OpenVPN Support Forum

From the Terms of Service at PrivateTunnel.com (https://www.privatetunnel.com/index.php/tos.html):

We respect your privacy and will not disclose it to a third-party, except in the following situations:

1. At the request of law enforcement agencies in compliance with all procedures established by law.

This wording seems a little loosey-goosey to me. I would expect PrivateTunnel to comply with the terms of a properly executed judicial warrant for disclosure. However, the wording above suggests that PrivateTunnel may disclose my personal information and decryption keys to "law-enforcement" under much less stringent conditions.

For most law enforcement agencies, the first step of "established procedure" is to “Ask politely”. Under these Terms, PrivateTunnel.com would be justified in complying with such a request.

Secondly, what constitutes “law enforcement”? Does it include any of these:

• • Private Investigator?
  • Security Guard?
  • Auditors?
  • The IT guy, ostensibly investigating a policy violation?

In short, the language used by PrivateTunnel.com does not inspire my confidence that this is an organization dedicated to preserving my privacy.

Ironically, in this paranoid day and age, uttering the words “national security” magically opens all doors. Stronger stuff is required to achieve real privacy.

LoadingDose wrote: This wording seems a little loosey-goosey to me. I would expect PrivateTunnel to comply with the terms of a properly executed judicial warrant for disclosure. However, the wording above suggests that PrivateTunnel may disclose my personal information and decryption keys to "law-enforcement" under much less stringent conditions.

For most law enforcement agencies, the first step of "established procedure" is to “Ask politely”. Under these Terms, PrivateTunnel.com would be justified in complying with such a request.

Secondly, what constitutes “law enforcement”? Does it include any of these:

• • Private Investigator?
  • Security Guard?
  • Auditors?
  • The IT guy, ostensibly investigating a policy violation?

Wow, someone other than me actually scans these TOS in fine detail -- great to know

The poll system is down, so I'll just manually enter my vote: I'll choose "[2] Pretty much"...... altough with added reservation. Borderline [2] / [3].

There is no traffic logging policy, so the safe assumption is that everything is logged for a long time. I agree with basically your entire analysis of the situation. The only thing I would add, is just that because they say they will comply with Law Enforcement, doesn't necessarily mean they will. Its a good catch phrase to add to a TOS because it can also make the provider feel protected. Its the opposite of saying "We will not ever co-operate with law enforcement" <--- I would avoid providers who say this because they will attract a bad crowd, and also most likely be a prime target for a covert tap (all speculation on my part of course).

There are some providers out there who are *really* specific with their TOS and AUP. I tend to trust those a lot more. One that comes to mind is Ivacy.

Boy this is scary. You know what I never read privacy policy terms, as I am sure most people don't. Now that being said I usually assume my information is going out. This, however, when you expect privacy is scary. I mean you are right under this privacy policy if someone calls and asks and says they are law enforcement this place is covered 100%. I think a much better wording would say subpoena required. I work for an online company and we won't give out crap without a subpoena.

It doesn't look good at all I'm sorry to say and I wouldn't trust it...

I've been into VPN services a long time and the companies that write up their TOS like this are the ones that are looking out for their butts more then yours...

Hey guys,

Just to clear things up here:

We will only release information (what little we may have) if we are subpoenaed by the US Courts. We will not just hand over information if anyone asks, cmon now. As much as we care about our customers privacy (being a privacy related service and all) we do need to comply with US Laws.

If you look at almost all legitimate VPN Service Providers they will have the same jargon and if they don't they will most likely not be in business for long.

We have yet to be subpoenaed and have only received the random DMCA complaint as far as abuse issues are concerned.

--- Andrew

EDIT: I will also talk to Management to see if we can amend our TOS with more precise and understandable terms.

Most VPN providers, and I assume PrivateTunnel, route your outgoing traffic through the same server as your incoming traffic (the server you connect to.) This makes it trivial for "law enforcement" to correlate your VPN traffic with your public traffic somewhere upstream.