Should I be concerned my vpn server provider is based in the U.K.?

Question

I understand in this age that there are several uses for vpns.

As such I did some research and decided to use nord as they seemed popular and claimed to not log.

However when I connect to certain servers in Europe and google what is my isp it brings back a company called M247 ltd. which appears to be based out of the UK.

Now my questions is this:

How can nord (or any other big provider) possibly claim a no log policy if they are simply renting the servers and since m247 is based in the U.K. Could they be forced to log turn over information even without consent of nord because the company is based in the U.K. even if the physical server is somewhere else like Switzerland for instance?

I get nothing is completely 100% and there has to be some level of trust but they claim no logs so surely they must have some controls over the logging of the servers they rent from m247 (or others who provide servers to them).

This seems like it would be a problem for any vpn provider who rented servers (which is a lot of big providers).

So what exactly is going on? Are they renting the servers and then nord install something to secure the servers from logging or is all traffic anonymised by the vpn before it even reaches the server? Or maybe they have a policy with the owner of the server to not log?

Hopefully it is clear what I am asking.

Thank you.

Answer 1

(Nothing related to law here. Should be migrated back to Security SE).

Could they be forced to log turn over information even without consent of nord

Hosting providers (like M247) renting out physical servers do not have routine access to the data on them. What is going on on the servers at data/software level is completely remotely controlled by the tenant (e.g. Nord).

The only way for the hosting provider to gain access to the data is to tamper with the hardware (dump the RAM, connect to the hard drive without taking it out etc.). Doing so in a way that the tenant does not notice is tricky and would only be attempted by intelligent agencies. Another option would be for the provider to fake physical server and sell virtual instead, in which case the data could be inspected via the hypervisor.

So, they cannot just "turn over" information because it is not their business to have access to it. But they can be compelled to cooperate with intelligent agencies and do what they can to make the data accessible.

So what exactly is going on? Are they renting the servers and then nord install something to secure the servers from logging or is all traffic anonymised by the vpn before it even reaches the server? Or maybe they have a policy with the owner of the server to not log?

As per above, the owner does not control the software/data/logs. It is completely up to the tenant to log or not to log.

On a different note, the absence of logs does not guarantee privacy; traffic correlation attacks can still reveal who is who. Thus, "no logs" is more of marketing buzz rather than real value.

Answer 2

While a data centre owner could spy on their customers, its not part of normal business. Leaving aside contractual terms, running a data centre is a low-margin business, so keeping unnecessary logs is not something that anyone is likely to do.

However in the UK the Investigatory Powers Act gives a lot of branches of the UK government the right to secretly order "communication service providers" to provide them with communications data. From what you say, m247 is probably a CSP and hence could be ordered to keep logs and provide them to the government.