Data provided by http: //attrition. Hackers assume fake online identities and go to great length to hide their location and other identifiable details for obvious reasons. It appears that the FBI traced a hack into Sony back to an IP address owned by HMA and promptly got a UK court oder, demanding logs from HMA an incident HMA dubbed the “Lulz.
Sec Fiasco” in a post on their blog on September 2. When leaked IRC chat logs revealed that some Lulz. Sec members used HMA to conceal their identities, HMA didn’t take any action they stated on their blog; however, later they made it clear that “Our VPN service and VPN services in general are not designed to be used to commit illegal activity. It is very naive to think that by paying a subscription fee to a VPN service you are free to break the law without any consequences.” They then went on to say that “We would also like to clear up some misconceptions about what we do and what we stand for.
In 2. 00. 5 we setup HMA primarily as a way to bypass censorship of the world- wide- web whether this be on a government or a corporate/localized scale. We truly believe the world- wide- web should be world- wide and not censored in anyway.”In later edits of this blog post they indicate that they do not log a user’s activity, just the log- on and log- off events, that they do this to identify abusive users, that they complied with UK law and finally, that there isn’t a UK law prohibiting them to aid Egyptian to access social networks, such as Twitter, which was blocked by that country’s government. While I appreciate HMA addressing these issues openly rather than swiping them under the rug, the incident points to a serious flaw in the system. When you are selling a service that claims to protect a users privacy, hence identity, you can’t turn around later and reveal just that to authorities without appearing at least a little insincere. Virtual Private Networks are used for many purposes, accessing blocked websites, accessing region restricted content, bypassing network filters, accessing Twitter, Facebook and Skype in countries that block such connections, or simpler applications like protecting your privacy when accessing a public Wifi spot and stopping your Internet Service Provider (or ISP) from snooping into your business. It doesn’t take too much imagination to see that VPNs can also be used for outright illegal activities, copyright violations and hacking for example.
All VPN providers know this and, while their terms and conditions always state that their services are not to be used for illegal activities, they derive a portion of their revenue from users who signed up for just that purpose, something all VPN providers are aware of. As a VPN service provider your main selling points are privacy, anonymity, presence (as in how many countries you have IP addresses in) and speed. At the same time you are also running a business (if we neglect any hobbyists and non- profits for a moment) that was setup to make money, and as any legal entity you must comply with the laws and regulations of the country you are operating in. Many (if not most or even all) lease bandwidth and IP addresses from other providers, and abusive behaviors of their customers can easily jeopardize their business. Usually the term abusive behavior when used by a VPN service refers to bandwidth hogs, subscribers with (much) higher than average bandwidth usage, potentially slowing down the service for others. With speed being one of the main selling points it is easy to see why.
In response to the HMA Lulz. Sec case, many VPN providers now quite prominently claim on their sites, that they don’t keep logs; yet many terms and conditions also alert users that they will investigate suspicious behavior, apparently referring to, what they consider to be, illegal activity. Download Office Web Apps Volume Licensing here. My question then is this: If a provider does not log your IP address and does not log your activity, how would they be able to investigate anything?
While the Lulz. Sec case may seem extreme and it is easy to think: why worry, I am not engaged in illegal activities online? The RIAA and MPAA (for those who don’t know, those are the Recording Industry Association of America and the Motion Picture Association of America) have come to an agreement with certain Internet Service Providers to cooperate to curb illegal file sharing under the clever and innocent sounding name Copyright Alert System or abbreviated CAS. They decide what they consider illegal and enlist your ISP to notify you, and if necessary, force you to watch educational videos or throttle your bandwidth. Maybe a no- log VPN is a good idea after all?
Update: Reuters reports that a Los Angeles judge sentenced 2. Cody Kretsinger to a one year prison term, one year home detention and 1. He also has to pay $6. Sony Pictures. Kretsinger had pleaded guilty to a single count of conspiracy and unauthorized impairment of a protected computer (i. Hammond is currently serving a 1.
Strafor (the global intelligence firm Strategic Forecasting), a crime Monsegur allegedly encouraged him to commit. You can find our comment policy here.