Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lulzsec fiasco - from HideMyAss VPN provider

blog.hidemyass.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: Lulzsec fiasco - from HideMyAss VPN provider

#31

Post by randomaccount4 »

dexen wrote: post #24
randomaccount4 wrote: post #18

Throwaway account here. I've actually done work for the owner of this website, on this particular service (front end) and another couple services that he runs (back end). He is a good guy - I believe people are reading into this a bit too much. In the end, he is just like us; trying to build a business/s. He runs a few websites that are fairly successful, and I believe he sold one a year or so ago - good for him. I d…

Does that mean US court order got executed in UK, on UK citizen, just like that? Asking because I can't get any company information out of their site, nor from whois data to confirm if that's indeed UK company and/or individual.

I'm not sure. I have not been in contact with him since 2008 and it would be weird to contact him out of the blue based on this situation - although, I'm very tempted. If I do decide to look into it, I'll let you know.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#32

Post by randomaccount4 »

DanBC wrote: post #25
randomaccount4 wrote: post #18

Throwaway account here. I've actually done work for the owner of this website, on this particular service (front end) and another couple services that he runs (back end). He is a good guy - I believe people are reading into this a bit too much. In the end, he is just like us; trying to build a business/s. He runs a few websites that are fairly successful, and I believe he sold one a year or so ago - good for him. I d…

No-one serious minds that a business complies with correctly formed legal requests. (And it's tricky for people in the UK facing the might of US law.) What's annoying is the disconnect between saying "We help you avoid censorship" and "we comply with correctly formed law enforcement documents".

He has US based servers - perhaps it was "give us your logs, or we take your servers" (speculation). I just figured I know the guy more than the people here - or at least, used to and from what I could tell he was a good guy who tried to to do the right thing. That's all I can say.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#33

Post by morpher »

From an edit to the article: "We have had a few queries as to our logging policies. We only log the time you connect and disconnect from our service, we do not log in any shape or form your actual internet traffic."

So, the information possibly gained by law enforcement is that "account X was connected to our proxy service at the time the crime was committed". I don't know how large their user base is, but it seems unlikely that the above is all that informative. Unless there are enough "criminal events" to knock the total "set of users connected during all events" down to a manageable size.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#34

Post by randomaccount4 »

thaumaturgy wrote: post #29
randomaccount4 wrote: post #18

Throwaway account here. I've actually done work for the owner of this website, on this particular service (front end) and another couple services that he runs (back end). He is a good guy - I believe people are reading into this a bit too much. In the end, he is just like us; trying to build a business/s. He runs a few websites that are fairly successful, and I believe he sold one a year or so ago - good for him. I d…

And if the U.S. decides to assist with some other country's pursuit of a political dissident? Do you help then, too? > You run this website, the US govt. comes knocking at your door looking for records - what do you do? You truthfully say that you don't have any records to provide, because responsible privacy services don't log their customers' activities. I think that's the one part of this situation that I don't un…

He states that only two things are recorded - the time you start using the service, and the time you stop.

I assume the FBI pieced that crime together based on this data. I honestly don't know much more than that, or what he has been up to in the past 2 years. I just know him from previously doing work for him, and thought I could give some insight to who he is and what he's like.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#35

Post by nirvana »

randomaccount4 wrote: post #18

Throwaway account here. I've actually done work for the owner of this website, on this particular service (front end) and another couple services that he runs (back end). He is a good guy - I believe people are reading into this a bit too much. In the end, he is just like us; trying to build a business/s. He runs a few websites that are fairly successful, and I believe he sold one a year or so ago - good for him. I d…

"You run this website, the US govt. comes knocking at your door looking for records - what do you do? Thought so."

I'm not sure what you're referring to in "this website", but I can tell you that jurisdictional arbitrage, and being able to protect my customers data in exactly this situation is something I spend a lot of time thinking about.

Of course, nobody wants to fight a powerful government, so a better strategy is to make it such that the powerful government never comes knocking on your door, or you don't have any useful information for that powerful government, or your site infrastructure is in the jurisdiction of a government that has no interest in rolling over to that powerful government, like say, singapore.

The US government can try to swing its weight around in singapore and will likely be told to go pound sand. And if the singapore government agrees with the US government, then what you hand over may not contain any sensitive client information (because you don't keep sensitive client information when you don't have to. If you have to, it is a different matter.)

I think every one of us working on web services should think long and hard about how we're going to deal with the reality that the US government, without cover of law, regularly demands information (using the PATRIOT act) that it doesn't have the legal right to, and regularly censors (the torrent site takedowns, etc.) content providers who have never even been charged, let alone convicted of violating the law.

You don't want your business shut down, that's true. (also a reason not to domicile your business in the USA, or keep your banking there.)

These are issues you should think about before, or early, in the period of starting your business.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#36

Post by chopsueyar »

randomaccount4 wrote: post #32
DanBC wrote: post #25

Earlier quoted context omitted.

No-one serious minds that a business complies with correctly formed legal requests. (And it's tricky for people in the UK facing the might of US law.) What's annoying is the disconnect between saying "We help you avoid censorship" and "we comply with correctly formed law enforcement documents".

He has US based servers - perhaps it was "give us your logs, or we take your servers" (speculation). I just figured I know the guy more than the people here - or at least, used to and from what I could tell he was a good guy who tried to to do the right thing. That's all I can say.

Is his infrastructure that complex?

Is this not just some deploy script on a bunch of VPSs?

Re: Lulzsec fiasco - from HideMyAss VPN provider

#37

Post by thaumaturgy »

randomaccount4 wrote: post #34
thaumaturgy wrote: post #29

Earlier quoted context omitted.

And if the U.S. decides to assist with some other country's pursuit of a political dissident? Do you help then, too? > You run this website, the US govt. comes knocking at your door looking for records - what do you do? You truthfully say that you don't have any records to provide, because responsible privacy services don't log their customers' activities. I think that's the one part of this situation that I don't un…

He states that only two things are recorded - the time you start using the service, and the time you stop. I assume the FBI pieced that crime together based on this data. I honestly don't know much more than that, or what he has been up to in the past 2 years. I just know him from previously doing work for him, and thought I could give some insight to who he is and what he's like.

Three things would have to be recorded in that case: the "you" part of the start & stop times, as well as the times themselves.

I'll take your word for it that he's a decent person. I certainly have no reason to think otherwise. But that doesn't change that his service is recording information that it ought not to be.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#38

Post by lsc »

DeusExMachina wrote: post #4

I find curious that they first state this: "As stated in our terms of service and privacy policy our service is not to be used for illegal activity, and as a legitimate company we will cooperate with law enforcement if we receive a court order" And then this: "In 2005 we setup HMA primarily as a way to bypass censorship of the world-wide-web whether this be on a government or a corporate/localized scale." If censorsh…

"Illegal" only has meaning within the context of a jurisdiction. Compare the rules on shooting unarmed burglars in California vs. Texas, for example.

The only reasonable way to read the article is to understand that "illegal" is shorthand for "Illegal in my jurisdiction, and in jurisdictions with enough power to get local law enforcement to turn the screws on me." It is simply impossible to follow all laws written by all countries; what is prohibited by one country may be mandatory in another.

No ISP in America is going to care if you post what would be protected speech in America from China where it may be illegal. From the point of view of the American courts, breaking that Chinese law is actually a public service; Here, the right to say bad things about our government is protected by our highest laws.

So yeah, I see no contradiction. The company is trying to obey laws that apply to them, and allowing customers to break laws that are outside of their jurisdiction.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#39

Post by eli »

jemka wrote: post #3
eli wrote: post #2

IANAL, but just because your terms say the service may not be used for illegal things it doesn't mean you can't also be culpable. If I purchase stolen goods from a thief, I might be breaking the law even if the thief has signed a contract swearing the goods aren't stolen.

That example doesn't really apply since the law is explicit about stolen property, which this case has nothing to do with.

My point was that if you're party to a crime, whatever contract you have probably isn't going to help.

Re: Lulzsec fiasco - from HideMyAss VPN provider

#40

Post by eatm0rewaffles »

morpher wrote: post #33

From an edit to the article: "We have had a few queries as to our logging policies. We only log the time you connect and disconnect from our service, we do not log in any shape or form your actual internet traffic." So, the information possibly gained by law enforcement is that "account X was connected to our proxy service at the time the crime was committed". I don't know how large their user base is, but it seems u…

We also have no idea what other potential information the source requesting the information has to correlate it to.
Post reply on HN