Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

Post reply on HN
Print view View original

251–260 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#251

Post by vkou »

hnarn wrote: post #75
wepple wrote: post #14

Earlier quoted context omitted.

Technically they could have been logging your traffic, which is “customer data” even if it doesn’t identify you by name

> Technically they could have been logging your traffic Of course they “could have” but their entire business depends on them not doing it.

> their entire business depends on them not doing it...

... in a way that you, as a customer, can detect.

1. You can't have any hard guarantees about what information is retained by third parties about you.

2. As other comments here have pointed out, something smells a bit weird with this.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#252

Post by kkielhofner »

troad wrote: post #200
kkielhofner wrote: post #186

Earlier quoted context omitted.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly d…

This is extremely silly.

I did not say it ends your rights. I did not say it gives them superpowers.

What it does do is give them government and legally sanctioned power backed up by force to do whatever the warrant says. They can tear your house apart. Seize your property. They can withdraw your blood by force if necessary. Micheal Jackson (rich, famous, and powerful) had his genitalia examined. They can certainly (and do) go in your office and take every single thing computer or data related if those devices may contain information relevant to the warrant.

"This information isn't responsive to the warrant?" - I feel like I'm living in an alternate universe at this point... That's borderline "One weird trick just say these magic words and the police disappear". Watch video of search warrants being executed. They walk out with TONS of material - anything electronic related, hand trucks with boxes of documents, etc. When the FBI searched a billionaire former US President they walked out with 28 boxes of documents[0].

Is anyone here under the impression that a search warrant for relevant electronic records involves the police sitting down with you and looking at your computer? No. They'll take EVERYTHING, image it for evidentiary purposes, and then take as much time as they need to review it in search for whatever was specified in the warrant.

A person or lawyer can say anything they want but the outcome in 99.9% of cases is the guys with the guns are going to do whatever they feel empowered to do. If there's anything questionable it can be argued in court later.

High powered lawyers in suits? The FBI executed a search warrant on a billionaire former United States President... Yes they'll likely behave differently but they're certainly not scared of you or whatever you or a lawyer says in the moment.

In street crime this is often called "You can beat the rap but you can't beat the ride".

In the moment the power asymmetry is very real. I point you to thousands of hours of YouTube police body camera footage, etc that demonstrates it.

[0] - https://www.youtube.com/watch?v=tcnJNfJqJTI

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#253

Post by j16sdiz »

password4321 wrote: post #127
input_sh wrote: post #119

Earlier quoted context omitted.

They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.

HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/

I guess they don't have them on hand today?

They will come back another day with a pile of batteries.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#254

Post by burnte »

kkielhofner wrote: post #186
Marsymars wrote: post #150

Earlier quoted context omitted.

I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

Maybe in Sweden, telling and proving to the prosecutor "I simply do not have what you want, and I can show you" works better than elsewhere.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#255

Post by zhengyi13 »

yellowapple wrote: post #242
hammock wrote: post #234

Earlier quoted context omitted.

Many cases the police don’t let you watch, they make you wait outside. Reason to have cameras in your place (pros and cons)

Pros: excellent material for a music video mocking the cops doing the search.

Point of order: multiple music videos, not just one.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#256

Post by akyuu »

jenadine wrote: post #157
KronisLV wrote: post #133

Earlier quoted context omitted.

> To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to hide? Even then fingerprinting would still present an issue, even without explicitly logging in, with most browsers. For example: https://coveryourtracks.eff.org/ Also have a look at this: https://www.amiunique.org/ So you might need to have a browser that lies and presents configura…

I believe the "a fresh OS" makes fingerprinting useless.

Not really. Modern web browsers expose a lot of information, such as your language, time zone, screen resolution, CPU and GPU details (number of cores, vendor, model...), etc. There's even fingerprint which depends on your GPU driver version.

If you use a custom built desktop computer, you're going to have a pretty unique browser fingerprint because few people will use the same exact hardware configuration. On the other hand, if you use Apple hardware you'll look the same as other Mac/iPhone users. The other option is to use Tor Browser or Tails OS, but I don't think that's feasible for everyday browsing.

As other people have said, it's suprisingly difficult to have privacy on everyday browsing today. Personally, I blame Google. I believe they purposefully pushed modern web standards into maximum user data exposure for their own profit.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#257

Post by nemetroid »

rasengan wrote: post #76
colourgarden wrote: post #64

Earlier quoted context omitted.

Maybe not in the US. > We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. If this line is to be believed then the police would have been committing a crime by proceeding.

This is not how police work anywhere. There would be an entire legal process for this.

I don't see why it's so difficult to believe. As noted on Mullvad's "Swedish legislation" page that you linked to, search of premises in a case like this is only allowed if there is a reasonable expectation of finding items subject to seizure (or other evidence of the offense in question). For what it's worth, the law itself is very readable, if you know Swedish [1].

Given that Mullvad are highly public about what data they store and why, Mullvad would arguably be able to make a strong case that there could be no such reasonable expectation. So the police had to weigh the potential gain of doing the search anyway against the risk of opening themselves up to lawsuits by doing so.

I would not have been surprised if they had decided to do it anyway, but I'm not really surprised at this outcome either.

1: https://lagen.nu/1942:740#K28P1S2

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#258

Post by digging »

daveoc64 wrote: post #144
panick21_ wrote: post #109

Earlier quoted context omitted.

Wait what? If you go to the post office and pay with your debit card, how exactly do they figure out who you are based on the stamp?

There's no evidence they're actually doing that, it's just possible that they could.

Possible, quite easy, and certainly of political value. But, you know, maybe they're not.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#259

Post by kkielhofner »

semanticist wrote: post #240
kkielhofner wrote: post #186

Earlier quoted context omitted.

Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop wha…

This feels like a very American-centric perspective, this happened in Sweden. For a bunch of reasons policing outside the US is very different to policing in the US.

I realize this happened in Sweden. My dad was a professor at the Karolinska Institutet in Stockholm; I practically grew up there. My first name is spelled "Kristian" for this reason.

Yes Sweden is very different from the US. In fact, seven years ago some Swedish cops on vacation in NYC became somewhat famous and drew significant attention (at the time) to policing issues in the US[0]. People in the US were literally saying "WE NEED SWEDISH COPS".

That said... Even by Swedish standards (of which I'm familiar) I find it very, very, very hard to believe the government would bother to do an initial investigation, draft and apply for a warrant, serve the warrant with SIX police officers, and then walk out with a handshake because some guy in the office says "we don't have that".

[0] - https://www.youtube.com/watch?v=izdfnHBMwSs

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#260

Post by DANmode »

kkielhofner wrote: post #207
hnarn wrote: post #184

Earlier quoted context omitted.

The people that attend when these warrants are executed are highly technically skilled, and obviously Swedish surveillance agencies know Mullvad very well, probably intimately (ie it wouldn’t surprise me if they even have an understanding of their infrastructure). It’s not at all “highly implausible” that they showed up for a technical discussion to see if the data they wanted but were almost certain did not exist co…

The first line of the post: "On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant." 1) The government put together the cause/case for a warrant. 2) They got it issued. 3) They showed up with six cops from the national police. That doesn't sound like the setting for a "technical discussion" betwee…

> Have you ever seen a search warrant involving anything technical/electronic executed?

What jurisdiction is your experience within?

Post reply on HN