Why Edward Snowden is urging users to stop using ExpressVPN?

MrGuvernment

MrGuvernment

Fully [H]
Joined
Aug 3, 2004
Messages
21,795

Why Edward Snowden is urging users to stop using ExpressVPN?​

https://securityaffairs.co/wordpress/122365/intelligence/edward-snowden-expressvpn.html

https://twitter.com/Snowden/status/1438291654239215619?s=20

The popular whistleblower Edward Snowden recommends customers of ExpressVPN VPN service to stop using it.​

Last week the Israeli cybersecurity firm Kape Technologies has acquired the industry’s leading virtual private networks ExpressVPN, as part of a $936 million deal. Kape announced that the acquisition will more than double its overall customer base, from almost 3 million customers to more than 6 million.

Edward Snowden expressed concerns about the VPN service offered by ExpressVPN and has warned users to stop using it.

Why Snowden is worried about ExpressVPN?

Last week, three former NSA employees (Marc Baier, 49, Ryan Adams, 34, and Daniel Gericke, 40) entered into a deferred prosecution agreement that restricts their future activities and employment.

The trio has worked as hackers-for-hire for the United Arab Emirates cybersecurity company DarkMatter between January 2016 and November 2019.

The US Department of Justice requires the payment of $1,685,000 in penalties ( $750,000, $600,000, and $335,000, respectively) to resolve its investigation regarding violations of U.S. export control, computer fraud and access device fraud laws. The three suspects worked at the UAE company and developed at least two iOS zero-click exploits dubbed Karma and Karma 2.

DOJ also ordered the former intelligence employees to cooperate with the relevant department and FBI components; they are also condemned to a lifetime ban on future US security clearances.

Snowden was likely worried by the fact one of the three former NSA employees, Daniel Gericke, was ExpressVPN’s CIO.

In 2019, the Reuter agencies published a report that detailed the activity of “a secret hacking team of American mercenaries” that joined Project Raven as part of a clandestine team of experts that helped the United Arab Emirates in conducting a surveillance program and conducting hit-and-run hacking operations.

ExpressVPN published an official response that confirmed the accusation of the DoJ but that pointed out that the experts took part to the Project Raven before he joined to the company in 2019.

“We find it deeply regrettable that the news of the past few days regarding Daniel Gericke has created concerns among our users and given some cause to question our commitment to our core values. To be completely clear, as much as we value Daniel’s expertise and how it has helped us to protect customers, we do not condone Project Raven. The surveillance it represents is completely antithetical to our mission.” reads the response. “When we hired Daniel in December 2019, we knew his background: 20 years in cybersecurity, first with the U.S. military and various government contractors, then with a U.S. company providing counter-terrorism intelligence services to the U.S. and its ally, the U.A.E., and finally with a U.A.E. company doing the same work. We did not know the details of any classified activities, nor of any investigation prior to its resolution this month. But we did know what we had built here at ExpressVPN: a company where every system and process is hardened and designed to minimize risks of all kinds, both external and internal. “

ExpressVPN added that it has implemented multiple security measures to implement a secure service that protectsthe privacy of its users.

“While we are confident that our commitment to this mission is unwavering, we understand that actions speak louder than words. To begin with, we’ll be increasing the cadence of our existing third-party audits to annually recertify our full compliance with our Privacy Policy, including our policy of not storing any activity or connection logs. This is just a first step, and we will continue to strive to earn your trust,” ExpressVPN blog post on the issue read.

Follow me on Twitter: @securityaffairs and Facebook

Click to expand...
 
All these VPN services seem to operate in two configurations, as a front end on an AWS instance, which really protects you against nothing as that is all logged on Amazon's side and god knows what they do with that there. Or as an ISP service being kept afloat by venture capital until they get large enough they can sell out. The cycle continues, if you don't own the hardware then all you have changed is who is watching your data and the hoops that interested parties need to jump through to get to it.
 
Ya, VPN's are nice to hide your ISP, but once a government agency gets involved and if they have enough power to get a court order to the company running the VPN, you will get logged if they ask. Just as what happened with ProtonVPN. They fact they got an order from France, and were forced to do it, just for a guy who was setting up environmental rallies?Imagine what power they will have to push to get logs enabled for a real criminal.
 
MrGuvernment said:
Ya, VPN's are nice to hide your ISP, but once a government agency gets involved and if they have enough power to get a court order to the company running the VPN, you will get logged if they ask. Just as what happened with ProtonVPN. They fact they got an order from France, and were forced to do it, just for a guy who was setting up environmental rallies?Imagine what power they will have to push to get logs enabled for a real criminal.
Click to expand...
To be fair that "Activist" and his compatriots are currently under house arrest and have pending charges against them for Terrorism related activities in France and there may have been a connection to the 2015 attack that left 130 people dead. So not exactly just for their environmental rallies but yes, if the information exists the necessary authorities will get access to it one way or another.
 
Lakados said:
To be fair that "Activist" and his compatriots are currently under house arrest and have pending charges against them for Terrorism related activities in France and there may have been a connection to the 2015 attack that left 130 people dead. So not exactly just for their environmental rallies but yes, if the information exists the necessary authorities will get access to it one way or another.
Click to expand...
My bad on that then, I had not read deep into them and just what one article had noted, in that case then! log it all
 
MrGuvernment said:
My bad on that then, I had not read deep into them and just what one article had noted, in that case then! log it all
Click to expand...
Yeah but in your defense, most of the sites are reporting about how Proton is selling out its customers and pushing articles about government overreach and blah blah blah, but it's not like the French government just asked Proton for the information. The Police nationale, had to put in a formal request with Interpol who then had to put in a request with Swiss Law enforcement, who then had to do up all the legal proceedings to formally request that Proton turn over the logs. That is a hell of a lot of red tape which can take months or years to actually complete, the reality of this situation is less of a "turn over your logs" and more of a "we are requesting your assistance with a police sting operation".
 
That is the frustrating part of it all, as you noted, everyone thinks Proton sold out.. with no understanding of what actually occurred, and that it was all done via legal methods and they had to, by law, oblige and follow through, or likely risk being shutdown entirely or their business severely hampered in some form by the government.
 
blackmomba said:
Sorry what's being logged on AWS exactly?
Click to expand...
Amazon logs everything they can from whatever they can. Guaranteed any initial handshakes before the encrypted tunnel is set up that's logged, along with the source and destination of any of said tunnels. They might not see what is in the tunnel but they will have records of anything coming to or from the hosted AWS server.
 
I love that in 2021 people still think VPNs hide you from the government , they are great for geo restricted content and such like watching Netflix... but if you think you are truly anonymous on the internet I've got some bad news for you...
 
Lakados said:
Yeah but in your defense, most of the sites are reporting about how Proton is selling out its customers and pushing articles about government overreach and blah blah blah, but it's not like the French government just asked Proton for the information. The Police nationale, had to put in a formal request with Interpol who then had to put in a request with Swiss Law enforcement, who then had to do up all the legal proceedings to formally request that Proton turn over the logs. That is a hell of a lot of red tape which can take months or years to actually complete, the reality of this situation is less of a "turn over your logs" and more of a "we are requesting your assistance with a police sting operation".
Click to expand...
Additionally, Proton didn't hand over logs as they didn't have logs. The order was for Proton to start logging that specific user from the time the court order was valid. A very different thing from what people think Proton did.
 
T_A said:
I love that in 2021 people still think VPNs hide you from the government , they are great for geo restricted content and such like watching Netflix... but if you think you are truly anonymous on the internet I've got some bad news for you...
Click to expand...
I always say - if you have attracted the interest of a state-level actor (let alone a superpower) ... good luck!
 
You must log in or register to reply here.
Back
Top