0

There are tons of VPN service providers that allow VPN connections for some little amount like 5-15$ per month. Imagine a malicious person using some of these services to hide his cyber-criminal activities. Say, he hacked a website resulting a major data breach. Even if the breach was successful, there is a high chance that the IP address will be recorded somewhere in the logs, either inside a hacked system or within its own ISP or both. So, theoretically, police will come to this VPN company owning this IP with the warrant or claim or whatsoever. My question is to someone inside this VPN industry - how the VPN companies continue to live and operate and their owners not going to jail.

Note: I perfectly know how these companies prohibit illegal activity in their Terms & Conditions published, but it's unclear to me how it protects them from prosecution rather than from affected victims.

Improve this question
2
  • 5
    The same way that knife manufacturers avoid prosecution when someone gets stabbed.
    – bdb484
    Commented Jan 4 at 14:39
  • @bdb484 I hear you, and yet, under Section 230, even if you know that your users are using your services for illegal purposes on an ongoing and continuing basis (other than copyright violations for which you've received a takedown notice), you are still immune from liability, while you would otherwise have civil and criminal liability for your complicity.
    – ohwilleke
    Commented Jan 5 at 1:44

2 Answers 2

Reset to default
4

Under U.S. law, Internet Service providers have broad immunity from civil and criminal liability for the conduct of their users pursuant to 47 U.S. Code § 230. While this immunity isn't absolutely without exceptions, there is a large and varied case law upholding it in situations where there would have been liability otherwise under the common law or state law.

The Electronic Frontiers Foundation has a short overview (with links to additional resources) of how this federal statute, which is part of the Communications Decency Act and is common referred to simply as "Section 230", has been applied.

Improve this answer
2
  • That's cool. I suppose the EU laws are not quite different. At least I hope so...
    – los vatos locos
    Commented Jan 4 at 20:31
  • @losvatoslocos No idea what EU law is on that subject.
    – ohwilleke
    Commented Jan 4 at 20:31
3

This problem is not exclusive to VPN providers - ISP's are also exposed to risks as well, stemming from users that may act maliciously.

In the US, providers like VPNs and ISPs are largely immune to liability for their users' actions, as these providers simply act as a conduit for the user to access the internet. If the provider is simply performing their usual function, and does not do something unusual to aid the user in performing the malicious activity, then typically they are not held liable.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .