*Feb 3, 2017: Because of new anti-VPN laws passed recently this article has been updated*
Virtual Private Networks (VPNs) are excellent tools to uphold the principles of privacy and anonymity. But is it legal to use them?
As we recently saw last month, the United Arab Emirates made it illegal to use a VPN. Their reason? They don’t want you using any system that is capable of hiding the fact that you are committing a crime, or covering one up. Since VPNs encrypt your web traffic, it’s theoretically impossible to prove/disprove that you were doing something illegal.
Many VPN providers have explicit terms of service that forbid users from doing illegal things while using their service. Examples of banned activities include:
- Spreading malware
- Distributing child pornography
- Spamming via email or other methods
- Committing fraud or theft
To make sure no illegal activity takes place, some VPN providers take measures for detection and prevention. These can range from heavy-handed tactics like logging IP addresses and/or collecting time stamps of when you log in and out. To taking a more tactical approach and creating firewall rules to identify users that are abusing the network.
Is VPN Illegal?
VPN is legal for consumers in all but ten countries. In the countries with VPN laws exemptions are provided to corporate and commercial service providers on the condition that they agree to abide by the government’s demand. Their demands range from VPN user registration lists, storing data locally or providing them with backdoor network access.
Currently, the United Arab Emirates, Turkey, Iran, Iraq, Oman, North Korea, Russia, Belarus, Turkmenistan, and China have passed laws regarding the use of VPN services. Russia, Iran, North Korea and Turkmenistan allows the use of approved VPN services. The six other countries with VPN laws have taken an even harder line by imposing hefty fines and long jail sentences to anyone caught using a VPN service to hide their identity.
Top Ten Countries That Violate Human Rights and Censor the Internet
- North Korea: The government controls all websites, and only about 4% of the population has internet access.
- Burma: The authorities filter emails and block websites that expose human rights violations of the government, or that just disagree with the government.
- Cuba: Citizens can only use the internet at government-controlled web access points. The government monitors online activity through IP blocking, keyword filters and checking browser history.
- Saudi Arabia: The country currently blocks 400,000 websites, including those that discuss political, social or religious beliefs that disagree with Islam.
- Iran: Iranian bloggers have to register with the Ministry of Art and Culture. The government harasses and jails any opposition.
- China: Notorious for having the most rigid censorship in the world with the Great Firewall of China. The Chinese government filters searches, blocks certain websites and erases offensive content.
- Syria: The Syrian government arrests bloggers who “jeopardize national unity”. People wanting to use cyber cafes must provide identification, and the authorities collect time of use.
- Tunisia: ISPs report IP addresses and personal information of bloggers to the government. All web traffic passes through a central network, and the government filters uploaded content and emails.
- Vietnam: The Vietnamese Communist Party requires Yahoo, Google, and Microsoft to hand over data on all bloggers using their services. The Party blocks websites critical of the government and those that advocate for democracy, human rights, and religious freedom.
- Turkmenistan: The government is the only ISP here, and it blocks many websites and monitors email accounts of Gmail, Yahoo, and Hotmail users.
Unless you live in one of the countries listed in the section above (except Saudi Arabia) VPNs are legal to use. Of course, we advise everyone to check with their local laws to be sure.
No Saudi Arabia VPN Law Exists Yet
Saudi Arabia blocks over 400,000 websites including many VPN websites. Their ISPs block commercial VPN traffic with a combination of Deep Packet Inspection and blacklists. It is pretty clear Saudi Arabia does not want citizens using VPN, but they have not outlawed them. It is anyones guess how long that will last.
So how do governments block VPNs anyway? System admins can close ports used for VPN tunneling purposes, like PPTP (TCP 1723) or L2TP (UDP 500, 1701, 4500). Web sites can also block access to its content from IP addresses known to belong to VPN providers. Some governments can block access to all overseas IP addresses.
In contrast, VPN providers look for ways to prevent blocking by making network connections more hidden. Some scramble OpenVPN packet metadata after the Chinese government began using deep packet inspection.
In April 2014 Hulu started blocking users outside the U.S. by blocking IP addresses from VPN providers. However, this also prevented access from U.S.-users who use VPNs for security purposes.
In September 2014, film studios pressured Netflix to block VPN access. Up to 200,000 Australian users were using VPNs to watch Netflix because it wasn’t available in their country. Verizon users also utilized VPNs to bypass carrier throttling.
A popular Quora answer by Stan Hanks, inventor of IP VPNs, gives more information. He says,
“You can…legislatively disallow it [but] you can’t enforce against it. Want to block GRE? Sure, knock yourself out. I’ll tunnel through HTTP Port 80 which you dare not block because to 99.9% of the world, that IS “the Internet”…The Net interprets censorship as damage and routes around it…”
Last year, the Australian Communications Consumer Action Network (ACCAN) raised concerns that a government bill blocking pirate websites would inadvertently include VPN services to evade geo-blocking.
We covered the bill, called Copyright Amendment (Online Infringement) Bill 2015 let movie studios apply for court orders to compel ISPs to block access to overseas sites (like Netflix). Certain VPN providers came up with technology to circumvent geo-blocking, but so far it’s still an issue.
Ultimately, a VPN is a tool just like any other. You can do both legal and illegal things while using them. Similarly, you can do legal and illegal things with a gun. Just because the technology can enable illegal things, that doesn’t make the technology itself illegal.