Comment by codethief
4 years ago
I've been following Mullvad for a long time and my impression (from countless reviews and comments here on HN) has been quite positive. But here's what I don't understand: Why are the servers located in Sweden, a country that's known for online surveillance[0] like no other country in the EU? From the Wikipedia article[1]:
> The law permits the signals intelligence agency, National Defense Radio Establishment, to monitor the content of all cross-border cable-based Internet traffic to combat "external threats" such as terrorism and organized crime.
[0]: https://www.opendemocracy.net/en/can-europe-make-it/didier-b...
[1]: https://en.wikipedia.org/wiki/Internet_in_Sweden#Internet_ce...
Thank you for asking.
> Why are the servers located in Sweden,
We have 762 servers spread across 38 countries. Less than 10% of our servers are located in Sweden [0].
> a country that's known for online surveillance
My cofounder and I started Mullvad as a protest against the growing mass surveillance of Sweden as well as other countries. Our intent was direct political action through entrepreneurship. Incorporating the company in Sweden was the obvious choice, since we are both Swedes. We felt that incorporating elsewhere would have been more risky, complicated, and costly.
Mullvad has excellent lawyers who continuously monitor the legal situation in Sweden. Right now there is no Swedish law that can compel Mullvad to start logging [1]. Should the situation change we have contingency plans.
[0]: https://mullvad.net/en/servers/ [1]: https://mullvad.net/en/help/swedish-legislation/
Thank you, this was the response I was looking for!
> Our intent was direct political action through entrepreneurship.
Again, I didn't mean to question your intent – as I said my impression of your company so far has been a very good one! :)
> We have 762 servers spread across 38 countries. Less than 10% of our servers are located in Sweden [0].
My apologies, it's been a few years since I last looked at your server locations (so I didn't remember) and I was probably getting the wrong impression from the fact that your post is only mentioning server locations in Sweden.
> Right now there is no Swedish law that can compel Mullvad to start logging [1].
But at the same time all cross-border traffic in and out of Sweden (so for anyone using Mullvad outside Sweden: virtually all traffic) is being monitored and (probably) logged, isn't it?
I highly doubt your VPN traffic will pass Sweden if you're outside Sweden and signing onto a Mullvad VPN server located outside of Sweden. The server list may be fetched from Sweden I guess? I haven't looked at the apps traffic to be honest, I have huge respect for the Mullvad team.
3 replies →
I have so much respect for everyone at Mullvad. You are the only VPN provider I trust! I have been a user for years now, and it has always been 5 dollars a month, which is quite generous. It is so cheap that even the poor can afford privacy. You guys have put a ton of effort into making your service as privacy respecting as possible. Not only that, the tech is on the bleeding edge (WireGuard, socks5, etc.) built right in. As a cybersecurity researcher, I could not be happier with the product. I hope you stay true to your mission, thanks again!
Also, will Monero ever become a supported payment method?
How is this nonsense the top comment?
OP's been doing a poor job of "following Mullvad for a long time" and apparently has never used Mullvad or visited its website. Heck, it's on their Wikipedia page[1].
If they had, it would be immediately apparent that Mullvad has servers all over the world. They have for many years -- perhaps since it's inception. It takes a bare minimum of effort to learn that.
1. https://en.wikipedia.org/wiki/Mullvad#Service
Your annoyance is understandable, and yet this question and direct response from a founder is a very informative interaction to have recorded in this thread. Much more informative than if GP had simply stated the results of their Wikipedia research.
Sometimes a mediocre question is the landing pad for a great answer. No need to begrudge the question.
While I agree the founder's response was informative, it does not justify the completely erroneous statement/accusation that prompted it.
That most certainly should be called out -- especially when it was, at the time, the top voted comment.
2 replies →
I have apologized for the factual incorrectness of my comment and explained how I had arrived at that conclusion / brain glitch: They are only mentioning Swedish servers in their blog post and for a second I had forgotten that, like any other big VPN provider, Mullvad of course has servers in many locations around the world.
What more do you want? Upvotes are not under my control and I also cannot edit my original comment anymore. No reason to get personal.
FWIW, I still think that it's important to raise awareness for the deficiencies of Swedish privacy law (irrespective of Mullvad and where their servers are located). I suspect that at least some of the upvotes were also given because people agreed with that.
Because it's a swedish company? The location of the servers is kinda irrelevant in that regard. They'd have to provide government access if there is a lawsuit that demands it. If there isn't one than your critique is entirely pointless
> Because it's a swedish company?
I'm not sure what point you're trying to make. If online privacy is as important to them as they say, they could have easily registered their company (or a subsidiary) in a different EU member state.
> They'd have to provide government access if there is a lawsuit that demands it.
IANAL but I am not entirely sure this is true in the EU. Either way, my question was "Why are the servers located in Sweden?" Whether or not this due to the company owning the servers being in Sweden is irrelevant.
I think you’re overthinking this. The people who run the company are based in Sweden. So they registered the company in Sweden, because that’s where they are. Then they hosted the servers in Sweden, because that’s where they are and where the company is registered.
Registering the company somewhere else wouldn’t do them any good when they’re living in Sweden, because the legal system isn’t fooled by sleight of hand like that. Likewise, hosting the servers elsewhere from where they’re based. Both would expand the number of entities with the ability to compel them to disclose data, because as long as the company owners live in Sweden, Sweden has that ability.
Unless you’re asking why they didn’t move to another country to start their company, which is surely a larger ask than the “easily” you suggest.
18 replies →
Really? How easy is it to create a company in another EU country.
In the US, it is mostly painless to create a company in another state. Fill out some forms online and pay a few hundred. If you don’t have a presence there, you have to pay for a registered agent in the state. That’s about $100/yr. You may also need a mailing address, but you can get a post office box that will accept and scan your mail for another hundred bucks a year. Star and local taxes.
What about the EU?
3 replies →
You don't have to use the servers in Sweden if you don't want to.