Mullvad should be viewed with skepticism

Asonderu

It’s completely understandable that many question Mullvad’s claim that, in over 14 years of operation, they have never had a police visit. Given that the VPN industry is constantly exposed to reports of run-ins with law enforcement agencies worldwide, it seems only natural to think that, under normal circumstances, there would have been several such visits by now. In this context, it’s entirely reasonable for privacy advocates to suspect that this might be a staged episode orchestrated in collusion with the police—or even global intelligence agencies.

https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised

Tell us your thoughts

Brothe3r_max

Asonderu You are correct, Basicly, trust but verifies. The problem, we can not prove any VPN operator doesn't log or do anything, except we accept they promise or it can be other third party will record our log activity.

What we can do is dual control, segregation of duties. Using 2 hop vpn operator.

VPN 1, they only know your source IP
VPN 2, they only know your destination IP

MotherShipton

Being skeptical is a healthy approach but your suspicion jumps straight to hyperbole which seems uneccesarily provocative.

matchboxbananasynergy

MotherShipton It's important to note that OP's tone might come across a little bit off due to them using a translator to post. Those aren't always the best at conveying tone.

matchboxbananasynergy

But they have had a visit by the police, as indicated by the blog post you linked to, and all the post says is what you should expect to happen (meaning that they had no data to provide).

Obviously, with VPNs, it's fundamentally a service you have to trust, and everyone's situation will be different. Do you trust your ISP more than your VPN provider? If the answer is no, then using a VPN makes sense.

As far as commercial VPN services go, I would say that Mullvad is among the most honest about what they provide (and what they don't provide) and they care about fixing issues/leaks etc. when they find them.

It's not clear what would've been a better way to handle the police visiting their company. If they hid it from people, that would be suspicious. I found their decision to be transparent to be the right choice.

Asonderu

matchboxbananasynergy

I'm not a native English speaker, so I'm not sure if all the nuances are coming through correctly. I don't trust ISPs at all. In my home country, there's no doubt that every ISP cooperates with the government and intelligence agencies. I believe it's dangerous to take VPN companies' word at face value and believe everything they say without question. If I were a member of an intelligence agency or a global surveillance organization, I would use every means available to co-opt the VPN companies that are popular among privacy advocates. That's only natural—it would be even harder to find a reason not to do so. Now, coming back to Mullvad, they officially stated that in 14 years of operation, they received a police visit for the first time. Can you really take that at face value and believe it without skepticism?

fph

matchboxbananasynergy Do you trust your ISP more than your VPN provider? If the answer is yes, the using a VPN makes sense.

Is this sentence missing a "not"?

MotherShipton

matchboxbananasynergy Understood. Apologies if I misspoke

dhhdjbd

Asonderu

It is possible, that they just mean, that only once did law enforcement show up with a search warrant?

I mean i believe, that usually companies (like isps would) would get like letters from law enforcment, which would request them to provide them with data (which they can just decline, because they dont have it)

Like i mean, they probably make a distincition between a physical "warrarant" and like a legal request.

That is my specutaltion about this

Octofine

Asonderu

If you are convinced that your ISP spies on you, and believe it to be a mere possibility that Mullvad doesn't, then I would get a subscription ASAP to mitigate risk.

Mullvad is also not based in the country your from (unless youre from Sweden) so even if your country wanted to, they couldn't force Mullvad to hand over data.

The police (before the raid) know about as much about Mullvads data as the average privacy aware person. Under international pressure, Swedish authorities will absolutely give Mullvaf a visit, even if mullvad claims to have a no log policy. This has happened to multiple VPNs that got exposed in that way for a fake no log policy.

Lastly, Sweden is a democratic state , and while they may spy on people, it would raise concerns if they fake the result of a police finding

Asonderu

dhhdjbd

Mullvad: “We have been visited by the police for the first time, but there was no data to hand over.”

The police are not stupid, so they must have understood that even if they visited Mullvad, there wouldn’t be any data available to receive. Nevertheless, is there any reason for them to go out of their way to visit Mullvad? Under ordinary circumstances, one might infer from this announcement that “something strange is happening,” I thought. Or did you, without thinking, blindly believe that “Mullvad is the best!”? I believe that perhaps many privacy enthusiasts have trusted everything uncritically and with blind faith.

elbert

Asonderu
As Mullvad themselves write in a follow up blog post:

In all the years up until now it has been clear to them [the police] that they are not able to seize non-existing data.

As you said yourself, the police knew that they would not be able to get any data, and that is why they did not carry out a search in the 14 years before. This time, however, the search was authorized because it was part of an international judicial cooperation from Germany and did not originate from the Swedish authorities themselves. The blog post goes into a bit more detail about this.

dhhdjbd

Asonderu Or did you, without thinking, blindly believe that “Mullvad is the best!”? I believe that perhaps many privacy enthusiasts have trusted everything uncritically and with blind faith.

I mean, atleast as far as i am aware, one can not find any evidence that mullvad did ever hand over data, or has data to hand over in the first place.

I feel like, if mullvad would do this, then there should be any evidence.
(Like court documents or anyone even saying that mullvad did like leak their data)

grayway2

Asonderu if you don't trust Mullvad, buy credit by sending cash or monero and always connect from public WiFi but honestly there is very few other candidate to trust (like airVPN)

You need to trust your VPN and let me tell you why it's possible with Mullvad

They donate every year a lot of money to privacy fighter organisations
Mozilla VPN use VPN servers from Mullvad to operate
They created a fork of firetox with the tor browser organisation called mullvad browser free from tracking
no data for Swedish police during the raid. Do you think that when police visit a place they are 100℅ confident to not find something ? That's nonsense

I mean yes, you can't be 100℅ confident that mullvad is not secretly recording your browsing history. You can't be 100℅ confident that GrapheneOS does not collect our IP address to give them to the NSA or that veracrypt has no secret backdoor/weakness but at this point let's just stop using technology and live in a mountain

area51

If Police or any agency took the word of a VPN provider, "we have no data to hand over" and accepetd this, they would be failing in their respective duties.
Now they have visited, any Mulvad employees failing to hand over data, if it existed, are now personally on the hook, as it were, should Mulvad have deceived said agencies. Police and Agencies abide by ABC,
Accept nothing, Believe nobody, Check everything.

Asonderu

I see.
I have come to understand that the vast majority of people take official announcements at face value.
I extend my respect to everyone who replied.

matchboxbananasynergy

Asonderu My thing is, I don't see what the alternative is. You can say "I don't believe them". Okay, then what? Who do you believe? Do you believe anybody?

elbert

Asonderu My point is not to blindly trust any official statements. Rather that there is a logical explanation for the supposedly suspicious fact that there was a house search after 14 years without a single one. For me, what they said makes sense and especially since they also published official police documents, my brief research at the time also revealed that the Swedish laws mentioned exist and contain the alleged passages. Since I have not found any solid evidence to contradict their statements, I personally trust them no less than I did before this incident.
But as the others have pointed out, fundamentally you have to trust a VPN provider (as well as many other things on the internet and in life in general).

mmmm

matchboxbananasynergy exactly this. One has to place trust somewhere when dealing with the internet and the issues it brings.

area51

matchboxbananasynergy Do you believe anybody?

Where the internet is concerned, on face value no, not even GrapheneOS, which is why my phone is essentially empty, save a few contact's listed by D.O.B, no names and one messaging app.
16 digit pin, no fingerprint, 30 minute reboot to BFU.
And just for good measure I factory reset it on average once a week and every OS update. You may say paranoid, I say carefull. The internet is a mess and best kept at arms length.

Asonderu

All intelligence agencies of various countries engage in acts that transcend the law.
History has proven this over time.

If you were an intelligence operative eager to uncover people’s online activities, you can easily imagine the steps you’d take. When choosing a VPN, you’d do well to think carefully. The VPNs that are overhyped as being the ultimate in privacy are exactly the ones they’re likely keeping a close eye on and proactively setting traps for.

elbert

Asonderu Especially Mullvad has in general been very honest on what they can provide and what not. For example they never claim to make you anonymous like many other VPNs do. They also require zero information about you to create an account and you can pay privately with cash or Monero.
But if a major intelligence service is part of your threat model, just using a VPN won't be enough, no matter which service you choose.