New data released by Homeland Security shows that U.S. Customs and Border Protection seized significantly more DMCA circumvention devices in 2017. The seizures, which includes mod chips for gaming consoles, increased 324% compared to the year before, although the actual number remains fairly low. In the United States, citizens are generally prohibited from tampering with DRM and other technological protection measures. This means that Blu-ray rippers are not allowed, nor are mod chips for gaming consoles, and some pirate streaming boxes could fall into this category as well. Despite possible sanctions, there are plenty of manufacturers who ship these devices to the US, often to individual consumers. To arrive at their destination, however, they first have to pass the border control. Not all make it to their final destination. A new report released by Homeland Security shows that the number of “intellectual property” related seizures increased by 8%, from 31,560 in 2016 to 34,143 a year later. The vast majority of these seized items are traditional counterfeit goods. This includes fake brand clothing, shoes, replica watches, toys, as well as consumer electronics. What caught our eye, however, is a sharp increase in “circumvention devices” that were found to violate the DMCA. Last year, the number of these seized items U.S. Customs and Border Protection increased by 324%. “CBP seized 297 shipments of circumvention devices for violations of the Digital Millennium Copyright Act (DMCA), a 324 percent increase from 70 such seizures in FY 2016,” the report reads. While the relative increase is quite dramatic, the absolute numbers are perhaps not as impressive, with less than one seized device per day. The report gives no explanation for the surge, nor is there an estimate of how many devices slip through. What we did notice is that the International Intellectual Property Alliance (IIPA) recently framed streaming boxes as possible circumvention tools. The strong enforcement focus of rightsholders on these devices may have been communicated to border patrols as well. When we previously reached out to Customs and Border Protection (CBP) to find out more about what type of circumvention devices are seized under the DMCA, a spokesperson provided us with the following definition. “[P]roducts, devices, components, or parts thereof that are primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner, and have only limited commercially significant purposes or uses other than to circumvent such protection measures.” TorrentFreak reached out to CBP again this week to ask if streaming boxes are seen as circumvention devices, but at the time of writing, we have yet to receive a response. In a press release commenting on the news, CBP Acting Commissioner Kevin McAleenan said that his organization is happy with last year’s results. “The theft of intellectual property and trade in counterfeit and pirated goods causes harm to an innovation-based economy by threatening the competitiveness of businesses and the livelihoods of workers,” McAleenan said. “Another record-breaking year of IPR seizures highlights the vigilance of CBP and ICE personnel in preventing counterfeit goods from entering our stream of commerce and their dedication to protecting the American people,” he added. https://torrentfreak.com/u-s-border-seizures-of-dmca-circumvention-devices-surges-180309/

After 13 years, the popular streaming link search engine Alluc is shutting down. The people behind the site, which was regularly used by pirates, say they will focus on other projects instead. The team still see a future for "uncensored search" and hope someone else will fill the gap the site leaves behind. With 80 million streaming links to more than 700 video services, Alluc sold itself as the premier streaming link site. It offered a wide variety of content and over the past thirteen years it grew out to become one of the largest sites of its kind. This week, however, Alluc surprised friend and foe by shutting down. “The alluc search engine has been discontinued. After 13 years of alluc, we decided to take a break and focus on other projects,” a message posted on the site’s homepage reads. That the site was popular is not a secret. People used it to find streaming links to nearly everything, from old movies to the latest hit series. The operators mention that they served a billion unique visitors over the past decade, which is an incredible achievement. Alluc says farewell What’s less clear, however, is why the site decided to stop now. In the past, we’ve reported on similar sites that threw in the towel because revenue was dwindling, but Alluc told us that is not the case here. “The decision was not driven by monetary reasons. We started alluc when we were still in high-school and it became into something bigger and better than we could have ever imagined when we started it,” Alluc’s Sebastian tells us. “But now it’s time for us to move on. We hope to have contributed a lot to the video space and to have helped out a lot of people during these 13 years of running alluc full time.” While Alluc could be used to find both authorized and unauthorized content, the movie industry saw it as a blatant pirate site. This resulted in a site blocking request in Australia, among other things. Alluc, however, always rejected the ‘pirate’ label and saw itself as an “uncensored” search engine. While they are shutting down now, they still see a future for similar services. “There will always be a future for uncensored search and I hope us shutting down alluc can help to create the vacuum needed to incentivize new sites of similar quality and scope or even a decentralized solution to be created by others,” Sebastian tells us. Time will tell whether another site will indeed jump in to fill the gap. Alluc’s API, which is used by third-party apps and services to find streaming links, will remain available until the end of the month when it will shut down. Meanwhile, Alluc’s search engine framework lives on at pron.tv, an adult-themed site. https://torrentfreak.com/streaming-link-search-engine-alluc-shuts-down-180309/

A pirate who uploaded large volumes of music to the Internet without permission has agreed to pay Dutch anti-piracy group BREIN 10,000 euros ($12,374) to avoid a lawsuit. Although the individual uploaded the content to the newsgroups, which are sometimes considered to be more secure, BREIN forced his Usenet provider to hand over his details, making it easy to track him down. In 2018, music piracy is a very different beast than it was back in the early P2P days of Kazaa and LimeWire. Where once it ran rampant, vastly improved official offerings have ensured that millions of former pirates are now enjoying music legally via convenient streaming services such as Spotify. However, there is no shortage of people who prefer to have personal archives of illicit MP3s stored safely on their own machines. This content can be easily obtained from web-based pirate sites, torrent platforms, and the aging Usenet system. The latter is often (and incorrectly) considered to be a safer option for distribution but for one uploader, things haven’t played out that way. According to news from Dutch anti-piracy group BREIN, a “large-scale” Usenet uploader has recently agreed to pay the not inconsiderable sum of 10,000 euros ($12,374) to make a potential lawsuit disappear. BREIN says the person was responsible for uploading unlicensed music releases to Usenet in breach of copyright, including recent albums by Ed Sheeran and Justin Timberlake. However, BREIN also criticizes the Usenet providers who facilitate this kind of sharing. “Although such uploaders usually do this free of charge for the status they receive from illegal downloaders, it is the Usenet providers that make money by selling subscriptions for access to their servers,” says BREIN director Tim Kuik. “Such providers like to close their eyes and claim that they do not know what is happening on their servers and only take action when they receive a notification.” Alongside BREIN’s suggestion of willful blindness to infringement, there’s also the issue of compliance when Usenet operators are presented with an official complaint. Dutch case law requires that when a “reasonable” case of infringement is presented, they must give up the identity of the alleged infringer. In this case, that’s exactly what happened. “BREIN has, in order to obtain the details the uploader, requested the Usenet provider of this uploader to provide the data. This request was answered,” the anti-piracy outfit reveals. Unlike other jurisdictions where a specific court order is needed for disclosure, in the Netherlands no such process is required. BREIN has taken advantage of this position in many previous cases, insisting that providers who don’t disclose when there are reasonable grounds are acting unlawfully. Following BREIN’s approach and the 10,000 euro settlement, the anti-piracy outfit says that the uploader took to Spotnet, a piece of software that allows downloading from newsgroups, to announce his demise. “As you may have noticed, I have not been actively uploading for a while, because BREIN finally found my details and I have been asked to stop acting as an uploader of copyrighted music content to Usenet,” the uploader wrote. “I have made a settlement with BREIN. A part of this settlement consists of the payment of a considerable sum of 10,000 euros, so I stop with uploading and advise other uploaders to think carefully about whether they want to continue. BREIN doesn’t stand idly by either. They are willing to take the necessary steps to get your details.” BREIN says that the circumstances of the uploader were taken into consideration when reaching the 10,000 euro figure but whether the full amount will ever get paid will never be publicly known. That being said, the publicity attached to the settlement agreement will be worth more to BREIN than the cash alone. https://torrentfreak.com/large-scale-music-pirate-settles-brein-10000-euros-180309/

Swedish Internet service provider Bahnhof has appealed a ruling that requires the company to hand over subscriber data of alleged pirates to the police. Bahnhof maintains that this goes against EU regulations since piracy is not a 'serious crime'. The provider is therefore requesting an opinion from the EU Court of Justice on the matter. In recent years Internet provider Bahnhof has fought hard to protect the privacy of its subscribers. The company has been a major opponent of extensive data retention requirements, has launched a free VPN to its users, and vowed to protect subscribers from a looming copyright troll invasion. The privacy-oriented ISP is doing everything in its power to prevent its Swedish customers from being exposed. It has even refused to hand over customer details in piracy cases when these requests are made by the police. This stance resulted in a lawsuit in which Bahnhof argued that piracy isn’t a serious enough offense to warrant invading the privacy of its customers. The ISP said that this is in line with European privacy regulations. Last month, the Administrative Court in Stockholm disagreed with this argument, ordering the ISP to hand over the requested information. The Court ruled that disclosure of subscriber data to law enforcement agencies does not contravene EU law. It, therefore, ordered the ISP to comply, as the Swedish Post and Telecom Authority (PTS) had previously recommended. While the order is a serious setback for Bahnhof, the ISP isn’t letting the case go just yet. It has filed an appeal where it maintains that disclosing details of alleged pirates goes against EU regulations. Bahnhof says NO To settle the matter once and for all, Bahnhof has asked the Swedish Appeals Court to refer the case to the EU Court of Justice, to have an EU ruling on the data disclosure issue. “Bahnhof, therefore, requires the Court of Appeal to obtain a preliminary ruling from EU law so that the European Court of Justice itself can rule on the matter before the Court of First Instance reaches a final position,” Bahnhof writes. Law enforcement requests for piracy-related data are quite common in Sweden. Bahnhof previously showed that more than a quarter of all police request for subscriber data were for cases related to online file-sharing, trumping crimes such as grooming minors, forgery and fraud. The ISP is vowing to fight this case to the bitter end. While it has no problem with law enforcement efforts in general, the company doesn’t want to hand over customer data without proper judicial review of a suspected crime. “This legal process has already been going on for two years and Bahnhof is ready to continue for as long as necessary to achieve justice. Bahnhof will never agree to hand over delicate sensitive customer data without judicial review,” the company concludes. https://torrentfreak.com/isp-wants-eu-court-ruling-on-identifying-pirating-subscribers-180308/

The operator of a Tor exit node has asked a federal court in Oregon for a summary judgment of non-infringement. The man, who is accused of sharing a pirated copy of Dallas Buyers Club, argues that the evidence gathering software is flawed and unreliable. Besides winning several prestigious awards, the people behind the movie Dallas Buyers Club are also known for their vigorous pursuit of online pirates. The film’s copyright holders have sued thousands of people in recent years, resulting in numerous out-of-court settlements. In Oregon, however, one defendant has proven to be a tough adversary. In a lawsuit that’s been ongoing for three years, defendant John Huszar was sued for an alleged copyright infringement that occurred via his Tor exit node. Tor is an anonymity tool and operating a relay or exit node basically means that the traffic of hundreds or thousands of users hit the Internet from your IP-address. When pirates use Tor, it will then appear as if the traffic comes from this connection. During the course of the legal proceedings, Huszar repeatedly denied that he personally downloaded a pirated copy of the film. However, he faces substantial damages because he failed to respond to a request for admissions, which stated that he distributed the film. This generally means that it’s seen by the court as true. With this admission, Dallas Buyers Club (DBC) requested a ruling in its favor. A few months ago, the film company argued that the Tor exit node operator admitted willful infringement, which could cost him up to $150,000 in damages. The Tor exit node operator then fought back pointing out several disputed claims and asked for a ruling in its favor. However, according to the filmmakers, this simply came too late, more than a year after the Court ordered the admissions. Huszar is not letting DBC off easy though. Before the court ruled on the filmmakers’ request, the defendant submitted a request for summary judgment of non-infringement a few days ago. Among other things, the defense argues that DBC misled the court about the quality and integrity of the evidence gathering software ‘MaverickMonitor,’ which was created by the German company MaverickEye. The defendant asked Dr. Kal Toth, a qualified software verification expert, to take a look at the system to see if it’s as reliable as claimed. According to his findings, it is not possible to “conclude that MaverickMonitor detects the IP addresses of infringing BitTorrent users correctly, consistently and reliably.” From the declaration In addition, the defense points out that DBC’s own expert never ran the software, suggesting that the filmmakers have no idea how it works. “Bizarrely, DBC’s fact and expert witness, Robert Young, testified that he never installed and ran the MaverickMonitor software on any server despite being designated by DBC as its designee on software. “DBC, a company that used software to sue thousands of people, has no idea how this software works,” the defense argues in its motion. Huszar’s legal team argues that the BitTorrent monitoring system that was used to sue thousands of people is “flawed and unreliable.” While it may produce accurate findings, there could be many false positives as well, their motion explains. “Perhaps Maverickmonitor worked 50% of the time. The problem is that we have no idea for this case which side of the coin was up for Huszar, nor does DBC, or MaverickMonitor. “It is, technically speaking, simply the equivalent of a random number generator, and as such any data generated from the MaverickMonitor system should be excluded,” the motion adds. While the filmmakers have the admission as their main ammunition, the Tor exit node operator points the finger at the evidence gathering software, hoping to find the court on his side. “[H]ere Huszar demonstrated with an inspection of the code that MaverickMonitor’s claim of ‘100% accuracy’ is a complete fraud. Huszar respectfully requests this Court grant his motion for summary judgment and deem him the prevailing party,” the motion concludes. It’s now up to the court to decide which side prevails. — A copy of the motion for summary judgment is available here (pdf). https://torrentfreak.com/torrent-tracking-evidence-is-flawed-and-unreliable-alleged-pirate-argues-180307/

Photography-focused site Fstoppers has revealed it poured considerable resources into 'pirating' one of its own video tutorials in order to send an anti-piracy message. Instead of a $300 instructional, the 25GB torrent uploaded to The Pirate Bay contains a somewhat hilarious tutorial which is clearly not what people have come to expect from the site. Fstoppers is an online community that produces extremely high-quality photographic tutorials. One of its most popular series is called Photographing the World which sees photographer Elia Locardi travel to exotic locations to demonstrate landscape and cityscape photography. These tutorials sell for almost $300, with two or three versions in a pack selling for up $700. Of course, like any other media they get pirated so when Fstoppers were ready to release Photographing the World 3, they released it themselves on torrent sites a few days before retail. Well, that’s what they wanted the world to believe. “I think it’s fair to say that we’ve all downloaded ‘something’ illegally in the past. Whether it’s an MP3 years ago or a movie or a TV show, and occasionally you download something and it turns out it was kinda like a Rick Roll,” says Locardi. “So we kept talking and we thought it would be a good idea to create this dummy lesson or shadow tutorial that was actually a fake and then seed it on BitTorrent.” Where Fstoppers normally go to beautiful and exotic international locations, for their fake they decided to go to an Olive Garden in Charleston, South Carolina. Yet despite the clear change of location, they wanted people to believe the tutorial was legitimate. “We wanted to ride this constant line of ‘Is this for real? Could this possibly be real? Is Elia [Locardi] joking right now? I don’t think he’s joking, he’s being totally serious’,” says Lee Morris, one of the co-owners of Fstoppers. People really have to watch the tutorial to see what a fantastic job Fstoppers did in achieving that goal. For anyone unfamiliar with their work, the tutorial is initially hard to spot as a fake and even for veterans the level of ambiguity is really impressive. However, when the tutorial heads back to the studio, where the post-processing lesson gets underway, there can be no doubt that something is amiss. Things start off normally with serious teaching, then over time, the tutorial gets more and more ridiculous. Then, when the camera cuts away to show Locardi forming a ‘mask’ on an Olive Garden image, there can be no confusion. That’s a cool mask….wait.. In order to get the tutorial out to the world, the site created its own torrent. They had never done anything like it before so got some associates to upload the huge 25GB+ package to The Pirate Bay and have their friends seed it. Then, in order to get past more savvy users on the site, they had other people come in and give the torrent good (but fake) reviews. The fake torrent on The Pirate Bay (as of yesterday) Screenshots provided by Fstoppers taken months ago reveal hundreds of downloaders. And, according to Morris, the fake became the most-downloaded Photographing the World 3 torrent online, meaning that the “majority of downloaders” got the comedy version. Also of interest is the feedback Fstoppers got following their special release. Emails flooded in from pirates, some of whom were confused while others were upset at the ‘quality’ of the tutorial. “The whole time we were thinking: ‘This isn’t even on the market yet! You guys are totally stealing this and emailing us and complaining about it,” says Fstoppers co-owner Patrick Hall. While the tutorial itself is brilliant, Fstoppers points to a certain hypocrisy within its target audience of photographers, who themselves have to put up with a lot of online piracy of their work. Yet, clearly, many are happy to pirate the work of other photographers in order to make their own art better. All that being said, the exercise is certainly an interesting one and the creativity behind the hoax puts it head and shoulders above more aggressive anti-piracy campaigns. However, when TF tracked down the torrent on The Pirate Bay last evening, it’s popularity had nosedived. While it was initially downloaded by a lot of eager photographers, probably encouraged by the fake comments placed on the site by Fstoppers, the torrent is now only being shared by less than 10 people. As usual, the Pirate Bay users appear to have caught on, flagging the torrent as a fake. The moderators, it seems, have also deleted the fake comments. While most people won’t want to download a 25GB torrent to see what Fstoppers came up with, the site has uploaded the fake tutorial to YouTube. It’s best viewed alongside their other work, which is sensational, but people should get a good idea by watching the explanation below. https://torrentfreak.com/fstoppers-uploaded-a-brilliant-hoax-anti-piracy-tutorial-to-the-pirate-bay-180307/

ISP Grande Communications and the RIAA are continuing their fight in court. US Magistrate Judge Andrew Austin recommends dropping the infringement claims against Grande's management company and the vicarious infringement claim against the ISP itself. However, the request to dismiss the contributory infringement claim should be denied. Regular Internet providers are being put under increasing pressure for not doing enough to curb copyright infringement. Last year several major record labels, represented by the RIAA, filed a lawsuit in a Texas District Court, accusing ISP Grande Communications of turning a blind eye on its pirating subscribers. According to the RIAA, the Internet provider knew that some of its subscribers were frequently distributing copyrighted material, and accused the company of failing to take any meaningful action in response. Grande disagreed with this assertion and filed a motion to dismiss the case. The ISP argued that it doesn’t encourage any of its customers to download copyrighted works, and that it has no control over the content subscribers access. The Internet provider admitted that it received millions of takedown notices through the piracy tracking company Rightscorp. However, it believes that these notices are flawed and not worthy of acting upon. It was not keeping subscribers on board with a profit motive, as the RIAA suggested. A few days ago US Magistrate Judge Andrew Austin issued his “report and recommendation” on the motions to dismiss, which brings some good and bad news for both sides. First of all, Judge Austin recommends granting the motion to dismiss the piracy claims against Grande’s management company Patriot Media Consulting, which is also listed as a defendant. According to the order, the RIAA failed to show that Patriot employees were involved in the decisions or actions that led to the infringements, only that they may have been involved in formulating Grande’s infringement related policies. “This is a far cry from showing that Patriot as an entity was an active participant in the alleged secondary infringement,” Judge Austin writes. Moving to Grande Communications itself, Judge Austin recommends dropping the vicarious infringement claim, as Grande requested. To show vicarious infringement, the RIAA would have to prove that the ISP has a direct financial interest in the infringing activity. That is not the case here. The record labels argued that the availability of copyrighted music lures customers, but the Judge found this allegation too vague, as it would apply to all ISPs. “There are no allegations that Grande’s actions in failing to adequately police their infringing subscribers is a draw to subscribers to purchase its services, so that they can then use those services to infringe on UMG’s (and others’) copyrights,” Judge Austin argues. “Instead UMG only alleges that the existence of music and the BitTorrent protocol is the draw. But that would impose liability on every ISP, as the music at issue is available on the Internet generally, as is the BitTorrent protocol, and is not something exclusively available through Grande’s services.” While the above is good news for the Internet provider, the report and recommendation opt to keep the contributory infringement claim alive. Contributory copyright infringement happens where a defendant intentionally induces or encourages direct infringement. Grande argued that Rightcorp’s notices were not sufficient to show that copyrighted material was ever downloaded, but Judge Austin disagrees. The RIAA has made a “plausible claim” that the ISP’s subscribers are infringing the labels’ copyrights. “It would be inappropriate to dismiss the case based on factual allegations Grande makes about the Rightscorp notices and system, without any evidence to back those up,” Judge Austin’s recommendation reads. In addition, Grande also argued that it’s protected from a secondary copyright infringement claim under the “staple article of commerce” doctrine, as “it is beyond dispute” that ISPs have numerous non-infringing uses. Referring to the legal case between BMG and Cox Communications, Judge Austin says that this isn’t as clear as Grande suggests. “The Court acknowledges that this is not yet a well-defined area of the law, and that there are good arguments on both sides of this issue,” the recommendation reads. “However, at this point in the case, the Court is persuaded that UMG has pled a plausible claim of secondary infringement based on Grande’s alleged failure to act when presented with evidence of ongoing, pervasive infringement by its subscribers.” The recommendation, therefore, is to deny the motion to dismiss the contributory infringement claim against Grande. If the U.S. District Court Judge adopts this position, it would mean that the case is heading to trial based on this claim. — Judge Austin’s full report and recommendations filing is available here (pdf). https://torrentfreak.com/judge-issues-mixed-order-in-riaas-piracy-case-against-isp-grande-180306/

The MPA, Netflix, Amazon, and dozens of other content companies are ramping up the pressure on a third-party Kodi addon developer. Last year, JSergio123 was warned by the Alliance for Creativity and Entertainment to cease his activities and sign a confidential settlement agreement. He did not and now he's coming under pressure to comply. But what are ACE's demands? The Alliance for Creativity and Entertainment (ACE) is a coalition of 30 companies that reads like a who’s who of the global entertainment market. All of the major Hollywood studios are members, plus Amazon, Netflix, BBC, Hulu, and Village Roadshow, to name a few. ACE was launched last year to present a united front against online infringement and since then has been involved in various anti-piracy actions. ACE has made the third-party Kodi addon scene one of its early priorities, targeting developers with home visits and lengthy letters demanding that they cease and desist their activities. This has led to several pulling back from the scene but in some instances, this doesn’t appear to have been enough for ACE. The letters received by the developers also include a requirement for them to sign a settlement agreement which binds them to a particular course of future behavior set out by ACE. It’s unclear how many developers have signed but TorrentFreak is aware that several have not. One of those is JSergio123 who last November announced he would be discontinuing development of several Kodi addons after being targeted by ACE. “Sorry to say but I am stopping all development of the urlresolver, metahandler, and my other addons,” he said. JSergio123’s reluctance to sign an agreement with ACE hasn’t gone unnoticed by the anti-piracy group. In a letter dated March 5, 2018 and signed by Kelly Klaus of US-based lawfirm Munger, Tolles & Olson, the developer is reminded of what transpired last year and what is expected of him moving forward. “I understand that ACE counsel have discussed with you various of your “Addon” software applications and related software and services, including URLResolver (collectively, the “[redacted] Addons”) and other actions you have undertaken to induce and contribute to the mass infringement of the ACE members’ copyrighted works,” Klaus writes. “I also understand that ACE counsel have provided you with a proposed settlement agreement, pursuant to which you would end your infringing activities and provide cooperation and other consideration in exchange for ACE agreeing not to pursue legal action against you arising out of your infringing activities. To date, you have not signed the settlement agreement.” JSergio123’s precise reasons for not signing the settlement agreement aren’t being made public. However, TorrentFreak understands that some of the terms presented to addon developers last year have caused considerable concern. In some cases they are difficult to meet, not to mention unpalatable to the people involved. They include promises to ensure that specified addons and indeed any developed in the future can no longer infringe copyright. For those that scrape third-party sources, this could prove impossible to absolutely guarantee. This could effectively put developers out of the addon game – legitimate or otherwise – for good. TF is also informed that ACE demanded a high-level of cooperation, including that the developers should supply what amounts to a full confession, detailing all the projects they’ve been involved in, past and present. Furthermore, the ACE agreement reportedly requires developers to inform on their colleagues by providing personal information such as identities and contact details. There’s also a requirement to indicate whether and how developers been making money from their activities. The new letter from ACE, which is shown below after being published by JSergio, refers to a “most recent draft of the settlement agreement that ACE members would be willing to sign.” Whether this contains any amendments from the settlement agreements sent out last year isn’t clear but Mr Klaus, who is a veteran of several large infringement lawsuits in the US, says that JSergio should take the offer seriously. “I strongly urge you to consider the gravity of this situation and sign the agreement,” the lawyer concludes. ACE Letter (credit: JSergio123) https://torrentfreak.com/ace-warns-kodi-addon-developer-to-sign-settlement-agreement-or-else-180306/

As Spotify prepares to collect billions of dollars with a listing on the New York Stock exchange, a little-known fact about the company has emerged. The music streaming service, which had uTorrent developer Ludvig Strigeus as one of its early developers, was also the owner of the popular BitTorrent client for a while. When Spotify launched its first beta in the fall of 2008, we described it as “an alternative to music piracy.” From the start, the Swedish company set out to compete with pirate services by offering a better user experience. Now, a decade later, it has come a long way. The company successfully transformed into a billion-dollar enterprise and is planning to go public with a listing on the New York Stock Exchange. While it hasn’t completely evaporated music piracy, it has converted dozens of millions of people into paying customers. While Spotify sees itself as a piracy remedy, backed by the major labels, its piracy roots are undeniable. In a detailed feature, Swedish newspaper Breakit put a spotlight on one of Spotify’s earliest employees, developer Ludvig Strigeus. With a significant stake in the company, he is about to become a multi-millionaire, one with a noteworthy file-sharing past. It’s unclear what is current stake in Spotify is, but according to Swedish media it’s worth more than a billion Kroner, which is over $100 million. Strigeus was the one who launched uTorrent in September 2005, when the BitTorrent protocol was still fairly new. Where most BitTorrent clients at the time were bloatware, uTorrent chose a minimalist approach, but with all essential features. This didn’t go unnoticed. In just a few months, millions of torrent users downloaded the application which quickly became the dominant file-sharing tool. Little more than a year after its launch the application was acquired by BitTorrent Inc., which still owns it today. While that part of history is commonly known, there’s a step missing. Strigeus’ coding talent also piqued the interest of Spotify, which reportedly beat BitTorrent Inc. by a few months. Multiple sources confirm that the streaming startup, which had yet to release its service at the time, bought uTorrent in 2006. While some thought that Spotify was mainly interested in the technology, others see Strigeus as the target. “Spotify bought μTorrent, but what we really wanted was Ludvig Strigeus,” former Spotify CEO Andreas Ehn told Breakit. This indeed sounds plausible as Spotify sold uTorrent to BitTorrent Inc. after a few months, keeping the developer on board. Not a bad decision for the latter, as his Spotify stake makes him a billionaire. At the same time, it was an important move for Spotify too. Ludvig (Ludde) is still credited in recent uTorrent releases In addition to having a very talented developer on board, who helped to implement the much needed P2P technology into Spotify, the deal with BitTorrent Inc. brought in cash that funded the development of the tiny, but ambitious, streaming service. It might be too much to argue that Spotify wouldn’t be where it is without uTorrent and its creator, but their impact on the young company was significant. The file-sharing angle was also very prominent in the early releases of Spotify. At the time, of all the tracks that were streamed over the Internet by Spotify users, the majority were streamed via P2P connections. And we haven’t even mentioned that Spotify reportedly used pirate MP3s for its Beta release, including some tracks that were only available on The Pirate Bay. Spotify’s brief ownership of uTorrent isn’t commonly known, to make an understatement. When BitTorrent Inc. announced that it acquired “uTorrent AB” there was no mention of Spotify, which was still an unknown company at the time. Times change. https://torrentfreak.com/spotify-owned-utorrent-before-bittorrent-acquired-it-180305/

In response to a growing threat of Internet surveillance and censorship, VPN services have surged in popularity in recent years. Encrypting one's traffic through a VPN connection helps to keep online communications private, but what more does your VPN provider do to keep you anonymous? We take a look at the logging policies and other privacy features of dozens of VPN providers. Using a VPN service is a great way to protect your privacy online. However, not all VPN services are as private as you might think. In fact, some are known to keep extensive logs that can easily identify specific users on their network. This is the main reason why we publish a yearly VPN review, asking providers about their respective logging policies as well as other security and privacy aspects. It’s worth keeping in mind though that not all VPN protocols and encryption algorithms are equally secure. PPTP is known to be vulnerable for example, and pre-shared keys are also a risk. We ask all VPN providers what their best recommendation is, but we encourage readers to fully research all options. This year’s questions are as follows: 1. Do you keep ANY logs which would allow you to match an IP-address and a time stamp to a user of your service? If so, exactly what information do you hold and for how long? 2. What is the name under which your company is incorporated, and under which jurisdiction does your company operate? 3. What tools are used to monitor and mitigate abuse of your service, including limits of concurrent connections if these are enforced? 4. Do you use any external email providers (e.g. Google Apps), analytics, or support tools ( e.g Live support, Zendesk) that hold information provided by users? 5. In the event you receive a DMCA takedown notice or a non-US equivalent, how are these handled? 6. What steps are taken when a court orders your company to identify an active or past user of your service? How would your company respond to a court order that requires you to log activity going forward? Has any of this ever happened? 7. Is BitTorrent and other file-sharing traffic allowed on all servers? If not, why? 8. Which payment systems/providers do you use? Do you take any measures to ensure that payment details can’t be linked to account usage or IP-assignments? 9. What is the most secure VPN connection and encryption algorithm you would recommend to your users? 10. Do you provide tools such as “kill switches” if a connection drops and DNS leak protection? 11. Do you have physical control over your VPN servers and network or are they outsourced and hosted by a third party (if so, which ones)? Do you use your own DNS servers? (if not, which servers do you use?) 12. What countries are your servers physically located? Do you offer virtual locations? —- Below is the list of responses from the VPN services in their own words. These are not endorsements and trust is crucial. Providers which didn’t answer our questions directly, blocked certain traffic, or are logging extensively were excluded. We specifically chose to leave room for detailed answers where needed. The order of the list holds no value. — PRIVATE INTERNET ACCESS 1. We do not store any logs relating to traffic, session, DNS or metadata. We do not keep any logs for any person or entity to match an IP address and a timestamp to a user of our service. In other words, we do not log, period. Privacy is our policy. 2. Private Internet Access is operated by London Trust Media, Inc., with branches in the US and Iceland, which are a few of the countries that still respect privacy and do not have a mandatory data retention policy. 3. We have an active, proprietary system in place to help mitigate abuse. 4. At the moment we are using Google Apps Suite and Zendesk. However, we are in the process of migrating our support to Deskpro, an in-house self-hosted solution. 5. We do not monitor our users, and we keep no logs, period. That said, we do have an active, proprietary system in place to help mitigate abuse. 6. Every court order is scrutinized to the highest extent for compliance with both the “spirit” and “letter of the law.” We do periodically receive subpoenas from law enforcement agencies that we scrutinize for compliance and respond accordingly. This is all driven based upon our commitment to privacy. All this being said, we do not log and do not have any data on our customers other than their signup e-mail and account username. 7. Yes, BitTorrent and file-sharing traffic are allowed and treated equally to all other traffic (although it’s routed through a second VPN in some cases). We do not censor our traffic because we believe in an open internet, period. 8. We utilize a variety of payment systems, including, but not limited to: PayPal, Credit Card (with Stripe), Amazon, Google, Bitcoin, Bitcoin Cash, Zcash, CashU, PaymentWall, and any major store-bought gift card and OKPay. Payment data is not linked nor linkable to user activity do to our no logs policy. 9. At the moment, the most secure and practical VPN connection and encryption algorithm that we recommend to our users would be our cipher suite of AES-256 + RSA4096 + SHA256. 10. Yes, our users gain access to a plethora of additional tools, including but not limited to: (a) Kill Switch: Ensures that traffic is routed through the VPN such that if the VPN connection is unexpectedly terminated, the traffic will not route. (b) IPv6 Leak Protection: Protects clients from websites which may include IPv6 embeds, which could lead to IPv6 IP information coming out. (c) DNS Leak Protection: This is built-in and ensures that DNS requests are made through the VPN on a safe, private, no-log DNS daemon. (d) Shared IP System: We mix clients’ traffic with many other clients’ traffic through the use of an anonymous shared-IP system ensuring that our users blend in with the crowd. (e) MACE™: Protects users from malware, trackers, and ads. 11. We utilize our own bare metal servers in third-party data centers that are operated by trusted friends and, now, business partners whom we have met and on which we have completed serious due diligence. Our servers are located in facilities including 100TB, Choopa, Leaseweb, among others. We also operate our own DNS servers on our high throughput network. These servers are private and do not log. 12. As of the beginning of 2018, we operate 3172 servers across 43 locations in 28 countries. For more information on what countries are available, please visit our network information page. All of our locations are physical and not virtualized. Private Internet Access website NORDVPN 1. We do not keep any logs nor timestamps that could allow our customers to be identified. 2. The registered company name is Tefincom co S.A., and it operates under the jurisdiction of Panama. 3.We have developed and implemented an automated tool that limits the maximum number of connections to six devices. We do not use any other tools. 4. We use Google Analytics and third-party ticket/live chat tools (Zendesk/Zopim). Google Analytics is used to improve our website and provide our users with the most relevant information. The ticket/live chat tool is used to provide the best support in the industry (available 24/7), but not tracking our users by any means. 5. We operate under Panama’s jurisdiction, where DMCA and similar orders have no legal bearing. Therefore, they do not apply to us. 6. If the order or subpoena is issued by a Panamanian court, we would have to provide the information if we had any. However, our zero-log policy means that we don’t have any information about our users’ online activity. So far, we haven’t had any such cases. 7. Yes, we allow P2P traffic. We have optimized a number of our servers specifically for file-sharing; this way, we ensure that other servers, which are meant for streaming and other purposes, have uninterrupted speeds. 8. Our customers are able to pay via credit card, PayPal and Bitcoin. Our payment processing partners collect basic billing information for payment processing and refund requests, but it cannot be related to any Internet activity of a particular customer. Bitcoin is the most anonymous option, as it does not link the payment details with the user identity or other personal information. 9. The ciphers we use along with the OpenVPN and IKEv2/IPSec protocols have never been cracked. Therefore, both of these protocols are highly secure. For OpenVPN connection, we use the AES 256 CBC algorithm. IKEv2/IPSec ciphers used to generate Phase1 keys are AES-256-GCM for encryption, coupled with SHA2-384 to ensure integrity, combined with PFS (Perfect Forward Secrecy) using 3072-bit Diffie Hellmann keys. 10. Yes, we do provide both an automatic kill switch and a feature for DNS leak protection. 11. We use a hybrid model, whereby we control some of our servers but also partner with premium data centers with strong security practices. Due to our special server configuration, no one is able to collect or retain any data, ensuring compliance with our no-logs policy. We also have specific requirements for network providers to ensure highest service quality for our customers. We do have our own DNS servers, and all DNS requests go through those. 12. All of our servers are dedicated and located in the same countries we state they are – we do not offer virtual locations. At the moment, NordVPN provides more than 3000 servers in 59 countries. Full location list can be found at nordvpn.com/servers. NordVPN website EXPRESSVPN 1. No, ExpressVPN doesn’t keep any connection or activity logs, including never logging browsing history, data contents, DNS requests, timestamps, source IPs, outgoing IPs, or destination IPs. This ensures that we cannot ascertain whether a given user was connected to the VPN at a certain time, assumed a particular outgoing IP address, or generated any specific network activity. It is not possible to match a user to data points that we never possess. 2. Express VPN International Ltd. is a BVI (British Virgin Islands) company. Being under BVI jurisdiction helps to protect user privacy, as the BVI has no data retention laws, is not party to any 14 Eyes intelligence sharing agreements, and has a dual criminality provision that safeguards against legal overreach. 3. To protect our customers’ privacy, we do not monitor or log any user activity on our network. We do however reserve the right to block specific abusive traffic to protect the server network and other ExpressVPN customers. With regards to limits on the number of devices simultaneously connected, no timestamps or IP addresses are ever logged; our systems are merely able to identify how many active sessions a given license has at a given moment in time and use that counter to decide whether a license is allowed to create one additional session. This counter is temporary and is not tracked over time. 4. We use Zendesk for support tickets and SnapEngage for live chat support; we have assessed the security profiles of both and consider them to be secure platforms. We use Google Analytics and cookies to collect marketing metrics for our website and several externals tools for collecting crash reports (a setting that can be switched off in any of our apps). ExpressVPN is committed to protecting the privacy of our users, and our practices are discussed in detail in our comprehensive Privacy Policy. 5. As we do not keep any data or logs that could link specific activity to a given user, ExpressVPN does not identify or report users as a result of DMCA notices. User privacy and anonymity are always preserved. 6. Legally our company is only bound to respect subpoenas and court orders when they originate from the British Virgin Islands government or in conjunction with BVI authorities via a mutual legal assistance treaty. As a general rule, we reply to law enforcement inquiries by informing the investigator that we do not possess any data that could link activity or IP addresses to a specific user. Regarding a demand that we log activity going forward: Were BVI law enforcement ever to make such a request, we would refuse to re-engineer our systems in a way that infringes on the privacy protections that our customers trust us to uphold. 7. We do not believe in restricting or censoring any type of traffic. ExpressVPN allows all traffic, including BitTorrent and other file-sharing traffic (without re-routing), from all of our VPN servers. 8. ExpressVPN accepts all major credit cards, PayPal, and a large number of local payment options. We also accept Bitcoin, which we recommend for those who seek maximum privacy with relation to their form of payment. As we do not log user activity, IP addresses, or timestamps, there is no way for ExpressVPN or any external party to link payment details entered on our website with any VPN activities. 9. ExpressVPN apps generally default to our recommended protocol for security and performance: OpenVPN UDP. Our apps use a 4096-bit CA, AES-256-CBC encryption, TLSv1.2, and SHA512 signatures to authenticate our servers. 10. Yes, ExpressVPN protects users from privacy and security leaks in a number of ways (for more info about leak protection, see our Privacy Research Lab). Our “Network Lock” feature, which is turned on by default, prevents all types of traffic including IPv4, IPv6, and DNS from leaking outside of the VPN, such as when your internet connection drops or in various additional scenarios where other VPNs might leak. 11. Our VPN servers are hosted in trusted data centers with strong security practices. The data center employees do not have server credentials, and the server disks are fully encrypted to mitigate risks from physical seizure. Our policy of not collecting activity or connection logs also means that servers do not contain any data that could map users to specific activity. We run our own logless DNS on every server, meaning no personally identifiable data is ever stored. We do not use third-party DNS. 12. ExpressVPN has over 2,000 servers covering 94 countries. For more than 97% of these servers, the physical server and the associated IP addresses are located in the same country — a physical footprint covering every continent save Antarctica, ensuring there are server locations near all users. For countries where it is difficult to find servers that meet ExpressVPN’s rigorous standards for server security, reliability, and speed, we use virtual locations to still make it possible for users to assume IP addresses from those countries. These locations represent less than 3% of ExpressVPN’s server count, and the specific countries are published on our website here. ExpressVPN website IPREDATOR 1. No logs are retained that would allow the correlation of the user’s IP address to a VPN address. The session database does not include the origin IP address of the user. Once a connection has been terminated the session information is deleted from the session database. 2. The name of the company is PrivActually Ltd which operates out of Cyprus. 3. Real abuse is mitigated by meatware [humans]. User traffic is not monitored or inspected in any way. TCP/IP sessions are not limited individually, but by server, to 10 million established connections. Packet floods are dealt with by using adaptive packet rate limiters at the switch port level and kick in at 90k pps. The number of concurrent connections is limited by the VPN backend software. 4. There is no visitor tracking mechanism, not even passive ones analyzing the web server logs. IPredator runs its own mail infrastructure and does not use third party products like GMail. Neither do we use data hogs like a ticket system to manage support requests. IPredator sticks to a simple mail system and deletes old data after three months from the mailboxes. 5. Requests are evaluated according to the legal frameworks set forth in the jurisdictions the service operates in and we react accordingly. After receiving a request its validity is verified. DMCA takedown abuse using fake credentials seems to be all the rage these days. 6. A canary is maintained to indicate the current legal state of affairs. In case of a court order that forces us to enable log activity we would rather shut down the service than comply. 7. BitTorrent and other file-sharing traffic is allowed. 8. PayPal, Bitcoins, Payza, and Payson are fully integrated. Other payment methods are available on request. An internal transaction ID is used to link payments to the payment processor. We do not store any other data about payments associated with the user’s account. The systems dealing with payments have no connection to the part of the infrastructure that handles VPN connections. Frontend proxies are used to make sure user IP addresses do not show up in any of the backend systems. 9. IPredator provides config files for various platforms and clients that enforce TLS1.2 on supported systems. Ideally, the client negotiates ECDHE-RSA-AES256-GCM as a suite for the control and AES256 for the data channel. For further protection, detailed setup instructions and howtos are provided to our users. 10. Netsplice, IPredator’s cross-platform VPN client, has native support for various types of kill switches. You can kill a program, just put it to sleep, shutdown your machine or wipe your hard disk … it is up to you. Users can use this page to check for a number of leaks, not just DNS leaks. 11. We own every server, switch, and cable we use to provide the VPN service up to our uplink network. The machines are located in Sweden due to the laws that allow us to run our service in a privacy-protecting manner. If the situation should change we are able to move operations to a different country. The core for any privacy service is trust in the integrity of the underlying infrastructure. Everything else has to build upon that, which includes the DNS servers. 12. Sweden. Ipredator website TORGUARD 1. No logs or timestamps are kept whatsoever. TorGuard does not store any traffic logs or user session data on our network. In addition to a strict no logging policy we run a default shared IP configuration across all servers. Because there are no logs kept and multiple users sharing a single IP address, it is not possible to match any user with an IP and time stamp. 2. TorGuard is owned and operated by VPNetworks LLC under US jurisdiction, with our parent company VPNetworks LTD, LLC based in Nevis. 3. We utilize a number of highly customized scripts to monitor network performance and limit simultaneous connections through a radius-based authentication server. 4. We use anonymized Google Analytics data to optimize our website and Sendgrid for transactional email. TorGuard’s 24/7 live chat services are provided through Livechatinc’s platform. Customer support desk requests are maintained by TorGuard’s own private ticketing system. 5. In the event a valid DMCA notice is received it is immediately processed by our abuse team. Due to our no log and no time stamp policy and shared IP network – we are unable to forward any requests to a single user. 6. If a court order is received, it is first handled by our legal team and examined for validity in our jurisdiction. Should it be deemed valid, our legal representation would be forced to further explain the nature of our shared IP network configuration and the fact that we do not hold any identifying logs or time stamps. TorGuard’s network was designed to operate with minimum server resources and is not physically capable of retaining such logs. There is no on/off switch to log activity so it would be impossible to comply with such a request. No, this has never happened. 7. Yes, BitTorrent and all P2P traffic is allowed. By default we do not block, re-route, or limit any types of traffic across our network. 8. We currently offer over 200 different payment options. This includes all forms of credit card, PayPal, Bitcoin, cryptocurrency (e.g. Litecoin, Ethereum, Monero + many more), Alipay, WeChat Pay, UnionPay, 100+ Gift Card brands, and many other worldwide local payment options. No user can be linked back to account usage or IP assignments because we maintain zero logs across our network. 9. For best security, we advise clients to use OpenVPN and select the cipher option AES-256-GCM, with 4096bit RSA and SHA512 HMAC. We use TLS 1.2 on all servers with perfect forward secrecy enabled. For faster speeds and “obfuscated” Stealth VPN access, we suggest using OpenConnect SSL VPN with cipher option AES-256-GCM. TorGuard offers a wide range of VPN protocols, including OpenVPN, iKEV2, IPsec, SSTP, OpenConnect/AnyConnect, Stunnel, and Shadowsocks. 10. TorGuard’s VPN software provides strict security features by automatically disabling IPv6 and blocking any potential DNS or WebRTC leaks. We offer a full connection kill-switch that safeguards your VPN traffic against accidental disconnects and can hard kill your interfaces if needed, and an application kill-switch that can terminate specific apps if the VPN connection is interrupted for additional safety. 11. We retain full physical control over all hardware and only seek partnerships with data centers who can meet our strict security criteria. All servers are deployed and managed exclusively by TorGuard staff. By default, the TorGuard VPN app uses private no log DNS on each VPN endpoint. The TG also app allows clients to modify their VPN session with a custom DNS entry of their choosing. 12. TorGuard currently maintains thousands of servers in over 55 countries around the world, and we continue to expand the network each month. All servers are physically located in the stated country of origin and we do not use any virtual locations. TorGuard website AZIREVPN 1. No, we do not record or store any logs related to our services. No traffic, user activity, timestamps, IP addresses, number of active and total sessions, DNS requests, or any other kind of logs are stored. System logs are disabled. Anonymity of our users is very important to us as described in our Terms of Service. 2. The registered company name is Netbouncer AB and we operate under Swedish jurisdiction where there are no data retention laws that apply to VPN providers. 3. Our servers are running using Blind Operator mode which means we took extra security steps to ensure that we cannot monitor any traffic at all. Abuses like incoming DDoS attacks are usually mitigated with UDP filtering on the source port used by an attacker. 4. No, we do not rely on and refuse to use external third-party systems. We run our own email infrastructure and encourage people to use PGP encryption. Ticketing support system, website analytics (Piwik, with anonymization settings) and other tools are hosted in-house on open-source software. We have plans to replace some of these tools by solutions developed by ourselves. 5. We politely inform the sender party that we do not keep any logs and are unable to identify a user. 6. In the case that a valid court order is issued, we will inform the other party that we are unable to identify an active user or past user of our service while running as a Blind Operator, which is preventing live analysis of traffic. In that case, they would probably force us to handover physical access to the server, which is fine since they would have to reboot to gain any kind of access, and since we are running diskless in RAM – all data will be lost. So far, we have never received any court order and no personal information has ever been given away. 7. Yes, BitTorrent, peer-to-peer and file-sharing traffic is allowed and treated equally to any other traffic on all of our locations. We strongly believe in net neutrality. 8. As of now, we propose a variety of payments options including anonymous methods such as Bitcoin, Bitcoin Cash, Litecoin, Monero, Ethereum and some other cryptocurrencies (through CoinPayments) and cash money via postal mail. We also offer PayPal, credit cards (VISA, MasterCard and American Express through Paymentwall) and Swish. We do not store sensitive payment information on our servers, we only retain an internal reference code for order confirmation. 9. We recommend our users to use our new WireGuard servers available on Linux, some routers (LEDE/OpenWRT), and soon on Android. – Data channel cipher: CHACHA20 with POLY1305 for authentication and data integrity – Authenticated key exchange: Noise Protocol Framework’s Noise_IKpsk2, using Curve25519, Blake2s, and CHACHA20-POLY1305, a formally verified construction. Otherwise, we recommend OpenVPN with default configuration available in UDP and TCP modes. These settings offer the highest grade of security achieved through OpenVPN on all of our servers: – Data channel cipher: AES-256-GCM (OpenVPN 2.4) or AES-256-CBC with HMAC-512 for authentication and data integrity (OpenVPN 2.3) – Control channel cipher: TLS v1.2 using TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 (AEAD) – Authenticated key exchange: Diffie-Hellman method and Perfect Forward Secrecy (DHE) using a RSA key with a 4096 bit key size, re-keying every 120 minutes (can be lowered) – Additional auth key: RSA with a 2048 bit key size – Additional crypt key: RSA with a 2048 bit key size 10. We offer a new custom open-source VPN application called azclient, for all desktop platforms (Windows, macOS and Linux), with source code released on Github under the GPLv2 license, currently supporting OpenVPN. Our client is developed by a security expert and designed with ease of installation and use in mind, allowing users to connect to the VPN servers with only a few clicks. We plan to add a kill switch and DNS leak protection features to the client in the future. 11. We physically own all of our hardware, in all of our locations, including bare metal dedicated servers and switches, co-located in closed racks on different data centers around the world meeting our strict security criteria, using network dedicated links and carefully chosen providers for maximum network quality and throughput. We host our own non-logging DNS servers in different locations and provide DNSCrypt support for DNS requests encryption. 12. As of now, we operate across five locations including Canada, Spain, Sweden, United Kingdom and the United States. Moldova is planned later this year, as indicated on our roadmap. There are no virtual locations. AzireVPN website HIDEIPVPN 1. Currently, we store no logs related to any IP address. There is no way for any third-party to match a user IP to any specific activity on the internet. 2. Registered name of the company is Server Management LLC and we operate under US jurisdiction. 3. A single subscription can be used simultaneously for three connections. Abuses of service usually means using non-P2P servers for torrents or DMCA notices. Also, our no-log policy makes it impossible to track who downloaded/uploaded any data from the internet using our VPN. We use iptables plugin to block P2P traffic on servers where P2P is not explicitly allowed. We block outgoing mail on port 25 to prevent spamming activity. 4. We use live chat provided by tawk.to and Google Apps for incoming email. For outgoing email we use our own SMTP server. 5. Since no information is stored on any of our servers there is nothing that we can take down. We reply to the datacenter or copyright holder that we do not log our users’ traffic and we use shared IP-addresses, which makes it impossible to track who downloaded any data from the internet using our VPN. 6. HideIPVPN may disclose information, including but not limited to, information concerning a client, in order to comply with a court order, subpoena, summons, discovery request, warrant, statute, regulation, or governmental request. But due to the fact that we have a no-logs policy and we use Shared IPs, there won’t be anything to disclose excepting billing details. This has never happened before. 7. This type of traffic is welcomed on our German (DE VPN), Dutch (NL VPN), Luxembourg (LU VPN) and Lithuanian (LT VPN) servers. It is not allowed on US, UK, Canada, Poland, Singapore and French servers as stated in our TOS – the reason for this is our agreements with data centers. We also have specific VPN plan for torrents. 8. Currently, HideIPVPN accepts following methods: PayPal, Bitcoin, Credit & Debit cards, JCB, American Express, Diners Club International, Discover. All our clients billing details are stored in WHMCS billing system. 9. SoftEther VPN protocol looks very promising and secure. Users can currently use our VPN applications on Windows and OSX systems. 10. Yes, our free VPN apps have both features built in. 11. We don’t have physical control on our VPN servers. Servers are outsourced in premium data-center with high-quality tier1 networks. 12. At the moment we have VPN servers located in 10 countries – US, UK, Netherlands, Germany, Luxembourg, Lithuania, Canada, Poland, France and Singapore. As you can see number of available locations is steadily growing. HideIPVPN website HIDE.ME 1. No, we don’t keep any logs. We have developed our system with an eye on our customers’ privacy, so we created a distributed VPN cluster with independent public nodes that do not store any customer data or logs at all. 2. Hide.me VPN is operated by eVenture Limited and based in Malaysia with no legal obligation to store any user logs at all. 3. We do not limit or monitor individual connections. To mitigate abuse we deploy general firewall rules on some servers that apply to specific IP ranges. By design, one username can only establish one simultaneous connection. 4. Our landing pages, which are solely used for advertising purposes, include a limited amount of third-party tracking scripts, namely Google Analytics. However, no personal information that could be linked with the VPN usage is shared with these providers. We do not send information that could compromise someone’s security over email. 5. Since we don’t store any logs and/or host copyright infringing material on our services, we’ll reply to these notices accordingly. 6. Although it has never happened, in such a scenario, we won’t be able to entertain the court orders because our infrastructure is built in a way that it does not store any logs and there is no way we could link any particular cyber activity to any particular user. In case we are forced to store user logs, we would prefer to close down rather than putting our users at stake who have put their trust in us. 7. There is no effective way of blocking file-sharing traffic without monitoring our customers which is against our principles and would be even illegal. Usually, we only recommend our customers to avoid the US & UK locations for file-sharing but it is on a self-regulatory basis since these countries have strong anti-copyright laws in place. 8. We support a wide range of popular payment methods, including all major cryptocurrencies like Bitcoin, Litecoin, Ethereum, Dash, Monero, PayPal, Credit Cards and Bank transfer. All payments are handled by external payment providers and are linked to a temporary payment ID. This temporary payment ID can’t be connected to the user’s VPN account/activity. After the payment is completed, the temporary payment ID will be permanently removed from the database. 9. After all, modern VPN protocols that we all support – like IKEv2, OpenVPN and SSTP – are considered secure even after the NSA leaks. We follow cryptographic standards and configured our VPN servers accordingly in order to support a secure key exchange with 8192-bit key size and a strong symmetric encryption (AES-256) for the data transfer. 10. Our users’ privacy is of utmost concern to us. Our Windows client has the features such as Kill Switch, Auto Connect, Auto Reconnect etc which makes sure that the user is always encrypted and anonymous. 11. We operate our own non-logging DNS-servers to protect our customers from DNS hijacking and similar attacks. We operate 30+ server locations in 27 different countries. However we do not own physical hardware. There is intrusion detection and other various security measures in place to ensure the integrity and security of all our single servers. Furthermore, we choose all third-party hosting providers very carefully, so we can assure that there are certain security standards in place (ISO 27001) and no unauthorized person can access our servers. Among our reputable partners are Leaseweb, NFOrce, Equinix and Softlayer. 12. Our servers are located in countries all over the world, among the most popular ones are Canada, Netherlands, Singapore, Germany, Brazil, Mexico and Australia. Below is the complete list of countries, alternatively you can view all available locations here. Hide.me website IVPN 1. No, not doing so is fundamental to any privacy service regardless of the security or policies implemented to protect the log data. In addition, it is not within our interest to do so as it would increase our liability and is not required by the laws of any jurisdiction that IVPN operates in. 2. Privatus Limited, Gibraltar. 3. We use a few custom scripts (based on PSAD) to proactively detect and alert malicious activity. From a management perspective, we monitor our network using Zabbix. In the almost 10 years we’ve been operating its safe to say we’ve seen almost everything. 4. No. We made a strategic decision from day one that no company or customer data would ever be stored on 3rd party systems. All our internal services run on our own dedicated servers that we setup, configure and manage. No 3rd parties have access to our servers or data. 5. Our legal department sends a reply stating that we do not store content on our servers and that our VPN servers act only as a conduit for data. In addition, we inform them that we never store the IP addresses of customers connected to our network nor are we legally required to do so. 6. Firstly, this has never happened. However, if asked to identify a customer based on a timestamp and/or IP address then we would reply factually that we do not store this information. If legally compelled to log activity going forward we would do everything in our power to alert the relevant customers directly (or indirectly through our warrant canary). 7. Yes, all file-sharing traffic is permitted and treated equally on all servers. We do encourage customers to use non-USA based exit servers for P2P as any company receiving a large number of DMCA notices is exposing themselves to legal action and our upstream providers have threatened to disconnect our servers in the past. 8. We accept Bitcoin, Cash, PayPal and credit cards. When using cash there is no link to a user account within our system. When using Bitcoin, we store the Bitcoin transaction ID in our system. If you wish to remain anonymous to IVPN you should take the necessary precautions when purchasing Bitcoin. When paying with PayPal or a credit card a token is stored that is used to process recurring payments but this is not linked in anyway to account usage or IP-assignments. 9. We provide RSA-4096 / AES-256-GCM with OpenVPN, which we believe is more than secure enough for our customers’ needs. 10. Yes, the IVPN client offers an advanced VPN firewall that blocks every type of IP leak possible including IPv6, DNS, network failures, WebRTC STUN etc. 11. We use bare metal dedicated servers leased from 3rd party data centers in each country where we have a presence. We install each server using our own custom images and employ full disk encryption to ensure that if a server is ever seized the data is worthless. We also operate an exclusive multi-hop network allowing customers to choose an entry and exit server in different jurisdictions which would make the task of legally gaining access to servers at the same time significantly more difficult. We operate our own network of log free DNS servers that are only accessible to our customers. 12. Please see https://www.ivpn.net/server-locations. We do not offer virtual locations. IVPN website WINDSCRIBE 1. We don’t keep any logs that can match a user to an IP and timestamp. 2. Windscribe Limited, Ontario (Canada) Corporation. 3. We store the total amount of bytes transferred in a 30 day period. This counter gets reset monthly and there is no historical usage. We block SMTP port 25 to prevent email spamming. 4. Everything is self-hosted including but not limited to email, support desk, and live chat. 5. We notify the sender that the IP address is a VPN node and is shared by hundreds of people at any given moment, so there is no way to trace the activity to any single user. 6. We received multiple subpoenas and court orders requesting subscriber information. Our response was identical to what we send in case of a DMCA related request in every case. We were never ordered to log users (although there were requests), but since we’re in Canada which has no mandatory data retention directives that apply to VPNs, we wouldn’t need to comply. 7. BitTorrent is allowed in all locations as we don’t interfere with the traffic. We request that users don’t do it in Japan and India due to more stringent providers in those regions, but it’s more of a guideline than a rule. 8. Credit cards (Stripe), PayPal, all major cryptocurrencies and various gift cards. As we store no logs of this type, there is nothing to link the payments to. 9. We support OpenVPN and IKEv2. Both are equally secure as we use the strongest encryption possible (GCM-AES-256) with both. We recommend trying IKEv2 first, as it’s faster almost in all cases. If it’s blocked on your network, then you can use OpenVPN which operates on common ports and is a lot harder to block, especially when using Stealth (Stunnel) mode. Our application tries all the protocols automatically and uses the best one for your specific network. 10. Windscribe Firewall is built into our Windows and Mac applications. It blocks all connectivity outside of the tunnel to ensure there is zero chance of any kind of leak, including but not limited to DNS leaks, IPv6 leaks, WebRTC leaks, etc. A firewall blocks ALL connectivity outside of the tunnel. If the VPN connection drops, there is nothing that needs to be done, and not a single packet can leave the machine, since the firewall will not allow it. In geek terms, it fails closed. 11. All our servers are bare metal machines which are leased from various reputable hosting providers worldwide. As we have servers in over 100 different data-centers, listing them here would create a fairly lengthy list. Each VPN node we operate has a recursive DNS server running on it, which is only accessible over the tunnel as it listens exclusively on a LAN IP address. 12. We have servers in 50 countries and over 100 cities. The full list is shown here. All our servers are physically where they are claimed to be, as we don’t have any fake/virtual locations. Windscribe website VPNBARON 1. We do not keep traffic logs that match an IP address with a user. We do monitor the number of active connections for the user in order to prevent unlimited connections from one subscription. 2. Our registered legal name is Hexville SRL. We’re under Romanian jurisdiction, inside of the European Union. 3. Our tools are developed in-house. To limit the concurrent connections we keep track of the active connections of users. Every user has a limited number of concurrent connections, depending on his subscription. When he connects, we subtract one. When he disconnects, we add one back. Reach zero and the service will not allow the user to connect until he disconnects one of his active instances. To limit the brute force types of abuses, we monitor the health of the servers and limit the network priority of the obvious DDOS that might be masked through our service. SMTP abuses will also result in temporary port blocking for that service. 4. Emails and the support platform are hosted in-house. For our sales site analytics, we rely on Google Analytics. Live support is hosted by tawk.to which has a great privacy policy. 5. We designed our system in such a way that DMCA notices cannot be forwarded to our users. A diverse approach is needed to deal with this particular industry issue: from explaining that we don’t host any content to replacing IPs and servers that received multiple strikes. 6. No subpoena has been received by our company. If that happens, we’ll be sure to assist as much as we’re legally obliged. Keep in mind that we don’t have much information to provide. 7. Net neutrality is king. We allow any kind of traffic. P2P included. 8. We use Bitcoins (and many other kinds of virtual currencies: ETH, XRP, DGB, LTC ), PayPal, PerfectMoney and Credit Cards. The sales & billing platform is stored separately of the actual VPN system. 9. We use only OpenVPN protocol, one of the most secure and hard to crack protocols, with AES-256-CBC cipher, TLSv1/SSLv3 DHE-RSA-AES512-SHA, 2048 bit RSA. On top of the OpenVPN, you can also choose one of the two anti DPI (Deep Package Inspection) protocols: “TOR’s OBFSPROXY Scamblesuit” and “SSL” that mask your VPN connection from your ISP. These protocols come handy in places that actively block VPN connections, like China, Egypt or university campuses. 10. Yes, we have an incorporated kill switch in our client and DNS leak protection. 11. We do use our own DNS and Google DNS for some servers. Because of the nature of the industry, we consider that replacing servers and blacklisted IPs as fast as possible, having the ability to migrate from one ISP to another, and not existing in a constant physical location is a great plus. That’s why decided to rent the VPN servers. 12. At the time of writing this, we do not offer virtual locations. We offer more than 30 servers in 18 countries and we’re expanding fast. You can find the full list here. VPNBaron website SECUREVPN.TO 1. We don’t log any individually identifying information. The privacy of our customers is our top priority. 2. Our service is operated by a group of autonomous privacy activists outside of “Fourteen Eyes” or “Enemy of the Internet” countries. Each server is handled within the jurisdiction of the server’s location. 3. There are no tools which monitor our customers but we use techniques which don’t require any logging to prevent the abuse of our service. 4. Our website has been entirely developed by ourselves and thus we don’t rely on external service providers. 5. We reply to takedown notices but can’t be forced to hand out information because of our non-logging policy. 6. This hasn’t happened yet, but if we were forced to identify any of our customers at a specific server location, we would immediately terminate this location. We are not going to log, monitor or share any information about our customers under any circumstances. 7. BitTorrent and other file-sharing traffic is allowed and treated equally to other traffic on all servers. 8. We offer a wide range of anonymous payment methods like Bitcoin, Dash, Ethereum, Paysafecard and Perfect Money. No external payment processor receives any information because all payments are processed by our own payment interface. 9. We would recommend OpenVPN, available in UDP and TCP mode. We are using AES-256-GCM/CBC for traffic encryption, 4096 bit RSA keys for the key exchange and SHA-512 as HMAC. These settings offer you the highest grade of security available. 10. Our VPN Client provides advanced security features like a Kill Switch, DNS Leak Protection, IPv4/IPv6 Leak Protection, WebRTC Leak Protection and many more. 11. We rent 27 servers in 20 countries and are continuously expanding our server park. During the last year we focused on replacing our 100 Mbit/s servers with high-end dedicated gigabit servers and thus the number of servers slightly decreased. It is impossible to have physical control over all widespread servers but we took security measures to prevent unintended server access. At the moment we are using the nameservers of Quad9 which offer good privacy. 12. Every server is physically located in its specified country and thus we don’t offer virtual locations. You can find our server list at the following link. SecureVPN.to website VPNAREA 1. We do not keep or record any logs. We are therefore not able to match an IP-address and a time stamp to a user of our service. 2. The registered name of our company is “Offshore Security EOOD” (spelled “ОФШОР СЕКЮРИТИ ЕООД” in Bulgarian). We’re a VAT registered business. We operate under the jurisdiction of Bulgaria. 3. To prevent mail spam abuse we block mail ports used for such activity, but we preemptively whitelist known and legit email servers so that genuine mail users can still receive and send their emails. To limit concurrent connections to 6, we use our in-house developed system that adds and subtracts +1 or -1 towards the user’s “global-live-connections-count” in a database of ours which the authentication API corresponds with anonymously each time the user disconnects or connects to a server. The process does not record any data about which servers the subtracting/detracting is coming from or any other data at any time, logging is completely disabled at the API. 4. We host our own email servers in Switzerland. We host our own Ticket Support system on our servers in Switzerland. The only external tools we use are Google Analytics for our website and Zopim Live Chat. 5. DMCA notices are not forwarded to our members as we’re unable to identify a responsible user due to not having any logs or data that can help us associate an individual with an account. We would reply to the DMCA notices explaining that we do not host or hold any copyrighted content ourselves and we’re not able to identify or penalize a user of our service. 6. This has not happened yet. Should it happen our attorney will examine the validity of the court order in accordance with our jurisdiction, we will then delegate our no logs policy to the appropriate party pointing out that we’re not able to match a user to an IP or timestamp due to not keeping or recording any logs. In our six year history we’ve upheld our reputation and we believe one of the reasons such court orders don’t reach us is our clearly stated no-logs policy. 7. BitTorrent/P2P is allowed on most of our servers but not all of them. Why not? Some servers that we use are not tolerant to DMCA notices, but some of our members utilize them for other activities not related to torrenting. That is why we keep them in our network despite the inability to use P2P/torrents on them. Most of our VPN servers and locations do allow torrents and P2P. We even allow torrenting on server locations that most VPN providers don’t, such as USA and Canada. 8. We accept PayPal, Credit/Debit cards and Webmoney via third party payment processor, plus Bitcoin and Payza. We do not require personal details to register an account with us. In the case of PayPal/Payza/card payments we link usernames to their transactions so we can process a refund. We do take active steps to make sure payment details can’t be linked to account usage or IP assignments. We do not use a recurring payments system. 9. We use AES-256-CBC + SHA256 cipher and RSA4096 keys on all our VPN servers with without exception. We also have Double VPN servers, where for example the traffic goes through Russia and Israel before reaching the final destination. 10. Yes, we provide both KillSwitch and DNS Leak protection for our Windows and Mac apps. Our new Android app already has DNS Leak protection and AdBlocking and within a couple of days will also have KillSwitch in the upcoming new version. 11. We work with reliable and established data centers. Nobody but us has virtual access to our servers. The entire logs directories are wiped out and disabled, rendering possible physical brute force access to the servers useless in terms of identifying users. 12. All our servers are physically located in the stated countries. A list of our servers in 70 countries can be found here. VPNArea website AIRVPN 1. No, we don’t. 2. The name of the company is Air and it is located in Italy. 3. We do not use any monitoring or traffic inspection tools. We do associate a connections counter for each account to enforce the limit of five simultaneous connections per account. We also promptly investigate any service (website etc.) running behind our service to prevent phishing and other scams (malware spreading, bot controllers, etc) if we receive a complaint about them. However, checking those services after a complaint or a warning from a third-party does not require any traffic monitoring. 4. Absolutely not. 5. They are ignored. 6. The matter is handled by our law firm which explains to the competent authorities how our system works and why it is not possible to track a user “ex-post” when such identification requires access to traffic logs, which simply do not exist. We have so far not received any order trying to force us to “log activity going forward” and we would not be able to comply for strictly technical reasons. 7. Yes, BitTorrent (just like any other protocol) is allowed on all servers without any re-routing. 8. Nowadays we use Coinpayments, BitPay, PayPal and Avangate. We accept a wide variety of cryptocurrencies and several credit cards. We also planned to accept payments in Bitcoin (and some other cryptocurrency) directly in late 2018, with no need for any third party payment processor, which anyway does not require any personal data to complete a transaction. We do not keep any information about account usage and/or IP address assignments, so there can’t be any correlation with any payment. As usual a customer needs to consider that any payment via a credit card or PayPal will be recorded for an indefinite amount of time by the respective financial companies. We also accept cryptocurrencies inherently designed to provide a strong layer of anonymity. 9. We recommend only and exclusively OpenVPN. A proper configuration must include TLS mode, Perfect Forward Secrecy, 4096 bit Diffie-Hellmnn keys, and at least 2048 bit (preferably 4096 bit) RSA keys. About the channels ciphers, AES-256 both on the Control Channel and the Data Channel is an excellent choice, while digests like HMAC SHA (when you don’t use an AED cipher such as AES-GCM) for authentication of packets are essential to guarantee integrity (preventing for example injection of forged packets in the stream), both on the Control and the Data channels. Our service provides all of the above. About Elliptic Curve Cryptography, since it is finally of public domain that at least one random number generator (Dual_EC_DRBG) had a backdoor, and that an NSA program did exist with the aim to implement backdoors in some curves and then have exactly those curves recommended by NIST, momentarily we would suggest to drop ECC completely, just to stay on the safe side and according to Bruce Schneier’s considerations. 10. Yes, of course. They are integrated in our free and open source software “Eddie” released under GPLv3. Anyway, usage of our software is not mandatory to access our service, so we also provide guides to prevent any kind of traffic leaks outside the VPN “tunnel” on a variety of systems. 11. The VPN server management is never outsourced. Even the IPMI, which has proven to be the source of extremely dangerous vulnerabilities, is patched and access-restricted by the AirVPN core management persons only. The Air company does not own datacenters. Owning a datacenter would put Air in a vulnerable position in the scenario described in your question number 6 (second part: court order to start logging traffic). 12. We do not offer “virtual” locations. No IP address geo-location trick, hidden re-routing or any other trick is ever performed. We do not use Virtual Servers at all. Currently, we have physical (bare metal) servers really located in the following countries: Austria, Belgium, Bulgaria, Canada, Czech Republic, Germany, Hong Kong, Japan, Latvia, Lithuania, Netherlands, Norway, Romania, Singapore, Spain, Sweden, Switzerland, Ukraine, United Kingdom, United States. AirVPN website TRUST.ZONE 1. Trust.Zone doesn’t store any logs. All we need from users is just an email to sign up. No first name, no last name, no personal info, no tracking, no logs. 2. Trust.Zone is under Seychelles jurisdiction and we operate according to the law in Seychelles. There is no mandatory data retention law in Seychelles. In our jurisdiction, a foreign court order would not be enforceable and since we don’t store any logs, there is nothing to be taken from our servers. The company is operated by Extra Solutions Ltd. 3. We have no usage restriction on our service. As we don’t have any logs, we can’t track any user online activity. Trust.Zone doesn’t use any third party tools on the website. The single restriction we have is three simultaneous connections per user. 4. Trust.Zone does not use any third-party support tools, tracking systems like Google Analytics or live chats. If a user loads our website in a browser, all information like Javascript, HTML and CSS belongs to trust.zone domain only. 5. If we receive any type of DMCA requests or Copyright Infringement Notices – we ignore them. Why? Trust.Zone is under Seychelles offshore jurisdiction. There is no mandatory data retention law in Seychelles. Since we don’t store any logs, there is nothing to be had from our servers. 6. A court order would not be enforceable because we do not log information and therefore there is nothing to be had from our servers. Trust.Zone is a VPN provider with a Warrant Canary. Trust.Zone has not received or has been subject to any searches, seizures of data or requirements to log any actions of our customers. 7. We don’t restrict any kind of traffic. Trust.Zone does not throttle or block any protocols, IP addresses, servers or any type of traffic whatsoever. 8. All major credit cards are accepted. Besides, Bitcoin, PayPal, Webmoney, Alipay, wire transfer and many other types of payments are available. To stay completely anonymous, we highly recommend using anonymous payments via Bitcoin. 9. Trust.Zone uses the highest level of data encryption. We use a protocol which is faster than OpenVPN and also includes Perfect Forward Secrecy (PFS). The unique feature of Trust.Zone VPN is that you can forward your VPN traffic via ports – 21(FTP) 22 ( SCP, SFTP ), 80 (HTTP), 443 (HTTPS) or 1194 (OpenVPN), most of which can’t be blocked by your ISP. Trust.Zone uses AES-256 Encryption by default. We also offer L2TP over IPsec which also uses 256bit AES Encryption. 10. Trust.Zone supports a kill-switch function. We also own our DNS servers and provide users with using our DNS to avoid any DNS leaks. Trust.Zone has no support for IPv6 connections to avoid any leaks. We also provide users with additional recommendations to be sure that there are no any DNS leaks or IP leaks. 11. We have a mixed infrastructure. Trust.Zone owns some physical servers and we have access to them physically. In locations with lower utilization, we normally host with third parties. But the most important point is that we use dedicated servers in this case only, with full control by our network administrators. DNS queries go through our own DNS servers. 12. We are operating with 150+ servers in 30+ countries and still growing. The most popular Trust.Zone locations are France, Australia, US, Canada and UK. The full map of the server locations is available here. Trust.Zone website CACTUSVPN 1. We don’t keep any logs. 2. CactusVPN Inc., Canada 3. We restrict our services with up to five devices per package for VPN connection and to unlimited devices for SmartDNS service as long as all of them have the same IP address. Abuse of services is regulated by our Linux firewall and most of the datacenters we hire servers from provide additional security measures for servers attacks. 4. No. 5. We did not receive any official notices yet. We will only respond to a local court order. 6. If we have a valid order from Canadian authorities we have to help them identify the user. Bus as we do not keep any logs we just can’t do that. We did not receive any orders yet. 7. BitTorrent and other file-sharing traffic is allowed on Netherlands, Germany, Switzerland and Romanian servers. 8. PayPal, Visa, MasterCard, Discover, American Express, Bitcoin & Altcoins, Alipay, Qiwi, Webmoney, Boleto Bancario, Yandex Money and other not so popular payment options. 9. We recommend users to use SoftEther with ECDHE-RSA-AES128-GCM-SHA256 cipher suite. 10. Yes, our apps include Kill Switch and Apps. Killer options in case a VPN connection is dropped. Also they include DNS Leak protection. 11. We use servers from various data centers. 12. USA, UK, France, Germany, Canada, Netherlands, South Korea, Australia, Poland, Japan, Switzerland, Singapore, Romania. CactusVPN website SHADEYOU VPN 1. ShadeYou VPN does not keep any logs. To use our service only a username and e-mail are required. No personal or real data is required. 2. We are incorporated as DATA ACCENTS LP and operate under the United Kingdom jurisdiction. 3. Limits of concurrent connections are regulated in real time on the server side by our own developed tools without any logs kept. 4. We are using Google Analytics as a tool which allows us to improve our website and bring our users better experience. Also, we are using SiteHeart online support. But none of these tools track / hold personal information. 5. The abuse team of ShadeYou VPN answers as follows: A) We do not store any illegal content on our servers. B) Every user agrees with our privacy policy while registering, so we warned that illegal actions are prohibited and at this time we are not responsible. C) We have no any personal data of our users or any logs of their activities that can be shared with third-parties because we simply do not store it. 6. There are no any special steps since we have no logs to share and analyze. It means we can’t help with identifying the active or past user of our service. Logging activity is not acceptable for our service. We had different cases but we can guarantee that none of our users were compromised. 7. BitTorrent and any other file-sharing traffic is allowed mostly on all our servers. There are only a few exceptions (such as when traffic is limited on the servers). 8. ShadeYou VPN uses payment systems including PayPal, Perfect Money, Webmoney, Qiwi, Yandex Money, Easy Pay, Ligpay, UnionPay, AliPay, MINT, CashU, Ukash also accept payments via Visa, Master Card, Maestro and Discover. Of course, Bitcoin is available. Important note: we do not store billing information which is required to improve users safety. 9. We strongly recommend using OpenVPN since it is the safest and uses the strongest encryption (TLS Protocol with 4096-bit key length and AES-256-CBC crypto-algorithm). 10. We support “Kill switches” and DNS leak protection using our desktop client. 11. All our servers are collocated around the world in data centers of different leading hosting companies. Yes, we are using our own DNS servers. 12. Here is an overview and all servers are physically located. ShadeYou VPN website PRIVATEVPN 1. We don’t retain or log any identifiers namely IP addresses, timestamps of any sort of connections on our VPN or authentication servers, data used, the speed of connection at all. Period. 2. PrivateVPN is run by a Swedish company viz. ‘Privat Kommunikation Sverige AB’ under Swedish jurisdiction. 3. Owing to our above-mentioned privacy promise, active monitoring of our service is out of the question. 4. We use a service known as LiveAgent to provide email or ticket and live chat support. They do not hold any information about chat sessions. Chat conversation transcripts are not stored on chat servers. They remain on the chat server for the duration of the chat session, then optionally sent by email to a user, and then destroyed. 5. DMCA is not applicable to our service as it is not a codified law or act under Swedish jurisdiction. So, it is none of our business. A Swedish equivalent isn’t in the scene as of now in our jurisdiction at all. 6. As already mentioned above, we don’t retain or log any identifiers at all. So, basically even when ordered to actively investigate a user we are limited to the number of active logins which is just a numerical value. That being said, we have not received a court order to date. 7. Of course, we are not in the business of restricting and throttling things. The whole point of a user connecting to our VPN servers is to get uncensored and unrestricted Internet. 8. We support PayPal, Stripe, and Bitcoin. Alipay as a payment method is en route. We offer a 30-day money-back guarantee and in order to enforce it, we keep a track of payments linked to a user account. There is no way to link an IP address assigned from us to a user account as we do not log such data. 9. No single VPN protocol works for everyone. We support multiple VPN protocols viz. PPTP,L2TP,IPsec,IKEv2,OpenVPN,Shadowsocks(beta) and soon SSH(in labs). Our default VPN protocol on all the platforms other than iOS is OpenVPN over UDP with 256-bit AEAD ciphers when you use our VPN application. We recommend a user with an ideal ISP to use OpenVPN over UDP/1194. In case your ISP happens to throttle default OpenVPN port 1194, you can use OpenVPN over TCP/443, which is deployed with the latest –tls-crypt that OpenVPN offers for additional privacy and very basic obfuscation of the protocol itself. For users who love built-in VPN clients for an OS, like Windows, Mac, Blackberry, iOS etc, we recommend IKEv2. For users from UAE, Egypt, some parts of China etc, we are working on secure Shadowsocks over TCP/80 with AEAD cipher and/or SSH-based solutions to tunnel their OpenVPN traffic. Shadowsocks is already being tested and working with many happy users new and old users from Egypt & UAE. For Tor lovers, we offer a guide, help, instructions on how to connect to our OpenVPN servers over Tor for additional security and privacy. 10. Our Windows VPN App offers robust Kill switch and DNS leak protection. DNS leaks on any major platform are owing to broken installations which are fixed as soon we see a report or any issues. IPv6 leak protection is available on every platform and multiple VPN protocols. We offer guides and instructions to set up a kill switch on macOS, GNU/Linux, BSD etc and are rapidly working with our developers to add these features in our easy to use and install VPN applications. 11. We have physical control over our servers and network in Sweden. We’re only using trusted data centers with strong security. Our providers have no access to PrivateVPN’s servers and most importantly, there is no customer data/activities stored on the VPN servers or on any other system we have. We have deployed our own multiple DNS nameservers which work from within tunnel and are automatically pushed to VPN clients upon successful connection. You are at liberty to use whatever DNS nameservers you like though. For example, if you or someone you trust hosts a server with additional security features like DNSCRYPT and DNSSEC, it is fair if you wish to use it. 12. We use a mix of physical and virtual servers depending on the demand and needs of a given location. PrivateVPN website OCTANEVPN 1. No. 2. Octane Networks, LLC. US registered company. 3. We block port 25 outbound to reduce the possibility of spam. Our auth system limits concurrent connections via our custom backend. 4. We use Google Analytics for general website trends. We use Hotjar occasionally for A/B and user experience testing. Support is internal. 5. If the customer session is still connected to our service we take action. Repeat infringers must be disabled since we are a US based company and must comply with DMCA. 6. This has not happened. We would take every action we legally could to maintain the privacy of our customers. Since logs are not used, there is little information we could provide if ordered to do so by a court of competent jurisdiction. 7. Yes. We operate with net neutrality with the exception of restricting outgoing SMTP to prevent spammers from abusing the service. 8. Bitcoin, Credit/Debit Card and PayPal. IP addresses are not linked to payment details. 9. OpenVPN tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 cipher AES-256-CBC auth SHA512 10. Our client disables IPv6 completely as part of our DNS and IP leak protection in our Windows and Mac OS X OctaneVPN clients. Our OpenVPN based client’s IP leak protection works by removing all routes except the VPN route from the device when the client has an active VPN connection. This a better option than a ‘kill switch’ because our client ensures the VPN is active before it allows any data to leave the device, whereas a ‘kill switch’ typically monitors the connection periodically, and, if it detects a drop in the VPN connection, reacts. With a ‘kill switch’, data sent during the time between checks is potentially vulnerable to a dropped connection. Our system is proactive vs a reactive kill switch. Customers should vigilant as other software such as JavaScript, Flash, Java and WebRTC can leak IP independently of their VPN connection. Customers might want to consider creating a profile in their web browser specifically tailored toward web browsing privacy by disabling 3rd party plugins/extensions. 11. In our more active gateway locations, we colocate. In locations with lower utilization, we normally host. We do not do the virtual location BS you hear about sometimes. Each of our gateways acts as a DNS server for the end-user. 12. We have gateways in 45 countries and 92 cities. OctaneVPN website SLICKVPN 1. SlickVPN doesn’t log traffic or session data of any kind. We don’t store connection time stamps, used bandwidth, traffic logs, or IP addresses. 2. Slick Networks, Inc. is our recognized corporate name. We operate a complex business structure with multiple layers of offshore holding companies, subsidiary holding companies, and finally some operating companies to help protect our interests. The main marketing entity for our business is based in the United States of America but the top level of our operating entity is based out of Nevis. 3. We block port 25 to reduce the likelihood of spam originating from our systems. The SlickVPN authentication backend is completely custom and limits concurrent connections. 4. We utilize third party email systems to contact clients who opt in for our newsletters and Google Analytics for basic website traffic monitoring and troubleshooting. We believe these platforms to be secure. Because we do not log your traffic/browsing data, no information about how users may or may not use the SlickVPN service is ever visible to these platforms. 5. If a valid DMCA complaint is received while the offending connection is still active, we stop the session and notify the active user of that session. Otherwise, we are unable to act on any complaint as we have no way of tracking down the user. It is important to note that we rarely receive a valid DMCA complaint while a user is still in an active session. 6. This has never happened in the history of our company. Our customer’s privacy is of topmost importance to us. We are required to comply with all valid court orders. We would proceed with the court order with complete transparency, but we have no data to provide any court in any jurisdiction. SlickVPN uses a warrant canary to inform users if we have received any such requests from a government agency. Users can monitor our warrant canary here: SlickVPN Warrant Canary 7. Yes. All traffic is allowed. SlickVPN does not impose restrictions based on the type of traffic our users send. 8. We accept PayPal, Credit Cards, Bitcoin, Cash, and Money Orders. We keep user authentication and billing information on independent platforms. One platform is operated out of the United States of America (Marketing) and the other platform is operated out of Nevis (Operations). Payment details are held by our marketing company which has no access to the Operations data. We offer the ability for the customer to permanently delete their payment information from our servers at any point and all customer data is automatically removed from our records shortly after the customer ceases being a paying member. 9. We recommend using OpenVPN if at all possible (available for Windows, Apple, Linux, iOS, Android) and we use the AES-256-CBC algorithm for encryption. 10. Our leak protection (commonly called a ‘kill-switch’) keeps your IPv4 and IPv6 traffic from leaking to any other network and protects against DNS leaks. Your network will be disabled if you lose the connection to our servers and the only way to restore the network is manual intervention by the user. 11. We physically control some of our server locations where we have a heavier load. Other locations are hosted with third parties unless there is enough demand in that location to justify racking our own server setup. To ensure redundancy, we host with multiple providers in each location. We have server locations in over forty countries. We’re currently in the process of deploying 10Gb connected nodes that are physically controlled by our company. In all cases, our network nodes load over our encrypted network stack and run from ramdisk. Anyone taking control of the server would have no usable data on the disk. We periodically remount our ramdisks to remove any lingering data. Each of our access servers acts as the DNS server for customers connected to that node. 12. At SlickVPN we actually go through the expense of putting a physical server in each country that we list. SlickVPN offers VPN service in 40 countries around the world. We do not do offer virtual locations. SlickVPN reviews CRYPTOSTORM 1. No. The only logs on our servers are security related, such as: [root@wilno ~]# tail -n1 /var/log/messages Feb 21 17:27:51 wilno kernel: grsec: exec of /usr/bin/tail (tail -n1 /var/log/messages ) by /usr/bin/tail[bash:14447] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:12336] uid/euid:0/0 gid/egid:0/0 This is so we can monitor for unauthorized commands in the unlikely event that a server is compromised by some 0day exploit. Strict privilege separation and access control is done to minimize the access any potential attackers would get if any of our services were vulnerable to a 0day exploit. None of those logs contain any customer-related data. 2. Cryptostorm consists of several different entities that are in different regions. This is so if any adversary were to put legal pressure on one of those entities, we can simply drop and replace it, along with any resources that might be under it. The names and locations of these entities are not publicly disclosed, simply to make it more difficult for any potential adversaries. 3. Abuse is mitigated by using snort’s NFQ DAQ as an Intrusion Prevention System. This allows us to block the most basic or automated attacks/scans that would violate the Terms of Service at most data centers. It also allows us to prevent basic attacks without requiring us to keep any data that could be used to identify a customer. No customer IPs ever show up in those snort alerts. 4. No. 5. Most of the data centers we’ve chosen aren’t legally required to do anything about DMCA or similar complaints. The few that are legally required to do something, are only required to forward the complaint to us. Currently, the only exception is one of our Netherlands data centers, who requires a response from us. For them, we use a template very similar to this. If an ISP, data center, or anyone else were to request customer information related to a DMCA complaint, we wouldn’t be able to provide anything since we don’t have anything. If a data center threatens to suspend our server if we don’t comply, we simply stop doing business with that data center. 6. The locations of the entities that make up Cryptostorm were specifically chosen for their strong privacy and business laws. We wouldn’t be able to comply with any court order requesting customer information since we don’t have any information to give. If a court successfully ordered one of our entities to start collecting customer information, we would absolve any entities in that court’s region. In the highly unlikely event that international courts coordinating together were successful in ordering all of our entities to comply, we would shut down Cryptostorm, Lavabit style. As of February 2018, we have never received any such court orders. If we were to receive any “gag orders”, our warrant canary would inform customers of its existence. 7. Yes. 8. Credit/debit card payments are accepted via PayPal and Stripe. Bitcoin is accepted through BitPay. Bitcoin, Bitcoin Cash, BlackCoin, Dash, DigiByte, Dogecoin, Ether Classic, Ether, GameCredits, Litecoin, PotCoin, Vertcoin, Monero, and Zcash are accepted through CoinPayments.net. Our anonymous token authentication system plus our no-logging policy prevents us from knowing which customers are connected to which server, or what traffic they’re generating on that server. 9. Our most secure OpenVPN instances use: SHA512 for authentication; AES-256-GCM to encrypt the data channel; TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 for the control channel, forced to TLS v1.2 to prevent downgrade attacks; Unique 4096-bit DH parameters for perfect forward secrecy; prime256v1 ECC server/CA certificates, signed with ecdsa-with-SHA512; 2048-bit static key for additional encrypting/authenticating of control channel packets. For backwards compatibility on older devices that might not support OpenVPN 2.4.x, we also provide instances using: SHA512 for auth, AES-256-CBC for the data channel, TLS-DHE-RSA-WITH-AES-256-CBC-SHA for the control channel, and unique 2048-bit DH parameters for perfect forward secrecy. 10. We do provide firewall rule sets for IPtables, ufw, pf, etc. For Windows users, our open-source VPN client includes a kill switch. 11. We rent/lease servers at various data centers throughout the world. To account for the possibility of physical compromise (i.e., a confiscated server), each server is designed to be as disposable as possible. We don’t keep any data on the servers that can be used to identify a customer, and the data cannot be used to gain access to any other server. We do use our own DNS servers, and we also provide more secure alternatives to DNS such as DNSCrypt and DNSChain. 12. Currently, we have servers in Germany, Netherlands, Lithuania, Finland, Poland, Moldova, Spain, Latvia, Canada, England, Italy, France, Switzerland, Portugal, and eight US servers. We do not use VPS/VMs for our VPN servers. Only bare metal dedicated servers. CryptoStorm website WHATTHESERVER 1. Our OpenVPN servers are configured with “verb 0” so that they keep no logs at all. 2. What The * Services, LLC is incorporated in the USA. We have VPN servers in the USA, Germany, and the Netherlands. 3. We use a custom session management system which operates completely on real-time data and keeps no logs. The session management infrastructure (and all VPN servers) is built on top of OpenBSD and uses the services built into OpenBSD to enforce user management. 4. We run all of our own communications infrastructure. However, we do use Google Analytics on the WhatTheServer.me website. 5. We have never received a DMCA take-down notice or a non-US equivalent regarding our VPN service. However, we did receive a DMCA take-down notice regarding a website one of our customers was running on our Virtual Private Servers. We responded by replying to the requester letting them know we were looking into it, and we notified the customer via his email on file. Then we contacted the EFF and they put us in touch with a lawyer who helped us get the case dropped, because we did not have the information requested. The customer’s identity was never revealed to the people making the DMCA take-down request, because the bill was paid in Bitcoin & a throwaway email account was used. 6. We have not yet received such a court order or subpoena for user information. However, if we do we will take several steps. First, we would consult with our lawyers to confirm the validity of the order/subpoena, and respond accordingly if it is NOT a valid order/subpoena. Then we would alert our user of the event if we are legally able to. If the order/subpoena is valid, we would see if we have the ability to provide the information requested, and respond that we do NOT have the information requested. If we DO have the information requested, we would immediately reconfigure our systems to stop keeping that information. Then we would consult with our lawyer to determine if there is any way we can fight the order/subpoena and/or what is the minimum level of compliance we must meet, as well as, notify the user of the event if we are legally able to do so. If we were forced to start keeping logs on our users, we would go out of business and start a new company in a different jurisdiction. 7. BitTorrent and other file-sharing traffic is allowed on all VPN/Proxy servers which are NOT located in the USA. 8. We accept PayPal, as well as Monero, Bitcoin and over 140 CryptoCurrencies and AltCoins via CoinPayments.net We encourage our users to pay with anonymous payment methods and supply false contact information. We also use a completely different authentication infrastructure and random usernames for the VPN accounts. 9. All of our OpenVPN and SOCKS Proxy servers are running OpenBSD and are using LibreSSL instead of OpenSSL. This protects our servers from a wide range of attacks on the encryption. Our OpenVPN Servers use AES-256-CBC & SHA512 HMAC for the Data Channel, and DHE-RSA-AES256-GCM-SHA384 on the Control Channel. Our OpenVPN Servers are also configured with 4096bit RSA keys and a custom 4096bit Diffie-Hellman parameters. Our SOCKS Proxy is based on OpenSSH, so they support any ciphers the client wants to use. With the OpenSSH protocol, the Client decides what cipher to use instead of the Server. 10. We push Google DNS 8.8.8.8 and 8.8.4.4 to clients. We also have ‘push “block-outside-dns”’ in our OpenVPN server config files which will prevent the client from leaking DNS requests. Additionally, we include “resolve-retry infinite” and “persist-tun” in the OpenVPN client config files which will prevent the client from sending data in the clear if the VPN connection goes down. 11. All of our infrastructure is hosted in third party colocations. However, we use full-disk-encryption on all of our servers. We use Google DNS at this time but we are currently testing alternatives. 12. We offer VPN server locations in the USA, Germany, and Netherlands. WhatTheServer website IBVPN 1. We do not keep any log that can identify a user of our service with an IP address and/or a timestamp. We are getting ready to be GDPR compliant and (in our opinion) keeping this kind of logs is not respecting the Privacy by Design guidelines. 2. Company’s registered name is Amplusnet SRL. We are a Romanian company, which means we are under EU jurisdiction. 3. We limit the number of concurrent connections and we are using Radius for this purpose. 4. The back end of the website is a dedicated WHMCS for billing and support tickets. We do not use external e-mail providers (we host our own mail server). Our users can contact us via live chat (Zopim). The chat activity logs are deleted on a daily basis. There is no way to associate any information provided via live chat with the users’ account. 5. So far we did not receive any DMCA notice for any P2P server from our server list. That is normal considering that the servers are located in DMCA free zones. For the rest of the servers, p2p and file sharing activities are not allowed/supported. 6. So far, we have not received any court order. We do not support criminal activities, and in case of a valid court order, we must follow the EU laws under which we operate. 7. We have dedicated P2P servers that allows BitTorrent and other file-sharing applications. The servers are located in Netherlands, Luxembourg, Canada, Sweden, Russia, Hong Kong and Lithuania. We do not reroute P2P connections. 8. Payments are performed exclusively by third party processors, thus no credit card info, PayPal ids or other identifying info are stored in our database. For those who would like to keep a low profile, we accept BitCoin, LiteCoin, Ethereum, WebMoney, Perfect Money etc. 9. We support SSTP and SoftEther on most of the servers. We also offer double VPN and TOR over VPN. 10. Yes, Kill Switch and DNS leak protections are implemented in our VPN Clients. Kill Switch is one of the most used features. Our users can decide to block all the traffic when the VPN connection drops or to kill a list of applications. We allow customers to disable IPv6 Traffic and to make sure that only our DNS servers are used while connected to the VPN. 11. We do not have physical control over our VPN servers. We have full remote control to all servers. Admin access to servers is not provided for any third party. 12. The full list of server locations is available here. ibVPN website OVPN 1. Our entire infrastructure and VPN service is built to ensure that no logs can be stored – anywhere. Our servers are locked in cabinets and operate without any hard drives. We use a tailored version ofAlpine, which doesn’t support SATA controllers, USB ports etc. To further increase security, we use TRESOR and grsecurity to be resistant to cold boot attacks. 2. OVPN Integritet AB (Org no. 556999-4469). We operate under Swedish jurisdiction. 3. None. 4. For website insights, we use Piwik, an Open Source solution that we host ourselves. The last two bytes of visitors’ IP addresses are anonymized; hence no individual users can be identified. For support, we use an internally built system. The mail server is hosted by Glesys, a trusted provider in Sweden. Automatic emails from the website are sent using Mailgun, but we never send any sensitive information via email. Zendesk chat is used for live chat, which we will eventually migrate from when we’ve built a satisfactory in-house solution. 5. Since we don’t store any information, such requests aren’t applicable to us. 6. We can’t provide any information to the court. A court wouldn’t be able to do that [require logging] in our jurisdiction – but in case it did happen we would move the company abroad. 7. Yes. 8. We offer PayPal, credit cards (via Braintree), Bitcoin (via Bitpay), cash in envelopes as well as a Swedish payment system called Swish. We never log IP addresses of users, so we can’t correlate an IP address to a payment. 9. We offer AES-256-GCM. In terms of connection, we recommend using our Multihop add-on. 10. Yes. 11. Yes. We own all the servers and routers, and they’re co-located in various data centers in locked cabinets. 12. USA, Germany, Sweden, United Kingdom, the Netherlands, Canada and Norway. No virtual locations are offered. OVPN website MULLVAD 1. No, all details are explained in our no-logging data policy. 2. Amagicom AB, Sweden. 3. We limit the number of simultaneous connections to five per account. This is monitored in real time by our VPN servers which report this information to our central service. When a customer connects to one of our servers, the server asks the central service if the account has reached its connection limit. As we do not save this information, we cannot, for example, tell you how many connections your account had five minutes ago. 4. We have no external elements at all on our website. We do use an external email provider; for those who want to email us, we encourage them to use PGP encryption which is the only effective way to keep email somewhat private. The decrypted content is only available to us. 5. There is no such Swedish law that is applicable to us. 6. From time to time, we are contacted by governments asking us to divulge information about our customers. Given that we don’t store activity logs of any kind, we have no information to give out. So far this has never happened. In addition, we do not believe that it’s possible for Swedish law to order us to actually give out information about our users. Not that we would anyway. We started Mullvad for political reasons and would rather discontinue the service than have it work against its purpose. 7. All traffic is treated equally, therefore we do not block or throttle BitTorrent or other file-sharing protocols. 8. We accept cash, Bitcoin, Bitcoin Cash, bank wire, credit card, PayPal, and Swish. We encourage anonymous payments via cash or one of the cryptocurrencies. We run our own full node in each of the blockchains and do not use third parties for any step in the payment process, from the generation of QR codes to adding time to accounts. Our website explains how we handle payment information. 9. On Windows, macOS, and mobile, we offer OpenVPN with RSA-4096 and AES-256-GCM. On Linux, we also offer WireGuard which uses Curve25519 and ChaCha20-Poly1305. We also offer an experimental post-quantum secure VPN tunnel using WireGuard and NewHope. 10. We offer a kill switch and DNS leak protection, both of which are supported in IPv6 as IPv4. While the kill switch is only available via our client/app, we also provide a SOCKS5 proxy that works as a kill switch and is only accessible through our VPN. 11. Yes, we use our own DNS servers. 12. Our website has an up-to-date server list. Mullvad website ACEVPN 1. We do not log period. No meta-data logging, no traffic logging, no bandwidth usage tracking. We do not have any hidden fair usage policy. We respect our users’ privacy. We do not store any personal or billing information on VPN servers. IP’s are shared amongst users and our configuration makes it extremely difficult to single out any user. 2. We are registered in USA and operate as AceVPN.com 3. We have developed tools to mitigate abuse. 4. We use Google Analytics on www.acevpn.com (marketing site). We do not track proxied pages. We use G Suite for email. Emails are deleted regularly. 5. If we receive DMCA takedown, we block the port mentioned in the complaint. IPs are shared by other users and our configuration makes it extremely difficult to single out any user. We do not share any information with third parties. 6. To date, we have not received a court order. We only store billing information which the payment processor or bank or credit card issuer has. 7. We have special servers for P2P and are in datacenters that allow such traffic. These servers also have additional security to protect privacy when p2p programs are running. We do not reroute traffic as this require inspecting and analyzing traffic which contradicts with our no logs policy. 8. We accept Paypal, Bitcons and Credit cards for payments. We store billing information on a secure server separate from VPN servers and do not track usage nor IP assignments. 9. Both our IKEv2 and OpenVPN supports Elliptic curve cryptography (ECC) which we recommend for secure connectivity. To give an idea, 384 bits ECDSA is equivalent to RSA 7680 bits. Higher the bits, more secure it gets. 10. Yes, we do provide kill switches if a connection drops. Our servers are tested for DNS leak. 11. We have full control over our servers. Servers are housed in reputed datacenters. Many of them are ISO certified and are designed to the highest specifications for performance, reliability and security. We operate our own DNS servers (Smart DNS) for streaming videos. For VPN, we use Google, OpenDNS and Level3 DNS. 12. We have servers in 26+ countries and over 50+ locations /datacenters. USA, Brazil, Canada, Mexico, Denmark, Egypt, France, Germany, Ireland, Italy, Japan, Latvia, Luxembourg, Netherlands, Norway, Romania, Russia, Spain, Sweden, Switzerland, Turkey, UK, Hong Kong, Singapore, Australia, and South Africa. AceVPN website BLACKVPN 1. No. We purge all this information when the user disconnects from the VPN. 2. The name of the company is BLACKVPN LIMITED and is registered in Hong Kong and operates under the jurisdiction of Hong Kong. 3. Most of the time we use iptables to manually monitor and mitigate abuse, but in some special and complicated cases we have used fwsnort and psad to detect hacking and spamming from our platform. Limiting concurrent sessions is done through built in functionality in FreeRadius. 4. We run our own email server plus support and live chat systems using open source tools. We use StreamSend for sending generic welcome and renewal reminder emails, as well as for the occasional news updates. We have Twitter widgets on our frontpage that may track visitors. We use our own website analytics (Piwik) where we only save anonymous IP data. 5. We block the port in the firewall on the server listed in the notice. 6. If we received a valid court order from a Hong Kong court, then we would be legally obliged to obey it. So far this has never happened. 7. Bittorrent traffic is not restricted in our Privacy VPN locations, but due to stricter enforcement of DMA notices in the USA and UK we restrict most BitTorrent traffic and only whitelist torrents of known open source software. 8. PayPal and PaymentWall for Credit Cards, Bank Transfers and Prepaid cards. Coingate for all kind of Cryptocurrencies. The transaction details (ID, time, amount, etc) are linked to each user account. 9. We recommend to use IKEv2 or OpenVPN for the most secure VPN connection. We support the very secure GCM cipher mode (AES-256-GCM) together with 4096 bit RSA and Diffie Hellman keys. We also enforce DHE/ECDHE enabled cipher suites and key exchange is done with Diffie-Hellman, providing forward secrecy. 10. For OpenVPN, we stop IPv6 and DNS leaks with the OpenVPN config, and we also disable and blackhole all IPv6 traffic server side. Our custom VPN app provides 100% IPV6 and DNS leak protection client side and we are working on adding a 100% working kill switch there soon. 11. We use dedicated servers which are hosted in 3rd party data centers, but they do not have access to login or manage the server. We run our own DNS servers which do not save any logs. Among others we use Steadfast, i3D, Zenex5ive, Worldstream, Evoluso, Estnoc,Amanah, Voxility, Rackend, CherryServers. 12. We do not now offer virtual locations. Our servers are in USA, UK, Australia, Brazil, Canada, Czech Republic, Estonia, France, Germany, Japan, Lithuania, Luxembourg, Netherlands, Norway, Romania, Spain, Switzerland and Ukraine. BlackVPN website PERFECT PRIVACY 1. We do not log or store any traffic, IP addresses or any other kind of data that would allow identification of our users or their activities. The anonymity and privacy of our users is our highest priority and the Perfect Privacy infrastructure was built with this in mind. 2. Perfect Privacy is operated by Vectura Datamanagement, registered in Zug, Switzerland. 3. The primary method to mitigate abuse is reacting to email tickets. In case of malicious activity towards specific targets, we block IP addresses or ranges so they are not accessible from our VPN servers. Additionally, we have limits on new outgoing connections for protocols like SSH, IMAP, and SMTP to prevent automated spam and brute force attacks. We do not limit or keep track of the number of connections per user. 4. All email and support tools are developed and hosted in-house under our control. We use Google Analytics for website optimization and better market reach, but with the anonymizeIp parameter set. However, Perfect Privacy users are exempted from any tracking by Google Analytics and are also able to use our TrackStop filter which will block any tracking (as well as ads and known malware domains) directly on our servers. 5. Because we do not host any data, DMCA notices do not directly affect us. However, we do receive copyright violation notices for file-sharing in which case we truthfully reply that we have no data that would allow us to identify the responsible party. 6. The only step on our side is to inform the contacting party that we do not have any data that would allow the identification of a user. There had been incidents in the past where Perfect Privacy servers have been seized but never was any user information compromised that way. Since no logs are stored in the first place and additionally all our services are running within ramdisks, a server seizure will never compromise our customers. In August 2016 Dutch Authorities seized two of our servers in Rotterdam and no user data was compromised. 7. Yes, BitTorrent and other file sharing is generally allowed and treated equally to other traffic. However, at certain locations that are known to treat copyright violations rather harshly (very quick termination of servers) we block the most popular torrent trackers to reduce the impact of this problem. Currently, this is the case for servers located in the United States and France. 8. We offer a variety of payment options ranging from anonymous methods such as sending cash, or Bitcoin. However, we also offer payment with PayPal and credit cards for users who prefer these options. Because we do not monitor or log IP assignments or account usage, there is no link to the payments. 9. While we offer a range of connection possibilities we would recommend using OpenVPN with 256 bit AES encryption. Additional security can be established by using a cascaded connection over up to four hops and by activating NeuroRouting for optimized routing to keep all traffic in the encrypted VPN network as long as possible. 10. Our VPN client versions for Windows and MacOS both have “kill-switch” functionality (firewall protection against IP and DNS leaks) integrated. 11. All our VPN servers are dedicated servers that run in various data centers around the world. While we have no physical access to the servers, they all are running within RAM disks only and are fully encrypted. We operate our own DNS servers. 12. Currently, we offer servers in 23 countries. All servers are located in the city displayed in the host name – there are no “virtual locations”. For full details about all servers locations please check our server status site as we are constantly adding new servers. Perfect Privacy website VPN.HT 1. We keep 0 logs about usage or to match IP-Timestamp to a user. 2. VPN.ht Limited, a Hong Kong Company 3. We allow five concurrent connections with the same UserID. 4. Google Analytics. 5. We do not handle DMCA notices, our data center partners do, and in all cases we do not keep logs so we cannot identify the customer. 6. We will stop updating our Warrant Canary. It has never happened before. 7. Allowed on all our servers. 8. We accept various payment methods: Credit card / PayPal / Cryptocurrency / Other national payments. All are linked by an email. 9. For general use 128bit AES, but we do offer 256bit AES as maximum encryption level. 10. On the next application update. 11. We don’t, but we do have a strong relationship with our partners who operate data centers. 12. We have 127 servers in around 33 countries and we try our best to expand to locations most requested by our customers. VPN.ht website VPN LAND 1. We store only payment IP addresses for the reasons of fraud prevention, applies to Credit Card and PayPal payments. We don’t record or store information about what our clients do online and it is practically impossible to reverse track an external IP with a timestamp back to a real user. 2. VPNLand Inc., Canada 3. We use custom modified Radius databases to limit concurrent connections. We have AVs installed on all servers, and obvious known attacks are blocked at the firewall level. 4. We use ZenDesk (former Zopim online chat) online chat. Email and support databases are all in-house. 5. Ignored 6. We haven’t received any court order, thankfully. If there is a court order it will be evaluated first and then any action will be taken. 7. P2P is OK on all our VPN servers, except the US ones 8. We use Stripe, PayPal, PaymentWall, BitPay. As said above – IP addresses are logged only for fraud prevention purposes. Payment details are not linked to account usage 9. OpenVPN with AES-256-CBC key, SHA512 Hash Auth, and additional 2048 bit “tls-crypt” key 10. At this moment no, but the work is in progress and with our updated iOS, Android, Windows and Mac apps a “kill-switch” feature will be offered 11. We own half of our infrastructure in Canada, UK and Netherlands. In other countries we rent dedicated servers from hosting companies. 12. USA, Canada, UK, Netherlands, Germany, France, Sweden, Italy, Belgium, Luxembourg, Russian Federation, Singapore, Korea and Japan. VPN Land has no “virtual locations.” VPN Land website BOLEHVPN 1. We do not keep any logs on our VPN servers that would allow us to do this. 2. BV Internet Services Limited, in the Seychelles. 3. Generally, we just look at network graphs and number of connections and see if there is any abnormal activity. We also block certain sensitive ports that are often used for hacking/spamming. 4. We use Zendesk to deal with support queries and do track referrals from affiliates. We also provide the option to send us PGP encrypted messages via e-mail and also Zendesk. We do not use Cloudflare. 5. We generally find providers that are friendly towards such DMCA notices or where it cannot be avoided, we just keep them as surfing/streaming servers with P2P disabled. These servers are more for geo-location or general purpose surfing rather than P2P. We at no times give out customer information to handle this. 6. We maintain a warrant canary which we do update once a month or when there is a request for information (even if we have not complied with it). 7. We marked a few servers as surfing-streaming, as they are on providers with strict DMCA requirements. All other servers support P2P and are not treated differently from any other traffic. 8. PayPal, Paymentwall, Coinpayments, Paydollar, MolPay, Z-Coin/Z-Cash, direct bank-in and we also accept direct Bitcoin/Dash payments. 9. We recommend OpenVPN, with our Cloak servers running AES-256 bit encryption as well as an XOR patch that obfuscates your traffic. This obfuscation prevents it from being recognized as VPN traffic. 10. Yes we do. Our leak prevention also includes IPv6. 11. They are bare metal boxes hosted in various providers. We use our own DNS servers. 12. Canada, France, Germany, Italy, Japan, Luxembourg, Malaysia, Netherlands, Singapore, Sweden, Switzerland, United Kingdom and USA. BolehVPN website SAFERVPN 1. No logs, timestamps or IP addresses are kept whatsoever. At SaferVPN, we guarantee that we will never log your browsing activity, data, or IP addresses. This includes any websites you visited, any data you may have downloaded, shared or viewed, and any of your IP address or DNS queries. In respecting everyone’s right to privacy, we also encrypt all of your data traffic, never share or sell any of your traffic details, never read your traffic, and never identify which traffic is yours. 2. SaferVPN operates under our Safer Social Limited company, under Israeli jurisdiction. Israel has strict privacy regulations which do not include a mandatory data retention policy and only apply specifically within the state. 3. Firstly, we do not monitor our users, and we keep no logs, period. That said, we have an active, proprietary system in place to help mitigate abuse. In addition, we also limit our simultaneous connections to five devices per user. 4. We use standard business tools including Google Analytics to improve our website and provide users with the most relevant information. We also use Zendesk as a secure third-party support platform and SendGrid for transactional emails. Our users’ information is never stored within these apps, rather in a separate proprietary database used solely for support and billing requirements. Any information about how our customers use the VPN itself (such as browsing history, traffic data or DNS queries) is never revealed to third parties and is never logged or stored by SaferVPN. 5. We have not received any court orders as of yet, but in the case that we would be served with one, we would not be able to offer any information at all. We do not log IP addresses nor browsing activity, and we cannot match any activity to real IP addresses, even if we were asked by the court. We simply don’t have that data. 6. See above. 7. BitTorrent and other file-sharing traffic is welcome on our Dutch (NL) VPN servers without any throttling. It isn’t allowed on our other servers as stated in our Terms of Service, due to our agreements with data centers. 8. Our customers can pay via credit card, PayPal and Bitcoin. Payments are performed exclusively by third-party processors — BlueSnap for credit cards, PayPal for PayPal and CoinBase for Bitcoin — who only get the necessary data to verify the payment. As we don’t monitor account usage, payment details cannot be linked to any IP assignments. 9. In most cases we recommend (and default to) OpenVPN UDP and our cipher suite of AES-256 + RSA4096 + SHA256. Our apps use a 4096-bit CA, AES-256-CBC encryption, TLSv1.2, and SHA512 signatures to authenticate our servers. We use TLS 1.2 on all servers with enabled Perfect Forward Secrecy keys. At the same time, we also offer a wide range of VPN protocols, including OpenVPN, L2TP, IPsec, OpenConnect/AnyConnect (SSL VPN), and iKEV2 – we still offer PPTP for those of you who need it, but we don’t recommend it. 10. SaferVPN provides both an automatic app-level kill switch and a feature for DNS leak protection across all mobile and desktop platforms. We also ensure that our users enjoy Automatic Wi-Fi Security that activates immediate VPN protection across public Wi-Fi hotspots. 11. We use dedicated servers at premium data centers with strong security practices. Due to our special server configuration, no one can access, retain or collect any data. All servers have been set up with a zero logs policy, ensuring that no customer data nor activity is stored on any VPN server. 12. Our servers are physically located in over 34 countries, and across every continent except Antarctica (we’re working on that!). SaferVPN website HEADVPN 1. We DO NOT keep any logs. We do not store logs relating to traffic, session, DNS or metadata. 2. We’re registered in the United Kingdom under the name “HEADVPN LTD” 3. We use a pre-configured firewall which is configured by our own technology. 4. Google is the one mail external based system we use. We make standard use of Google Apps and Google Analytics. Of course, we provide 24/7 Live Chat support (powered by Tawk). All other support tools are kept internal for our users and visitors. 5. Since we don’t keep any information on any of our servers there is nothing that we can take down. If we receive a valid DMCA notice we can only take action if the connection is still active (we notify the user and stop the session). 6. We haven’t received any court orders. If that happens, the agency will be informed that no user information is available as we DO NOT keep log. In our practice this was not the case. 7. Yes, we allow P2P/BitTorrent downloading. For P2P/Bittorent traffic we have special VPN servers (which are located in a data center that allows such traffic). On other VPN servers, P2P/Bittorent traffic is blocked. 8. We accept all forms of Credit/Debit cards payments through the Stripe payment gateway, Bitcoins, QIWI, Yandex.Money, WebMoney, AliPay, CashU, iDeal, PaySafecard, and PayPal payment method. We do not store any billing information such as credit cards or addresses. 9. We provide all kinds of encryption methods, including PPTP, L2TP/IPsec, SSTP, OpenVPN and SoftEther protocols. We recommend using OpenVPN protocol as it’s the most secure and using RSA 4096 bit and AES 256 bit encryption keys. 10. We do not offer DNS leak protection via kill switches. DNS leak protection is best handled by using OpenVPN protocol (AES-256-CBC algorithm for encryption). 11. All our VPN servers are hosted in 3rd party data centers with the highest specifications for performance, reliability and security. We have direct access to each server and they all are running within RAM disks (which are fully encrypted). 12. Our VPN servers are located in the United Kingdom, United States, Germany and Netherlands. We do not offer virtual locations. HeadVPN website ZENMATE 1. No, we do not keep any such logs. We do not monitor the bandwidth usage, nor the websites that users visit. 2. ZenMate is incorporated under the legal entity “ZenGuard GmbH”, registered and operating under German jurisdiction. Germany is known for its strict internet privacy and security laws, we are therefore bound to Germany’s data privacy rules. The latter are reflected in the company’s strict privacy policies, which are followed rigorously. 3. All of our VPN systems and tools that are used to prevent abuse are proprietary and maintained in-house. 4. For user support we use ZenDesk that holds the email address the user provided us and a name if the user added that to the support ticket. For our website we do use Google Analytics, but with the “anonymize_IP” setting enabled. 5. We answer that due to the absence of any user-related data in regards to the usage with ZenMate we cannot give any support to these authorities, as this kind of data is not logged. 6. Due to the absence of any log data we cannot give any historical data to these authorities. As of now, no judge was ever willing to sign a court order to make us start logging (in general, without a specific suspicion) in the future, as this would result in a breach of several other German/European laws. We therefore have been successfully defending our users’ rights for now more than five years, without having to fear any change anytime soon. 7. Yes, we allow all traffic on all servers – as we do not have any control over the user’s traffic at all. 8. We offer a variety of payment methods depending on the country you are located in. Among others, we support payments via VISA, MasterCard, American Express, PayPal, Sofort Banking. We do not process payments on our own. We contracted with Adyen B.V. as our payment provider for the processing of payments – who is fully PCI DSS and PCI SAQ compliant. We do not have a linked connection between payment details (which is on Adyen’s side) and account usage (which we do not log) or IP assignment (which happens completely automatically), as these are completely different systems at two different companies. 9. We use the latest TLS 1.2 (RFC 5246) protocol and support different cipher suites with PFS (Default for Chrome is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) and up to TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. No known attack currently target these cyphers. AES 128 is preferred to AES 256. There have been discussions on whether AES 256 extra security was worth the cost, and the result is far from obvious. At the moment, AES 128 is preferred, since it provides bulletproof security, it is really fast and seems to be more resistant to timing attacks. 10. Yes, we provide kill switches in the browser extensions, Windows and Android. 11. We work with a small number of trusted partners that operate premium data centers with strong security practices. Nevertheless, due to the high encryption and the zero-logging policy even at an unauthorized access, the attacker could not get any information about the activity of a specific user, as there is none on our VPN servers. 12. With ZenMate you can relocate your IP address to hide your real location and circumvent network restrictions to unblock geo-restricted sites. We are currently offering over 30 different country locations to choose from, for example: Germany, Romania, Hong Kong, United States, Austria, Australia, Belgium, Bulgaria, Canada, Czech Republic, Finland, France, Israel, Italy, Japan, Latvia, Luxembourg, Moldova, Netherlands, Norway, Poland, Russia, Singapore, South Africa, Spain, Sweden, Switzerland, Ukraine, United Kingdom, United States. Zenmate website BUFFERED 1. We do not keep any logs that can link a user to a certain IP address. We keep anonymized logs of some usage so that we can improve the service. No single user can ever be identified. 2. We are incorporated in Gibraltar as Buffered Ltd. All card payments are taken via this entity. We take payments on PayPal via our Hungarian subsidiary, which is fully owned by the Gibraltar company. 3. Our own internal tools monitor how many devices a user has connected. 4. We do not use any external email providers, we only use internal traffic analytics (no Google Analytics or any other tracking). We use Livechat.com for live support. 5. We are not a content provider, but a network/transit service, therefore DMCA requests are not applicable to us. If we do receive one we do not attempt to identify the user (since we cannot anyway). 6. This has not happened. 7. Yes, we do not interfere with traffic in this way. 8. We use Checkout.com and PayPal, and Bitpay for bitcoin payments. Since we do not store usage logs of users this cannot be linked to payment providers, however, users should be aware that paying for a VPN with anything other than bitcoin will make it easy to identify that you have at least paid for that particular VPN. 9. Even though blowfish is sufficiently secure, now with hardware-accelerated AES, this is faster than blowfish. Consequently, we are rolling this out everywhere as it greatly improves battery consumption and security, especially in resource-constrained environments like routers and mobiles. 10. Yes we do, we recently released a firewall based killswitch. It blocks all traffic in case of the VPN connection dropping. 11. We use our own DNS servers. We rent servers across the world from providers like Leaseweb and 100TB. 12. We offer connections in 45 countries, and there are no virtual locations. Buffered website VPN PROVIDERS WITH SOME LOGS SEED4.ME 1. We do not analyze or DPI traffic. We also do not keep logs on VPN nodes. General connection logs are stored on a secure server for seven days to solve network issues if there are any (for example if VPN IP is blocked in China and needs replacement). These logs are deleted after seven days if there are no network problems. 2. Taiwan. Seed4.Me Inc. We are not aware of any legislation requiring to share client information and we are not aware of any precedents in Taiwan, where client information was disclosed. We do not hold much information anyway. On the other hand, we do not welcome illegal activities which potentially harm other people. 3. We use simple firewall rules to avoid some abuses in advance. Regarding concurrent connections: we do not have any limits when Client uses our Windows, MAC, iOS or Android app. When Customer sets up L2TP/PPTP VPN manually he has one simultaneous connections by default, this number can be increased and it’s totally free. We use our own solution to manage abusive accounts and limit concurrent L2TP/PPTP connections. 4. Currently, we utilize Google Analytics and G Suite (ex. Google Apps). Regarding G Suite, we do not store any sensitive information there, only support issues. 5. In case of abuse we null route the IP to keep ourselves in compliance with the DMCA. Currently, we use simple firewall rules to block torrents in countries where the DMCA applies. 6. We will act in accordance with the laws of the jurisdiction, only if court order comes from a jurisdiction where the affected server is located. Fortunately, as I said before, we do not keep any logs on VPN nodes, on the other hand – we do not encourage illegal activity. This never happened. 7. Torrents are allowed on our VPN servers in Switzerland, Sweden, and Latvia. This is torrent-friendly countries with high-quality data centers and networks. 8. We accept Bitcoin, PayPal, Visa, MasterCard, Webmoney, QIWI, Yandex.Money, Bank transfer and In-App purchases in our mobile apps. We do not store sensitive payment information on our servers, in most cases payment system simply sends us a notification about successful payment with the amount of payment. We validate this data and grant access to VPN. BTW, we do not require name of the cardholder when he pays for the VPN in our desktop app. 9. Obfuscated OpenVPN with 2048-bit key will be a good choice, it’s available in our Desktop and Android apps. Also our iOS App has Automatic protection option that guarantees for example that all outgoing connections on open Wi-Fi will be encrypted and passed through secure VPN channel. 10. Yes, we have a kill switch in our Desktop VPN app. Yes, we provide DNS leak protection in our Desktop VPN app. 11. All servers are remotely administered by our team only, no outsourcing. No data is stored on VPN nodes (if the node is confiscated, there will not be any data). We prefer to deal with trustworthy Tier-3 (PCI-DSS) data centers and providers to ensure reliable service with high security. As for DNS, we use Google, users can override these settings with their own. 12. Currently we offer VPN nodes in 21 location: USA, UK, Canada, France, Russia, Switzerland (torrent-friendly), Sweden (torrent-friendly), Belgium, Ukraine, Latvia (torrent-friendly), Bulgaria, Netherlands, Spain, Germany, Italy, India, Hong Kong, Singapore, Israel, Taiwan and South Korea. We offer one virtual location. Currently, we try not to fake IP locations and provide real IPs directly from the country where the VPN server is physically located. Seed4.me website VPN.AC 1. We keep connection logs for one day to help us in troubleshooting customers’ connection problems but also to identify attacks (e.g. bruteforce, account theft). This information contains IP address, connection start and end time, protocol used (including port) and amount of data transferred. 2. Netsec Interactive Solutions SRL, registered in Romania. 3. There are automated firewall rules that can kick-in in the event of some specific abusive activities, manual intervention can be done when absolutely necessary in order to maintain the infrastructure stable and reliable for everyone. Concurrent connections are limited by the authentication back-ends. 4. No. 5. We are handling DMCA complaints internally without involving the users (i.e. we are not forwarding anything). We use shared IP addresses so it’s not possible to identify the users. 6. It never happened. In such event, we would rely on legal advice. 7. It is allowed. 8. All major cryptocurrencies, PayPal, credit cards, Perfect Money, several country-specific payment methods, gift cards. Payment with cryptocurrencies can be anonymous. 9. OpenVPN using Elliptic Curve Cryptography for Key Exchange (ECDHE, curve secp256k1) is used by default in most cases. We also support RSA-4096, SHA256 and SHA512 for digest/HMAC. For data encryption we use AES-256-GCM and AES-128-GCM. 10. Yes, such features are embedded in our client software. 11. We have physical control of our servers in Romania. In other countries, we rent or collocate our hardware. We use our own DNS resolvers and all DNS traffic between VPN gateways and DNS resolvers is encrypted. 12. We don’t use “virtual locations”. All servers are physically located in several countries (and growing), such as: Australia, Canada, Switzerland, Germany, Spain, Finland, France, Hong Kong, Italy, Japan, South Korea, Lithuania, Luxembourg, Mexico, Netherlands, Norway, Poland, Portugal, Romania, Sweden, Singapore, Taiwan, UK, USA. VPN.ac website IRONSOCKET 1. We keep limited session logs for all of our services. These logs record the duration of a connection, the IP address used for the connection and the number of bytes transferred. These logs are typically kept for 72 hours, usually less, after which they are purged. We log this data for fraud and abuse detection/prevention. Since we use shared IPs on our servers, and do not log activity, it is difficult to associate specific activity with individual users. 2. IronSocket is owned and operated by Pusa and Daga Hong Kong Limited in the jurisdiction of the Hong Kong Special Administrative Region. 3. We do not use any third-party email providers or support tools. We use Google Analytics and HasOffers which have minimal visitor tracking information used for website usage reporting and management of our affiliate program, respectively. 4. IronSocket is not subject to the DMCA or any international equivalent. We do NOT host any user-uploaded content on any of our servers. While IronSocket is not subject to DMCA, some of our hosting and data center partners reside in locations that are. If they escalate a DMCA notice to us, we reply to the provider that we are a service provider like them, and that we do not log our user’s activity. 5. This has not happened. It is our policy to cooperate with legal orders that are valid under Hong Kong SAR law. The process to address such request is: (A) Verify the order is legal and valid. (B) Consult with legal counsel to determine what we are required to provide. (C) Determine if we have the data being requested. Because of our privacy policy, terms of service, shared IP usage, and anonymous payment methods, it would be difficult to impossible to associate a specific activity with an individual user. 6. P2P traffic is allowed on servers in countries where such traffic is not restricted. We do not allow P2P on all servers due to the legal pressure on the data centers in certain regions of the world. All traffic is treated equally on our network. 7. We accept credit / debit card payments via SafeCharge and PayPal. Bitcoin transactions are processed by BitPay and major US brand gift cards are handled by PayGarden. We do not collect sensitive payment information. Any sensitive payment information is maintained by each respective payment processor and is linked by a unique transaction number. 8. OpenVPN with strong encryption: AES 256-bit encryption with SHA256 message authentication, using a 4096-bit key for secure authentication. 9. We are currently beta testing a new client for Microsoft Windows systems that offers DNS leak protection and VPN drop protection. VPN drop protection has the option of killing specific applications or the system’s network connection. 10. We are currently beta testing a new client for Microsoft Windows systems that offers support for the OpenVPN, L2TP, and PPTP VPN protocols. 11. We host and maintain our own DNS servers. We manage all our VPN servers but they are hosted and maintained by third-party data centers. We vet all providers prior to engaging their services and we continuously evaluate the quality of service and responsiveness to our requirements and requests. 12. We have hundreds of servers in 38 different countries and are always adding more. The most up-to-date list can be found here. IronSocket website —– Note: several of the providers listed in this article are TorrentFreak sponsors. We reserve the first three spots for our sponsors, as a courtesy. VPN providers who want to be in future question rounds are free to get in touch. https://torrentfreak.com/vpn-services-keep-anonymous-2018/

Website blocking is a common tool for copyright holders to keep people away from pirate sites. While these measures are often mandated by court order, ISPs also offer voluntary blocking tools, to prevent subscribers from accessing dangerous sites. Comcast's Xfinity, for example, offers "protected browsing" which, ironically, will prevent users from reading this article. Regular TorrentFreak readers know that website blocking is rampant around the globe. Thousands of pirate sites have been blocked by court orders for offering access to infringing content. However, there are plenty of voluntary blocking measures as well. Some Internet providers offer web filtering tools to help their customers avoid malware, adult content, pirate services, or other suspicious content. Comcast’s Xfinity Xfi service, for example, has a “protected browsing” feature. While this can be useful in some situations, it’s far from perfect. The blocklists that are used can be quite broad. Websites are sometimes miscategorized or flagged as dangerous while that’s not the case. This also appears to be happening with Xfinity’s protected browsing feature. A reader alerted us that, when he tried to access TorrentFreak, access was denied stating that a “suspicious” site was ahead. A pirate logo on the blocking page suggests that there’s copyright-infringing activity involved. While it’s no secret that we cover a lot of news related to piracy, it goes a bit far to label this type of news reporting as suspicious. Suspicious….. While we don’t know whether the blockade is intentional or a false positive, this is certainly not the only ‘problem’ with Xfinity’s protected browsing feature. Previously, Comcast users reported that this system prevented people from accessing PayPal as well, which is a bit much, and others reported that it stopped the Steam store from loading properly. The good news is that the blocking ‘feature’ isn’t mandatory. Subscribers can enable and disable it whenever they please, by changing their network settings. Unfortunately, Xfinity’s blocking efforts are not unique. We regularly get reports from users who can’t access TorrentFreak because it’s blocked, often on public WiFi networks. In these and other cases, a VPN can always come in handy. https://torrentfreak.com/comcasts-protected-browsing-blocks-torrentfreak-as-suspicious-site-18004/

The Pirate Bay regularly suffers downtime, which can lead to a lot of frustration among users. Software developer TechTac hopes to bring an end to this with the release of OfflineBay, a searchable offline archive of TPB's torrents. The software relies on downloading and updating a dump file manually at the moment, but the developer hopes to replace this with a blockchain in the future. The Pirate Bay is touted as one of the most resilient torrent sites. While it has indeed weathered many storms, occasional downtime is no longer an exception, as became clear again this week. This can be quite frustrating for users, including software developer TechTac, who came up with a simple but effective solution: OfflineBay. Simply put, OfflineBay is a multi-platform application that people can install on their local computer. As the same suggests, it helps users to store a copy of all Pirate Bay torrents locally, in case the site does down. The idea for the tool started a few weeks ago when TechTac realized that he had quite a bit of his monthly bandwidth quota left. However, as The Pirate Bay and other sites were down, he was unable to download anything through the usual channels. “All of that remaining quota went to waste. Only if I had a tool like OfflineBay at that moment. So I thought ‘Never again’ and ended up developing this tool,” TechTac tells TorrentFreak. The end result is an application that allows users to search and download Pirate Bay torrents, without having to use the website. Instead, the application searches through the publicly available TPB dump file, which users have to download first. This means that only those torrents that were available at the time of the latest dump file update will be in the local database as a backup, in case TPB and other major torrent indexes go down. OfflineBay “OfflineBay is designed to discover torrents when online torrent search providers are not available. Torrents will be available up to the time the last dump file was created,” TechTac says. The developer realizes that downloading and updating the dump file, which is just under 100 MB in size, is a major drawback. While he considered automating the process, there’s not really an elegant way to implement that at the moment. This may change in the future though. TechTac will continue to develop the software. While it’s closed source at the moment, open sourcing the code is under consideration for the future. One of the most interesting plans is to use a blockchain for this project. This would mean that the torrent database is stored and shared among users, without the need to import a dump file. “I’m planning to move this project to the blockchain so it won’t be depending on the dump file anymore. This is the ultimate goal,” TechTac tells us. These types of changes require a lot of time though, and that’s proven to be a bottleneck. TechTac is doing all the work on his own right now but he hopes that other developers will join the project. “Currently, I’m the only one developing this tool. I can’t handle this on my own anymore. Waiting for more developers to get in contact. There’s a lot to discuss,” he says. The official OfflineBay announcement and related information are available in the Pirate Bay forums over at Suprbay, where it was posted with permission of the Pirate Bay crew. https://torrentfreak.com/offlinebay-saves-the-day-when-pirate-bay-goes-down-180303/

Rightsholders and ISPs in Belgium have agreed to present a list of 450 domains to a judge alongside allegations they facilitate illegal downloading. With the ISPs keen to assist but without accepting any liability, it appears that the collaborative process will lead to the blocking of the domains while avoiding complex and costly legal proceedings. While site-blocking on copyright infringement grounds is now widespread, in most countries it requires intervention from the courts. The process nearly always involves rightsholders grouping together with claims that customers of ISPs are infringing their rights by using ‘pirate’ sites to obtain movies, TV shows and music. As such, it isn’t pirate sites that are targeted by rightsholder legal action, but the ISPs themselves. Of course, none of the ISPs targeted are breaking the law by providing access to the sites. However, the demands for a blocking injunction frame the ISPs as the wrong-doers, even if there is an underlying understanding that the pirate sites themselves are the issue. For this reason, ISPs around the world have regularly found themselves in an adversarial process. In the Netherlands, for example, ISPs took their fight to the highest court in Europe to avoid blocking but will almost certainly fail after spending large sums of money. In others, such as the UK where the blocking process has matured, ISPs rarely object to anything, smoothing the process for both them and the rightsholders. With the knowledge that site-blocking injunctions are likely to be granted by national courts in Europe, rightsholders and ISPs in Belgium now appear to be taking a collaborative approach. Sites have been blocked in the country before but future blocking efforts will be much easier to implement if a case before the Commercial Court of Brussels runs to plan. It involves the Belgian Entertainment Association (BEA) on one side and ISPs Proximus, Telenet and VOO on the other. Rather than squabbling over the details, it appears that the parties will jointly present a list of 33 websites and 450 domain names to a judge, alongside claims that they facilitate the illegal downloading of copyrighted material. According to a report from L’Echo (paywall), the companies hope to avoid complex and costly legal proceedings by working together and accepting the inevitability of a blocking injunction. The case has been running for a year already but during a hearing before the Commercial Court of Brussels this week, Benoît Michaux, lawyer for the Belgian Entertainment Association, explained the new approach. “The European legislator has put in place a mechanism that allows a national judge to request injunctions to order the providers to block access to the websites in question”, Michaux said. After being presented to the Court, the list of sites and domains will be assessed to determine whether they’re acting illegally. Michaux said that the parties have settled on a common approach and have been able to identify “reasonable measures” that can be ordered by the Court that are consistent with case law of the European Court of Justice. “This joint request is a little unusual, things are changing, there is a certain maturation of minds, we realize, from all sides, that we must tackle the problem of piracy by blocking measures. There is a common vision on what to do and how to handle piracy,” he said. While the ISPs are clearly on a path of cooperation, L’Echo reports that concerns over possible breaches of the E-Commerce Directive mean that the ISPs don’t want to take action against the sites themselves without being ordered to do so by the Court. “The responsible actors want to demonstrate that it is possible to stop piracy through procedural law,” says Benoît Van Asbroeck, lawyer for Proximus and Telenet. The Court is expected to hand down its judgment within a month. Given the cooperation on all sides, it’s likely to be in favor of mass site-blocking. https://torrentfreak.com/rightsholders-belgian-isps-cooperate-to-block-450-pirate-domains-180303/

With the Academy Awards ceremony coming up, we traditionally take a look at the availability of nominated films on various pirate sites. This year, all 34 prime Oscar nominees are readily available on torrent and streaming sites, most in high quality. While screener leaks are stable, the number of camcorded films appears to be on the rise. The Oscars are the most watched awards show of the year, closely followed by hundreds of millions of movie fans around the world. This weekend Hollywood’s finest are gathering on the red carpet once again. While they associate the celebration with eternal fame and recognition, online pirates are keeping an eye on it as well. Traditionally, Oscar winners see a surge in piracy activity, so we decided to take a look at the availability of this year’s nominees through unauthorized channels. Relying on data released by Oscar piracy watcher Andy Baio, we see that all nominated* films are now available on pirate sites, most in decent quality too. There are just three films that haven’t been released as a screener, Blu-ray or other high-quality rip, including the highly anticipated “Star Wars: The Last Jedi.” That all films are readily available isn’t really new. This has happened consistently over the past decade. This year, however, that tradition was nearly broken. A pirated copy of “The Breadwinner” only leaked last week. On the screener front, there’s not much movement. Like previous years, most of the leaked screeners have been released by Hive-CM8. A dozen screeners of Oscar nominees are available on pirate sites at the time of writing. Screener leaks 2003 – 2018 There is another trend visible, however, one which we didn’t immediately expect. The number of Cam releases, which are recorded in movie theaters, is on the rise. This year 20 camcorded (Cam) copies of Oscar contenders have leaked, which is a record high for the last decade. As Cams usually come out early, when films are still playing in theaters, Hollywood sees these leaks as a great threat. Cam leaks 2003 – 2018 The same increase is also visible for Telesync releases, which are higher-quality Cam releases that use a direct sound input. There have been 14 Telesync leaks for the 2018 Oscar contenders, which is a significant uptick compared to previous years. While these releases reach millions of people they tend to originate from a small circle. As the Hive-CM8 situation has shown, one group can make an enormous impact on the numbers. This also means that next year’s figures can easily turn around if one or two prominent sources are cut off. — * – Foreign film and documentary categories are not included – The high quality leak of Ferdinand was not included in Baio’s data at the time of writing, but it was included in the analysis above. https://torrentfreak.com/all-oscar-contenders-leaked-on-pirate-sites-again-180302/

According to anti-piracy group BREIN, traffic to The Pirate Bay's main domain suffered a 40% drop in Dutch traffic in the three months after local ISPs began blocking the site. While the figure initially seems dramatic, there are important things to consider that a straightforward percentage simply can't capture. Over the past several years, Dutch anti-piracy outfit BREIN has been engaged in continuous legal action against local ISPs Ziggo and XS4All. BREIN felt they should block The Pirate Bay to reduce copyright infringement but the ISPs felt blocking was disproportionate. The case went all the way to the Supreme Court and then to the EU Court of Justice for clarification. Last June, the ECJ ruled that as a platform effectively communicating copyright works to the public, The Pirate Bay can indeed be blocked by ISPs. The case will go back to the Supreme Court which is likely to give permanent blocking the go ahead. However, BREIN wanted a blocking decision more quickly and got onelast September when The Hague Court of Appeal told Ziggo and XS4All to block The Pirate Bay pending a Supreme Court decision. With The Pirate Bay blocked by the ISPs from September last year, BREIN has been monitoring the effect of the blockade on traffic to the site. In a statement, the anti-piracy outfit suggests that blocking is doing its job. “Monitoring by ComScore shows that the number of unique visitors to thepiratebay.org from the Netherlands has dropped by more than 40% between September 2017 and December 2017 after internet providers Ziggo and XS4ALL were ordered by the court to demand access to the site on the basis of BREIN’s claim,” BREIN writes. Ziggo is the largest cable operator in the Netherlands and XS4All one of the longest standing, so it comes as no surprise to learn that traffic to The Pirate Bay’s main domain has been hit. However, since the site can be accessed in numerous different indirect ways, including via proxies, mirrors and VPNs, to name a few, does BREIN’s claim that “blocking works” still hold water? According to BREIN director Tim Kuik, yes it does. “We also are blocking many proxies and mirrors. There is a whole list of them which also changes. New ones are added and others may be deleted,” Kuik informs TF. “The monitoring compares like with like and shows a trend that correlates with other sources. I think this trend holds true for all blocked sites.” So, to be clear, the 40% does not represent a drop in Dutch traffic to The Pirate Bay’s site and/or content overall, it only represents traffic which goes directly to the specific thepiratebay.org domain. Anyone circumventing the blockade isn’t counted. Of course, that’s not to say that the overall traffic numbers from the Netherlands aren’t down as well, but there are no public figures to prove that one way or another. The precise impact of proxies and mirrors is also unclear but Kuik thinks that the blockades themselves send a message. “Bypassing a blockade requires users to take action to illegally download and it is now clear that they are committing a criminal offense and most people do not want that,” he says. VPNs are undoubtedly an effective unblocking solution for some but Kuik doesn’t believe they represent a big threat, currently at least. “We think VPN use is not common under the average user, that is more something for the hardcore and not all of those will use it for access to illegal sources,” he informs TF. While BREIN is fairly relaxed about VPNs for now, the group suggests it could take action if they begin to pose a risk to the site-blocking regime they’ve fought so hard for. “If it becomes problematic, blocking could in principle also be demanded from VPN services,” Kuik warns. Given the 40% figure and the caveats above, it is likely that the direct traffic figure to The Pirate Bay’s domain will fall again in the months to come. Mid-January a Dutch court ruled that local Internet providers KPN, Tele2, T-Mobile, Zeelandnet and CAIW must follow Ziggo and XS4All by also blocking The Pirate Bay. There’s no doubt that blocking has at least some effect on direct traffic to pirate sites and it’s clear that entertainment industry groups feel it’s essential as part of a bigger anti-piracy toolkit. Thus far, however, pirates have proven to be extremely resilient so the Netherlands will probably need further action against a much broader range of sites if blocking is to have any meaningful effect. https://torrentfreak.com/the-pirate-bays-domain-suffers-40-traffic-drop-after-dutch-blocking-180302/

Dish Network argues that there's sufficient reason to pursue a lawsuit against the people behind the TVAddons website and ZemTV Kodi addon. The defendants previously asked the Texas court to drop the case because they are foreign nationals with no connection to the state. Dish, however, counters this and argues that the US was the focal point of their business. Last year, American satellite and broadcast provider Dish Network targeted two well-known players in the third-party Kodi add-on ecosystem. In a complaint filed in a federal court in Texas, add-on ZemTV and the TVAddons library were accused of copyright infringement. As a result, both are facing up to $150,000 in damages for each offense. While the case was filed in Texas, neither of the defendants live there, or even in the United States. The owner and operator of TVAddons is Adam Lackman, who resides in Montreal, Canada. ZemTV’s developer Shahjahan Durrani is even further away in London, UK. According to the legal team of the two defendants, this limited connection to Texas is reason for the case to be dismissed. They filed a motion to dismiss in January, asking the court to drop the case. “Lackman and Durrani have never been residents or citizens of Texas; they have never owned property in Texas; they have never voted in Texas; they have never personally visited Texas; they have never directed any business activity of any kind to anyone in Texas […] and they have never earned income in Texas,” the motion reads. Dish, however, sees things differently. Yesterday the broadcast provider replied to the motion, submitting hundreds of pages of evidence documenting TVAddons and ZemTV’s ties to the United States. According to Dish, both defendants utilized US companies such as Twitter, Facebook, Google, and Cloudflare to facilitate their infringing activities. In addition. US residents were directly addressed in various messages on the TVAddons site and social media. “Defendants used TV Addons to target residents of the United States and it was designed to appeal to United States television consumers. The TV Addons Home page stated ‘Whether you’re in the United States, United Kingdom, Canada, Germany, India or anywhere else, Kodi Addons will work great for you!’,” Dish writes. Furthermore, TVAddons own data showed that most of its users came from the United States, more than one-third of the total user base. “The United States was Defendants’ largest market with approximately 34% of all TV Addons traffic coming from users located in the United States, which was three times the traffic from the second largest market.” Dish points out that the Court has personal jurisdiction under the “Calder effects test,” because defendants knew that the focal point of the harm from their action was in the US, and because their actions connect the defendants to the US in a meaningful way. The focal point of the harm from TVAddons and ZemTV was in the United States, Dish states, adding that both defendants were well aware of their infringing activities. “Defendants’ boasting on TV Addons that their services allow users ‘to cut down your cable or satellite television bill substantially, if not entirely’ shows that Defendants were well aware that TV Addons and ZemTV were harming DISH and other legitimate, subscription television service providers in the United States,” Dish writes. Without getting too deep into the legal jargon, Dish relies on an alternative basis for jurisdiction as the defendants did in their motion to dismiss, which means that they don’t have to address specific connections to the state of Texas. The broadcast provider hopes that the Court agrees, and wants the case to proceed. — A copy of Dish Network’s reply is available here (pdf). https://torrentfreak.com/tvaddons-and-zemtv-should-stand-trial-in-us-dish-tells-court-180301/

The Pirate Bay has been hard to reach for the past 24 hours, causing concern among many BitTorrent users. No further details have been announced, but judging from past experience the outage is likely being caused by temporary technical issues. The Pirate Bay has been hard to reach for roughly a day now. For most people, the site currently displays a CloudFlare error message across the entire site, with the CDN provider mentioning that the “connection timed out.” No further details are available to us and there is no known ETA for the site’s full return. However, judging from past experience, it’s likely a small technical issue that needs fixing. TPB 522 Cloudflare error The Pirate Bay has had quite a few stints of downtime in recent months. The popular torrent site usually returns after several hours, but an outage of more than 24 hours has happened before as well. The Pirate Bay team has a status page in the forums where people can check to see if an outage is affecting everyone or not. This also shows that the Tor version of the site is suffering downtime, although it briefly reappeared a few times. As always, the TPB team advises people to be patient. “If our sites are down we’ll already know and be working on getting them back up. We don’t issue estimates so don’t ask how long it will take,” the status page notes. In any case, there’s no need to panic. But we expect that seasoned TPB users will probably know the drill by now… Update: And they’re back… https://torrentfreak.com/the-pirate-bay-suffers-extended-downtime-180301/

Kim Dotcom is claiming that an associate was able to hire a friend of the Obamas to ask about the Megaupload case. "Mistakes were made. It hasn’t gone well. It’s a problem. I’ll see to it after the election,” Barack Obama reportedly said. With Obama due to land in New Zealand next month, Dotcom says he'll have a court subpoena waiting for the former president. When Megaupload was forcefully shut down in 2012, it initially appeared like ‘just’ another wave of copyright enforcement action by US authorities. When additional details began to filter through, the reality of what had happened was nothing short of extraordinary. Not only were large numbers of Megaupload servers and millions of dollars seized, but Kim Dotcom’s home in New Zealand was subjected to a military-style raid comprised of helicopters and dozens of heavily armed special tactics police. The whole thing was monitored live by the FBI. Few people who watched the events of that now-infamous January day unfold came to the conclusion this was a routine copyright-infringement case. According to Kim Dotcom, whose life had just been turned upside down, something of this scale must’ve filtered down from the very top of the US government. It was hard to disagree. At the time, Dotcom told TorrentFreak that then-Vice President Joe Biden directed attorney Neil MacBride to target the cloud storage site and ever since the Megaupload founder has leveled increasingly serious allegations at officials of the former government of Barack Obama. For example, Dotcom says that since the US would have difficulty gaining access to him in his former home of Hong Kong, the government of New Zealand was persuaded to welcome him in, knowing they would eventually turn him over to the United States. More recently he’s been turning up the pressure again, such as a tweet on February 20th which cast more light on that process. “Joe Biden had a White House meeting with an ‘extradition expert’ who worked for Hong Kong police and a handful of Hollywood executives to discuss my case. A week prior to this meeting Neil MacBride hand-delivered his action plan to Biden’s chief of staff, also at the White House,” Dotcom wrote. But this claim is just the tip of an extremely large iceberg that’s involved illegal spying on Dotcom in New Zealand and a dizzying array of legal battles that are set to go on for years to come. But perhaps of most interest now is that rather than wilting away under the pressure, Dotcom appears to be just warming up. A few hours ago Dotcom commented on an article published in The Hill which revealed that Barack Obama will visit New Zealand in March, possibly to celebrate the opening of Air New Zealand’s new route to the U.S. Rather than expressing disappointment, the Megaupload founder seemed pleased that the former president would be touching down next month. “Great. I’ll have a Court subpoena waiting for him in New Zealand,” Dotcom wrote. But that was just a mere hors d’oeuvre, with the main course was yet to come. But come it did. “A wealthy Asian Megaupload shareholder hired a friend of the Obamas to enquire about our case. This person was recommended by a member of the Chinese politburo ‘if you want to get to Obama directly’. We did,” Dotcom revealed. Dotcom says he’ll release a transcript detailing what Obama told his friend on March 21 when Obama arrives in town but in the meantime, he offered another little taster. “Mistakes were made. It hasn’t gone well,” Obama reportedly told the person reporting back to Megaupload. “It’s a problem. I’ll see to it after the election.” Of course, Obama’s position after the election was much different to what had gone before, but that didn’t stop Dotcom’s associates infiltrating the process aimed at keeping the Democrats in power. “Our friendly Obama contact smuggled an @EFF lawyer into a re-election fundraiser hosted by former Vice President Joe Biden,” he revealed. “When Biden was asked about the Megaupload case he bragged that it was his case and that he ‘took care of it’,” which is what Dotcom has been claiming all along. On March 21, when Obama lands in New Zealand, Dotcom says he’ll be waiting. “I’m looking forward to @BarackObama providing some insight into the political dimension of the Megaupload case when he arrives in the New Zealand jurisdiction,” he teased. Better get the popcorn ready…. https://torrentfreak.com/dotcom-obama-admitted-mistakes-were-made-in-megaupload-case-180301/

A few pieces of exciting news in the space of a few hours have many PlayStation 4 owners hot under the collar today. Following yesterday's release of a kernel exploit for firmware v4.55 by developer 'Qwertyoruiop', a few hours ago a full implementation of the exploit landed on Github courtesy of SpecterDev. On top, there's news of an interesting 'payload' quietly circulating. Largely since the advent of the third generation of games consoles in the early to mid 80s, adventurous users have been interested in making their machines do things they’re not supposed to. In common with the 8bit games-capable computers that preceded them, much emphasis was placed on piracy, with people seeking to cut console games costs with copies of what would otherwise be expensive investments. Alongside, however, was a rapidly developing “homebrew” scene in which often amateur coders sought to utilize their purchased hardware for non-conventional means. These days the process of digitally cracking open a device is much more complex and has given birth to the term ‘jailbreaking’. It can be applied to devices as diverse as iPhones and PlayStations but it all means the same thing – the removal of restrictions put in place by manufacturers in order to control what can be done with a device. These restrictions mostly relate to the running of software, with the big manufacturers wanting people to not only use ‘app stores’ that they control but also to pay for the privilege. The jailbreaking scene often aims to undermine the former but despite many good intentions, it often gets dragged into piracy as a result. Yesterday there was cause for both homebrew coders and pirates-in-waiting to celebrate with the announcement that developer ‘Qwertyoruiop’ had released the full code for his PS4 firmware 4.55 kernel exploit. While the release caused much excitement, the kernel exploit still needs a usermode entry point. As reported by Wololo, that could come via the Webkit exploit previously released by Qwertyoruiop for PS4 firmware 4.07 a while back. So, to put things into basic terms, while the new exploit works up to v4.55, the user exploit only works up to those with PS4s running v4.07, at least until another usermode exploit for later firmwares is released. But with anticipation in the air, a few hours later yet more exciting news appeared on the horizon. Taking Qwertyoruiop’s v4.55 kernel exploit and running with it, developer SpecterDev announced on Twitter that he’d published a full implementation of the exploit on Github. Twitter Ads info and privacy In other words, SpecterDev has released a fully-functional jailbreak of PS4 firmware 4.55, which opens up a whole world of opportunities for the homebrew scene – and beyond. That being said, he’s careful to note on Github that others will have to step up to fill in the gaps from here. “[The implementation] will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, does not contain any code related to defeating anti-piracy mechanisms or running homebrew,” he explained. Nevertheless, SpecterDev’s code has an inbuilt ‘ear’ that can take instructions (a so-called ‘payload’) and do something useful with them. “This exploit does include a loader that listens for payloads on port 9020 and will execute them upon receival,” he explains. Rumors suggest that there’s already some kind of payload being shared privately. We haven’t been able to confirm what it does yet but people seem excited by it. Update: Confirmation of what it does from Wololo: “When run in combination with the recently released exploit for PS4 4.55, Holy Grail lets users install and run unsigned packages. In practice, this will let 4.55 owners install and run homebrews as well as, yes, pirated PS4 games.” A video showing the jailbreak in action has been uploaded to YouTube and can be seen below. https://torrentfreak.com/new-ps4-jailbreak-hits-firmware-4-55-excites-the-masses-180228/

Switzerland hopes that its newly proposed copyright law will be enough to keep the country off the United States' Special 301 Report watchlist. The Swiss Government notes that the law addresses two of the main piracy concerns previously identified by the US. In a few weeks, the Office of the United States Trade Representative (USTR) will publish its yearly Special 301 Report, highlighting countries that fail to live up to U.S copyright protection standards. In recent years Switzerland was among countries that were placed on the ‘Watch List.’ In 2017, the US reported that the Swiss had made some progress, but not enough. Its policies towards online piracy were not up to par, according to U.S. standards. “Switzerland remains on the Watch List this year due to U.S. concerns regarding specific difficulties in Switzerland’s system of online copyright protection and enforcement,” USTR wrote in its Special 301 Report. One of the key issues the United States identified is the lack of enforcement against hosting companies that do business with pirate sites. Branding these as a “safe haven” for pirates, the US called for suitable countermeasures. A second problem that was highlighted is the so-called ‘Logistep Decision.‘ In 2010 the Swiss Federal Supreme Court barred anti-piracy outfit Logistep from harvesting the IP addresses of file-sharers. The Court ruled that IP addresses amount to private data, and outlawed the tracking of file-sharers in Switzerland. According to the USTR, this ruling prevents copyright holders from enforcing their rights, and they called on the Swiss Government to address this concern as well. Today nearly a year has passed and it looks like the recommendations were not ignored. In a letter to the USTR, the Swiss Government writes that the two main complaints are dealt with in their new copyright law, which was introduced late last year. “The draft bill, adopted by the Federal Council at its meeting on November 22, 2017, addresses both of those concerns. It aims at further modernizing Swiss copyright law for the purposes of the digital environment and steps up the fight against Internet piracy,” the Swiss write. The new copyright law addresses the hosting problem by introducing a “take-down-and-stay-down” policy. Internet services will be required to remove infringing content from their platforms and prevent that same content from reappearing. Failure to comply will result in prosecution. “The ‘stay down’ will prevent rogue websites from being hosted in Switzerland and will make the fight against Internet piracy more effective and sustainable. That should put an end to criticism directed against Switzerland as a host country for infringing sites,” Switzerland informs the U.S. Similarly, the Logistep ruling will no longer be an issue either if the country’s new copyright law is implemented. “[T]he draft bill clarifies that the processing of data for the purposes of prosecuting copyright infringement is permissible. With that, it puts an end to the debate that followed the Logistep decision about the extent to which the recording of IP addresses for prosecution purposes is admissible.” Many copyright holder groups have also asked for ISP blocking of pirate sites, but Switzerland notes that this idea is off the table for now. There is not enough support in Parliament for an Internet blocking provision which may jeopardize acceptance of the entire draft bill, their letter explains. While not mentioned in the letter, downloading and streaming copyright infringing content for personal use also remains unpunished, video games and software excepted. Uploading and other types of distribution of infringing content are not permitted, however. Still, the Swiss hope that the newly proposed changes to its copyright law will be enough to have it removed from the Special 301 Watch List. “Switzerland is confident that the revision of the Swiss Copyright Act will more effectively address the challenges posed by the Internet,” the Swiss Government writes, adding that it “looks forward to continuing to work with the U.S. to further clarify any issue relating to online piracy.” — Switzerland’s letter to the United States Trade Representative is available here (pdf). https://torrentfreak.com/switzerland-hopes-new-law-will-keep-it-off-us-pirate-watchlist-180228/

Late last year several filmmaker groups asked the US Copyright Office to lift some of the current DMCA circumvention restrictions, so they can rip and use clips from Blu-rays and other videos without repercussions. The MPAA and other industry groups don't think this is a good idea and point out that filmmakers have plenty of other options. Technically speaking it’s not hard to rip a DVD or Blu-ray disc nowadays, and the same is true for ripping content from Netflix or YouTube. However, in the US people can break the law when they do this. The DMCA’s anti-circumvention provisions specifically forbid it. There are some exemptions, such as educational and other types of fair use, but the line between legal and illegal is not always clear, some argue. Filmmakers, for example, are allowed to use small pieces of other copyrighted films under some conditions. However, this only applies to the documentary genre. This is confusing and creates uncertainty, according to the International Documentary Association, Kartemquin Films, Independent Filmmaker Project, University of Film and Video Association, and several other organizations. Late last year they penned a submission to the Copyright Office, which is currently considering updates to the exemptions, where they argued that all filmmakers should be allowed by break DRM and rip Blu-rays. The documentary exemptions have been in place for years now and haven’t harmed rightsholders in any way, they said. “There is no reason this would change if the ‘documentary’ limitation were removed. All filmmakers regularly need access to footage on DVDs and without an exemption to DVDs, many non-infringing uses simply cannot be made,” the groups noted. Not everyone agrees with this assessment though. A group of “joint creators and copyright owners” which includes Hollywood’s MPAA, the RIAA, and ESA informs the Copyright Office that such an exemption is too broad and a threat to the interests of the major movie studios. The MPAA and the other groups point out that the exemption could be used by filmmakers to avoid paying licensing fees, which can be quite expensive. “Many of the filmmakers who have participated in the rulemaking assert that license fees are often higher than they are willing to pay,” the Joint Creators and Copyright Owners write. “While unfortunate, the fact that a copyright owner has chosen to make works available on terms that are not palatable to a particular user does not make that user’s proposed use fair or justify granting an exemption.” If the filmmakers don’t have enough budget to license a video, they should look for alternatives. Simply taking it without paying would hurt the bottom line of movie studios, the filing suggests. “Many filmmakers work licensing fees into their budgets. There is clearly a market for licensing footage from motion pictures, and it is clear that unlicensed uses harm that market. “MPAA members actively exploit the market for licensing film clips for these types of uses. Each year, MPAA member companies license, collectively, thousands of clips for use in a variety of works,” the group writes. The Copyright Office has limited the exemption to the documentary genre for a good reason, the creators argue, since non-documentaries are less likely to warrant a finding of fair use. In addition, they also refute the claim that the documentary category is “vague.” They note that the International Documentary Association, which argued this, has an award ceremony for the same category, for example. Finally, the MPAA and other creators respond to calls to extend the current exemptions to 4K content, such as AACS2 protected Ultra HD discs. They see no need for this, as the filmmakers and other groups haven’t shown that they suffer negative consequences in the current situation. They have alternatives, such as regular Blu-ray discs, while allowing AACS2 circumvention could severely impact the Ultra HD ecosystem, they argue. “No one has released a universal hack to all Ultra HD films protected by AACS2. The integrity of the AACS2 and Ultra HD technology is an especially important component of the ecosystem that is resulting in the increased availability of motion pictures. “The Register and the Librarian should not undermine this integrity by authorizing widespread hacking, which could negatively impact ‘the market for or value of’ some of the industry’s most exciting products,” the Joint Creators add. The Copyright Office will take all arguments into consideration before it makes a final decision later this year. — A copy of the Joint Creators reply is available here. https://torrentfreak.com/mpaa-wants-filmmakers-to-pay-licenses-not-rip-blu-rays-180227/

The owner of ISP Bahnhof has criticized new proposals currently under consideration by the Swedish government. The new rules, which envision copyright infringers going to prison for up to six years, are said to be needed to bring Sweden into line with other EU countries. However, according to Bahnhof chief Jon Karlung, the extended tariffs have been commissioned by Hollywood According to local prosecutors who have handled many copyright infringement cases over the past decade, Sweden is nowhere near tough enough on those who commit online infringement. With this in mind, the government sought advice on how such crimes should be punished, not only more severely, but also in proportion to the damages alleged to have been caused by defendants’ activities. The corresponding report was returned to Minister for Justice Heléne Fritzon earlier this month by Council of Justice member Dag Mattsson. The paper proposed a new tier of offenses that should receive special punishment when there are convictions for large-scale copyright infringement and “serious” trademark infringement. Partitioning the offenses into two broad categories, the report envisions those found guilty of copyright infringement or trademark infringement “of a normal grade” may be sentenced to fines or imprisonment up to a maximum of two years. For those at the other end of the scale, engaged in “cases of gross crimes”, the penalty sought is a minimum of six months in prison and not more than six years. The proposals have been criticized by those who feel that copyright infringement shouldn’t be put on a par with more serious and even potentially violent crimes. On the other hand, tools to deter larger instances of infringement have been welcomed by entertainment industry groups, who have long sought more robust sentencing options in order to protect their interests. In the middle, however, are Internet service providers such as Bahnhof, who are often dragged into the online piracy debate due to the allegedly infringing actions of some of their customers. In a statement on the new proposals, the company is clear on why Sweden is preparing to take such a tough stance against infringement. “It’s not a daring guess that media companies are asking for Sweden to tighten the penalty for illegal file sharing and streaming,” says Bahnhof lawyer Wilhelm Dahlborn. “It would have been better if the need for legislative change had taken place at EU level and co-ordinated with other similar intellectual property legislation.” Bahnhof chief Jon Karlung, who is never afraid to speak his mind on such matters, goes a step further. He believes the initiative amounts to a gift to the United States. “It’s nothing but a commission from the American film industry,” Karlung says. “I do not mind them going for their goals in court and trying to protect their interests, but it does not mean that the state, the police, and ultimately taxpayers should put mass resources on it.” Bahnhof notes that the proposals for the toughest extended jail sentences aren’t directly aimed at petty file-sharers. However, the introduction of a new offense of “gross crime” means that the limitation period shifts from the current five years to ten. It also means that due to the expansion of prison terms beyond two years, secret monitoring of communications (known as HÖK) could come into play. “If the police have access to HÖK, it can be used to get information about which individuals are file sharing,” warns Bahnhof lawyer Wilhelm Dahlborn. “One can also imagine a scenario where media companies increasingly report crime as gross in order to get the police to do the investigative work they have previously done. Harder punishments to tackle file-sharing also appear very old-fashioned and equally ineffective.” As noted in our earlier report, the new proposals also include measures that would enable the state to confiscate all kinds of property, both physical items and more intangible assets such as domain names. Bahnhof also takes issue with this, noting that domains are not the problem here. “In our opinion, it is not the domain name which is the problem, it is the content of the website that the domain name points to,” the company says. “Moreover, confiscation of a domain name may conflict with constitutional rules on freedom of expression in a way that is very unfortunate. The issues of freedom of expression and why copyright infringement is to be treated differently haven’t been addressed much in the investigation.” Under the new proposals, damage to rightsholders and monetary gain by the defendant would also be taken into account when assessing whether a crime is “gross” or not. This raises questions as to what extent someone could be held liable for piracy when a rightsholder maintains damage was caused yet no profit was generated. https://torrentfreak.com/hollywood-commissioned-tough-jail-sentences-for-online-piracy-isp-says-180227/

Music publisher BMG has petitioned the Court of Appeals for a rehearing of the piracy liability case against Internet provider Cox. The panel of judges reached the wrong conclusion when it overturned the $25 million verdict and issued a new trial, the company says. The RIAA and the National Music Publishers Association back the request. Earlier this month, the Court of Appeals for the Fourth Circuit overturned the $25 million piracy liability verdict against Internet provider Cox. The panel of three judges concluded that the district court made an error in its jury instruction and ordered a new trial. The erroneous instruction said that the ISP could be found liable for contributory infringement if it “knew or should have known of such infringing activity.” The Court of Appeals agrees that based on the law, the “should have known” standard is too low. As a result of the ruling, music publisher BMG Rights Management and Cox would have to go head to head again in a new trial. However, according to BMG, the Court of Appeals itself made a mistake. A few days ago the copyright holder petitioned the court for a rehearing en banc, asking for a do-over before all the judges of a court. The music publisher argues that the appeals court judges mistakenly reached their decision based on a legal principle that applies to “inducement” of liability, while BMG was pursuing a claim of “material contribution.” “The panel’s unprecedented application of a heightened knowledge standard creates a conflict with decisions and pattern jury instructions from other circuits as well as with the common-law rules underlying contributory infringement. “All of those recognize that BMG’s material-contribution theory requires only constructive knowledge,” BMG’s brief adds. Even if the appeals court persists with its assertion that the liability standard is “willful blindness” rather than “should have known,” a new trial would not be warranted, according to the music publisher. They point out that plenty of evidence was presented which proved that Cox was wilfully blind to the copyright infringements and describe the erroneous instruction as a “harmless error of the most benign kind.” The music publisher’s request for a rehearing is supported by the RIAA, which filed an amicus curiae brief together with the National Music Publishers Association. Both music industry groups back BMG’s arguments and ask the appeals court to consider a rehearing, stating that it would be in the best interests of artists, songwriters, and other rightsholders. “The level of copyright infringement that takes place over the Internet is ‘staggering,’ and it is vital that copyright owners have effective mechanisms to address it. It is also critical that copyright owners can adequately address infringement that occurs in other contexts. “If the panel’s decision is not corrected, it would threaten the very incentives of artists, songwriters, and others to create valuable works and distribute them to the public,” the RIAA and NMPA add. For the RIAA the case is particularly important since it filed a similar lawsuit againstInternet provider Grande Communications last year. Given what’s at stake, we can assume that Cox will protest the request for a rehearing. And it wouldn’t be a big surprise if other telecommunications companies take the same position. — BMG’s petition is available here (pdf) and a copy of the RIAA/NMPA motion can be found here (pdf). https://torrentfreak.com/bmg-wants-appeals-court-to-rehear-cox-piracy-liability-case-180226/

Four men sentenced last year for their part in running several pirate sites have been told they will no longer have to spend time behind bars. After being ordered to spend up to ten months in prison, the court of appeal has now decided that for their activities on Dreamfilm, TFplay, Tankafetast and PirateHub, the men should walk free but pay increased damages to the entertainment industries. With The Pirate Bay proving to be somewhat of an elusive and irritating target, in 2014 police took on a site capturing an increasing portion of the Swedish pirate market. Unlike The Pirate Bay which uses torrents, Dreamfilm was a portal for streaming content and it quickly grew alongside the now-defunct Swefilmer to dominate the local illicit in-browser viewing sector. But after impressive growth, things came to a sudden halt. In January 2015, Dreamfilm announced that the site would be shut down after one of its administrators was detained by the authorities and interrogated. A month later, several more Sweden-based sites went down including the country’s second largest torrent site Tankefetast, torrent site PirateHub, and streaming portal Tankefetast Play (TFPlay). Anti-piracy group Rights Alliance described the four-site networks as one of “Europe’s leading players for illegal file sharing and streaming.” Image published by Dreamfilm after the raid After admitting they’d been involved in the sites but insisting they’d committed no crimes, last year four men aged between 21 and 31-years-old appeared in court charged with copyright infringement. It didn’t go well. The Linköping District Court found them guilty and decided they should all go to prison, with the then 23-year-old founder receiving the harshest sentence of 10 months, a member of the Pirate Party who reportedly handled advertising receiving 8 months, and two others getting six months each. On top, they were ordered to pay damages of SEK 1,000,000 ($122,330) to film industry plaintiffs. Like many similar cases in Sweden, the case went to appeal and late last week the court handed down its decision which amends the earlier decision in several ways. Firstly, the Hovrätten (Court of Appeals) agreed that with the District Court’s ruling that the defendants had used dreamfilm.se, tfplay.org, tankafetast.com and piratehub.net as platforms to deliver movies stored on Russian servers to the public. One defendant owned the domains, another worked as a site supervisor, while the other pair worked as a programmer and in server acquisition, the Court said. Dagens Juridik reports that the defendants argued that the websites were not a prerequisite for people to access the films, and therefore they had not been made available to a new market. However, the Court of Appeal agreed with the District Court’s assessment that the links meant that the movies had been made available to a “new audience”, which under EU law means that a copyright infringement had been committed. As far as the samples presented in the case would allow, the men were found to have committed between 45 and 118 breaches of copyright law. The Court also found that the website operation had a clear financial motive, delivering movies to the public for free while earning money from advertising. While agreeing with the District Court on most points, the Court of Appeals decided to boost the damages award from SEK 1,000,000 ($122,330) to SEK 4,250,000 ($519,902). However, there was much better news in respect of the prison sentences. Taking into consideration the young age of the men (who before this case had no criminal records) and the unlikely event that they would offend again, the Court decided that none would have to go to prison as previously determined. Instead, all of the men were handed conditional sentences with two ordered to pay daily fines, which are penalties based on the offender’s daily personal income. Last week it was reported that Sweden is preparing to take a tougher line with large-scale online copyright infringers. Proposals currently with the government foresee a new crime of “gross infringement” under both copyright and trademark law, which could lead to sentences of up to six years in prison. https://torrentfreak.com/pirate-site-operators-jail-sentences-overturned-by-court-of-appeal-180226/

The top 10 most downloaded movies on BitTorrent are in again. 'Justice League' tops the chart this week, followed by ‘Thor Ragnarok'. 'Black Panther' completes the top three. This week we have two newcomers in our chart. Justice League is the most downloaded movie. The data for our weekly download chart is estimated by TorrentFreak, and is for informational and educational reference only. All the movies in the list are Web-DL/Webrip/HDRip/BDrip/DVDrip unless stated otherwise. RSS feed for the weekly movie download chart. THIS WEEK’S MOST DOWNLOADED MOVIES ARE: Movie Rank Rank last week Movie name IMDb Rating / Trailer Most downloaded movies via torrents 1 (1) Justice League 7.1 / trailer 2 (2) Thor Ragnarok 8.1 / trailer 3 (…) Black Panther (HDTS) 7.9 / trailer 4 (5) The Shape of Water (DVDScr) 8.0 / trailer 5 (4) Coco 8.9 / trailer 6 (8) Lady Bird 7.7 / trailer 7 (3) Pitch Perfect 3 6.2 / trailer 8 (…) The Disaster Artist 7.7 / trailer 9 (6) Three Billboards Outside Ebbing, Missouri 8.3 / trailer 10 (7) Daddy’s Home 2 6.0 / trailer