Windscribe CEO Says ‘No Consumer Knowledge’ at Threat After Dutch Authorities Reportedly Seize Server

Dutch authorities simply seized certainly one of Windscribe’s VPN servers, in line with a post on X from the VPN company on Friday. 

The put up did not embrace any indication as to what prompted Dutch authorities to grab the server, solely that the seizure was performed and not using a warrant and that authorities stated they’d return the server to Windscribe as soon as they “totally analyze it.” However regardless of how severe the incident would possibly seem at first look, Windscribe reassured the general public that authorities will not discover something of use on the server that would put its customers’ privateness in jeopardy.

As a result of all of Windscribe’s servers are RAM-only, “the one factor the authorities will discover is a inventory Ubuntu set up,” the corporate stated on X.

Windscribe CEO Yegor Sak advised CNET by way of e-mail that authorities seized the server with out clarification past wanting it in reference to an energetic investigation. He stated it was potential they needed to carry out a RAM dump, which might seize the server’s reminiscence. 

“Nonetheless even within the occasion of it being profitable, no person knowledge could be in danger, as there isn’t a person knowledge or any data of energetic connections in server reminiscence as soon as a community cable is pulled (which it was),” Sak stated.

RAM-only servers run on risky reminiscence, that means that knowledge isn’t saved to a tough disk and is totally wiped when a server is powered off or rebooted. Consequently, there should not be something for Dutch authorities to extract from their evaluation of the confiscated server. That is why we all the time search for VPNs which have a RAM-only server infrastructure or in any other case make use of full-disk encryption on their servers to make sure person privateness is correctly protected within the occasion of a server seizure.   

Moreover, Windscribe’s privacy policy states that the corporate does not maintain logs of its customers’ supply IP, historic document of VPN periods or something associated to the websites customers go to whereas linked to the corporate’s servers. With out these logs, there would not be any helpful knowledge on the server for authorities to gather anyway. 

Nonetheless, no-logs claims are impossible to verify with 100% certainty, which is why we additionally spotlight the significance of normal third-party audits when evaluating VPNs and their privateness protections. Though third-party audits aren’t all the time foolproof and don’t paint a full picture, they’re necessary belief alerts that may add credence to a VPN’s claims, particularly when performed regularly. 

Windscribe has been audited at a reasonably common clip since 2021, with its latest audit printed in the summertime of 2024, which regarded into the corporate’s FreshScribe VPN infrastructure. 

Common audits could make a robust case for a VPN’s privateness, however real-world authorized instances arguably make a fair stronger case as a result of their timing isn’t one thing VPN corporations can put together for. Windscribe encountered such a case in 2023, when Greek authorities charged Sak with “unlawful entry to data system” after a person misused a Windscribe server to breach a Greek web site and ship spam emails. Nonetheless, the case was finally dismissed following a prolonged authorized battle after Windscribe proved it had nothing helpful at hand over to Greek authorities on the time.

“It could have been quite a bit quicker (and cheaper) to easily hand over the logs to be able to establish the precise offender behind the alleged crime,” Sak wrote in a blog post. “Nonetheless, you can’t hand over what you should not have.”    

‘We get a handful of regulation enforcement requests each month. And every time we inform them we now have no logs,” Windscribe wrote on X in response to the newest incident involving Dutch authorities. “This time they did not ask, they only snatched the server from the rack to search for the logs themselves.”

Windscribe retains a operating real-time tally of the authorized requests it receives in its transparency reports. The report states that “zero requests had been complied with because of lack of related knowledge.”