Russian Government Seize Private Internet Access' Servers

This is a copy of the email I received from them last night:

To Our Beloved Users,

The Russian Government has passed a new law that mandates that every provider must log all Russian internet traffic for up to a year. We believe that due to the enforcement regime surrounding this new law, some of our Russian Servers (RU) were recently seized by Russian Authorities, without notice or any type of due process. We think it’s because we are the most outspoken and only verified no-log VPN provider.

Luckily, since we do not log any traffic or session data, period, no data has been compromised. Our users are, and will always be, private and secure.

Upon learning of the above, we immediately discontinued our Russian gateways and will no longer be doing business in the region.

To make it clear, the privacy and security of our users is our number one priority. For preventative reasons, we are rotating all of our certificates. Furthermore, we’re updating our client applications with improved security measures to mitigate circumstances like this in the future, on top of what is already in place. In addition, our manual configurations now support the strongest new encryption algorithms including AES-256, SHA-256, and RSA-4096.

All Private Internet Access users must update their desktop clients at https://www.privateinternetaccess.com/pages/client-support/ and our Android App at Google Play. Manual openvpn configurations users must also download the new config files from the client download page.

We have decided not to do business within the Russian territory. We’re going to be further evaluating other countries and their policies.

In any event, we are aware that there may be times that notice and due process are forgone. However, we do not log and are default secure against seizure.

If you have any questions, please contact us at helpdesk@privateinternetaccess.com.

Thank you for your continued support and helping us fight the good fight.

Sincerely, Private Internet Access Team

This is truly disheartening. I hope that other providers follow suit and choose the privacy of their customers over profits. This move is unacceptable by the Russian government. To save logs as required by this radical new Russian legislation is to compromise the entire concept of a VPN. I hope that the US government takes note of how direct of an impact this has on the tech industry in Russia, and how it can happen here in the US if the government keeps encroaching on privacy as they have been doing in the past few years. It's going to kill our tech industry if we don't stop.

Putin thinks that his country will be stronger if he suppresses all dissent. But history has shown that, in the long-term, better decisions are usually made if issues are debated out in public.

Quick comment on two Russian laws that often get mixed up:

242-FZ: It requires data on Russian citizens be kept in databases within the borders of Russia, and that first-write and first-update happen in Russia.

The other laws involved required retention of internet access logs for 6 months.

Feels bad for Snowden.

Without any additional information, the story, as presented, is fishy.

1. The “counter-terrorism” package to which they seem to point has only been enacted last month. The details and dates for its impossible requirements for ISPs, hosting providers, services, etc. (to save up to three years of connection metadata and up to half a year of content of all — vaguely defined — “transmissions”) hasn't yet been set.

2. Current law also states that ISPs have to save metadata for 6 months and all traffic for 12 hours (numbers and details can probably be optimized by one-on-one deals with local authorities). This has been in effect since 2014, and the VPN providers seem to didn't have problems with that.

3. I highly doubt they were registered as an ISP and got a license. Compliance to these laws was mostly their hosting provider's headache.

4. Failure to comply is punished by enormous fines, not property seizure.

5. Russian law enforcement can seize your servers “without notice or any type of due process” if they think they have a reason with or without those laws. ISPs do have formal and informal contacts with various agencies to prevent collateral damage and assist in evidence gathering. Maybe they didn't care in this case or it was too important.

6. Haphazard reactions like revoking all their certificates (if they didn't actually have their master server with all the keys in Russia) and boasting snake oil solution of pushing key widths to their limits without a valid cryptographic cause is actually a reason to seriously reconsider whether your own cloud VPN instance would have more competent administrator. (Offtopic rant follows further down.)

So, while it is not impossible that Russian government sent them off with a noticeable brazen in order to scare other companies providing tunneling services (that have been seen as uncooperative and allowing access to content censored by government), there is still no official statement for what happened of any kind. AFAIK, censorship agency, who has always been pretty vocal about its noble citizen protecting activities, didn't comment that accident at all.

Offtopic rant: Let me remind you that all these VPN services are made by people greedy for a quick buck who don't even understand how to setup NAT without side effects for outbound traffic that should return inbound to the same network, and that “anonymity” and “not keeping logs” claims are unenforceable. Traditional ISPs are limited by strict laws in most countries, and they still spy on traffic and sell “depersonalized” (yeah, yeah) data on ad market. VPN server is even tastier way to spy on browsing habits of each of the clients, the temptation is too high to resist if you are not ideologically solid (which, despite all the website speeches, they are not).

It's going to take many decades to repair the damage Putin has done to whatever form of democracy Russia had before him.

But Russians are just as much for blame for wanting a "strong leader" (as in ruling with an iron fist). This is the type of thing such strong leaders do.

Got the message yesterday.

I really liked using Russian Servers, things that are banned in the EU would load fast.