4

This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that can be sabotaged.

Regardless though, many VPN service providers vehemently claim that they do not keep logs. An example is NordVPN, which is based in Panama and so there is no domestic legislation that forces it to keep logs:

NordVPN Privacy Policy:

"Our top priority is customer data security. Operating under the jurisdiction of Panama allows us to guarantee our no logs policy, which means that your activities while using the privacy solutions created by NordVPN.com are not monitored, recorded, logged, stored or passed to any third party."

What I do not understand is companies like NordVPN have hundreds of servers around the world, most of which are not in the country that they are originally based in. Surely, no-logging is impossible for most of their servers? Or are companies compelled to log depending on where they are based? So US legislation would not apply to a VPN server in the US which is run by a company based in Hong Kong - but this doesn't make sense - wouldn't US legislation apply to them regardless of where they are based?

This link says, again, that one of the pros of VPN servers being based in Hong Kong is that companies are not compelled to keep logs (I assume this is in contrast with servers in the US and other countries):

"There are no mandatory data retention laws in Hong Kong. Most Hong Kong-based providers offer a “no logs” service, and international companies are not required to keep logs relating to their Hong Kong servers (although some companies, notably US based ones, choose to do so)."

Surely legislation does not discriminate based on where a company is based? Eg. all companies that operate in the UK are forced to abide by the Data Protection Act (DPA). Whether or not they are based in the UK does not matter. As long as the data that that company possesses remains in the UK, it has to be treated in compliance with UK law.

Also, why would US companies with servers in Hong Kong willingly keep logs if the law is not forcing them to? Sounds like a great marketing tool if they were able to claim they intentionally choose not to log.

My assumption here is that any legislation regarding mass surveillance of private citizens is followed by companies the same as legislation regarding anything else (DPA, legislation about the treatment of employees, etc.). Chinese companies with offices in the UK cannot treat their employees according to Chinese law, so why does are they allowed to treat legislation pertaining to internet traffic differently?

As for who would do the forcing, the local governments. Eg. the US government, that passes mass-surveillance legislation. If the US government argues they need logs to keep track of the movements of criminals and especially terrorists, wouldn't a company saying "we do not keep logs by choice" be condemned as impeding government counter-terrorism efforts? If the law requires all VPN servers in the US to keep logs, wouldn't a company not keeping logs be in violation of the law and hence 'criminal'?

If it's a legal loophole, it sounds like a dumb loophole if politicians are trying to claim they need logs to track down criminals (including terrorists), while allowing VPN providers to not keep logs.

5
  • 2
    Logs are kept when it is required for whatever reason, no matter what the marketing bullshit says. But even then, it doesn't really matter as you can be traced without logs anyway.
    – Greendrake
    Jan 23, 2018 at 10:38
  • From a purely technical point of view, logging is absolutely essential to running a successful VPN business. As a result, there are two kinds of VPN providers: Those that say they are logging, and those that are lying.
    – gnasher729
    Apr 5, 2018 at 16:05
  • @gnasher729 1) How is logging absolutely essential? 2) Maybe the logs just strip all identifiable information?
    – user138072
    May 12, 2018 at 21:38
  • Though mind you, those that claim no logging, mean it an an absolute and strict sense.
    – user138072
    May 13, 2018 at 1:52
  • @user138072 Logging is essential to running a successful VPN business because they need to identify customers who use up enormous amounts of bandwidth, who use VPN on a dozen computers while paying only once, and so on.
    – gnasher729
    Feb 14, 2019 at 22:03

2 Answers 2

6

This is tied up in the concept of sovereignty - nation states have control over their territories and citizens and they recognise the right of other nation states to do likewise.

The USA, China (Hong Kong) and Panama are all sovereign states, they each decide what the law is within their own territory and they can’t tell each other what to do; they can ask, however, that’s what diplomats do.

If a HK domiciled company provides HK based servers then they have to comply with HK law irrespective of where their customers are located. The USA could pass a law requiring US companies (like ISPs) to keep logs of traffic to and from HK servers but they cannot force a HK company to do anything, unless and until it operates in a place where the US has jurisdiction which means both the right and the ability to enforce their law.

4
  • What about a HK domiciled company with US based servers? I believe that's what this question is about. Or does that not matter because it's a HK company?
    – user14261
    Jan 23, 2018 at 23:01
  • AytAyt That is exactly what I am asking. I don't understand why (it appears) companies working in one country are being ruled by the law of another country on something that is allegedly so vital towards national security (mass surveillance).
    – user138072
    Jan 25, 2018 at 8:18
  • So basically you can make illegal things legal by simply incorporating somewhere else. Not surprising. But interesting nevertheless.
    – user4234
    May 4, 2018 at 6:55
  • 1
    @SharenEayrs Illegality is geographic - don't blaspheme in Indonesia, it's illegal, go for your life in the USA.
    – Dale M
    May 4, 2018 at 6:58
-2

It all depends where the company is physically located or has physical offices. Having servers in the USA doesn't mean that a Panamanian VPN company keeps its records in the USA. On the contrary, it keeps its logs in Panama, if it keeps any logs at all. By "logs" I am referring to records of potentially personally identifiable info. I believe NordVPN acknowledges 24 hour records of IP addresses, then they are destroyed - they supposedly have no value to the VPN after they are analyzed for misuse.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .