Sure you can never prove anything 100% but VPN providers can still make moves that make them more or less credible.
Even if they shouldn't be able to force you to do some things the best you can do is take them to court, still completely outside public eye, and they can provide some plausible reasons regarding say national security which are likely pretty much impossible to verify.
Eh, this is unsettled law [1]. If you have logs and the U.S. asks for them, you must turn them over. But it's unclear the U.S. can compel you to write new software.
[1] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute#L...
“A party which conducts activities which are subject to a reporting obligation pursuant to Chapter 2, section 1 of the Electronic Communications Act (2003:389) ("LEK") is obligated, upon request of the enforcement agency, to cooperate in connection with the enforcement of covert surveillance of data.”
https://mullvad.net/en/help/swedish-covert-surveillance-data...
> Mullvad cannot be made subject to a duty to cooperate in connection with the enforcement of a decision authorising covert surveillance of data since VPN services are not an activity subject to a reporting obligation pursuant to Chapter 2, section 1 of the LEK.
Same page.
There is some nuclear options https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
> Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
Surely, in a free society, you are free to close down your business for whatever reason you want? Someone might feel like the business is no longer fun to run for X reason, it just happen to have coincided with law enforcement wanting to add wiretaps.
Much like you are free to destroy your belongings in general, but not once their is or there will be a legal order for their surrender (I.e. Destruction of evidence).
Sure, but it’s not something you can do within a day. You need to settle your legal obligations.
The Lavabit founder made the right decision instead of letting law enforcement tap his servers.
That’s really not comparable to a vpn service if a significant proportion of users are using it to legitimately protect against privacy invasion when using an open WiFi network.
How do you know? It could also just be "terrorism" and "child pornography" and that's often reason enough. Similar to the current discussion about banning Telegram in Germany: https://www.euronews.com/my-europe/2022/01/26/germany-consid...
Besides, if it’s “terrorism” and “child pornography” the vpn endpoints would attract attention quickly enough. It’s not like a VPN is a magical anonymous entry into the internet, it just changes the location and mixes your traffic with other customers’.
I'm pretty sure if someone is determined enough to shut down a service or force them to add logging they don't really care about the marketing material of said service. Just like EncroChat didn't brand themselves as phone brand for organized crime.
I there's an entity that wants WireGuard to add logging they'll make up a "terrorism" reason and all the existing "anti-terrorism" laws will open many doors to do just that.
Encrochat was never really taken down, it took itself down because it was cracked and so lost its sole asset, the secrecy of the communications.
But the thing you propose would require quite a few changes to Swedish law to be possible to happen. Mullvad is a Swedish company.
Then they both stopped.
If you need this sort of anonymity, VPNs aren’t the way.
They “both stopped” because the government paid a company to unlock the phone, not because Apple caved.
https://en.m.wikipedia.org/wiki/FBI–Apple_encryption_dispute
Apple also tweaked things like iMessage to make that data available in the cloud (ie available via subpoena or warrant) in most common scenarios.
And BlastDoor last year?
However, I still appreciate a vendor making a credible effort with privacy just as an everyday value.
If I'm gone use a VPN I much rather use a vendor that does a credible job at privacy protection.
[1] https://www.theverge.com/2013/12/18/5224130/fbi-agents-track...
Then they noticed that "that the originating IP address would have been revealed in the email header, which would have indicated Tor usage"
And from there "agents checked to see if anyone had accessed Tor through the local wireless networks. That led them to <culprit>, who promptly confessed."
Doesn't sound like they even had to engage with Tor infrastructure or Guerrilla Mail backends, just 'hmmm did a student use Tor, oh some did, let's check them out in full FBI livery' which freaked the kid out and he confessed.
It's easy to check if an IP is a Tor exit node, but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.
It's an easy problem if you control the majority of the nodes. All it takes is throttling traffic on an exit node and watching which inbound traffic is affected. It is cheap for the US to fund the operation of all Tor nodes in return for the massive intelligence boost it offers.
However FBI tracing bomb-threat is probably still not using NSA-level resources... given the whole not our citizens wink wink thing.
Intercepting encrypted domestic communication is fair game as far as the TLAs are concerned. They also always have the option of routing domestic traffic outside the country to make it "foreign origin".
To me, comparing tor's privacy features against normal VPN is like comparing a jet plane to a tricycle
1. Something happens (terrorism/cpam/insert-bad-thing-here) and a court case ensues and the defense says we don't have logs as we pipe them to /dev/null and the judge says haha nice try here's a fine that puts you out of business or worse jail time.
Mullvad is not bad, but until average people don't have the means to create their own silicon in a cheapo way, you are just farting in the wind.
* for longer than required by law
I mean I get why they removed it, but still, it was a nice convenience.
Sure, you have to trust what they say about logging, but at least they don't have my personal information
If you're doing any sort of activism, well, Darwinism applies here very well.
The problem, of course, is that, as Proton demonstrated, any "no log" provider can be compelled to begin logging for a specific customer by any random corrupt privacy-hating judge.
I am a huge fan of technical solutions to tyranny, but what we need is a VPN provider that provides a jurisdictional solution. Set up the operating corporation in a Non-FVEY jurisdiction with no MLAT, and run all your edge nodes in colos where you install your own hardware with tamper detection switches.
That way, when the Feeb decides to make you an Enemy Of The State, there's no local judge or LEO required to follow an MLAT request, and when they try to go after the edge node providers that are in their jurisdiction, any attempt to tamper with the box will just brick the device.
At that point, the only real option left is for the CIA to smear the country's leader as a "dictator" and covertly fund a coup.
Look how secure we are!
This is such an underrated test - the response to a court order is; here is every piece of information we have and can hand over. (Ironically any response at all to a court order triggers hysteria amongst the 'privacy' cosplayers out there)