SoylentNews is people
SoylentNews
Cops Raid Swedish VPN Provider Only to Find Out There's No 'There' There
Cops Raid Swedish VPN Provider Only To Find Out There's No 'There' There:
[...] So, it always gives me pleasure to learn that cops armed with court orders approached a privacy oriented tech company only to find out the stuff they wanted didn't actually exist at the place they searched. Due diligence is a thing, investigators. Your boilerplate is obviously false if you've claimed (based on "training and expertise") that the place you want to search contains the information you wish to obtain.
That's the case here. A Swedish VPN provider was raided by local law enforcement, but was unable to produce any of the information officers were searching for... something officers might have realized prior to the search if they'd bothered to read the terms of service. Here's Michael Kan with the details for PC World:
The company today reported that Swedish police had issued a search warrant two days earlier to investigate Mullvad VPN's office in Gothenburg, Sweden. "They intended to seize computers with customer data," Mullvad said.
However, Swedish police left empty-handed. It looks like Mullvad's own lawyers stepped in and pointed out that the company maintains a strict no-logging policy on customer data. This means the VPN service will abstain from collecting a subscriber's IP address, web traffic, and connection timestamps, in an effort to protect user privacy. (It's also why Mullvad VPN is among our most highly ranked VPN services.)
If the cops had run a search of Mullvad's website before running a physical search of its offices, it might have discovered the stuff they swore would be found there actually wouldn't be found on Mullvad's premises. It's not like it's that difficult to find:
There is a law to collect user data in India and other countries. Does this affect Mullvad?
Mullvad does not collect user data. Mullvad is based in Sweden and none of the Swedish regulations (https://mullvad.net/help/swedish-legislation/) can force VPN providers to secretly collect traffic-related data. We also have no servers, infrastructure or staff in India.
In other words, bring all the law you want, but in the end:
Raid if you want. But you can't have what providers like Mullvad are unwilling to collect. In the end, you've done nothing more than make some noise and embarrass yourself. It's all there in the Mullvad FAQ, including the fact that Mullvad performs no logging of user activity. If your investigation leads you to providers like Mullvad, it's a dead end. Look elsewhere.
This policy isn't in place because Mullvad wants to protect criminals. It's in place because people all over the world deserve protection from government overreach. That criminals may benefit from policies like these doesn't make these policies bad, it just makes it more difficult for abusive governments to engage in third-party-enabled surveillance.
And the long history here shows Mullvad isn't a home for criminals. It's just an extremely well-run VPN provider:
"Mullvad has been operating our VPN service for over 14 years. This is the first time our offices have been visited with a search warrant," the company added.
Cops Raid Swedish VPN Provider Only to Find Out There's No 'There' There - followup
Mullvad has published an update: The Swedish authorities answered their protocol request but without providing any information. The Swedish authorities based their refusal on claims of national security due to carrying out the raid at the behest of Germany. Mullvad quotes the specific laws which even show that they were raided in error.
Electronic Communications Act (2022:482) (LEK) Does not apply to Mullvad VPN AB
According to LEK's definitions, LEK does not apply to Mullvad since we, as a VPN service provider are not regarded as an electronic communications network nor an electronic communications service.
Act (2012:278) on Collection of Data in Electronic Communication in the Crime Combating Authorities' Intelligence Service (IHL)
This law can only be used to request user data from businesses having the LEK reporting obligation. This means authorities cannot use LEK nor IHL to request information from Mullvad.
The Swedish Code of Judicial Procedure (1942:740) (RB)
According to this, a search of premises may be instigated not just on the individual who is suspected on reasonable grounds but on anyone, provided that there is a factual circumstance and that it can be tangibly demonstrated that there is a reasonable expectation of finding items subject to seizure, or other evidence of the offense in question. Objects may also be seized if they are believed to have importance for the investigation.
According to one of the relevant laws, the government can only grant the police permission to search the premises if it can be tangibly demonstrated that there is a reasonable expectation of finding items subject to seizure. Given that Mullvad neither collects that information nor is required to collect that information, there was no basis for the raid except, I conjecture, for possible harassment.
Furthermore the Swedish authorities seem to have lost Mullvad's earlier inquiry.
(Score: 0, Troll) by JoeMerchant on Wednesday May 03, @03:17PM (15 children)
>If the cops had run a search of Mullvad's website before running a physical search of its offices,
they would have had to understand what they were reading.
IDK Swedish cops, but US cops know guilty people on sight, all they have to do is look them in the eyes and they know if this is somebody they should be arresting. (sadly, no /s here)
So, seems like the Swedish cops were sure, based on that 13 year old hacker they busted last year and their search of his PC, that they could find information on the VPN servers that would lead them to guilty people.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 3, Funny) by Anonymous Coward on Wednesday May 03, @03:43PM (14 children)
> all they have to do is look them in the eyes and they know if this is somebody they should be arresting.
Based on the news I get (somewhat reliable in this case?), USA cops may also look slightly away from the eyes...to check skin color. And in the cases where someone gets shot in the back (no view of the eyes), it seems that skin color may be a primary factor...
(Score: 2, Troll) by JoeMerchant on Wednesday May 03, @03:53PM (13 children)
That's not all US cops, not even a majority, but when 49% of your police force is prejudiced it's still a major problem.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 4, Insightful) by Tork on Wednesday May 03, @05:18PM (4 children)
That depends on how you gauge the silent ones that enable them.
Slashdolt Logic: "25 year old jokes about sharks and lasers are +5, Funny." 💩
(Score: 2) by JoeMerchant on Wednesday May 03, @06:42PM (3 children)
>That depends on how you gauge the silent ones that enable them.
I agree with you (otherwise good cops who don't call out bad cops are themselves bad cops), but still believe, on balance, we've got something more than 51% good cops in this country, maybe not much more, maybe quite close to 0% in select jurisdictions, but also cops who do a hell of a lot more good than harm, even in some of the worst jurisdictions.
And then you get into questions like: "if they're prejudiced against black people but they hardly ever see a black person in their jurisdiction, does that count?" Yes, it should, but if we're going to get to 51% good we'll probably have to cut them some slack somewhere...
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 2) by Tork on Wednesday May 03, @06:52PM (2 children)
Slashdolt Logic: "25 year old jokes about sharks and lasers are +5, Funny." 💩
(Score: 2) by JoeMerchant on Wednesday May 03, @09:37PM (1 child)
>That's a terrible success rate
Yes it is, and the next time somebody tells you "most X are Y" remember that: most can be 51%, even though they're speaking like they're assuring you that it's 99.9%.
Most pickup truck drivers around here are very respectful and courteous drivers, even when I'm in a Mazda Miata. The other 40% are raging testosterone fueled assholes.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 2) by Tork on Wednesday May 03, @09:47PM
Slashdolt Logic: "25 year old jokes about sharks and lasers are +5, Funny." 💩
(Score: 3, Touché) by mhajicek on Wednesday May 03, @06:39PM (1 child)
Put a cup of shit in a bucket of soup, you have a bucket of shit.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 3, Funny) by Tork on Wednesday May 03, @06:47PM
Slashdolt Logic: "25 year old jokes about sharks and lasers are +5, Funny." 💩
(Score: 1) by pTamok on Wednesday May 03, @08:49PM (1 child)
It's a major problem when only 1% of your police force are prejudiced. Especially when the 99% don't deal with the bad apples. Failure to deal with them is complicity.
(Score: 3, Insightful) by JoeMerchant on Wednesday May 03, @09:40PM
The scariest thing about US police is: they could be SO much worse than they are (see: https://www.miaminewtimes.com/news/river-of-sleaze-6378923 [miaminewtimes.com] the result of "loosening recruitment requirements.")
They need higher standards, but the inherent problem is: most people who want that job, you don't want to have that job.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 2) by NotSanguine on Wednesday May 03, @11:39PM (3 children)
One is too many in a group with qualified immunity [cornell.edu]. Sadly, we're never going to get rid of all prejudice, so we should work hard to get rid of the worst of those folks and create sane standards around qualified immunity.
No, no, you're not thinking; you're just being logical. --Niels Bohr
(Score: 2) by JoeMerchant on Wednesday May 03, @11:50PM (2 children)
> sane standards around qualified immunity.
Good luck with that. We're in a bad place and getting out of the bad place is going to involve a lot of pain for a lot of people who live in constant denial that there even is a problem.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 2) by NotSanguine on Thursday May 04, @02:18AM (1 child)
And more's the pity.
No, no, you're not thinking; you're just being logical. --Niels Bohr
(Score: 3, Insightful) by JoeMerchant on Thursday May 04, @04:09PM
The fun part is, they believe since it's not a problem _for them_ that it's not a problem at all. Occasionally fortunes change and they start to care about somebody who it is a problem for, and then where are they? Cut off from their previous "friends" because they can no longer support the cause.
Maybe a stretch, maybe not, but the wealthy of Colombia have plenty of money - enough money to come to Miami and spend $10M building houses on Key Biscayne (starting with $3 to 4M to buy the old houses for the land and knock them down to build from scratch...) What that money couldn't buy them in their home country was: security. Those without their wealth would get together and kidnap the children of the wealthy for ransom, like: a lot. It wasn't just an idle concern, it happened to their friends, it happened to them.... when they get to Key Biscayne they'll comment "oh, it's so wonderful here, the children can play in the street and you don't have to have armed guards watching them!"
Even when you can afford armed guards, you have to ask yourself: is this system really working for me? What's broken here? From my perspective, what's broken is that you've got a lot of people in positions of sufficient desperation and suffering that they're striking back any way they can, and kidnapping children is just one example of how that degrades the quality of life of the multi-millionaires below the level of the middle class in a more egalitarian society.
And, still, we started with "trickle down" philosophy 40+ years ago, and we continue blasting down our own road to massive inequality, because the people benefiting from those policies are so short sighted that they think their increasing their own wealth while decreasing others' is going to make their own lives better...
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 4, Interesting) by Entropy on Wednesday May 03, @03:30PM (3 children)
It's nice that there's a trustworthy corporation these days, but no one in their right mind
would suggest that's a common thing. It's nice that they say they don't record that data,
but most companies these days not only collect but then resell our data. Pretty much
any company I assume would prefer to make a nice marking spin on information vs
actually tell the truth.
(Score: 4, Interesting) by JoeMerchant on Wednesday May 03, @03:37PM
I'd honestly pay extra for a company that implements fully transparent 3rd party audits, particularly if there are multiple third parties doing the auditing and they audit competing companies producing similar reports.
Me and about 1% of the market out there, thus the lack of compliance in the free market.
Україна досі не є частиною Росії Слава Україні🌻 https://news.stanford.edu/2023/02/17/will-russia-ukraine-war-end
(Score: 3, Insightful) by DeathMonkey on Wednesday May 03, @06:43PM (1 child)
Hopefully this demonstrates to the rest of them that it's way cheaper to NOT log the data when you factor in Discovery costs and fighting in court to get your servers back.
(Score: 0) by Anonymous Coward on Thursday May 04, @05:14AM
Well, unfortunately, the company can be ordered to keep logs, in the US it can be done in secret, with gag orders and everything, probably in Sweden too. It appears somebody skipped that step in this case
(Score: 0, Offtopic) by MIRV888 on Wednesday May 03, @04:34PM (2 children)
Michael Jackson on the hook.
That sh1t was dope.
(Score: 2) by Tork on Wednesday May 03, @05:21PM (1 child)
Slashdolt Logic: "25 year old jokes about sharks and lasers are +5, Funny." 💩
(Score: 2, Funny) by MIRV888 on Wednesday May 03, @10:27PM
I always feel like somebody's watching me.
(Score: 2, Informative) by pTamok on Wednesday May 03, @09:03PM (1 child)
The Swedish Prosecution Authority don't exactly have a good reputation for strictly following procedure, which is great in 'police procedural' dramas, where maverick guys do irregular things to catch the guilty criminals, but not so good in an impartial justice system.
If you read about the handling of the accusations against Julian Assange, whether or not you like the guy, or think he has a bad reputation, you can describe the work of the Swedes as 'somewhat' irregular.
Deutsche Welle: The case of Julian Assange: Rule of law undermined -- Injustice, torture, political persecution — UN Special Rapporteur on torture Nils Melzer raises serious allegations in his new book, backed up by the results of a two-year investigation. [dw.com]
(Score: 1, Interesting) by Anonymous Coward on Thursday May 04, @06:35AM
Yeah. Maybe I'm too cynical and paranoid[1] but I was actually half suspecting that this incident was actually a "setup" to try to get more people to use this particular Swedish provider because they're working with the NSA etc.
If lots of people you're trying to spy on are using VPNs it's better to convince more of them to use the VPN provider that you're spying on.
Similarly if I'm the Chinese Government I'd buy and create some VPN providers and popularize them in China.
[1] But is it really paranoia given Sweden's track record in such things? They've practically worked for the US Gov. And as you mentioned they did dubious stuff in the Assange case.
https://archive-yaleglobal.yale.edu/content/swedens-nsa-spy-links-deeply-troubling [yale.edu]
https://www.reuters.com/article/us-sweden-spying-idUSBRE9B40AG20131205 [reuters.com]
https://www.thelocal.se/20130906/50096 [thelocal.se]
https://www.thelocal.se/20090508/19324 [thelocal.se]
(Score: 2) by maxwell demon on Thursday May 04, @04:39AM
No. From the terms of service, they could have found that they promise to not collect the data. It doesn't prove that they actually don't do it.
Actually, I'd say that police raid was a net positive for Mullvad VPN. Now we have independent verification from a third party that they really don't store that data. And in that regard, that third party is reliable (had they found something, they would have used it instead of denying it's there). Which increases trust into that VPN provider.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by legont on Thursday May 04, @05:00AM
They should have put the owner under suicide watch, naked in an all white camera with lights always on with no sleep for three months. I am sure some logs would be found if not this time but the very next.
"Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.
(Score: 3, Insightful) by khallow on Thursday May 04, @05:42AM
So if the authorities were to assume that the claims made on Mullvad's site were accurate, then they would reach the above conclusion. But why would they assume that? I see two obvious reasons why not: 1) Mullvad could be lying, and/or 2) Mullvad could have made a mistake and be accidentally collecting the information.
Either way, it seems aggressive (Steve Jackson Games [wikipedia.org] aggressive) to attempt to seize the computers rather than just get the necessary access to them and copy over relevant data.