Live data from Hacker News

Mullvad VPN was subject to a search warrant – customer data not compromised

mullvad.net

331–340 of 345 posts

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#331
post #254

Earlier quoted context omitted.

Maybe in Sweden, telling and proving to the prosecutor "I simply do not have what you want, and I can show you" works better than elsewhere.

I don't know where this perspective of "Sweden has so many rights and protections the legal system is parallel to general practice in the rest of the world" comes from. See Julian Assange[0]. [0] - https://en.wikipedia.org/wiki/Assange_v_Swedish_Prosecution_...

> I don't know where this perspective of "Sweden has so many rights and protections the legal system is parallel to general practice in the rest of the world" comes from.

I don't know where that came from either, I certainly didn't say anything like that. However using his rape accusation to show Sweden is bad isn't a great example. He raped a woman, they tried to get him for it.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#332

I don't understand why go after the VPN, I think most people don't use a VPN correctly. What good is a VPN when multiple apps on your computer are phoning home? If the law has a suspect IP, couldn't they just ask google, microsoft and facebook what accounts were accessed with that IP? To use a VPN correctly wouldn't have to use a fresh OS and absolutely not login to any accounts connected to the IP you are trying to…

[deleted]

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#333
post #287

Earlier quoted context omitted.

You use Qubes OS? Otherwise, a lot of ram, CPU and storage might be needed.

Actually no, just home-rolled with virt-manager. I can definitely see the advantages of Qubes, but at this point it feels like it would be a lot of learning and changes for what is mostly a similar system. And I don't think it would work for the servers/daemons I run either.

Yeah, even getting that beast installed on a typical machine may not be straightforward. It has very specific hardware requirements.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#334
post #326

Earlier quoted context omitted.

This is extremely silly. I did not say it ends your rights. I did not say it gives them superpowers. What it does do is give them government and legally sanctioned power backed up by force to do whatever the warrant says. They can tear your house apart. Seize your property. They can withdraw your blood by force if necessary. Micheal Jackson (rich, famous, and powerful) had his genitalia examined. They can certainly (…

With respect, you're speaking with an unwarranted degree of confidence about a topic you do not seem very well versed in. The key problem is that you're confusing two very different kinds of police operations. If the police get a tip off about a dangerous meth lab in your basement, then yes, they will execute a dawn raid, in which they storm your house, guns drawn. In that moment you simply comply, and any police ove…

Appreciate the respect (and sense it as well). Warning a lot of anecdotal and "I have a friend" inbound that (I believe) provides plenty of factual and real world data to justify my confidence on these matters:

- I have many friends in law enforcement. I've been on many ride alongs and seen probable cause, phoning in warrants, etc on the street in person.

- One of my friends is on a county level SWAT team and executes high-risk criminal search warrants all of the time.

- Another one of my friends is an agent with a criminal federal law enforcement agency (IRS CI) that deals with a lot of "soft"/white collar/financial/computer/crypto/corporate crime. Including lawyers that have perpetuated financial schemes and crimes against their clients (it's amazing how many sleazy lawyers embezzle money from their clients in personal injury, settlements, etc). They execute A LOT of search warrants.

With this there are several types of situations I've noticed:

1) SWAT team friend gets an early AM no-knock warrant and an army effectively shock and awes you in your sleep at 3 AM. This is the "they can and will destroy your house" as they can do things like rip your walls apart because they heard you have drugs in them or whatever. This is usually a lot of warrants, drug cases, etc where the justification for the search/arrest is an undercover narcotics buy or something like that and cause can be presented that the subjects are violent, armed, and/or likely to destroy evidence with a daytime "knock and announce" warrant. From what I've gathered the colloquial term for these groups is "door kickers".

2) IRS CID friend goes out to have a "friendly" chat/interview with someone. There's no warrant but it's a federal felony to lie to most federal law enforcement so they'll do a lot of "ask questions they already know the answer to" because the lie itself is a crime and they'll leverage or convict you on that alone. No one ever talk to them. Seriously. Not ever. They'll walk away but it's likely not the last you'll see of them (they'll come back with a warrant).

3a) IRS CI (or similar) comes back with a warrant. From my understanding there are special steps and justifications that must be presented for a search warrant to be executed before 6 AM and after something like 9 PM. From what my friend tells me they show up after 6 AM-ish and "bang on the door and shout police and search warrant multiple times loud enough for the entire neighborhood to hear". Compared to SWAT team friend these are very gentle and reasonable (approaching what you're describing). From what I can remember they very rarely even physically force entry. The subject politely and calmly answers the door, they put their guns away, and everyone does their thing.

3b) What you're describing. If the warrant is for a business or individual known to be at a business during business hours they'll calmly walk in during business hours with their cool blue yellow-lettering "raid jackets" that communicate "we mean business" compared to their usual dress suit (with gun on hip) "uniform". This is the "Ok everyone stop what you're doing, step away from your computer, and go over there". From what I understand it's amazing how intimidating a cheap blue nylon jacket that says "IRS" or "FBI" on it can be.

While these scenarios FEEL very different they are more similar than dissimilar. In all cases simply having a lawyer present isn't going to modulate their behavior significantly - they're going to do what they came to do. Meth lab and a poor nobody? They'll definitely go harder. Billionaire former president? By the book but they're still going to get what they came for.

What people don't seem to understand about warrants is the fundamental shift in power they represent:

1) We have laws. Laws that govern what anyone can do - including law enforcement and government.

2) The police operate under these laws as police.

3) When law enforcement needs to comply with the law while being able to extend governmental power they apply to the independent judicial branch of government to review and act as a check against their governmental (LE) power.

4) At the point a judge signs a warrant law enforcement is empowered by the entire judicial branch of government to largely do whatever is necessary (within other laws, policies, and procedures) to enforce what is now (effectively) a court order.

So at this point law enforcement is actually doing two things:

1) They are furthering their investigation.

2) They are satisfying a court order.

So... The support here of this bizarre Mullvad statement is bewildering to me. While this is anecdotal and very US-focused there isn't a functioning government/justice system in the world where this scenario makes any sense whatsoever:

1) Law enforcement has an investigation.

2) They assembled enough evidence to pursue a search warrant.

3) They were granted said warrant.

4) They sent out SIX (presumably) armed police officers from the national police to execute a search and enforce the warrant.

5) Even after all of this... They arrive and are essentially talked out of doing anything because the subject of the warrant said "we don't have that".

I'm really trying to understand the support for the (essentially) impossible scenario described in this statement from Mullvad.

Thank you for your recognition on my zeal against police overreach - what I've learned over hours and years of my curiosity and peppering these friends with questions is "don't talk to the police, ESPECIALLY the Feds in the US". When I received training on interacting with federal law enforcement in a corporate context the script was:

"Hi I'm agent X from Y and I have a few questions".

All you say is: "Do you have a business card? Thank you - someone will be in touch." With that "someone" being an attorney.

Do not say another single word. If it's a search (3 AM SWAT or nice conversation in your office) things can be calm, polite, and cordial but at the end of the day LE has an incredible amount of power at this point and when it comes down to it they're going to use it and get what they're looking for.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#335

Earlier quoted context omitted.

This has been talked to death on this thread. Swedish law enforcement did an initial investigation. Applied for a warrant. Was granted a warrant. Then six officers from the national police arrived to serve the warrant. In any country in the world with a functioning government they are not just going to walk away because someone said they don’t have the materials covered in the warrant.

> In any country in the world with a functioning government they are not just going to walk away because someone said they don’t have the materials covered in the warrant. That's probably true, but entirely unrelated to what you claimed before. You said this specifically, and none of that is permissive anywhere in Europe. > They can tear your house apart. Seize your property. They can withdraw your blood by force if…

> That's probably true, but entirely unrelated to what you claimed before.

I'm not seeing how but I don't think it matters.

> You said this specifically, and none of that is permissive anywhere in Europe.

Europe doesn't have crime? Europe doesn't have law enforcement that needs to assemble and collect evidence? Law enforcement in Europe doesn't have situations where the entirety of the situation and circumstances can't possibly be known and warrants need to be extremely (almost impossibly) specific?

Again, US centric but I point to the search warrant affidavit for a billionaire former US President[0]. Page 37 and 38 include language that (from what I've seen) is fairly typical. Statements like "any and all areas that may contain XYZ". "Any and all physical documents", etc.

The US and Europe generally are very different places and US governmental overreach, infringing on civil liberties, abuse of power, etc is a popular topic on HN (I don't disagree). However, the US isn't quite the dystopian Orwellian nightmare described on HN (yet).

It may be my US blinders but I don't understand an environment like the one you describe where a search warrant from government (law enforcement and an independent judicial branch) would be specific enough to include ambiguous terms like "servers". What is a "server", really? Even the technical crowd on HN would debate that ferociously.

I think HN is giving LE and government too much credit here. I have a friend in LE in the US at the federal level who deals with a lot of electronic, crypto, etc investigations and search warrants. He frequently tells me things like "then I have to sit down with the 60 year old lawyers/bureaucrats and get them to understand what a crypto tumbler is".

Again, possibly too US centric but Sweden or otherwise the process is clearly more similar that not:

1) There's an investigation.

2) LE puts together some justification for a warrant.

3) They apply for and get one (again - there's a low common denominator here because everyone through the chain up to and including a judge needs to understand what's described).

4) The get warrant.

5) They send out six police officers from the national police organization.

6) They arrive and someone (per Mullvad's statement) says "we don't have that". If there is a single computer on site (or potentially even storage media, etc) there's no way to establish the veracity of that statement (coming from a party that is clearly under criminal investigation) without performing a search of some kind or (more likely) seizing materials for review later.

7) Per Mullvad's statement LE didn't do anything and (incredulously) walked away without taking any action whatsoever.

I'm not saying what did or didn't happen, I'm saying what they're describing is pretty fantastical.

[0] - https://www.documentcloud.org/documents/22267182-trump-searc...

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#336
post #331

Earlier quoted context omitted.

I don't know where this perspective of "Sweden has so many rights and protections the legal system is parallel to general practice in the rest of the world" comes from. See Julian Assange[0]. [0] - https://en.wikipedia.org/wiki/Assange_v_Swedish_Prosecution_...

> I don't know where this perspective of "Sweden has so many rights and protections the legal system is parallel to general practice in the rest of the world" comes from. I don't know where that came from either, I certainly didn't say anything like that. However using his rape accusation to show Sweden is bad isn't a great example. He raped a woman, they tried to get him for it.

I'm not saying "Sweden is bad" I'm saying "Sweden, like any other government in the world, has a lot of power and they use it".

I used Assange specifically because I think it's pretty clear the lone superpower in the world (the United States) clearly threw their weight around on the Assange situation. It's not a leap (at all) to think a popular VPN provider that (due to the nature of their business) likely attracts the interest of law enforcement from governments around the world - almost certainly including the US - would trigger similar levels of interest at the highest levels of government internationally.

Rape is clearly abhorrent but I think it's pretty obvious Assange had a gigantic target on his back because he pissed off and embarrassed the United States. Any rape investigation should be taken very seriously but when you look at the Assange situation it's VERY clear the aggressiveness and pursuit of that was far beyond what is likely typical in those kinds of investigations.

I think the same would happen in this scenario and anyone who says "oh they're just a VPN provider Sweden wouldn't take it too seriously" is pretty naive.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#337
post #322

I've been a Mullvad customer for some time and I'm quite satisfied. But the main issue I have is that many of its servers are blacklisted by Cloudflare and other services. Because Mullvad provides the strongest anonymity a VPN can provide, it attracts not only normal users, but also malicious users (scammers, hackers, or less malicious but more numerous scrappers).

> many of its servers are blacklisted by Cloudflare Can't relate, haven't had this happen when using Mullvad

Maybe it’s not entirely obvious, but you should be seeing captchas more frequently while using Mullvad.

Whenever I disable it, I don’t run into captchas as often.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#338
post #270

Earlier quoted context omitted.

Items removed outside the scope of a warrant have similar standing to items seized without a warrant.

Yes, in the sense that they are both admissible in court. This is Sweden, not USA.

Are you saying in Sweden police can enter your home, seize your computers, phones and documents without a court order, to look for evidence of some hunch? No that is very far from the general western democracy laws we broadly expect

Search and seizure laws are designed to protect citizens from the police and from the state, not some humanitarian protection for criminals

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#339

Earlier quoted context omitted.

> In any country in the world with a functioning government they are not just going to walk away because someone said they don’t have the materials covered in the warrant. That's probably true, but entirely unrelated to what you claimed before. You said this specifically, and none of that is permissive anywhere in Europe. > They can tear your house apart. Seize your property. They can withdraw your blood by force if…

> That's probably true, but entirely unrelated to what you claimed before. I'm not seeing how but I don't think it matters. > You said this specifically, and none of that is permissive anywhere in Europe. Europe doesn't have crime? Europe doesn't have law enforcement that needs to assemble and collect evidence? Law enforcement in Europe doesn't have situations where the entirety of the situation and circumstances can…

I think you're misunderstanding me. My only issue was with the quoted examples. I completely agree that the situation is pretty unbelievable and the warrant was likely very poorly worded if they were forced to leave without taking anything.

To me, the whole situation sounds more like a local government failure which mullvad successfully capitalized on.

Re: Mullvad VPN was subject to a search warrant – customer data not compromised

#340

Earlier quoted context omitted.

And if you do go out of your way to avoid fingerprinting, get ready for endless captcha prompts, automatic shadowbanning, etc as punishment

>automatic shadowbanning Yes that seems to be the case here on Hacker News as well as it seems like my submissions and comments don't show up unless I'm logged in. Let's see about this one.

I see your comment just fine but iirc accounts with few posts might show up as dead
Post reply on HN