EU authorities start seizing VPN services

[alani123]

It hit the news recently that EU authorities have begun major operations against VPN services.
A couple of days ago a VPN service called first VPN was seized electronically in an operation where multiple state authorities from all over Europe collaborated:
https://www.securityweek.com/first-vpn-cybercrime-service-disrupted-administrator-arrested/
https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown

Now today we have need of another seizure, this time with server seizures and arrests:




It seems like the EU is doing it's best to play hardball with VPNs, especially those not having KYC or bank payments as their primary payment method.


Be careful out there. I'm not sure how this could be mitigated from an opsec perspective. Maybe we need a decentralised VPN network.

[OmegaStarScream]

-snip-

Be careful out there. I'm not sure how this could be mitigated from an opsec perspective. Maybe we need a decentralised VPN network.

We already do, most popular one probably being nym: https://nym.com/

There are a couple of other ones, although I have not tried them and I'm not sure how good they are (in terms of privacy and decentralization) or how do they compare to each other.

[Upgrade00]

NYM VPN is the top choice if you're looking for open source and decentralized options. I discovered then last year and would recommend.

Mullvad is also a good option and they allow you mail in cash payments for those who wants extra privacy.

[TryNinja]

NYM VPN is the top choice if you're looking for open source and decentralized options. I discovered then last year and would recommend.

Besides, it literally costs $28,68 for 2 years if paid with their coin $NYM (which you can just buy and send to the checkout address).

$1,20 per month for a VPN.

[Z-tight]

It seems like the EU is doing it's best to play hardball with VPNs, especially those not having KYC or bank payments as their primary payment method.

Yeah, any service that facilitates privacy is a target, they would accuse them of money laundering or aiding criminals to perpetrate their crime. Surely, it cannot be only criminals who use these services, right? But that counts for nothing i guess and as long as it has a single point of failure, there is a chance they would eventually take it down.

[CreepyUncleJoe]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

[rat03gopoh]

According to the news, FirstVPN had previously been flagged for deliberately serving cybercrime for years. So I think your headline is a bit hyperbolic. This wasn't an operation against global VPN services.

For years, the service, known as "First VPN," was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

And also added that DoubleVPN was shut down in 2021. www.secnews.gr/en/358169/doublevpn-arxes-ekleisan-vpn-ipiresia-xrisimopoiountan-apo-egklimaties/

[Free Market Capitalist]

According to the news, FirstVPN had previously been flagged for deliberately serving cybercrime for years. So I think your headline is a bit hyperbolic. This wasn't an operation against global VPN services.

For years, the service, known as "First VPN," was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

And also added that DoubleVPN was shut down in 2021. www.secnews.gr/en/358169/doublevpn-arxes-ekleisan-vpn-ipiresia-xrisimopoiountan-apo-egklimaties/

Thanks for that. I found that OP's FUD strange, given that the EU has no laws against VPNs:

There is currently no legislation in the European Union that bans or criminalizes the use of Virtual Private Networks (VPNs). VPNs are entirely legal to use across all EU member states for online privacy, secure browsing, and accessing remote corporate networks.

However, while the technology itself is legal, EU regulators are heavily scrutinizing VPNs in two specific contexts:

Online Age Verification: As the EU tightens child protection frameworks under the Digital Services Act, some policymakers are viewing VPNs as a "loophole" that minors can use to bypass parental controls and age-verification sites. While total VPN bans are not on the table, the EU is debating how to make age-verification systems harder to bypass.

Anti-Piracy Enforcement: Localized legal actions have targeted VPNs in specific copyright battles. For example, a court in Spain ordered major VPN providers to block IP addresses linked to illegal streaming of football matches, marking a shift where privacy tools are being pressured to assist in content controls.Because VPNs are treated as standard privacy infrastructure, they remain fully protected by EU privacy frameworks, including the General Data Protection Regulation (GDPR).

The quote comes from Gemini AI after doing a Google search.

[alani123]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

The EU claims to have had some of these VPN services on their watchlist for a good while and acted only now.

Is it coincidence that there is now talk to ban VPNs too? Probably not. They're trying to create a false image that VPN use is dangerous for the general public and has nothing to offer.
Why else wouldn't they target these supposedly criminal operations earlier?

[Yamane_Keto]

If law enforcement agencies obtain the logs and all the IP addresses of subscribers who used the service's servers, then the privacy service is what caused their privacy to be exposed.

We already do, most popular one probably being nym: https://nym.com/

My subscription ends next month, I will give them a try.

[Lucius]

As far as I'm concerned, they (the EU) can ban every VPN that exists for any crazy reason they can think of, but if they think that's going to achieve anything, they're sorely mistaken. Real criminals use Tor and various other much more sophisticated methods to conceal their identity, not VPNs, whose security is actually at a very low level.

When I just remember that years ago they started withdrawing EUR 500 banknotes because they were allegedly used by criminals, I wonder what is in the minds of these people - Switzerland has banknotes of 1000 francs, which is worth approximately the same as the euro, and they have no problems with criminals and terrorists.

[TryNinja]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

Still, that's weird.

We all know cybercriminals and ransomware actors use all kinds of "regular" VPNs, like Mullvad or ProvonVPN. Is it only a crime if they are actively marketing themselves as "criminals-friendly"?

[ingiltere]

I haven't used Nym but I know Mullvad is very popular. Unfortunately a VPN has become a necessity for people living in countries like mine. Because when you try to access the internet normally, half the websites don't even load. The government has arbitrarily blocked everything.
It's not good that the EU is taking this approach. It seems they're becoming more authoritarian as well. It's up to people to decide why they use a VPN. If there's a crime involved, they should investigate it and punish the culprit. Not everyone who uses that service.

[CreepyUncleJoe]

Still, that's weird.

We all know cybercriminals and ransomware actors use all kinds of "regular" VPNs, like Mullvad or ProvonVPN. Is it only a crime if they are actively marketing themselves as "criminals-friendly"?

Yeah, that’s basically the legal distinction.

Samourai Wallet devs made a similar mistake when they publicly posted stuff like “welcome Russian oligarchs.” That kind of marketing makes it way easier for authorities to argue you’re knowingly catering to sanctions evasion or criminal activity, instead of just providing neutral privacy tools.

[rat03gopoh]

Why else wouldn't they target these supposedly criminal operations earlier?

I don't know the exact reason; I assume the surveillance duration determines how much evidence they can gather. Or more importantly, they actually want to uncover a larger criminal network that's still using this service.

[Z-tight]

Yeah, that’s basically the legal distinction.

If that is the case, then i guess these services should know better than to advertise in cybercriminal platforms, since it easily makes them a target of law enforcement agencies. I believe without advertising there, criminals would still find their services and make use of it.

[PrivacyG]

As far as I'm concerned, they (the EU) can ban every VPN that exists for any crazy reason they can think of, but if they think that's going to achieve anything, they're sorely mistaken. Real criminals use Tor and various other much more sophisticated methods to conceal their identity, not VPNs, whose security is actually at a very low level.

It will achieve some thing in my opinion.  Privacy has to be gone and out lawed.  This is not even my thoughts any more, do not forget the Welcome to 2030 essay!  The age verification.  The European Digital Identity.  Every thing is scheduled to only make Privacy tougher to achieve or even out lawed!

Tor is already known as the 'dark side' of the Internet where all crime happens.  If Tor becomes illegal tomorrow, I can assure you over 90 percent of people would think this is a good thing because it was powering all the crime.  I actually believe CreepyUncleJoe is closer to the truth.  Because when you think about it.  They would be stupid to seize the lower security options such as VPNs while leaving Tor out in the wild when if they did the other way around and cracked down on Tor first, they would leave us with only surface level Privacy which is easy for them to get under.

On the other hand.  Tor Project was partially funded by United States federal agencies so it looks like they would shoot them selves in the foot if they banned what they funded them selves.

When I just remember that years ago they started withdrawing EUR 500 banknotes because they were allegedly used by criminals, I wonder what is in the minds of these people - Switzerland has banknotes of 1000 francs, which is worth approximately the same as the euro, and they have no problems with criminals and terrorists.

I am going to put my usual double layered tin foil hat on now and say that this was only one of the small but important steps in making people more used to less Cash and more Cards around.  Withdrawing a 500 Euro bank note here, adding taxes to Cash on Delivery orders and almost forcing people to pay by Card by making it way more possible for Cash terminals to have a longer queue there, they are all restricting so much on Cash payments that it makes you look at the people who pay by Card and say, 'why am I the stupid one sitting in a queue?'.

[Lucius]

~snip~
On the other hand.  Tor Project was partially funded by United States federal agencies so it looks like they would shoot them selves in the foot if they banned what they funded them selves.

It is true that Tor has donors from some government agencies in the US, but they are not some of the agencies that people usually think of. However, when we talk about privacy, Tor can be a trap set by those who want control over those who want privacy, or it is something that was developed for the reason of being a private and secure network for the communication of the privileged, and then it got out of control.

Many people do not know that even some of the most famous intelligence agencies have their own onion link, which in itself shows that using Tor for your privacy is completely legal. On the other hand, research has shown that a very large percentage of VPNs have their owners in various spy agencies.

[PX-Z]

It seems like the EU is doing it's best to play hardball with VPNs, especially those not having KYC or bank payments as their primary payment method.

Be careful out there. I'm not sure how this could be mitigated from an opsec perspective. Maybe we need a decentralised VPN network.

Sezeing VPN? It seems like the EU will do anything against anyone who leads, makes, or offers any privacy-centered tools and apps, which can be used in the EU to mask their privacy. From their side, it's usually framed as a way to combat cybercrime and improve enforcement. But for people focused on privacy, it can look like a move against anonymity tools in general.

I think the concern is more about misuse than targeting privacy itself, but i get why it raises questions, especially when VPNs and similar tools are involved. As for TOR, people have been predicting pressure on it for years, but it's still widely used, so it's not that simple to just "target and remove" it lol