OVPN received a court order from the Rights Alliance (RA) in Sweden, representing AB Svensk Filmindustri and Nordisk Film A/S. The Rights Alliance (RA) requested information connected to one user account. They want to know which user was allocated a specific Public IPv4 address, at a specific time. Furthermore, RA wants to know the name, address, payment information as well as how long that specific user account was a paying subscriber to OVPN. We are contesting the injunction.
To be clear, OVPN can not provide the requested information as there are no logs related to which customer was historically allocated a specific IP address.
OVPN is the privacy friendly VPN provider. As such, our entire infrastructure is built with privacy & security as the core principles. OVPN does not log any activity when connected to our VPN service. Therefore, we do not know who is connected to our service, what they are doing or when they are doing it. Nothing can be connected to an account; there is:
- no logging of traffic
- no logging of timestamps
- no logging of DNS requests
- no logging of IP addresses
- no logging of MAC addresses
- no logging of individual user bandwidth volumes
We own every single server used to run our service. All VPN servers run without any hard drives - instead we use tmpfs storage in RAM. Writing permissions for the OpenVPN processes have been removed, as well as syslogs. Our VPN servers do not support physical console access, keyboard access nor usb access.
Process
This injunction has been quite interesting, where RA first issued an injunction towards our ISP in Sweden as they thought the IP address in question was theirs. After RA learned what whois is, and learnt that the IP address in reality is ours, they filed an injunction against OVPN. We were literally notified about the injunction against OVPN in a Swedish online newspaper, as RA had submitted an incorrect postal address to our office in the injunction, which meant that we didn't receive it. The injunction was only received after I called the court requesting information.
Due to OVPN's insurance that helps cover trial costs, we immediately retained legal counsel to help fight the injunction. Since we were only given two days to provide an answer, we submitted our response on Wednesday. In accordance with Swedish laws, the entire injunction is publicly available (Swedish). Our response is available here (Swedish).
As stated numerous times across our website, OVPN does not keep any logs. That's true for all services that we offer. The only difference between Public IPv4 and our ordinary service is that for Public IPv4, a specific IP address is reserved for a specific user. That means that OVPN has the ability to check to whom a Public IPv4 address is allocated to right now. However, we can not provide any information as to who had a specific Public IPv4 address at a specific date, as users are free to change Public IPv4 address at will, and another user might have been using that Public IPv4 address at that time.
We wholeheartedly disagree with the Rights Alliance claims that we're running a "disloyal service" used to circumvent law enforcement. On the contrary, we have a wide range of different customers, such as journalists, lawyers, politicians, government agencies and consumers. To be perfectly clear: We do not, in any way, endorse or advocate using OVPN to commit crimes. It's something we are very clear about in our Terms of Service.
Our main goal is to protect people from hackers and avoid being monitored online. We wholeheartedly believe that people have a right to communicate privately whether it is in a physical or a digital world. Communications online should be as private as a communication in a room between two people.
We are standing firm.