-
FBI records from a 2017 stalking case showed how PureVPN data helped identify one customer.
-
PureVPN said it did not record browsing, but it admitted it kept connection details.
-
The company later hired outside auditors to test its no-logs claim.
A 2017 stalking case still shapes the debate about VPN privacy. The case involved PureVPN, a company that promised not to keep user logs. It showed that connection records can help investigators find a real person. This can happen even when a VPN says it does not track browsing.
FBI records tie PureVPN data to a cyberstalking suspect
FBI Special Agent Jeffrey Williams filed an affidavit in the case. It named Ryan S. Lin of Newton, Massachusetts, as the suspect. According to the document, Lin ran a long campaign of stalking and online harassment. His targets were his former roommate, her friends and her family. Local authorities looked into the case first. Federal investigators joined later.
The FBI said Lin used several tools to hide who he was. These included VPN services and anonymous messaging platforms. A VPN hides a person’s web traffic from some outside watchers. Think of it like a tinted car window. People outside cannot see in, yet the car still has a license plate.
Records from PureVPN then helped investigators link the online acts to Lin. The affidavit said PureVPN found one customer using its service from two IP addresses. An IP address works like a street address for a device online. One address linked to Lin’s home. The other linked to his workplace. That detail mattered because both addresses pointed to one customer.
The records also tied Gmail accounts from the case to the same PureVPN IP address. Investigators compared timestamps from online services with the VPN company’s records. A timestamp is simply the exact time an action took place. This comparison lets them match the activity to the customer’s own IP addresses.
Investigators also target the online infrastructure that supports cyberattacks. In a separate case, US authorities seized seven domains linked to Flax Typhoon hacking tools, disrupting infrastructure associated with the China-linked threat group.
Authorities arrested Lin in October 2017. In May 2018, he pleaded guilty to 25 offenses. These included cyberstalking, computer fraud and making hoax bomb threats.
PureVPN says it kept its privacy promise
The case drew criticism because PureVPN had promoted a no-logs policy. That promise suggested the company kept nothing that could identify users or track them. Reports say the company answered the backlash directly. PureVPN said it had not broken its privacy policy.
According to the company, it did not log browsing history. It also did not log visited websites or downloaded content. However, PureVPN admitted that its systems recorded the IP addresses people used to reach its service. In simple terms, it said it did not watch what customers did online.
This difference became the center of the debate. Think of an activity log as a camera that films everything you do. A connection log is more like a sign-in sheet at the door. The sheet does not show what you did inside. Yet it still shows who arrived and when.
A VPN may skip browsing records and still keep connection records. Investigators can compare those records with timestamps and IP addresses held by other services. That comparison can point to one subscriber. The case did not prove that PureVPN recorded every website Lin visited. It showed something narrower. Connection details can weaken a user’s privacy when outside records support them.
The controversy also raised questions about how clearly VPN companies explain activity logs and connection logs. Users may read a no-logs claim as proof that no one can link their activity to them. That can be untrue when the company’s data practices allow the link.
Independent audits follow as PureVPN seeks proof
PureVPN later revised its privacy policy. It also sought independent checks of its logging practices. An independent audit means outside experts test a company’s claim. In 2019, the security auditing firm Altius IT reviewed the provider’s systems, server settings and service logs.
The audit report carries the date June 28, 2019. According to the report, auditors found no system settings or log files that could identify a specific person. They also found none that could reveal what that person did while using PureVPN. This held true both alone and when the pieces were combined.
The review has limits. It covered only the systems and information available during the audit period. It did not guarantee how PureVPN would act in the future. Reports say PureVPN later announced more no-logs checks. These included an assessment by KPMG in 2021. A further review followed in 2023.
The wider lesson for VPN users stays clear. A privacy policy describes what a company says it does. It shows only the company’s own words. An audit offers evidence on whether the company’s systems follow those words. Users should check what a provider collects. They should ask how long it keeps that data. They should also ask whether connection timestamps or IP addresses can link activity to a person.
Audits and transparency reports can help. Their scope and dates matter too, because an audit from one year describes only that period. A VPN can protect traffic from certain observers. It cannot promise complete anonymity. Knowing that difference matters when you pick a service for sensitive online activity.
