Internet users can use VPN to protect their online privacy. By masking their true IP addresses, VPN users be somewhere else than their true location, allowing them to also hide their true identity.
This prevents internet service providers and the authorities of governments from carrying out snooping or surveillance on those people.
These are the reasons why VPN services are popular among many people who wish to circumvent geographic restrictions, as well as among hackers and cybercriminals.
With their ability to remain anonymous, those bad actors can carry out their attacks and abuse, with lesser things to worry.
Most good, reputable and respectable VPN providers promise a no-log policy, and this makes the job of law enforcement agencies harder.
One however, went beyond the borders.
In a joint force, the FBI and Europol managed to shut down 'Safe-Inet'” a VPN service that went to extreme lengths to keep its customers hidden.
Through an operation dubbed 'Operation Nova', the authorities went to work with the coordination of the German Reutlingen Police Headquarters and the help from many international partners.
According to Europol in a newsroom post, Safe-Inet was used by "some of the world’s biggest cybercriminals, such as the ransomware operators responsible for ransomware, E-skimming breaches and other forms of serious cybercrime. "
“This VPN service was sold at a high price to the criminal underworld as one of the best tools available to avoid law enforcement interception, offering up to 5 layers of anonymous VPN connections,” Europol notes.
“Law enforcement were able to identify some 250 companies worldwide which were being spied on by the criminals using this VPN. These companies were subsequently warned of an imminent ransomware attack against their systems, allowing them to take measures to protect themselves against such an attack.”
As a result of this takedown, the authorities managed to shut down several servers, and took control over three domain names associated with the VPN service: insorg.org, safe-inet.com, and safe-inet.net.
Hiding users' IP address without leaking any users' real information and having a no log policy are two of the most sought-after features of a good VPN service.
However, Safe-Inet went further than that.
First, according to the authorities, Safe-Inet was "designed to support crime."
Commenting on the matter, the U.S. Department of Justice noted that Safe-Inet provided the so-called “bulletproof” services, which were “intentionally designed” to provide hosting or VPN services to cybercriminals.
“These services are designed to facilitate uninterrupted online criminal activities and to allow customers to operate while evading detections by law enforcement. Many of these services are advertised on online forums dedicated to discussing criminal activity."
“A bulletproof hoster’s activities may include ignoring or fabricating excuses in response to abuse complaints made by their customer’s victims; moving their customer accounts and/or data from one IP address, server, or country to another to help them evade detection; and not maintaining logs.”
The U.S. Department of Justice said that by acting in this manner, Safe-Inet knowingly aided and supported criminal activities of its clients, which makes the company liable.
Second, the VPN was found advertising to criminals on underground and hacker forums. In contents that post access to stolen credit cards, stolen identities and hacking tools, Safe-Inet was found actively promoting its services.
“We are happy to announce you about our elite level of service for high anonymity in the Internet network from insorg.org company, reads one of Safe-Inet advertisements reads, with another one mentioning that the VPN doesn't keep logs and never show the real IP addresses of users.
While Operation Nova comes as a shock to the VPN industry, regular VPNs don’t advertise in these places because they know those sites will ruin their brand in the face of search engines and reviewers.
In other words, Safe-Inet was unlike most other VPN services out there.
There are many VPNs that strive by keeping users private and secure, this case however, created some uncertainty among them. While VPN services won’t be rendered illegal anytime soon, there should be some others that are undoubtedly used by criminals as well.
And here, the authorities are looking forward to crack the bad ones if any of those services are found to cross the borders by providing some "bulletproof" protections.
“Criminals can run, but they cannot hide from law enforcement, and we will continue working tirelessly together with our partners to outsmart them,” said Edvardas Šileris, head of Europol’s European Cybercrime Centre, in a statement.
