bragr 4y ago
        That does not appear to be factual: https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2008717-om-signalspaning-i_sfs-2008-717 https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-f...
        SiempreViernes 4y ago
        What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data. Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1 https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.
        bragr 4y ago
        Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws. [1] https://lagen.nu/prop/2006/07:63 https://lagen.nu/prop/2006/07:63
- ragnese 4y ago
  Does anyone here know how to corroborate Mullvad's account of this event? Perhaps we can find the Swedish entity that wrote the warrant and any public information reported by the officers executing said warrant? If such information is publicly accessible, and it corroborates Mullvad's story here, I'd feel like that's pretty compelling evidence that we can trust that Mullvad isn't simply committing fraud by promising not to log customer data while actually logging it.
  - larsnystrom 4y ago
    When the prosecutor brings forth the charges to a court, this information will be public. Until then it is probably covered by “förundersökningssekretess”, which just means that ongoing investigations are not public.[0] You can contact the “Åklagarmyndigheten” (the Swedish prosecutor authority) and ask them and they’ll help you out. Generally speaking it is pretty easy to get information from government agencies in Sweden due to our constitution. Everything is public by default, with some exceptions like military secrets. I think it shouldn’t be a problem for the prosecutor to confirm they had a warrant at Mullvads office, and maybe even to confirm they didn’t seize anything, unless they think it could harm the ongoing investigation somehow. [0] https://www.aklagare.se/om_rattsprocessen/fran-brott-till-atal/brottsutredningen/sekretess-under-pagaende-forundersokning/ https://www.aklagare.se/om_rattsprocessen/fran-brott-till-at...
CodesInChaos 4y ago
How did you pay?
- sunbum 4y ago
  Mullvad lets you pay with just an envelope of cash via the mail if you want.
- fudgefactorfive 4y ago
  Apparently you can literally mail them cash with your randomly generated user id on a card and they'll top up credit for you.
- deleted 4y ago
  [deleted]
- actionfromafar 4y ago
  At least before, one could pay in cash in envelope.
  - eitland 4y ago
    Cash in envelope is still welcome.
- Maxious 4y ago
  > Which payment methods do you accept? > We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24. > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD. https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/
  - andygeorge 4y ago
    ah yes, notoriously-anonymous physical mail
lxgr 4y ago
> I'm a paying customer, yet I have never given them any PII. By nature, every VPN gets at least the IP you are connecting from and the IPs (and almost always also hostnames) you are connecting to. I'd consider that PII.
- InCityDreams 4y ago
  If you pay cash, and use the service the pii is 2 IP numbers?
  - LeonM 4y ago
    How would you pay cash for an online service?
    - HDThoreaun 4y ago
      you can mail them cash with your account number.
    - pulpfictional 4y ago
      Mullvad accepts mail-in cash.
    - msdrigg 4y ago
      One quick google away: > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD. https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/
    - csomar 4y ago
      They accept Cash and also Crypto.
  - lxgr 4y ago
    As long as you only connect from one IP and only ever access one host, sure! That's not trivial to achieve with most VPN clients and devices/operating systems, though.

wepple 4y ago

Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name

john_the_writer 4y ago
Also, just because a company doesn't get your name, doesn't mean they don't know every little thing about you. PPI doesn't include my fingerprint, but Google 100% has my online fingerprint.
- raverbashing 4y ago
  True, and it's a good reminder that VPN does not mean "more privacy". It means more privacy in relation to specific parts and less to others. You can get a lot of info through DNS queries for example.
  - zamnos 4y ago
    Dns-over-HTTPS (DoH) ftw https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
    - raverbashing 4y ago
      I know, I'm glad Mullvad is offering this service and I think the benefits outweigh the worries some had (of course, it all depends on the DNS provider you choose)
hnarn 4y ago
> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.
- bragr 4y ago
  That's a specious argument, because the choice could be between logging your traffic and being forced to shutdown under some kind of Swedish NSL, or forced to keep operating and logging even if they want to shut down. Not saying this is what happened, just that your reasoning doesn't really hold. Hell it's entirely possible Mullvad is a honeypot operated by some foreign intelligence service.
  - nabla9 4y ago
    There is no such laws in Sweden.
    - bragr 4y ago
      That does not appear to be factual: https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2008717-om-signalspaning-i_sfs-2008-717 https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-f...
      - SiempreViernes 4y ago
        What do you mean? Lag 2008:717 does not contain any provisions about forcing companies to log or store data. Rättegångsbalken does have a provision that a prosecutor can order you to preserve information you already have saved for a maximum of 180 days (https://lagen.nu/1942:740#K27P16S1 https://lagen.nu/1942:740#K27P16S1). I can't find anything about what the punishment for ignoring such an order would be, but to say a company could be forced to keep operating seems extraordinarily unfounded.
        bragr 4y ago
        Try this one [1] which contains an obligation for operators to comply and maintain secrecy. I'm not a lawyer, and definitely not a swedish lawyer, but my point is, despite baked in protections, like most countries, Sweden seems to have a robust set of overlapping national security and surveillance laws. [1] https://lagen.nu/prop/2006/07:63 https://lagen.nu/prop/2006/07:63
ragnese 4y ago
Does anyone here know how to corroborate Mullvad's account of this event? Perhaps we can find the Swedish entity that wrote the warrant and any public information reported by the officers executing said warrant? If such information is publicly accessible, and it corroborates Mullvad's story here, I'd feel like that's pretty compelling evidence that we can trust that Mullvad isn't simply committing fraud by promising not to log customer data while actually logging it.
- larsnystrom 4y ago
  When the prosecutor brings forth the charges to a court, this information will be public. Until then it is probably covered by “förundersökningssekretess”, which just means that ongoing investigations are not public.[0] You can contact the “Åklagarmyndigheten” (the Swedish prosecutor authority) and ask them and they’ll help you out. Generally speaking it is pretty easy to get information from government agencies in Sweden due to our constitution. Everything is public by default, with some exceptions like military secrets. I think it shouldn’t be a problem for the prosecutor to confirm they had a warrant at Mullvads office, and maybe even to confirm they didn’t seize anything, unless they think it could harm the ongoing investigation somehow. [0] https://www.aklagare.se/om_rattsprocessen/fran-brott-till-atal/brottsutredningen/sekretess-under-pagaende-forundersokning/ https://www.aklagare.se/om_rattsprocessen/fran-brott-till-at...

CodesInChaos 4y ago

How did you pay?

sunbum 4y ago
Mullvad lets you pay with just an envelope of cash via the mail if you want.
fudgefactorfive 4y ago
Apparently you can literally mail them cash with your randomly generated user id on a card and they'll top up credit for you.
deleted 4y ago
[deleted]
actionfromafar 4y ago
At least before, one could pay in cash in envelope.
- eitland 4y ago
  Cash in envelope is still welcome.
Maxious 4y ago
> Which payment methods do you accept? > We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24. > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD. https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/
- andygeorge 4y ago
  ah yes, notoriously-anonymous physical mail

lxgr 4y ago

> I'm a paying customer, yet I have never given them any PII. By nature, every VPN gets at least the IP you are connecting from and the IPs (and almost always also hostnames) you are connecting to. I'd consider that PII.

InCityDreams 4y ago
If you pay cash, and use the service the pii is 2 IP numbers?
- LeonM 4y ago
  How would you pay cash for an online service?
  - HDThoreaun 4y ago
    you can mail them cash with your account number.
  - pulpfictional 4y ago
    Mullvad accepts mail-in cash.
  - msdrigg 4y ago
    One quick google away: > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD. https://mullvad.net/en/pricing/ https://mullvad.net/en/pricing/
  - csomar 4y ago
    They accept Cash and also Crypto.
- lxgr 4y ago
  As long as you only connect from one IP and only ever access one host, sure! That's not trivial to achieve with most VPN clients and devices/operating systems, though.