Cyberstalking Case Highlights How VPN Provider Claims About Not Keeping Logs Are Often False

Failures

from the privacy-panacea dept

When the Trump administration recently decided to gut consumer privacy protections for broadband, many folks understandably rushed to VPNs for some additional privacy and protection. And indeed, many ISPs justified their lobbying assault on the rules by stating that users didn’t need privacy protections, since they could simply use a VPN to fully protect their online activity. But we’ve noted repeatedly that VPNs are not some kind of panacea, and in many instances you’re simply shifting the potential for abuse from your ISP — to a VPN provider that may not actually offer the privacy it claims.

Latest case in point: like many companies, a VPN provider by the name of PureVPN has been advertising for years on its website that it keeps no logs of user behavior:

“PureVPN operates a self-managed VPN network that currently stands at 750+ Servers in 141 Countries. But is this enough to ensure complete security? That’s why PureVPN has launched advanced features to add proactive, preventive and complete security. There are no third-parties involved and NO logs of your activities.”

But when the Department of Justice announced last Friday it had arrested a Massachusetts man by the name of Ryan Lin for stalking, one key component of the case involved using PureVPN logs to track his online activities. According to the DOJ complaint (pdf), the man in question engaged in a ?multi-faceted campaign of computer hacking and cyberstalking?:

“It is alleged that Lin engaged in an extensive, multi-faceted campaign of computer hacking and cyberstalking that began in April 2016 and continued until the date of his arrest, against a 24-year-old female victim, her family, friends and institutions associated with her. Lin, the victim?s former roommate, allegedly hacked into the victim?s online accounts and devices, stealing private photographs, personally identifiable information, and private diary entries that contained highly sensitive details about her medical, psychological and sexual history. It is alleged that Lin then distributed the victim?s private photographs and diary entries to hundreds of others. ”

Lin had apparently used Tor, PureVPN, and other tools to try and obscure his online footprints. In this instance, authorities seemed to already have enough brick and mortar evidence against Lin to build a case, but data from the logs Pure VPN supposedly doesn’t collect helped contribute to the case against him:

“An affidavit submitted by Special Agent Jeffrey Williams in support of the criminal complaint against Lin provides most of the answers….?Artifacts indicated that PureVPN, a VPN service that was used repeatedly in the cyberstalking scheme, was installed on the computer,? the affidavit reads. From here the Special Agent?s report reveals that the FBI received cooperation from Hong Kong-based PureVPN.

?Significantly, PureVPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time,? the agent?s affidavit reads.

It should go without saying that Lin’s alleged behavior is abhorrent. That said, the case serves as an example of how the promises most VPNs make about not keeping logs can’t really be trusted, something the company’s users would have noticed if they’d dug a little deeper into the VPNs privacy policy, which details how the Hong Kong company does store IP addresses as well as connection duration, time and date. Ironically, Lin had taken to Twitter not that long ago to acknowledge that VPN promises on this front often aren’t worth all that much:

“There is no such thing as a VPN that doesn?t keep logs,? Lin said. ?If they can limit your connections or track bandwidth usage, they keep logs.?

Few will shed a tear over a stalker not heeding his own privacy and security advice. But as VPNs are also used by political dissidents, reporters, and millions of security-conscious individuals, it’s worth remembering that the technology isn’t the magic fairy privacy dust it’s often portrayed as in media reports. And VPNs are not, as ISP lobbyists have claimed, a panacea for the slow but steady erosion of online privacy protections by companies looking to collect and sell every shred of personal data that’s not nailed down.

Filed Under: doj, logs, privacy, ryan lin, vpn
Companies: purevpn