0

If I created a website online using a VPN, can law enforcement still find out I made the website? What other forms of identification could potentially give away that my computer made this website, and how can I protect myself from that? The VPN I use does not carry logs (PIA VPN)

  • did you register the domain? – iainpb Jul 30 '17 at 14:12
  • yes, it's a wordpress site. I created the email associated with the website using a VPN also. – user8358234 Jul 30 '17 at 14:15
  • Anyone querying the whois database will see the name and address you registeted with. You can test this yourself at whois.com. Depending on your setup and provider you can enable domain privacy which will mask this information. – iainpb Jul 30 '17 at 15:39
  • I wanted to know if law enforcement would be able to find out – user8358234 Jul 30 '17 at 18:50
  • No, you are not safe. (Why do you care?) – Bob Brown Jul 31 '17 at 2:23
1

On a long enough time line with sufficient resources, law enforcement (state actors) will find you. The question is more of an economic one: is it worth it. For the sake of argument, let's say Bob made a website. It contains ideas that are unpopluar with the government where he resides. Grace, head of that countries intelligence agency decides she wants to find Bob. She's start by looking up obvious things: domain registrations, looking for EXIF data from posted pictures on Bob's website, among other information.

If that all comes up nil, Grace will setup up the investigation and start looking for money transactions, checking their state-run packet inspection hardware, and other information looking for the traffic. She even intimidates he hosting provider to give up the records of the IP address that accessed it.

So, now Grace has (at least) a list of IP addresses that accessed the website over FTP, HTTP, HTTPS, etc and other meta data about the visitors of the site - at least one of which is the author she's interested in.

Grace now runs this against a database of known enemies of the state and gets several hits. One of which is a VPN provider who "goes dark" by not keeping logs.

No matter. Grace has the ISPs in her pocket because she's a member of a govnerment that does not take detractors lightly. She issues a request to the ISPs of the VPN service and several other ISPs to get traffic meta data for analysis of that traffic.

She discovers that there are a number of people who were sending packets at the same time the VPN was also sending packets to the target website. These people are short listed as people "of interest."

From here, because Grace's superior has taken an interest in the case, they use a series of targeted spear phishing attacks to get malware on each of the suspect's computers. Now, keyloggers will hang the publisher.

Eventually, Bob logs into the VPN, and accesses the website. The malware phones home back to the intelligence agency, and flags Bob's computer as the primary suspect.

Hours later, men in black boots break down the door and seize the computer.

This is an overly simplified version of what can happen, but it illustrates several points:

  1. There is no-such-thing as anonymous on the Internet. It was not built with anonymity in mind.

  2. Law Enforcement agencies have a number of tools at their disposal. Some are trivial to use. Some are explicitly non-trivial. There are economics behind each of these. The cost associated with a non-trivial exercise general goes up exponentially the more moving parts are required. Doing traffic analysis to find out "when does a burst of traffic from the VPN to the target site coincide with a burst of traffic from an ISP ... and which subscriber was it" is orders of magnitude more expensive than checking WHOIS and EXIF data. Using state-level spear phishing is much more involved than getting the ip addresses form a provider.

  3. With enough time and resources, Grace will always get Bob.

So here's the moral of the story: you cannot be completely anonymous, but you can be very expensive to catch. If you are running a website in a country where free speech does not exist, there are several steps you can take to make it more expensive to catch you, and VPN is just one of them.

3

Under the assumption that the blogging service provider doesn't request any personal identifiable information from users (or doesn't check the correctness of the information it does require) and that the suspect only accesses the website from a VPN, the blogging service should not be able to deanonymize the suspect.

But there are two other paths which could be used to deanonymize the suspect:

  1. Following the money. Did the suspect pay for the service? Did the suspect make any money from the website (advertisement revenue, for example)? Then that money must somehow come from / go to their personal banking account. In most places of the world, banks must cooperate with law enforcement.
  2. The VPN provider could assist in finding the suspect. A VPN is not an anonymity panacea. It just shifts the trust from the ISP to the VPN provider. If the VPN provider gets a subpoena forcing them to deanonymize the suspect, they can and likely will do that.

What other forms of identification could potentially give away that my computer made this website?

When someone gets physical access to the suspect's computer, there are several ways to notice that it was used to create the website. For example:

  • The password might be in the password manager
  • The admin portal might be in the web browser history
  • A cached version of the admin portal might be in the web browser cache

Using full disc encryption can protect their privacy, unless the attacker acquires the computer while it is running or they can force the suspect to reveal the decryption password.

  • I agree that the VPN could get subpoenaed but if the VPN I use does not keep logs, then would they still give my internet history? There's no money attached to the website. Thank you for your answer. – user8358234 Jul 30 '17 at 22:34
  • @user8358234 The VPN says they don't keep logs, but can you be sure of that? Also, they might have to start taking logs from you when you are already under suspicion. – Philipp Jul 31 '17 at 0:31
  • @user8358234 Even if the VPN does not keep logs, their ISP will. The VPN has no control over whether or not that happens. – forest Nov 1 '18 at 8:33
2

Creating a website with a Virtual Private Network is not going to improve anonymity of people trying to find out who built a website, necessarily. Ofcourse if you want to hide your IP address from being available in the weblogs you might want to be using a VPN for that.

You can whois a website to find out who the registrant is, you can test this yourself on, for example, whois.com. You cna change registration details for domains, contact your hosting provider for more information.

As pointed out by Philipp in the comments, there are also domain-by-proxy services who register the domain for you, so they show up in the WHOIS-info instead of you. The drawback, however, is that you don't officially own the domain in that case. The registrar does. That can be problematic if there is a domain ownership dispute. Also, they usually do not protect their customers from law enforcement.

A possibility to consider is to remove all source files from your computer when you are done uploading. Remember that emptying the bin in Windows does not mean your files are completely removed, read this article for more information.

You will want to email to be completely anonymous as well. In your question, you state you used a VPN when you created the email, so I am assuming you also entered fake details. If not; you will have to consider your information compromised.

The nickname you use on the Wordpress website can also give away your identity, as seen in the case of Silkroad owner Ross Ulbricht who got caught because he used an account name on his private website which was the same as another account name where he used his real IP address. So make sure to use an anonymous nickname for Wordpress.

Do not advertise the website yourself without making sure you are anonymous - If you send the website to friends using Facebook, for example, while using your own Facebook account you can consider your anonymity to be compromised as well.

  • Thanks. I'm a little unclear on what you mean by finding out who the registrant is. I tried this with the website I made but nothing showed up and how can the website know my address of location services are off and I used a vpn to create it? – user8358234 Jul 30 '17 at 18:53
  • @user8358234 You need to enter your address etc. when you register a domain, but ofcourse you can use fake credentials for that. – Kevin Voorn Jul 30 '17 at 19:12
  • There are also domain-by-proxy services who register the domain for you, so they show up in the WHOIS-info instead of you. The drawback, however, is that you don't officially own the domain in that case. The registrar does. That can be problematic if there is a domain ownership dispute. Also, they usually do not protect their customers from law enforcement. – Philipp Aug 5 '17 at 16:58
  • @Philipp I touched that subject slightly indeed, will add it to the answer to be complete. – Kevin Voorn Aug 5 '17 at 19:24
0

A vpn (assuming that it doesn't log) only hides your IP address.

If the vpn's logging policy is a sham, or if the vpn provider is compelled by the government where it's headquartered to start logging, you're toast.

Also note that most vpn providers don't own their own infrastructure but rely on rental agreements with data centres, some of which may have corrupt employees.

So using only one layer of IP address obfuscation is really not enough to retain anonymity if your adversary is your local law enforcement.

Rather use the vpn in conjunction with a chain i.e another's wifi > vpn > Tor > your blog.

If there is a local data retention law, your ISP may be legally required to retain information about which IP addresses are accessed by its customers.

Also be aware of the jurisdiction of the vpn provider and the server you are using in relation to possible speech crimes you might commit by blogging.

If the vpn provider answers to local law, and that local law criminalizes the same speech as your own nation, legal cooperation is likely.

However, if the vpn provider and the server is located in a jurisdiction with no similar prohibition, you are probably safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.