> Electronic Communications Act (2022:482) (LEK) Does not apply to Mullvad VPN AB
According to LEK’s definitions, LEK does not apply to Mullvad since we, as a VPN service provider are not regarded as an electronic communications network nor an electronic communications service.
This is super interesting. I don't know anything about Swedish law, but I'd find it difficult to believe that a VPN provider in the USA would not fall into one of those two classifications. The devil is in the details, of course: definitions of terms of art such as these usually accompany the rules or laws that involve them - at least under U.S. law.
I would love to hear from a qualified Swedish lawyer on the question.
If you are curious about the definitions of these terms, you can read the law in full here: https://lagen.nu/2022:482 — specifically paragraph 7 in chapter 1.
Not sure how useful it is through Google Translate, but to your point: yes, there are definitions.
> We have now received a response from the Swedish Prosecution Authority and the prosecutor in charge of the operation, who told us that the search warrant was a decision made in international legal cooperation with Germany
Yes that's the crux of it. Similarly, - the US can't legally spy on it's citizens, but it could absolutely sell the same spy software to Australia and let Australia spy on our citizens, and then broker the data back and forth. Psh those pesky civil rights seem to go out the window as long as a foreign country is asking.
> the US can't legally spy on it's citizens, but it could absolutely sell the same spy software to Australia and let Australia spy on our citizens, and then broker the data back and forth.
I thought that it was well known that, in fact, this was happening
https://en.wikipedia.org/wiki/Five_Eyes
One of the core principles is that members do not spy on other governments in the alliance. U.S. Director of National Intelligence, Admiral Dennis C. Blair, said in 2013: "We do not spy on each other. We just ask."[87]
In recent years, documents of the FVEY have shown that they are intentionally spying on one another's citizens and sharing the collected information with each other. Although the FVEYs countries claim that all intelligence sharing was done legally and followed the domestic law of each nation. [11][12][13][14][88] Shami Chakrabarti, the director of the advocacy group Liberty, claimed that the FVEY alliance increases the ability of member states to "subcontract their dirty work" to each other.[89] The former NSA contractor Edward Snowden described the FVEY as a "supra-national intelligence organisation that doesn't answer to the laws of its own countries". While many claims of illegal intelligence sharing among FVEY nations have been made, only once has any FVEY intelligence agency been shown to have broken the law with intelligence sharing in Canada.[10]
I don't see how that makes any sense at all. Nothing happened in this case that the Swedish police couldn't do themselves without any international requests.
Only partly, the argument that OVPN put forward had two parts:
1. They have no information to hand over as they do not keep logs.
2. There is no law that requires them to keep logs.
They proved the first part in court, but there wasn't anything in the torrentfreak article about the second point. The second point is the relevant one here as Mullvad are making both of the same claims. While they have a legal for the first one (case law) the second is still untried as far as I could tell (only made a quick search).
For the second part to be proven, somebody would need to take them to court on the second point. Nobody has tried to do that (yet) and so the question still open, and it depends on how you interpret the wording of the law https://lagen.nu/2022:482. In particular, is the definition strict enough that it applies to the operators of the hardware that makes up the network, or does it apply to a virtual service over the top.
I'm not a lawyer, there is a lot of subtlety in how §7 is written that I do not claim to be aware of, and my swedish is quite basic.
True, we did not have full lock downs. However there were multiple restrictions in place through various phases of the pandemic. Restaurants/bars/clubs closed at 8 pm as opposed to being open to 1 am/ 3am. Max 4 people at a table (with mandated spacing in between). No events with crowds allowed (all theaters, shows, sporting events etc cancelled/without audience). Masks in subway.
Sweden is also not best in class when it comes to privacy. We've introduced far reaching mass surveillance laws, first aimed at counter terrorism but slowly the allowed usage has widened. There EU chat control bill is not being opposed by the parties in power, nor the largest opposition party.
I would not be surprised if the definition you're talking about changed, although it's not a given. Could go either way.
Their summary at the end is a hell of a statement. Not many organizations would reasonably be able to say such a thing. Funny that a served warrant happens to be good marketing but I guess that's just the world we live in.
The previous thread about this incident was incredibly frustrating to read, with many more or less openly saying that Mullvad was lying or somehow secretly cooperating with authorities in order to keep their hardware. Hopefully this post can convince these people that what happened isn’t as incredible and unrealistic as they seem to assume.
Interesting read. If anyone else got curious why Amagicom AB was mentioned, it seems to be the parent company of Mullvad.
I'm still surprised the police left without any fuzz because Mullvad surely must keep track of both transactions and the connected computers (to limit use). But maybe that data is stored somewhere else.
I'm also a bit surprised it took the police one month from the approved search warrant to them actually doing it. Unless I misunderstood.
> I'm still surprised the police left without any fuzz because Mullvad surely must keep track of both transactions and the connected computers (to limit use). But maybe that data is stored somewhere else.
First, I'm not surprised because it sounds like the Swedes knew what the result was going to be from their history with Mullvad. It sounds like they performed the action because of the international nature of the request, but they expected the result.
Second, the only thing that Mullvad needs to keep track of to run their business is which accounts have paid and when they will need to pay again. They do not need to keep anything more than that. Based on their pricing model, they do not need to worry about who is connected where, when, etc.
It's described as blackmail that stopped institutions from doing their work, so possibly an encryption virus? The German police had an IP going to Mullvad so it kinda makes sense that they would ask Swedish police to get info on who used it? Would be an error on their part to not follow the lead?
Well my point was, if German police is making international requests to check out a vpn provider based on an ip from 2 years ago, probably they're running out of ideas at that point, possibly even aware that the data is no longer there, and just responding to political pressure to "do something".
Mullvad even pointed out that Swedish police are well aware at this point that there's no useful information for them there. That's why I think probably it's just to appease some politican or DA somewhere, or some other type of strange bureaucratic machination.
Investigations take time. It's possible that they managed to get a disk dump of a compromised server and found a Mullvad config file, for instance, and they were just trying to follow the trail back to the criminals that carried out the attack.
I'm guessing the authorities were hoping that Mullvad lies about their no logs policy, like some cheap VPN providers do.
This is super interesting. I don't know anything about Swedish law, but I'd find it difficult to believe that a VPN provider in the USA would not fall into one of those two classifications. The devil is in the details, of course: definitions of terms of art such as these usually accompany the rules or laws that involve them - at least under U.S. law.
I would love to hear from a qualified Swedish lawyer on the question.