Hot Take Bitdefender... You Love it, but it slows down your PC... Want to Make BD Superfast ? Do This... Takes 3-4 Days,

[Trident]

A court order is all it takes, and they're singing like birds of a feather.

When there is a court order, the police will come, they will confiscate your personal devices and they will go through them nicely. Those iMessages from 2017 you don’t remember, your gym pics and progress, your taps on Tindr, the cake for your birthday 12 years ago, your searches and many more will soon be searched like gold is about to come out of them.

VPN and the Swiss/Finnish privacy laws are gonna be of 0 use and help in this case.

Just saying.

That’s why you should live in a way that doesn’t require the issuing of a court order.

 

[ForgottenSeer 123960]

Why are you even writing things you don't understand?
Greece isn't part of any alliance, not even the 14 Eyes. First of all. Secondly, Windscribe had a "battle" with a Greek court and isn't subject to Greek law. Windscribe is a Canadian product and is subject to Canadian law.
Thirdly, Canada and the US have laws that, under the "guise of citizen safety," their governments have the right to collect data during internet use, and if a user breaks the law, the services must disclose this data. I think someone forgot the three letters FBI, NSA, CIA, etc.
And that could be IP, email, device number, logs, etc.
Canada is a member of the 5 Eyes alliance, a group of countries that monitor their citizens' online activity. In this respect, they are considered "the biggest spies."

I won't write about the biggest spies like Microsoft or Google. Google is a free service, and by using their services according to their terms and conditions, we are vulnerable to their data collection, processing, and sharing. Google has had so many privacy mishaps (including a glitch with their encryption) that it's not even worth mentioning.
Even Apple collects data because it has to, but at least they don't resell it, because it's not free and you have to pay for its services. And although its encryption is much better and more secure than Google's,

Proton, which was supposed to be private, was also forced by a court order in Switzerland, forced by Interpol, to disclose activists' data. Fortunately, it only had an IP address, as the client wasn't connecting through TOR. But Proton's terms and conditions stated that it could disclose IP addresses in the event of a court order.
Proton is extremely privacy-conscious, and although I'm skeptical about it, I trust them more than the solutions from America or Canada.

France/Suisse/Sécurité IT : Protonmail a communiqué à la police l’adresse IP de militant·es anti-gentrification

L'année 2020 et 2021 a été marqué par la mise en place et la répression d'une série d'occupations ouvertes dans le quartier de la place Sainte Marthe. Durant l'enquête, les policiers se sont concentré sur un collectif et ont remarqué qu'il communiquait via une adresse mail protonmail. Ils ont...

secoursrouge.org

Besides, Switzerland, Sweden, and Germany have their own laws, independent of the US. Just like every state has state law in the US. Currently, they strongly protect user privacy.
But the European Union is starting to get annoyed and wants to change that law. Hence, Proton is fleeing Switzerland. Of course, Switzerland isn't in the EU, but they have signed agreements and treaties – for example, Interpol's pressure on the Swiss court mentioned above.

Regarding Mullvad: If it were a major scandal and the US wanted the data, they would have fought for it. And Mullvad doesn't have the financial backing (it's also in the country of the 14 Eyes, Sweden) to go to war with the Lion to defend some user who pays $2 or $3 a month for their service. And I don't believe that Mullvad, as a Swedish service in the 14 Eyes alliance, doesn't collect some data. They can defend themselves, fight the courts, and claim they don't have it, but it also depends on their opponent. They'll find one where they'll have to give everything they have. I'll just repeat – Sweden is far from how privacy works (or even the lack thereof) in the US and Canada.
In Sweden, obtaining data through a court order is a daunting task. But that doesn't mean it's impossible (14 Eyes Alliance)
Besides, we don't know the Swedish police warrant or the charges. They could have been trivial, and the law in Sweden was on Mullvad's side, who could only ridicule them.
But the news spread worldwide, and they capitalized on it brilliantly for marketing purposes.
Just like Apple did with unlocking the shooter's phone.

Programs, services, etc., from America are the biggest spies. Perhaps only Russia, Israel, China, and North Korea are worse.

That's why those who defend "user rights" most strongly flee to countries where the US or some alliance doesn't operate. But that doesn't entirely work either. Nord VPN is supposedly registered in Panama, but the parent company is probably in the Netherlands. You can read about it online.

Of the VPNs currently on the market, despite Mullvad's pros and cons, Proton seems to offer the highest privacy standards. But as a citizen of this world, I have limited confidence in Proton.

Anyway, to wrap this up. When I read that an AV provider uses VPN services registered in Canada or the US, you can be 99% sure there's no privacy. A court order is all it takes, and they're singing like birds of a feather.

It's none of my business if someone turns a blind eye or believes what American companies promise them. I prefer the policies of Proton or even Fsecure, which explicitly state what they can share with law enforcement if compelled by a court order. Rather than trusting the promises of a service that promises they don't collect anything and that you're 100% anonymous. Because that's a lie.

Anyway, as a fun fact, In 2021, Widscribe's servers in Ukraine were compromised, and the stored data was unencrypted, allowing the Ukrainian government to track users of the service. Has Widscribe made any reparations for this? It merely apologized, saying it was a human error and people lost their privacy
And what was the truth? We don't know. But we're at war there, so how can we be sure it wasn't intentional because the US needed the data? We don't know. We can only speculate.

I'm doing the dishes because I'm going on vacation. Best regards and thank you for the interesting conversations.

A country that is part of an intelligence-sharing alliance, such as the 14 Eyes, can absolutely try to compel a foreign VPN company to provide data by targeting the servers within its borders.

The key here is that VPN servers are subject to the laws of the country where they are physically located, regardless of where the VPN company is headquartered. This creates a potential vulnerability. For instance, if a VPN provider based in a privacy-friendly country like Panama has a server located in the United Kingdom (a 14 Eyes member), UK authorities could potentially get a court order to seize that specific server and try to extract any data on it.

This is a critical point that highlights why both jurisdiction and a no-logs policy are so important. A VPN could have a perfect no-logs policy and be headquartered in a safe country, but a server misconfiguration or a legal demand from a foreign government targeting a specific server could still compromise user data.

This is exactly what happened with the Windscribe incident in Ukraine, where local authorities seized servers. Even though Ukraine isn't a 14 Eyes member, the principle is the same: the physical location of the server determines which laws apply to it.

This is also why many privacy advocates recommend choosing a VPN that not only has a strong no-logs policy and is based in a privacy-friendly jurisdiction, but also one that uses technologies like RAM-only servers. These servers run entirely on volatile memory, meaning that all data is wiped every time the server reboots, which makes it far more difficult for authorities to extract information from a seized server.

I originally wanted to clarify a critical point about VPN security. Just because a VPN company is registered in a jurisdiction you consider safe, like Panama or Switzerland, doesn't mean your data is protected. A country can still attempt to compel the company to share information by seizing a server that is physically located within its own borders. Because most VPN users prioritize connection speed, they will typically connect to the closest server, which, for many people in 14 Eyes nations, means connecting to a server within another 14 Eyes country. Therefore, their online activity remains vulnerable to government seizure, despite the VPN's foreign headquarters.

Another key point to address is with a valid court order, government agencies can legally intercept and monitor encrypted traffic, but they typically don't perform a widespread man-in-the-middle (MitM) attack. Instead, they operate under a strict legal framework, such as the Electronic Communications Privacy Act (ECPA) in the U.S., which requires a warrant demonstrating probable cause. The most common and direct method involves compelling service providers, like internet service providers or social media companies, to provide unencrypted data or assist in the interception. Other methods include gaining access to a suspect's device to extract information before or after it's encrypted, or using technical exploits to bypass encryption.

Additionally, telecommunications equipment often has built-in "lawful interception" features designed for this purpose. This approach focuses on targeted, legally-sanctioned surveillance rather than a massive-scale MitM operation on public internet infrastructure.

 

[IceMan7]

@IceMan7
Oh yeah, only you understand everything. I didn't know that your amazingly creative username `IceMan7` is a synonym for `Mr. I Know It All'.
Why did you write here that you are going on a vacation? Now FBI, CIA, NSA, Mossad, Google, Microsoft, ISIS, Hamas, Taliban everyone knows that you're going on a vacation.

Very funny
Where did I say I know everything? I don't comment on topics I don't know anything about, and if I don't know something, I ask.
Regarding VPNs, I've delved deeply into privacy. I also have a hobbyist interest in geopolitics.

I install software fully aware of what to expect. As I mentioned, if someone wants complete incognito, they have to unplug the cable from the network.
I have Bitdefender blocked from running VPN services, and I don't use it. I don't use any VPN at all because I don't need it. When I do need it, I have Proton VPN Free for things like logging into hotel Wi-Fi (but rarely, only when my mobile operator doesn't provide coverage in a given location). But only for security reasons, to have an encrypted network. But that's the only public Wi-Fi I log into, because I usually use my permanent connection or the mobile network I have a contract with.
I don't even fully trust Proton, although I personally consider it the most private VPN provider. But if I am forced to use open Internet services, I need to secure the connection somehow.

I don't use VPNs because I don't believe their privacy myths. Because 99% of them lie, have unclear terms and conditions, hide things, or don't provide accurate information. Similarly, I don't use cloud-based password managers or AI at all.

If someone thinks using VPNs guarantees privacy, that's their problem. Especially those registered with the Five Eyes Alliance.

The key here is that VPN servers are subject to the laws of the country where they are physically located, regardless of where the VPN company is headquartered. This creates a potential vulnerability. For instance, if a VPN provider based in a privacy-friendly country like Panama has a server located in the United Kingdom (a 14 Eyes member), UK authorities could potentially get a court order to seize that specific server and try to extract any data on it.

Well, you see, not entirely. In the case of Windsribe, it was just a slip-up, and there were no claims for data or court cases.

And in the case of Proton, it was an activist from France. He didn't log into a server in Switzerland, but rather into another one. The French court couldn't do anything. Only Interpol obtained a court order from a Swiss court, and they went to Proton. And Proton was forced to disclose its IP. Only a court in the country where Proton is registered forced this action, not activity on servers in other countries.

This is also why many privacy advocates recommend choosing a VPN that not only has a strong no-logs policy and is based in a privacy-friendly jurisdiction, but also one that uses technologies like RAM-only servers.

Not entirely. It's most secure when a VPN has its own servers worldwide, not rented from external companies. And then it's 100% only subject to the court where it's registered (if it doesn't, it's clearly violating the law of the country where the server is located).

Generally, most VPN providers collect logs, IP, and have your email address used to register. They also have your bank details if you make a transfer (unless you can pay with Bitcoin).
But it's not like they sell or share them because they feel like it. And the countries in the Five Eyes Alliance have their own laws enforcing their right to collect data. Because they have the right, supposedly under the banner of "citizen safety." End of story.

Someone can turn a blind eye. Let them. Psychologically, the more incognito a user feels online (a VPN gives that feeling), the more they bend the law, believing they can and won't be caught (because a given VPN guarantees no tracking or data collection).
If someone already uses a VPN, they should probably avoid VPNs registered with the 5, 9, or 14 Eyes alliance. Especially the 5.

BTW, I don't know how it is in the USA. Are you aware, for example, that countries in the European Union require mobile network operators to record all your phone calls for up to two years? And in the case of internet use, the internet service provider also records all your online activities for up to two years?

VPNs and AI have unclear operations. I don't care if anyone thinks otherwise. I'm writing this to make you aware that it's not as common as most people imagine. Have limited trust in such services and don't rely on their privacy claims.
For my part, VPNs from countries in the 5 Eyes alliance don't exist. Even 9 and 14, but I'd be willing to use them if they're "technically" good. Or at least explicitly state what they're collecting. However, any VPN alliance that claims they don't collect logs and are completely safe is marketing bulls.it.

What good is it to me that Bitdefender provides me with certain privacy provisions (Romania) when it uses VPN services from the US? It's not without reason that countries from the Five Eyes alliance primarily share their VPN service or licenses with other providers of various solutions

However, if someone laughs at it or waves it off, that's their problem

Regards

 

[Trident]

What good is it to me that Bitdefender provides me with certain privacy provisions (Romania) when it uses VPN services from the US? It's not without reason that countries from the Five Eyes alliance primarily share their VPN service or licenses with other providers of various solutions

Bitdefender is offering VPN at a much lower price point than let’s say SurfShark, Proton and orhers.
That price includes also a solidly engineered security product, and potentially other bells and whistles like password managers and identity monitoring.

It is normal that Bitdefender will try to reduce the costs associated with the VPN.

That’s what they offer and millions of users are making use of this VPN every day.

Bitdefender is not forcing you to buy or use a product with a VPN, neither they’ve engineered the solution specially for you.

I also don’t like several aspects if BD, hence I’ve decided to not use it. It’s my problem, not BD’s.

 

[Harputlu]

Don't trust VPNs. Don't worry about everything. After all, I don't think the US cares much about what kind of porn you like.

 

[IceMan7]

Don't trust VPNs. Don't worry about everything. After all, I don't think the US cares much about what kind of porn you like.

In many countries, watching porn isn't banned. In many countries, using torrents isn't banned either. Some countries don't allow downloading, and others allow downloading but not sharing (uploading). And, of course, in P2P, you're also uploading while downloading.

Logically. If someone has Windows 11 installed (several scandals have already surfaced regarding it being Microsoft's most spy-prone version), uses Google services (Gmail, where Google knows exactly what you're receiving and sending, or a password manager—where you could just as easily email them your passwords), etc., and then pays for a VPN (especially from the Five Eyes countries), then congratulations on their common sense. In this case, they're throwing money down the drain, paying for "supposed" privacy
You'll never have privacy, but you can fight for it if you're a conscientious user. Of course, there are those who don't care because they think they have nothing to hide.

 

[ForgottenSeer 123960]

Not entirely. It's most secure when a VPN has its own servers worldwide, not rented from external companies. And then it's 100% only subject to the court where it's registered (if it doesn't, it's clearly violating the law of the country where the server is located).

This claim is incorrect and misleading. It contradicts the fundamental principle of legal jurisdiction.

A server physically located in the UK is subject to UK law, period. It doesn't matter if the company that owns or rents it is based in Panama, Switzerland, or anywhere else. If UK authorities have a valid legal warrant, they can go to the data center, seize the server, and attempt to extract data.

The headquarters' jurisdiction determines whether the company can be compelled to provide data it may have stored elsewhere (like customer sign-up information, payment details, or any limited logs it might keep).

For example, a court in a 14 Eyes country might issue a warrant to a VPN company in a non-14 Eyes country asking for user information. The company can refuse, citing its local laws.

However, if that same VPN company had a server in the requesting country, the law enforcement agency could skip the international legal process entirely and go directly to the data center to seize the hardware. This is the critical vulnerability that RAM-only servers are designed to prevent.

In conclusion, your second claim is fundamentally flawed. A VPN server is always subject to the laws of the country where it is physically located, regardless of who owns it. This is precisely why the combination of a no-logs policy, a privacy-friendly jurisdiction, and RAM-only servers is the gold standard for privacy-conscious VPN providers.

 

[IceMan7]

I've written about this.

Government authorities have the right to seize a local server to examine the data stored on it. However, they can't force a VPN company to share information because it's based in another country, beyond their reach. And here, jurisdiction is crucial—the country where it's registered. It's important that it's outside the Eye Alliance.

In Eye Alliance countries where a VPN is registered, you can even have a NASA RAM server, and RAM won't protect you from anything.

So if you have a VPN from the US, for example, it doesn't matter where the server is located or what type (RAM or not)—they still collect logs. This isn't the case; an American VPN with a RAM server in Brazil protects you. The US still regularly collects logs from it. Alliances were formed to exchange information and spy on their own residents, i.e., users. They do this.

That's why providers are fleeing to countries like Panama, the Cayman Islands, the Seychelles, and Malaysia. It's all about jurisdiction and staying outside the Eye Alliance's reach.

Of course, everyone relies solely on the fact that if they break the law, they're supposedly protected and safe, and no one knows what they're doing online. NO. If you use a VPN service in Eye Alliance countries, they know exactly what you're doing. You don't have to break the law to have no reason to collect data.

To answer the objection, it doesn't matter whether the server is a RAM server. If the server is from a third-party company, for example, in Eye Alliance countries, like the UK, that company is still subject to British law and will log this data continuously (it's common knowledge that RAM is erased when unplugged), but they collect this data because they have to. They might download it to another drive or not disconnect the power if ordered to do so, because it complies with the law of the country they're in. Or in some other way.

For example, Proton, which also has RAM drives, isn't entirely subject to the law in the country where its server is located. For example, in the UK.
And why? Because it's their server, their RAM drive, it doesn't collect logs and is outside the jurisdiction of the 14 Eyes. A UK court seizes their server by order and has nothing to demand from them, because Proton is answerable to a court in Switzerland. And above all, it's their server, so there's no risk of anything leaking if they used an external company registered in the UK, which is subject only to UK law.
But as we know, in one case, Proton, under a court order in Switzerland, was forced to share its IP address.

RAM drives don't always protect. If a court order forces the government to seize the server, if they don't power it down (because they can't, because they don't have time, for example), they will still have access to my logs, even if they collect them (14 Eyes alliance).

Some argue that an even better solution than RAM servers is intelligent routing. This dual VPN solution supports connections through two VPN servers, the first of which It's always located in a country with strong security and privacy laws: Iceland, Switzerland, or Sweden.

In any case, if you want to be safe, you should first and foremost avoid using a VPN belonging to the Eye Alliance. And don't believe that RAM saves everything. Proton has written about this on its blog more than once, and people have assumed that RAM is all you need.

In any case, we're essentially talking about the same thing, but using different words.

 

[ForgottenSeer 123960]

For example, Proton, which also has RAM drives, isn't entirely subject to the law in the country where its server is located. For example, in the UK.
And why? Because it's their server, their RAM drive, it doesn't collect logs and is outside the jurisdiction of the 14 Eyes. A UK court seizes their server by order and has nothing to demand from them, because Proton is answerable to a court in Switzerland. And above all, it's their server, so there's no risk of anything leaking if they used an external company registered in the UK, which is subject only to UK law.
But as we know, in one case, Proton, under a court order in Switzerland, was forced to share its IP address.

Legal Jurisdiction vs. Server Location.

This article highlights this distinction perfectly. While Proton's headquarters and legal entity will remain in Switzerland for now, the company is diversifying its physical infrastructure to avoid being "held hostage" by the new Swiss law. This demonstrates that a company can be headquartered in one country (Switzerland) while its servers are subject to the laws of another (Germany or Norway).

Is Proton leaving Switzerland? "Legal uncertainty" of proposed surveillance laws is pushing them to make several changes

Several of Proton's products could be headed elsewhere in Europe in the wake of proposed surveillance laws

www.techradar.com

 

[Game Of Thrones]

Bitdefender has significant issues with slowness and bugs, and the size of each database update is overwhelming. The lack of notifications for many tasks is disappointing for a product in this range. For instance, if it blocks an online executable file you wanted to download with a download manager, retrying the download simply results in a Windows error without any notification. It uses cloud detection only on execution, not on access, and you can't tell if it's connected to the cloud. Additionally, it requires heavy signature downloads every hour. It still has a long way to go to be as balanced and detailed as Kaspersky, McAfee, or ESET. There are even more small details where Bitdefender and many other suites fall short. Good detection is not everything; creating a balanced product is an art.

 

[IceMan7]

Finally, because I'm tired of it. Read up on international law, the Fourteen Eyes alliances, and these matters in general. And don't provide links to websites edited by some author, only to the source.
You've stuck to your theory and are now trying to force it.

This demonstrates that a company can be headquartered in one country (Switzerland) while its servers are subject to the laws of another (Germany or Norway).

Where? What are you writing? What does one have to do with what we're writing about?
I've already written in this thread that Proton wants to exit Switzerland, and supposedly it could be Iceland (those are theories). This is due to regulations imposed by the EU. I've also written about the dependence of Switzerland and the EU, even though Switzerland isn't in the EU.
They've long since set up servers in Switzerland, Norway, Germany, and other countries. This is nothing new. Now they're investing even more because they intend to leave Switzerland.
What do the servers in Germany have, and what are the laws? Where is this? The author only assumes that due to hosting in Germany and investing in Germany, they might relocate there—so ultimately, they might be under German jurisdiction, not Swiss.
And they won't relocate to Germany. The author suggests that Germany... But how? The author himself mentions the Protect EU project. So why would Proton move to Germany, since being in Switzerland now would mean it would be subject to the same laws, since Germany is also in the EU and Germany rules the EU?
So with all due respect. Don't confuse things like this author and don't force your way, since you're wrong.
So, in conclusion. Jurisdiction is key. Server location, RAM, etc. are important, but not as important as jurisdiction.
Even if Proton invests in Germany, it still uses intelligent routing. I've already mentioned several ways. A compromised server, if there are no logs, is owned by a given VPN, etc. – a VPN service outside the 14 Eyes countries is more secure than a VPN from the 14 Eyes countries. They can then take over that logless server and dream that the VPN service will give them access to something. Of course, that's if the service in question isn't actually collecting logs and isn't lying in its statements. But that's a different story.

EOT

It still has a long way to go to be as balanced and detailed as Kaspersky, McAfee, or ESET. There are even more small details where Bitdefender and many other suites fall short. Good detection is not everything; creating a balanced product is an art.

You see, I disagree. Kaspersky is banned in most countries. Eset is overrated, annoying, and weaker than Bitdefender. And McAfee... now it's such a sweetener lately, and I've had so many problems with it over the years that I wouldn't even take it for free today.

And I have Bitdefender on three computers and it has no problems or bugs, and it runs just as fast on my computer as I did with Eset
So what about this? So many people, so many opinions

BTW
The best one I had was F-Secure. I had it for many years. I will always have fond memories of it. It's a shame it wasn't there And I have a feeling there won't be an AV as good and polished as F-Secure for a long time. RIP

 

[Trident]

I am vaguely following this discussion but I feel that this

But as we know, in one case, Proton, under a court order in Switzerland, was forced to share its IP address.

Is related to the 2021 Proton Mail case. This has got nothing to do with Proton VPN.
The Swiss court ordered Proton to start logging and Proton had no choice. Prior to that, Proton did not really have any logs.

This further proves that even jurisdiction in privacy-friendly countries is not a guarantee that your precious data won’t end up in court.

There is no privacy and no immunity.

 

[ForgottenSeer 123960]

Finally, because I'm tired of it. Read up on international law, the Fourteen Eyes alliances, and these matters in general. And don't provide links to websites edited by some author, only to the source.
You've stuck to your theory and are now trying to force it.


Where? What are you writing? What does one have to do with what we're writing about?
I've already written in this thread that Proton wants to exit Switzerland, and supposedly it could be Iceland (those are theories). This is due to regulations imposed by the EU. I've also written about the dependence of Switzerland and the EU, even though Switzerland isn't in the EU.
They've long since set up servers in Switzerland, Norway, Germany, and other countries. This is nothing new. Now they're investing even more because they intend to leave Switzerland.
What do the servers in Germany have, and what are the laws? Where is this? The author only assumes that due to hosting in Germany and investing in Germany, they might relocate there—so ultimately, they might be under German jurisdiction, not Swiss.
And they won't relocate to Germany. The author suggests that Germany... But how? The author himself mentions the Protect EU project. So why would Proton move to Germany, since being in Switzerland now would mean it would be subject to the same laws, since Germany is also in the EU and Germany rules the EU?
So with all due respect. Don't confuse things like this author and don't force your way, since you're wrong.
So, in conclusion. Jurisdiction is key. Server location, RAM, etc. are important, but not as important as jurisdiction.
Even if Proton invests in Germany, it still uses intelligent routing. I've already mentioned several ways. A compromised server, if there are no logs, is owned by a given VPN, etc. – a VPN service outside the 14 Eyes countries is more secure than a VPN from the 14 Eyes countries. They can then take over that logless server and dream that the VPN service will give them access to something. Of course, that's if the service in question isn't actually collecting logs and isn't lying in its statements. But that's a different story.

EOT


You see, I disagree. Kaspersky is banned in most countries. Eset is overrated, annoying, and weaker than Bitdefender. And McAfee... now it's such a sweetener lately, and I've had so many problems with it over the years that I wouldn't even take it for free today.

And I have Bitdefender on three computers and it has no problems or bugs, and it runs just as fast on my computer as I did with Eset
So what about this? So many people, so many opinions

BTW
The best one I had was F-Secure. I had it for many years. I will always have fond memories of it. It's a shame it wasn't there And I have a feeling there won't be an AV as good and polished as F-Secure for a long time. RIP

You are fixated on the company's home jurisdiction as the ultimate privacy protection.

This is a common but flawed belief because it doesn't account for the principle of territoriality, which is a core tenet of international law. This principle dictates that a state has jurisdiction over all persons, property, and events that occur within its borders.

Your argument essentially ignores this reality.

"Proton wants to exit Switzerland...This is due to regulations imposed by the EU."

This is incorrect. The article explicitly states that Proton is moving its infrastructure because of "legal uncertainty" over a proposed Swiss surveillance law, which the article notes would be even more intrusive than EU regulations. You are confused about the source of the new law. Proton is acting because of a potential change in Swiss law, not because of EU pressure.

"Why would Proton move to Germany...since Germany is also in the EU and Germany rules the EU?"

This shows a misunderstanding of both EU politics and the legal landscape. First, Germany does not "rule" the EU. Second, the article states that the proposed Swiss law is a form of mass surveillance that has already been deemed illegal in the EU. Moving to an EU country might still pose risks, but it would be a strategic move to a legal environment that is, for now, considered more protective of privacy than the proposed Swiss law.

The physical server location is a direct point of legal and physical interception that jurisdiction alone cannot protect against.

 

[ForgottenSeer 114717]

I've written about this.

Government authorities have the right to seize a local server to examine the data stored on it. However, they can't force a VPN company to share information because it's based in another country, beyond their reach. And here, jurisdiction is crucial—the country where it's registered. It's important that it's outside the Eye Alliance.

In Eye Alliance countries where a VPN is registered, you can even have a NASA RAM server, and RAM won't protect you from anything.

So if you have a VPN from the US, for example, it doesn't matter where the server is located or what type (RAM or not)—they still collect logs. This isn't the case; an American VPN with a RAM server in Brazil protects you. The US still regularly collects logs from it. Alliances were formed to exchange information and spy on their own residents, i.e., users. They do this.

That's why providers are fleeing to countries like Panama, the Cayman Islands, the Seychelles, and Malaysia. It's all about jurisdiction and staying outside the Eye Alliance's reach.

Of course, everyone relies solely on the fact that if they break the law, they're supposedly protected and safe, and no one knows what they're doing online. NO. If you use a VPN service in Eye Alliance countries, they know exactly what you're doing. You don't have to break the law to have no reason to collect data.

To answer the objection, it doesn't matter whether the server is a RAM server. If the server is from a third-party company, for example, in Eye Alliance countries, like the UK, that company is still subject to British law and will log this data continuously (it's common knowledge that RAM is erased when unplugged), but they collect this data because they have to. They might download it to another drive or not disconnect the power if ordered to do so, because it complies with the law of the country they're in. Or in some other way.

For example, Proton, which also has RAM drives, isn't entirely subject to the law in the country where its server is located. For example, in the UK.
And why? Because it's their server, their RAM drive, it doesn't collect logs and is outside the jurisdiction of the 14 Eyes. A UK court seizes their server by order and has nothing to demand from them, because Proton is answerable to a court in Switzerland. And above all, it's their server, so there's no risk of anything leaking if they used an external company registered in the UK, which is subject only to UK law.
But as we know, in one case, Proton, under a court order in Switzerland, was forced to share its IP address.

RAM drives don't always protect. If a court order forces the government to seize the server, if they don't power it down (because they can't, because they don't have time, for example), they will still have access to my logs, even if they collect them (14 Eyes alliance).

Some argue that an even better solution than RAM servers is intelligent routing. This dual VPN solution supports connections through two VPN servers, the first of which It's always located in a country with strong security and privacy laws: Iceland, Switzerland, or Sweden.

In any case, if you want to be safe, you should first and foremost avoid using a VPN belonging to the Eye Alliance. And don't believe that RAM saves everything. Proton has written about this on its blog more than once, and people have assumed that RAM is all you need.

In any case, we're essentially talking about the same thing, but using different words.

Uhm, your post is full of inaccuracies. Don't read stuff online because much of it is "What ifs...," "What could happen...," incomplete, and/or inaccurate. Consult a team of international attorneys that know from real world cases what the facts are.

5, 9, and 14 Eyes members agree to intelligence sharing. What is shared is not everything. The frameworks and reciprocity agreements limit what is shared, and there are multi-layered checks & balances.. Regardless of a nation's participation in 5, 9, or 14 Eyes, it does not modify the way that the nation's criminal legal system works and what restrictive processes the nation's law enforcement agencies must follow. Those local jurisdiction rules & procedures can deny any 5.9, or 14 Eyes requests. For example, applying for a warrant before being able to do stuff. However, most nations - whether or not members of 5, 9, or 14 Eyes - when it comes to national security matters the government can compel anyone to comply if that is what it takes.

5, 9, and 14 Eyes participation in no way permits carte blanche sharing of user data and it requires no member state to share. The framework is voluntary. Not compulsory. Furthermore, national intelligence services are not the same thing as law enforcement. Most national law enforcement agencies at the national level already have criminal intelligence sharing agreements that are outside the purview of 5, 9, and 14 Eyes. Some of those programs have been operational since before WW II.

In cases of international terrorism, child pornography rings, sex trafficking, cybercrime, and so forth - governments are not using 5, 9, or 14 Eyes to make national security or criminal investigation requests to VPNs. They are making the requests via already existing criminal intelligence sharing agreements and the formal, mandatory requests required as part of those agreements. The policies & procedures for investigatory agencies to follow and the criteria they must meet is quite the hurdle.

The issue of jurisdiction is not cut-and-dry, but for the most part where the data resides is the applicable jurisdiction in a criminal investigation and the rules & procedures therein. A national security investigation is NOT the same thing as a criminal investigation. Different frameworks, statutes, rules, procedures, etc apply. A large-scale criminal issue might be considered and treated as a national security matter (e.g. drug trafficking), and only when a nation treats a particular large-scale problem as such is there interface between national intelligence and law enforcement.Even when the local jurisdiction criminal investigation rules apply that is not a guarantee of protection for the VPN user/subscriber because some jurisdictions make wonky or ill-defined distinctions between physical hardware, virtual machines, RAM - and a judge can rule for or against the data request based upon those issues or any of a plethora of other variables.

The bottom line is that no VPN company, when faced with a legitimate criminal investigation request, is going to refuse for the sake of any user/subscriber in the face of government administrative, civil, or criminal sanctions.