Would I be liable for any illegal traffic that comes through my VPN?

Question

Say I hosted a virtual private network somewhere on a cloud hosting provider, say an amazon aws server. If I shared access to that VPN to other people (say for simplicity's sake, 5 friends), someone could potentially use it to access illegal content while trying to remain anonymous.

I know I could be subpoenaed or sued for this. Of course, being personally innocent, I would hand over the server logs, or do whatever was required of me.

2 cases:

1. If the logs showed that the illegal traffic was going to another IP address not in my possession, am I still liable for routing that traffic?
2. If the logs for whatever reason couldn't prove that the illegal traffic was going to another specific IP address not in my possession, does liability default to me personally, for having ownership over the VPN server which routed it?

I'm trying to ascertain the level of risk associated with hosting my own VPN server, for extra-personal use, but not as a business. No contracts, no fees, just like a club that also accepts donations to keep the service alive.

Answer 1

Generally speaking, in U.S. law, a provider of a service via the Internet, such as a VPN, is immune from liability for user generated content pursuant to Section 230, so long as a copyright take-down notice is in place is complaints are lodged. So, you do not default to liability or have liability merely as a result of running a VPN.

But, there is a second problem. If the VPN is very small and you can't be distinguished from other users, you could conceivably face risk not as a VPN operator, but as a user of the VPN who is confused for someone engaging in illegal activity.

For example, suppose that there were five users, and that two could be ruled out due to being in places with no Internet access or being sick in the hospital, etc., leaving three possible suspects, and some weak circumstantial evidence pointed to you. You could easily become a prime suspect and maybe even end up on a terrorism watch list, even if it might be difficult or impossible to actually prove any wrongdoing on your part.