Law enforcement agencies arrested a man from Massachusetts this past week for the suspicion of carrying out an online campaign of cyberstalking.
The man conducted the online campaign against one of his former female roommate, her family, and her friends.
Court documents also revealed that law enforcement agencies had used logs to find out more information about the arrested man.
The FBI obtained these documents from an online privacy service by the name of PureVPN>
These documents helped the FBI and the prosecution.
Of course, law enforcement agencies have to do what they have to do.
But as far as the VPN service provider in question is concerned, this is a big dent on its reputation.
The VPN service provider in question is PureVPN.
Now, although the VPN service provider provided logs for a useful purpose, it doesn’t change the fact that this VPN service provider had previously maintained that the company did not keep any logs whatsoever.
Now it turns out, the company didn’t really say that.
PureVPN ALMOST did not carry any logs.
That ALMOST part cost the man and helped the FBI catch him.
Table of Contents
Cyberstalking And PureVPN. How Are They Connected?
The police arrested a man by the name of Ryan S. Lin, a 24-year-old man who lived in Newton Massachusetts last Thursday.
As mentioned before, law enforcement agencies suspected him of carrying out a rather elaborate cyberstalking campaign.
Against who?
Against his former female roommate.
Media reports say that the man targeted his former roommate, another 24-year old woman living in Massachusetts along.
The man in question also conducted a similar campaign against his former roommate’s family and friends.
The Department of Justice documents also say that Lin carried out a multi-faceted online campaign of cyberstalking and computer hacking.
He began his “operations” back in April of 2016.
Back then he started off by hacking into his victim’s online accounts.
He also managed to obtain personal photographs belonging to the victim.
Moreover, Lin also got hold of sensitive information about the 24-year-old woman living in Massachusetts.
The sensitive information included details regarding the victim’s sexual histories and medical records.
Lin also obtained other private details about his victim.
The prosecution has also alleged that Lin distributed that information to hundreds of other people after obtaining the above-mentioned material himself in the first place.
Moreover, according to more allegations, Lin created a bunch of fake online profiles which showed his victim’s home address.
He also solicited illicit sexual activity through those online profiles.
This action of Lin caused several men to show up at Lin’s victim’s house.
The Lawyer’s Viewpoint
William D. Weinreb, the Acting United States Attorney, said that Mr. Lin allegedly conducted out a relentless online cyberstalking campaign.
He also said, Lin targeted a young woman in a shocking effort to violate his victim’s privacy.
According to Weinreb, Lin also threatened people around his victim like her friends and family.
All the while Lin used anonymizing services offered by VPN service providers.
Lin also used other online privacy tools in order to avoid any kind of attribution.
Using these tools and services Mr.Lin directly harassed his victim, his victim’s family and the victim’s friends along with roommates and co-workers.
But Mr.Lin did not stop there.
He also went after local institutions and schools that existed in his victim’s community.
Attorney William D.Weinreb said that now Mr.Lin must prepare himself to face the real consequences of his online actions/crimes.
Mr.Lin And His Fate
Mr.Lin will have to wait for a while before the court ultimately decides its fate.
He managed to appear before the US district court on Friday in Boston.
Readers should keep in mind that all of the claims, as of now, are just allegations.
And according to these allegations, Mr.Lin used online anonymization tools to hide his identity.
So how did law enforcement agencies catch the guy?
This indeed raises a lot of questions about anonymizing tools and their efficacy.
Afterall, all VPN service providers claim that they provide means to people to hide themselves from stalkers, criminals, and hackers.
Regardless of the roles, whichever VPN service provider Mr.Lin used, as a matter of policy, should have protected his identity.
Special Agent Jeffrey Williams, submitted an affidavit that supported the criminal complaint.
That complaint against Mr.Lin provided almost all of the answers to questions like how did Mr.Lin reveal his identity to law enforcement agencies.
The Affidavit described, in detail, Mr.Lin’s horrible actions against his victim.
The document described those actions as doxing.
Williams began his affidavit by pointing out that while Mr.Lin certainly acted as the initial aggressor, the simple fact that Mr.Lin distributed and made available the information to such a wide level raised another set of questions and possibilities.
Questions and possibilities such as other people who may have involved themselves in the case by carrying out their own malicious acts much later on than when Mr.Lin got hold of sensitive information on his victim.
Regardless of such scenarios, it is clear that Mr.Lin would remain as the investigation’s main and prime suspect.
The Affidavit Against Mr.Lin
According to Williams’s affidavit, Mr.Lin had majored in computer science from college and thus had expertise in carrying out his heinous crimes.
Williams also noted that Mr.Lin made use of a number of online methods in order to hide his IP address and his identity.
According to Williams Affidavit, he used tools such as,
- TOR
- Anonymous email providers
- Virtual Private Network service providers
He used services that claimed that they did not keep any logs or any other kind of record on their users.
As we have mentioned before, Mr.Lin soon found out that those services did not keep their word.
Or rather, we are assuming here that these services did not do their job.
Otherwise, the question remains, how did law enforcement agencies get to Mr.Lin when he used such anonymizing tools?
How Did Law Enforcement Agencies Catch Mr.Lin When He Used A VPN Service Provider?
Perhaps, the first thing that is worth noting here is that Lin’s stalking and aggressive behavior towards his victim provided plenty of indications to law enforcement agencies.
Lin demonstrated these physically.
That is, in the offline world.
Or the real world.
If we keep that in mind, it certainly appears that law enforcement authorities had beforehand information of Mr.Lin as the main suspect.
After that, law enforcement agencies worked backward from that point onwards.
Moving backward, the FBI managed to examine a computer that Mr.Lin had used before at his former workplace.
In that instance, the FBI investigated that computer.
The FBI agents noted that someone had reinstalled the operating system, Windows, on that computer.
Nevertheless, the FBI with their advanced tools managed to discover some old Google Chrome, a web browser, data.
This data showed the FBI had Mr.Lin had used this computer to view articles about all the bomb threats that he allegedly made.
THe FBI agents also managed to determine that Mr.Lin had used the same computer to access his victim’s online Gmail account.
Moreover, Mr.Lin had also used the same computer to access additional data on his victim.
This clearly suggested to the FABI that Mr.Lin had used a VPN service provider to hide his tracks and his identity.
William’s Affidavit Also Detailed Mr.Lin’s Other Methods To Hide Himself Online
William’s Affidavit also read that the found artifacts also indicated that Mr.Lin allegedly used PureVPN to hide his activities.
PureVPN is a VPN service provider that promises online anonymity.
Mr.Lin used the service repeatedly to carry out his cyberstalking scheme against his victim.
Needless to say, the FBI also found out that someone, allegedly Mr.Lin, had installed PureVPN on the computer they had found.
Special Agent’s Report
The report from FBI Special agents also revealed that the FBI accepted cooperation from PureVPN, a Hong Kong-based VPN service provider.
The Special Agent’s affidavit also read that critically, PureVPN (a VPN service provider) managed to determine that one user of their accessed their services from two different IP addresses.
Lin accessed the service via the RCN IP address from his home where he lived at the time of carrying out these cyberstalking attacks.
He also accessed the same service from the software company where he worked at the time.
There is no doubt about the fact that the information PureVPN provided to the FBI would help FBI’s prosecution.
And there is a good chance that Mr.Lin would have to pay for his crimes too.
But apart from that, this case would raise a lot of questions about PureVPN, the VPN service provider.
As mentioned before, PureVPN had always maintained that the company did not keep any logs.
In the VPN industry, such a feature is known as a zero-log policy.
PureVPN had a zero-log policy on its users.
But, the affidavit from Williams and the FBI reports clearly indicate that PureVPN did indeed keep some logs on its customers.
The Problem With PureVPN
If you go to the official PureVPN website right now, the company clearly claims that the company does not keep any logs that can identify or help in monitoring their user’s activity.
The company also says that they, PureVPN, has launched several advanced features to protect its users.
PureVPN marketing statement mentions that PureVPN,
- Manages its own VPN network
- The company has more than 750 servers around the world in over 140 countries’
The company also says that it believes this isn’t enough to ensure absolute security.
Furthermore, the company say, for this reason alone PureVPN has a set of advanced feature to add,
- Preventive
- Proactive
- And complete
online security methods to ensure that no third-parties can view its customer’s information.
PureVPN also says that no one has a record of its customer’s online activities.
In other words, the company does not keep any logs.
The Catch With PureVPN Zero-Log Policy
Of course, marketing material is one thing and actual performance is another.
Every VPN service provider claims that it is the best VPN service provider in the world.
Why would any VPN service provider claim otherwise?
Regardless, if one tries to drill a bit deeper into the official PureVPN privacy policy document, one can spot a lot of problems.
The company mentions in that document that the company’s servers automatically recorded the time and date at which a user connects to any of the company’s servers.
From that point onwards, the company says, PureVPN does not keep any records.
PureVPN says that it doesn’t monitor anything that could associate a specific user with a specific activity.
Moreover, the document says, the time whenever a user successfully connected to its servers, the company counted that as a connection.
PureVPN also recorded the total bandwidth that a user consumed during the connection.
This is what the company called bandwidth.
PureVPN privacy policy says that the company used bandwidth and connection logs to maintain their quality of service.
Additionally, PureVPN says that such information helps the company to understand its flow of traffic to the company’s specific VPN servers.
This way the company can optimize its VPN servers better to serve its users.
PureVPN “Zero-Log” Policy Is Exactly How The FBI Caught Mr.Lin
Upon further inspection, it is clear that the FBI made use of the finer points in PureVPN privacy policy.
Because the “loopholes” in the privacy policy page seem to match what the FBI has said about the case against Mr.Lin.
As mentioned before, PureVPN maintains that the company does not keep logs.
But in the privacy policy document, PureVPN clearly mentions that it keeps a record of when its customers connected to its services and for what amount of time.
Before, the FBI had mentioned that PureVPN also captured its customer’s IP address.
This appears to indicated that PureVPN not only monitored what it said it monitored, but also record its customer’s IP address that belonged to a different VPN service provider by the name of WANSecurity.
Allegedly, this is the VPN service provider that Mr.Lin used in order to connect to PureVPN.
This “record” helped the FBI to complete its other circle of the investigation.
Allegedly, Mr.Lin used Secure Internet LLC (PureVPN servers) and WANSecurity (Kansas-based) IP addresses to access his Gmail accounts.
Mr.Lin, ironically, used his Twitter handle to vent out his criticism of all VPN service providers.
In particular, he criticized IPvanish.
Yes.
IPVanish.
IPvanish, as we all know, is not even involved in this case.
But that did not stop Mr.Lin from criticizing it over the company’s no-log claims.
Mr.Lin tweeted that all VPN service providers kept logs.
In fact, a VPN service provider that did not keep logs simply lied to its customers.
Mr.Lin further said that if a VPN service provider could limit a user’s connection or track his/her bandwidth usage, then that VPN service provider simply kept logs.
In PureVPN’s case, if the company kept a log of connection time and the user’s source IP address, then that was sufficient to raise suspicions.
The FBI probably knows this.
And can probably use it to boost their already strong case.
What Happens If The Court Convicts Mr.Lin?
Mr.Lin could face around five years worth of prison time.
He could also face a three-year supervision time after the initial prison time.