Cyberstalking Suspect Arrested After VPN Providers Shared Logs With the FBI (bleepingcomputer.com) 212
An anonymous reader writes:
"VPN providers often advertise their products as a method of surfing the web anonymously, claiming they never store logs of user activity," writes Bleeping Computer, "but a recent criminal case shows that at least some do store user activity logs." According to the FBI, VPN providers played a key role in identifying an aggressive cyberstalker by providing detailed logs to authorities, even if they claimed in their privacy policies that they don't. The suspect is a 24-year-old man that hacked his roommate, published her private journal, made sexually explicit collages, sent threats to schools in the victim's name, and registered accounts on adult portals, sending men to the victim's house...
FBI agents also obtained Google records on their suspect, according to a 29-page affidavit which, ironically, includes the text of one of his tweets warning people that VPN providers do in fact keep activity logs. "If they can limit your connections or track bandwidth usage, they keep logs."
FBI agents also obtained Google records on their suspect, according to a 29-page affidavit which, ironically, includes the text of one of his tweets warning people that VPN providers do in fact keep activity logs. "If they can limit your connections or track bandwidth usage, they keep logs."
Good reminder (Score:2)
This is a good reminder that you shouldn't put much faith in the claims made by service providers.
Re: (Score:3)
Service providers routinely have incentives to overstate the quality of their product. Perverted incentives, brought to you by capitalism. End even extreme lies can often stay undetected for a long time, see, e.g. the current nice example with diesel cars. In actual reality, at the very least, a careful check of the plausibility of such claims is necessary and almost universally you find the product is nowhere near as good as claimed. This case here is no exception.
Of course, it is quite possible that the V
Re: (Score:2)
Replace "Service providers" with sellers, and it's been accurate since the dawn of humanity.
Anyone selling has incentive to make as much sales as possible, and that includes immoral or dishonest means if those means do not lead to far less sales. For businesses theoretically operating within the law this is why it's important to have groups like the consumer products safety commission and the federal trade commission, because businesses will go through whatever steps are necessary to protect themselves up-
Re: (Score:2)
I have given up getting exceptions for Internet access via customer laptops (I do IT security consulting). Instead I have an unlimited mobile data-plan and bring my own laptop in addition. This is quite often needed to get the information I need to do my work.
Re: (Score:2)
AND you are stupid enough to use a VPN provider in the same country where you piss off the police.
Re: (Score:3)
This is a good reminder that you shouldn't put much faith in the claims made by service providers.
From PureVPN provider's privacy policy (linked in TFS):
"Our servers automatically record the time at which you connect to any of our servers. From here on forward, we do not keep any records of anything that could associate any specific activity to a specific user. The time when a successful connection is made with our servers is counted as a “connection” and the total bandwidth used during this connection is called “bandwidth”. Connection and bandwidth are kept in record to maintain
Re: (Score:2)
I'm not feeling the outrage.
I'm not even upset, let alone outraged.
Re: (Score:2)
I'm not feeling the outrage.
I'm not even upset, let alone outraged.
I'm glad they caught the assole, who is both a criminal, and stupid.
Re: (Score:3)
So he was found out by metadata? This is perhaps a good reason why govt. should require a warrant to get ahold of it.
GOOD! (Score:2)
This guy was a major asshole. I hope when he gets out, his terms of parole include "never allowed to touch a computer for any reason."
Re: (Score:2)
Now the detection metghod is ready to bust anyone who is illegally downloading the new Stsr Trek Discovery epuisodes.
Re:Good reminder (Score:5, Insightful)
That's not the reasoning. Some are surely trustworthy. The underlying problem is that you literally have no way to tell which ones those are.
Re: (Score:3)
Examples; LavaBit & the original axcrypt
Re:Good reminder (Score:5, Interesting)
That's not the reasoning. Some are surely trustworthy. The underlying problem is that you literally have no way to tell which ones those are.
The internet is not anonymous. Never has been, never will be unless the fundamental nature off it is changed, which will destroy the internet. The only thing that gives a person any sense of anonymity is the degree of the crime, and how badly they want to find you.
Re: (Score:3)
That's true. I use a vpn to help my privacy, but have no expectation that it would help me if i commited a serious crime. If you do, there's a good chance you'll be caught, thankfully.
Yup. Protecting your privacy on line is very sensible. I do what I can also. Where there can be confusion is the concept of of privacy, and anonymity. Some folks get a little confused, thinking that anonymity is privacy. and vice versa.
Re: (Score:3)
Re: (Score:2)
The more you can verify, the less you need to rely on trust. But how do you verify that a VPN provider is well-behaved?
Re: (Score:2)
The more you can verify, the less you need to rely on trust. But how do you verify that a VPN provider is well-behaved?
Simple: (a) Register with multiple VPN providers. (b) Make threats against the President using different aliases through different VPNs. (c) See who the Secret Service comes looking for.
Re: (Score:2)
One website scammed me, so all websites cannot be trusted. Therefore, to show I trust all websites, I shall disable all firewalls.
Re: (Score:2)
It's interesting that you would post that as "Anonymous Coward". I trust you realize that this is not actually anonymous, but only harder to trace.
Slashdot doesn't actually pretend to offer true anonymity. Don't be fooled by the visible handle.
Get a VPN they said ... (Score:2)
... you'll be anonymous, they said.
I'm bookmarking this article for reference material for the VPN fanbois.
Re: (Score:3)
Re:Get a VPN they said ... (Score:5, Informative)
That's all a VPN does for you , which is irrelevant to what Pure VPN says it does [purevpn.com] for others.
PureVPN operates a self-managed VPN network that currently stands at 750+ Servers in 141 Countries. But is this enough to ensure complete security? That's why PureVPN has launched advanced features to add proactive, preventive and complete security. There are no third-parties involved and NO logs of your activities .
Emphasis mine.
Re: (Score:3)
Except that, according to TFA, Pure is lying when they say that.
Re: (Score:2)
Precisely.
Which leads to the next question: Are other or all VPN providers lying?
Re: (Score:2)
Indeed. I think it's safe to assume three things: some are lying, some are honest, and we can't really distinguish between the two.
Re: (Score:2)
Agreed.
And I would add that people who think they can outsmart other people are not clever enough to do so.
Re: (Score:2)
people who think they can outsmart other people are not clever enough to do so.
Well, they can outsmart some people, but yes. If you really think you're the smartest one in the room, then your comeuppance is only a matter of time -- and usually, not very much time.
Re: (Score:2)
Well... even if you genuinely are the smartest person in the room, the second and third smartest people in the room, working together, are smarter than you. Only a few people in the world are ever so much smarter than everyone else as to leave any potential rival in the dust. Those people tend to wind up having elements or units of measurement named after them.
Re: (Score:2)
Well, you can't really assert that any are honest, unless you consider deceptive phrasing honest. There's a small amount of evidence that those which actually are honest are regularly put out of business by government officials.
So you can rephrase that as: some are lying, some may be honest, and we can't really distinguish between the two. But the honest ones may be an empty set.
Re: (Score:2)
Re: (Score:2)
Agree.
I've been at this for over 30 years and I've found that the best way to avoid capture is to refrain from risky behaviour.
There's a lot that I could do, (as can you), but I know there are people like us who can catch people like us.
Re:Get a VPN they said ... (Score:5, Insightful)
It also forces the security services to actively target you and expend some extra effort to get your data.
In some countries, e.g. the UK, ISPs are required to log and hand over such data pretty much on demand to the police, and of course you have outfits like GCHQ and the NSA doing mass surveillance.
A VPN increases to cost to spy on you from nearly zero to something that will discourage casual snooping and a lot of abuse. It's not perfect but it's a useful line of defence.
Re: (Score:2)
Get a VPN they said ... you'll be anonymous, they said.
You will be anonymous until the VPN gets a warrant for specific information.
If you want to be entirely anonymous then you will need to set up proxies using multiple hacked IoT devices in nations that will not cooperate.
Re: (Score:2)
If you want to be entirely anonymous then you will need to set up proxies using multiple hacked IoT devices in nations that will not cooperate.
So say you.
Where do you publish your guarantee, and how do we know you're not outright lying like Pure VPN is?
Re: (Score:3)
VPNs aren't meant to keep people anonymous. They just obscure the origin IP address enough to where an average site may not know for certain who is visiting and law enforcement would have to request account connection details -- time and origin of connection, user name, actual name, length of time of connection, bandwidth usage, etc. Sure, VPNs don't usually record what sites you visit, but the sites themselves keep detailed logs that include the IP address of the VPN used... which in this situation corre
Re:Get a VPN they said ... (Score:4, Interesting)
VPNs aren't meant to keep people anonymous.
Yes, this is exactly correct. VPNs don't disguise endpoints or decorrelate access times.
Personally, I use a VPN solely so that I don't have to worry quite as much when I'm connecting through WiFi access points that I don't control (open access points, workplace WiFi, etc.).
I'm not even trying to hide from my ISP (since, at some point, my datastream is going to be exposed to an ISP anyway -- at least this way, I know which one I'm exposed to). So, I don't use a third party VPN. I run my own VPN server, and my devices all use that.
Security is always a tradeoff, and others may not find this one acceptable for their situation and preferences. But it works for me.
Re: (Score:3)
Cyberstalking generally isn't something that people who are good at thinking things through and restricting their behaviors accordingly do.
Re: (Score:2)
VPNs aren't meant to keep people anonymous.
Really? From their site: [purevpn.com].
Anonymity: PureVPN replaces your real IP with one of our abundant IPs, allowing you to use the internet freely whilst remaining completely invisible.
Re: (Score:2)
That's just Pure being deceptive. The point that VPNs aren't designed to keep you anonymous is true regardless of what they say.
Re: (Score:2)
True. However, the uninformed will jump all over that statement by PureVPN and run with it.
I think deceptive trade practices should apply, but predict that a lot of sites would be quickly editing their narrative.
Re: (Score:2)
"The moron" believed the promises made on the services web page. There seem to be a lot of people here that accept deceptive phraseology as honest, but it's interesting that many of them post as Anonymous Coward. One might almost think someone has hired a reputation management company.
That said, I agree with your statements about the design of VPNs. But that's not saying what the company that's selling the service promises. And the promise *could* be essentially correct, if they actually never saved the
Vendors used (Score:2)
He also used a secure email and Tor but no indication that logs or info was pulled from those.
--For the karma whoring.
Re: (Score:2)
Tor has no logs. This has been tested and verified, also bu diverse law-enforcement agencies, time and again. That does not make Tor absolutely secure, large traffic analysis, insecure user behavior and zero-days in the browser (or failure to update) can still de-anonymize Tor users though. The Tor project has a nice collection of documents on these things.
Re: (Score:2)
Re: (Score:2)
The guy is getting what he deserves.
I'm glad that this scumbag got caught.
But at the same time, it's important to remind people that they may not be as secure as they're assuming, so that innocent people don't get caught out.
Roll your own (Score:4, Insightful)
Re: (Score:2)
The best defense is not to do dumb stuff in the first place.
Re: (Score:2)
The best defense is not to do dumb stuff in the first place.
That doesn't protect you from other entities doing dumb or abusive stuff, though.
She is not the only victim here. (Score:4, Insightful)
Special Agent in Charge of the Federal Bureau of Investigation, Boston Field Division. “This kind of behavior is not a prank, and it isn't harmless. He allegedly scared innocent people, and disrupted their daily lives, because he was blinded by his obsession. No one should feel unsafe in their own home, school, or workplace, and the FBI and our law enforcement partners hope today's arrest will deter others from engaging in similar criminal conduct.”
This jerk has degraded the trustworthiness of ALL bomb threat calls, ALL emergency distress calls. As incidents like this increase, as people figure out better ways to hide their tracks, more people will do such things. In the end the police and emergency services will take time to check veracity and trustworthiness of the caller before responding. False alarms will increase cost for all tax payers. Some stalking victims could actually be raped or violated due to such postings.
This guy is evil, he should be punished so severely others don't even fantasize doing such things.
Comment removed (Score:4, Insightful)
Re: (Score:2)
Unfortunately, severely punishing somebody for a crime has a negligible effect on discouraging anybody else from committing the same crime. I guarantee that at no point did this person ever think, "I wonder what happened to others who have stalked and harassed people? What's my risk vs. reward ratio here?"
Then, pray tell, what would have non-negligible deterrent effect?
Are you claiming people don't fear punishment or getting caught at all?
Re: (Score:3)
Re: (Score:2)
Studies have shown that the thing that makes people think twice is the perception that they'll be caught, and not the severity of the punishment. From that stand point the publicity around punishing someone helps, but giving them a stiffer sentence does not. (Note I said perception that they'll be caught rather than likelihood of being caught, because the 2 are not really related)
It also doesn't help that the human mind tends to think in terms of exceptionalism, people always think they're smarter than the
Re: (Score:3, Insightful)
Citing "deterrence" is very often a thin disguise over the real intent: vengeance.
Re: (Score:2)
You, of course, retain the right to refrain from vengeance. You have the right not to file charges when you are the victim.
You also have the right to tell other victims to give up vengeance, not to file charges and practice universal love.
And they have the right to ask you to go fly a kite.
Re: (Score:2)
Whats wrong with vengeance?
A "justice system" is supposed to result in justice. Vengeance isn't justice, it's emotional expression.
Re: (Score:2)
No, "we as a society" decided no such thing. We punish people in jail, and execute murderers. You can rephrase those things, but they are vengeance nevertheless.
Re: (Score:2)
Re: (Score:2)
Don't confuse it with US Constitution and 1776. Not even the Magna Carta. State taking our the monopoly to mete out vengeance is at least 5000 years old, possibly older.
Fore people, Kalahari bushmen and some tribes
Re: (Score:2)
Have bomb threat calls EVER been considered trustworthy? When I was in college in the '90s, most professors included wording in their syllabuses to the effect that exams would most definitely NOT be cancelled or postponed in the event of a bomb threat; and gave a meeetup point elsewhere on campus where we would be expected to show up and take our exams in the event that a bomb threat was called in for the building in which our exam was scheduled. That would indicate to me that, by that point in time about
Re: Mocking NK (Score:2)
Right to Privacy has Limits (Score:2)
So wait a sec (Score:2)
Something doesn't sound quite right about this. From TFA:
The logs showed how within the span of minutes the same VPN IP address had logged into Lin's real Gmail address, another Gmail address used for some of the threats, and a Rover.com account Lin created to discover Smith's real phone number.
Gmail has forced HTTPS since 2014. What are we being asked to believe here?
Re: (Score:2)
Perhaps that the feds issued a search warrant to get the Gmail logs?
Re: (Score:2)
That's certainly possible, but it just reinforces my point. If they had the Gmail logs, they wouldn't need anything from PureVPN but the IP address association for the customer's session (which PureVPN's privacy policy by my read doesn't explicitly exclude from logging). Activity logs showing that particular session accessed Gmail, without actual account information, might perhaps reinforce what the Gmail logs already showed, but wouldn't independently show anything.
And if it wasn't necessary for PureVPN
Re: (Score:2)
That would be a fine explanation if there were three different services used by three different URLs. But here we're talking about two different Gmail accounts. What information would the VPN service have about what specific Gmail account the customer was accessing through that IP address?
Re: (Score:2)
As I read it:
google would provided the documentation that both accounts A and account B were accessed from a particular ip address one after another from the same computer based on browser strings etc.
the vpn service is only confirming that suspect X was in fact connected to the vpn service at the time.
VPN services are a pseudo-product, security-wise (Score:4, Interesting)
VPN services are nice if you want to pretend to be in another geographically location, but the claims of security are pure marketing. Incidentally, anybody that cares to find out knows that. And no VPN service that is run commercially can say "no" when the Feds want logs to be recorded and handed to them. Lavabit is an extremely rare exception (and just did anonymous email, not VPN) and it can be seen nicely in their case what happens after such a "no". The CEO is lucky to not end up in prison.
At this time, the only VPN service with actual security is Tor and even there, you anonymity can be compromised by attacks on the client or making mistake while using it. And, of course, a large-scale traffic analysis can break even Tor. The thing with Tor is however, that nobody that can break it will admit so for a mere cyberstalking case. It would have to be something really, really large for anybody to admit that they can compromise Tor itself.
Re: (Score:2)
And no VPN service that is run commercially can say "no" when the Feds want logs to be recorded and handed to them.
Sure they can. By "feds" I'm assuming you one of America's three letter agencies. The reality is that there are many countries in the world who don't play America's bullshit game.
the real litmus test of privacy is (Score:2)
does your VPN (website, Tor network, etc) hosts child pornography, Islamic State glorification materials, bomb making manuals?
If yes, then the website is private.
Re: (Score:2)
None. Anybody sane already knows VPNs are not secure if anybody can get a court-order against them. All the others are to dumb to care.
Re: So (Score:5, Insightful)
And WANSecurity.
But the take-home lesson here shouldn't be that if you avoid those you're good. The lesson is that in the end, you're taking every provider's word for security. Certainly some are good and some aren't, but there is literally no way for you to be able to tell which ones are good.
Misleading (Score:5, Informative)
Most of the damning info came from a laptop, and all the VPNs did was confirm an IP address for his residence was used to connect to one of their IP addresses during the same time frame "someone" logged into both the victim's e-mail account and the abuser's e-mail account -- both from the same VPN address.
PureVPN lists what data it records and states it cooperates with investigations. The only thing I can find that they gave to investigators that wasn't explicitly stated in the TOS was that they gave the origin IP address for the connection. but... the TOS already says they store the name of the person on the account and connection times and bandwidth anyway, so that's pretty damning to begin with if requested by law enforcement.
Basically, Law Enforcement said:
"Hey we have a laptop with evidence that you have a VPN and have accessed both the victim's and the abuser's e-mail addresses. We just checked with the e-mail services and discovered a login to both from a VPN IP address within a short time period."
And the VPN provider upon court order said:
"That user was logged into our service from their residential IP address during that time and was connected to that same VPN IP address (along with many other users). Here's the amount of time they were on our system and the amount of bandwidth they used."
The VPN didn't rat out what site they went to -- but the sites they went to DID keep IP logs.
In short, the VPN service provided exactly what it said it would record and it just happened to correlate nicely with what the detectives found. It's not proof, but it's strong evidence.
Frankly, I'm a little surprised the victim's e-mail service allowed a connection to a VPN IP to begin with. I'm also surprised this moron thought that just because a VPN doesn't record every site you visit that the sites themselves wouldn't be recording every login and IP address along with cookies that might identify his specific hardware and/or tie into a social media profile or the like.
Re:Misleading (Score:4, Informative)
Yes, this is a good and important point.
Encrypting your actual payload data is insufficient (metadata is often just as revealing as payload data). That's why the more skilled hackers and criminals use multiple VPNs along with services that decorrelate access times.
Re: (Score:2)
Entirely plausible. They would not record actual traffic, that would probably have them go out of business. Connection time and user name is almost always enough to identify the user if you have a few more of these. And then you can get a search-warrant.
In the end, this person just violated too many of the rules to stay anonymous online.
Re: (Score:2)
It's tricky wording. That sentence qualifies itself with after you connected to any of our servers. i.e. we do log the connection, just not what you do with it.
Re: (Score:2)
They do not keep any logs, but they do "automatically record the time at which you connect to any of our servers". Probably, in legalese, records and logs are different things.
When there is enough activity, these logs.... pardon me, "records", are quite enough to identify a single user. As they claim to have 10M users, having as little as 10 or so observed malicious actions may already be enough to filter the potential users down to a number small enough to check individually whether they plausibly could be
Re: (Score:2)
And WANSecurity.
But the take-home lesson here shouldn't be that if you avoid those you're good. The lesson is that in the end, you're taking every provider's word for security. Certainly some are good and some aren't, but there is literally no way for you to be able to tell which ones are good.
I'd primarily use a VPN provider to make life harder for the RIAA, MPAA, Sony, HBO, and the rest of that ilk and to make it harder for them to identify me and then sue me for damages because they themselves forced me to torrent their movies and music because of their own artificial trade barriers (and I'd preferably use a VPN service headquartered in Europe to make it that little bit harder since most of these corps are US based which significantly increases the legal complexities). I have no delusions abou
Re: (Score:2)
By the time my son was five, he already understood that the "he forced me to do it" defense is, unless someone literally has a gun to your head, a cowardly lie.
Time to take responsibility for your own actions. It's what adults do.
Re: (Score:2)
That's proxies. Not VPN providers.
And seven wasn't enough, remember?
Re: (Score:2)
I would also like to point out, that PureVPN was being sold right here on the Slashdot site for lifetime memebership for quite a while (maybe still). That is the offer that I grabbed a year or two ago. While I use it mostly to protect my privacy when using open hotspots or hotel/shared wifi connections, and als
Re: (Score:2)
Please don't post your sexual fantasies. There are forums where that may be appropriate but this isn't one.
Re: (Score:2)
That list doesn't really mean anything, though. All they've done is ask providers questions and ranked them according to the provided answers. There has been no independent verification of the provider's practices or technical security, so there's no way to tell if the answers were complete and honest.
Re: (Score:2)
How do you know that reviewed VPNs don't keep logs?
Re: (Score:2)
Pure VPN says, in writing, that they do not log.
What VPN would you suggest, and how do you know they actually do what they say they do ... in writing?
Re: (Score:2)
What VPN would you suggest, and how do you know they actually do what they say they do ... in writing?
PIA. [privateint...access.com] They've also been tested in court as keeping no logs at all. [torrentfreak.com]
Re: (Score:2)
I appreciate your response, supported by a reference link.
Thanks.
Re: (Score:3)
Actually, they say "Our servers automatically record the time at which you connect to any of our servers." My guess would hence be that, legally, they do not log, but they do keep records.
Re: (Score:2)
Apparently [slashdot.org], you missed my earlier post where I copy/paste directly from PureVPN:
PureVPN operates a self-managed VPN network that currently stands at 750+ Servers in 141 Countries. But is this enough to ensure complete security? That's why PureVPN has launched advanced features to add proactive, preventive and complete security. There are no third-parties involved and NO logs of your activities .
Re:So don't use PureVPN (Score:4, Insightful)
I did quote directly from their privacy policy. No idea why you think I missed anything here, this is literally on their site.
If indeed "records" and "logs" are different legally (no idea whether they are), then "no logs of your activities" would not even be a lie. There would just be records of your log-ins and log-outs, but no logs. It is also possible, that the log-in and log-out does not count legally as "activity" within the context of the service. And to make the deception complete, "complete security" is a term without meaning, i.e. it gives you no assurances whatsoever.
Re: (Score:2)
It's not complicated, OK?
Cyberstalking Suspect Arrested After VPN Providers Shared Logs With the FBI
Re: So don't use PureVPN (Score:2)
Re: (Score:2)
PROTIP:
Xanax, when taken as directed, is a safe and effective palindrome. ~ © 2017 CaptainDork
Re: (Score:2)
I just looked over PureVPN's site and policies and they make no claim about logging one way or the other.
Not true. TFA links to Pure's page where they specifically claim that they do not log your activities. That page has even been quoted a couple of times by other commenters.
Re: (Score:2)
... they make no claim about logging one way or the other.
You just blew it [purevpn.com] in an obvious way.
PureVPN operates a self-managed VPN network that currently stands at 750+ Servers in 141 Countries. But is this enough to ensure complete security? That's why PureVPN has launched advanced features to add proactive, preventive and complete security. There are no third-parties involved and NO logs of your activities .
Emphasis mine.
Shame on you.
Re: (Score:2)
Down vote this post to oblivion, please.
Re:Virtual (Score:4, Interesting)
My favorite definition of "virtual" is one I got in an advertising class talking about meaningless advertising words. Whenever you see "virtual", you can mentally replace it with "not in fact".
Re: (Score:2)
If you depend on Tor you better not get the Feds after you. It's *probably* safe against anyone else, but, IIRC, the Feds were reported own enough of the exit nodes to track you. That was a few years ago, but I doubt they've decreased their penetration.
Still, it's probably more secure than a VPN is even designed to be.
But do note all the "probably"s in my comments. And recall that Google is working hard on getting a quantum computer to perform well. (And it's not the only gang so working.) So almost al
Re: Use proxies vs. VPN bs then (Score:2)