One of the commonly used “selling points” for a VPN provider is the jurisdiction in which the company providing the VPN service is organized. Certain companies, organized in well-known tax havens or “offshore” countries, emphasize this fact as a sign that it is alleged that these companies refuse to comply with legal procedures (judicial and administrative summonses and other legal requests for information).
In return, such VPN providers can better protect consumer information from the prying eyes of government officials and individuals. Such VPN vendors point to limited public information on government surveillance programs and supranational information-sharing alliances with creepy names such as 5 Eyes, 9 Eyes, 14 Eyes, PRISM, and Upstream. They also claim that the legal organization of the provider is not subject to such monitoring and disclosure of information.
This argument is greatly exaggerated.
Education between countries is a norm
First of all, very few nations refuse to participate in an exchange of information with other nations. The standard for the lack of information exchange would probably be North Korea, but few VPN providers seem to maintain their origins in this country.
There is no way to know for sure whether a country is monitoring or not
Second, it is not known if and to what extent a single nation is involved in mass surveillance and information gathering activities at national and supranational levels. For example, the British Virgin Islands (BVI) is a nation made up of a few islets in the Caribbean. Superficially, it seems reasonable that this nation does not carry out mass surveillance or participate in supranational intelligence operations.
This view, however, is wrong when considering the BVI as a British overseas territory – which means that the United Kingdom (UK) (a member of 5 Eyes) is responsible for the defense and external relations of the BVI. This also means that British Virgin Islanders are British and EU citizens. What does this mean for the state surveillance and the legal requests for information of the BVI companies?
Panoramic view of the tropical coast of the British Virgin Island (BVI), where many offshore VPNs are located
The fact is that the public does not know for sure. It is easy to argue that companies organized by BVI are not subject to the laws of the United Kingdom or the EU, but it is much more difficult to prove that such companies do not disclose information at the request of the UK authorities. It is also easy to imagine that companies and natural owners of a company organized by BVI, which are not publicly known due to the status of BVI as a tax haven, are located in a country that conducts mass surveillance.
Every multinational company must comply with the laws of the countries in which it operates
Third, the laws of the nation in which a company is organized are not necessarily the only laws that such a company must comply with. It is well known that multinational companies, which want to do business in China, for example, are forced to comply with the burdensome Chinese laws on business organization and technology transfer.
The idea is the same as in any other nation. If you want to do business in a particular country, you must be willing to comply with the laws of that nation. Of course, this does not mean that all government requests for information are fully complied with. However, companies doing business in a country can not credibly claim to simply ignore the laws of that country.
It’s not just about surveillance, it’s about your ability to fight back
Finally, and above all, laws and institutions of certain nations ensure transparency and a “day in court”. Now we all know that the United States Government (US) is often maligned, sometimes rightly so, because it participates in surveillance activities that go beyond the limits of extreme necessity and violate the US Constitution.
But at least the US has fair and transparent institutions that allow consumers the day in court. Consumers and public interest groups have been able to successfully repel the unconstitutional information collected by the US government. Consumers may not find the same protection as in BVI or Romania.