VPN provider helped track down alleged LulzSec member

UK VPN and web proxy service provider Hide My Ass! (HMA) says that it helped identify the alleged member of the LulzSec hacker group who was arrested by the FBI last week. The company explained that it had complied with a court order to disclose the IP address that the suspect used to log into HMA.

HMA says that the issue first came to its attention through a LulzSec IRC chat log that was released on the web; in this chat log, users discussed various VPN services, including HMA, in early June. Among the chat members was a user who went by the online nickname of Topiary and who was arrested by the UK police at the end of July, as well as a person called "Recursion"; allegedly, the user behind this nickname is a 23-year-old man who has now been arrested by the FBI. HMA said that the chat conversation itself wasn't illegal and didn't warrant a response by the company, but that a court order to disclose the data was received later.

HMA has justified the disclosure by pointing out that, according to its terms of service and privacy policy, the service is not to be used for illegal activity. The company said that if anyone uses the VPN service for criminal activities, HMA will cooperate with the authorities. LulzSec has allegedly been responsible for a number of illegal activities including a Distributed Denial-of-Service (DDoS) attack on the UK Serious Organised Crime Agency (SOCA), the defacement of the web sites of The Sun and The Times newspapers, and an attack on Sony's PlayStation Network.

HMA logs a user's IP address at the beginning and at the end of a VPN session. The company said that the main reason for doing this is so that users who misuse the VPN service can be identified. HMA assured its users that it only complies with UK law and will only respond to court orders issued by a UK court. "If a request for information is sent to us from overseas, we will not accept this request unless it is sent through the appropriate UK channels", it added. HMA said that UK law doesn't prohibit foreign nationals from using VPN or web proxy services to bypass censorship in their home countries.

(crve)