5 ms·

I am all-but-certain that NordVPN doesn't. I am in possession of records from a recent police investigation in which law enforcement subpoenaed NordVPN and the

I am all-but-certain that NordVPN doesn't. I am in possession of records from a recent police investigation in which law enforcement subpoenaed NordVPN and the company replied, essentially, that they had no information connecting a particular IP address, at a specific date and time, to any specific user. (I am a reporter who covers law enforcement and crime.)

ejiblabahaba 3y ago
Are you sure you're not thinking of Mullvad? Related: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917
- trogdor 3y ago
  Yes. This is a totally unrelated case that never made the news.
  - wallaBBB 3y ago
    Countless examples of Nord supplying logs. They all have to keep logs or would be banned from offering services to US citizens.
    - Timber-6539 3y ago
      Provide just one example. Am curious.
      - wallaBBB 3y ago
        Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... Exact examples are hard to find in the press. One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed.
        Timber-6539 3y ago
        > Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. > Exact examples are hard to find in the press. You said there are countless examples of Nord logging user data, why are you backtracking now? > One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed. Give source or it did not happen.
        wallaBBB 3y ago
        >This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” Why you don't find articles googling is that Nord puts a lot of effort in removing or burring it (google their dispute with TorGuard). Same what they tried to do with the breach in 2018, they half-ass disclosed at least 6 months later after being known to them. (at a point in time the breach already leaked) Example I gave was a talk in a hacker conference, with no recording (common request for hacker conference talks).
        Timber-6539 3y ago
        > Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” This is obviously true for every VPN company that intends to keep operating. And in itself is not evidence of anything. If all the links were taken down, how come no one saved a copy on wayback machine because the burden of proof is on you to provide these backups every time you make such allegations. Otherwise I'll just assume you are just being disingenuous.
    - salawat 3y ago
      Are you sure you aren't thinking UK? In the US, you have to be a common carrier to be covered by CALEA. Internet services are not required to keep logs. I could be wrong though.
rvba 3y ago
Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. The (law enforcement) agencies can just go to the few biggest VPN suppliers. Just like they go to FAANG.
- chollida1 3y ago
  > Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. Based on what? You just seem to be making a wild unsubstantiated conjecture here.
  - tarboreus 3y ago
    It's obviously an unsubstantiated statement, but given all the concrete information on the MOs of alphabet agencies, it seems like a reasonable bet. If they haven't done one of those things, they probably just haven't gotten around to it yet.
    - deleted 3y ago
      [deleted]
    - lazide 3y ago
      Frankly, they’d have to be criminally incompetent or negligent considering all the things we know for sure they’ve done.
  - KeplerBoy 3y ago
    It's the perfect honeypot situation, isn't it?
    - foobiekr 3y ago
      Watering hole.
  - Nanana909 3y ago
    Is it that wild? There are a few questions we have to ask 1. Do these agencies have the motivation to do the above? I think the answer here is an obvious yes to everyone 2. Do these agencies have the technical ability to hack the VPNs, the finances to pay them for access, or some other reasonable measure to coerce compliance? If 1 and 2 are both true, then the OP claim is also certainly true. Given that 1 is true, I don’t think it’s “wild” to claim that these agencies cannot satisfy 2. In fact I’d say given the historical record, the more wild claim is that the CIA/NSA etc is incapable of satisfying #2.
Etheryte 3y ago
You must be mistaking NordVPN for Mullvad.
- trogdor 3y ago
  I am not. This is an unrelated case that has never been reported publicly.
  - Etheryte 3y ago
    This sounds somewhat hard to believe. If the description of events is accurate, this would be superb marketing for the VPN provider. Why would they not talk about it publicly?
dingle_thunk 3y ago
There's no reason to have a link with intelligence agencies when you're already run by an intelligence agency...
nullc 3y ago
Then that is a service then which might be safe for people who's opponents are the police. But some people also worry about threats from the obscenely rich, from their own intelligence agencies, from foreign intelligence agencies, from organized crime, and/or from popular mob outrage. Your experience doesn't indicate the safety of the service against those other threats, and not only may they not be correlated but they may be anti-correlated. E.g. I bet both CIA and mob run VPN services are really good at saying no to the police. The fundamental thought that drives my opinion on this subject is this: We already know for a fact that some state actors do broad scale full take surveillance of the internet. VPN services are even more attractive to monitor because the users are somewhat self-selecting as people who have something to hide, more intel bang per megabit monitored. Without surveilling VPNs these entities would have a blindspot in their expensive internet monitoring machine, so its important just for completeness sake. The VPN provider game is also a much lower barrier to entry, smaller players that don't have the power to push around AT&T can get in on it. Russia, for example, isn't in that much of a position to engage in world wide telecom monitoring (except perhaps that one fiber that goes through sibera and has really low latency between europe and china)-- but they sure can stand up some VPNs and get the worlds traffic to come to them. Plus, if you run a VPN service people will pay you to run their secret data through you. It's a profit center even before you get to the potential revenue streams from abusing your position. Perhaps it becomes so profitable that you'd prefer to protect it and so you minimize your abuse, but the optimal amount of abuse will pretty much never be zero. So, If you're the head of a clandestine service or serious organized crime group and you haven't launched at least one VPN service you should be immediately fired for grave incompetence. The best reason to not run one would just be that you've already infiltrated many existing ones through operatives and backdoored hardware. And also the heat you take running these services is much easier to deal with if you have 'connections' either of the run-by-a-TLA sort or the we-have-blackmail-material-and-can-break-your-fingers sort. And corrupt VPNs have a whole extra potential revenue/benefit source so they can afford to under-price any honest competition. Given that, we should expect that many VPNs are honeypots. Probably not all of them, but by their very nature it should be hard to impossible to tell which.
TedDoesntTalk 3y ago
Here’s one such subpoena and reply (full PDF linked in the article): https://blog.getfoxyproxy.org/2017/11/04/secret-service-subpoena/ https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...

ejiblabahaba 3y ago

Are you sure you're not thinking of Mullvad? Related: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917

trogdor 3y ago
Yes. This is a totally unrelated case that never made the news.
- wallaBBB 3y ago
  Countless examples of Nord supplying logs. They all have to keep logs or would be banned from offering services to US citizens.
  - Timber-6539 3y ago
    Provide just one example. Am curious.
    - wallaBBB 3y ago
      Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... Exact examples are hard to find in the press. One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed.
      - Timber-6539 3y ago
        > Here is a general text on that: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-with-law-enforcement-data-requests https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. > Exact examples are hard to find in the press. You said there are countless examples of Nord logging user data, why are you backtracking now? > One that comes to mind is from a Belgian Telco company that was internally hacked by an employee hiding behind NordVPN. Nord when approached by the telco responded with the usual no logs, but after the telco involved the Interpol, logs were given and the attacker doxxed. Give source or it did not happen.
        wallaBBB 3y ago
        >This article (edited multiple times!) is not evidence of anything, let alone Nord co-operating with law enforcement to log customer data. Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” Why you don't find articles googling is that Nord puts a lot of effort in removing or burring it (google their dispute with TorGuard). Same what they tried to do with the breach in 2018, they half-ass disclosed at least 6 months later after being known to them. (at a point in time the breach already leaked) Example I gave was a talk in a hacker conference, with no recording (common request for hacker conference talks).
        Timber-6539 3y ago
        > Not sure what is not clear from this: “We will comply with lawful requests as long as they are delivered according to all the laws and regulations," NordVPN says. "We are a company that protects the security and privacy of our customers, but we operate according to laws and regulations.” This is obviously true for every VPN company that intends to keep operating. And in itself is not evidence of anything. If all the links were taken down, how come no one saved a copy on wayback machine because the burden of proof is on you to provide these backups every time you make such allegations. Otherwise I'll just assume you are just being disingenuous.
  - salawat 3y ago
    Are you sure you aren't thinking UK? In the US, you have to be a common carrier to be covered by CALEA. Internet services are not required to keep logs. I could be wrong though.

rvba 3y ago

Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. The (law enforcement) agencies can just go to the few biggest VPN suppliers. Just like they go to FAANG.

chollida1 3y ago
> Looking at the scale of NordVPN they either already have a liason with aurhorities inside, or are hacked by authorities. Based on what? You just seem to be making a wild unsubstantiated conjecture here.
- tarboreus 3y ago
  It's obviously an unsubstantiated statement, but given all the concrete information on the MOs of alphabet agencies, it seems like a reasonable bet. If they haven't done one of those things, they probably just haven't gotten around to it yet.
  - deleted 3y ago
    [deleted]
  - lazide 3y ago
    Frankly, they’d have to be criminally incompetent or negligent considering all the things we know for sure they’ve done.
- KeplerBoy 3y ago
  It's the perfect honeypot situation, isn't it?
  - foobiekr 3y ago
    Watering hole.
- Nanana909 3y ago
  Is it that wild? There are a few questions we have to ask 1. Do these agencies have the motivation to do the above? I think the answer here is an obvious yes to everyone 2. Do these agencies have the technical ability to hack the VPNs, the finances to pay them for access, or some other reasonable measure to coerce compliance? If 1 and 2 are both true, then the OP claim is also certainly true. Given that 1 is true, I don’t think it’s “wild” to claim that these agencies cannot satisfy 2. In fact I’d say given the historical record, the more wild claim is that the CIA/NSA etc is incapable of satisfying #2.

Etheryte 3y ago

You must be mistaking NordVPN for Mullvad.

trogdor 3y ago
I am not. This is an unrelated case that has never been reported publicly.
- Etheryte 3y ago
  This sounds somewhat hard to believe. If the description of events is accurate, this would be superb marketing for the VPN provider. Why would they not talk about it publicly?

dingle_thunk 3y ago

There's no reason to have a link with intelligence agencies when you're already run by an intelligence agency...

nullc 3y ago

Then that is a service then which might be safe for people who's opponents are the police. But some people also worry about threats from the obscenely rich, from their own intelligence agencies, from foreign intelligence agencies, from organized crime, and/or from popular mob outrage. Your experience doesn't indicate the safety of the service against those other threats, and not only may they not be correlated but they may be anti-correlated. E.g. I bet both CIA and mob run VPN services are really good at saying no to the police. The fundamental thought that drives my opinion on this subject is this: We already know for a fact that some state actors do broad scale full take surveillance of the internet. VPN services are even more attractive to monitor because the users are somewhat self-selecting as people who have something to hide, more intel bang per megabit monitored. Without surveilling VPNs these entities would have a blindspot in their expensive internet monitoring machine, so its important just for completeness sake. The VPN provider game is also a much lower barrier to entry, smaller players that don't have the power to push around AT&T can get in on it. Russia, for example, isn't in that much of a position to engage in world wide telecom monitoring (except perhaps that one fiber that goes through sibera and has really low latency between europe and china)-- but they sure can stand up some VPNs and get the worlds traffic to come to them. Plus, if you run a VPN service people will pay you to run their secret data through you. It's a profit center even before you get to the potential revenue streams from abusing your position. Perhaps it becomes so profitable that you'd prefer to protect it and so you minimize your abuse, but the optimal amount of abuse will pretty much never be zero. So, If you're the head of a clandestine service or serious organized crime group and you haven't launched at least one VPN service you should be immediately fired for grave incompetence. The best reason to not run one would just be that you've already infiltrated many existing ones through operatives and backdoored hardware. And also the heat you take running these services is much easier to deal with if you have 'connections' either of the run-by-a-TLA sort or the we-have-blackmail-material-and-can-break-your-fingers sort. And corrupt VPNs have a whole extra potential revenue/benefit source so they can afford to under-price any honest competition. Given that, we should expect that many VPNs are honeypots. Probably not all of them, but by their very nature it should be hard to impossible to tell which.

TedDoesntTalk 3y ago

Here’s one such subpoena and reply (full PDF linked in the article): https://blog.getfoxyproxy.org/2017/11/04/secret-service-subpoena/ https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...