Hacker News Reader

Comment by dewey | Hacker News Reader

Because for this use case of avoiding the extortion lawyers this is good enough. Nobody is going to bother with trying to go after some VPN provider when there's millions of people on normal ISPs where they just have to give them a call.

As usual, it's all about knowing your threat model.

View on HN

You don’t think providers would be willing to sell that information for cheap? They’d just saw off country sized chunks and sell bit by bit

The business model of these lawyers is to join a few swarms of big popular titles, then send automated letters to the ISP, then send automated letters to the address they got from the ISP and collect money (At least here in Germany).

They are only going after the low hanging fruits, it's not about catching everyone or doing deals with VPN providers located in some hard to reach country.

That’s an extremely definitive point of view. What if the lawyers agree to give the VPN provider 10% of the proceeds?

That VPN provider would likely be out of business extremely fast. If you offer a service that's supposed to increase privacy, and it doesn't... who's gonna pay for that service? Of course exceptions apply with law enforcement, but then again your threat model is very different there (and the VPN provider in question will not be able to say no).

That being said, there are VPN providers who guarantee that no logs are kept (I believe ProtonVPN does this) and are extremely privacy-oriented. I am inclined to believe these companies, if all I'm doing is pirating a few movies.

VPN\seedbox providers probably don’t make the wisest business choices. They may not care bout the longevity of their business even if they do.

Hosting providers that sell bandwidth to VPN services could easily log traffic.

There have been numerous cases where ‘No logs’ VPN providers have been caught logging details. See the recently exposed logstash breach.

Why couldn't lawyers almost as easily send bulk IP requests to VPN providers as they send notifications to ISPs?

The VPN can credibly claim not to hold on to that information.

What does the VPN provider claim when they receive a court summons for copyright infringement?

In the US at least, they are neither liable for the actions of their users nor under any sort of obligation to retain IP address logs. So, as far as I can tell, they're free to respond with "sorry, can't help you." IANAL, though.

The EU on the other hand has mandatory data retention, but it seems that this has been challenged be several countries, according to https://www.eff.org/issues/mandatory-data-retention

PIA (before acquisition) said in lawsuit that they can't provide IP address because they don't save.

They don't receive a summons, because the courts in their jurisdiction don't issue summons for that.

Why wouldn't lawyers run a vpn service in order to collect IPs?

Reply on news.ycombinator.com