In the days of unwarranted government surveillance and elaborate data collection, people increasingly rely on anonymizing services to keep their online activities private, such as proxy servers, encrypted cloud storage, and virtual private networks. Virtual private networks, or VPNs, route online communications through a secure and encrypted private network to a remote server (sometimes in a jurisdiction with greater protection for freedom of speech or weaker law enforcement). That computer in turn accesses content on the Internet and passes it back through the private network to the user. From outside the network, the only visible traffic is to and from the remote server, leaving the user anonymous. This ability to anonymize, however, can be used for multiple purposes, including to increase secrecy in unlawful actions but also to allow for unhindered expression and freedom from censorship.
As VPNs make it extremely hard to track a user, individuals can use VPNs to disguise their identity on torrent sites and illegally download copyrighted material without being traced. In the U.S., the role of VPNs in torrenting has been highlighted by the February launch of the "Six Strikes" Copyright Alert System, which grants media owners, the MPAA, and the RIAA a means of warning and punishing repeat copyright infringers through five major Internet service providers -- AT&T, Cablevision, Comcast, Time Warner, and Verizon. The ISPs will send escalating warnings to their users who are found torrenting illegally shared material. Because the "Six Strikes" system depends on identifying end users, the system may simply end up increasing VPN use and, therefore, revenue to companies offering VPN services.
Those concerned about the use of VPNs for illegal purposes have turned to options other than the courts. Recently, PayPal stopped providing payment services to Swedish VPN provider iPredator, launched in part by Pirate Bay co-founder Peter Sunde. This action came shortly after Mastercard and Visa reportedly made a policy change banning payment providers from processing payments to VPN providers in Sweden, also affecting iPredator. The international credit card companies ordered Payson, a Swedish payment provider, to discontinue its processing services to anonymizing services. At the end of June, Payson sent its customers an email in compliance with an "urgent requirement" from Mastercard and Visa to no longer accept payments for VPN services. The email read, "Payson has restrictions against anonymization (including VPN services). As a result Payson can unfortunately no longer give your customers the option to finance payments via their cards (VISA or MasterCard)."
According to TorrentFreak, this may be a part of Visa's and Mastercard's increasing efforts to take action against services linked to copyright infringement. TorrentFreak noted that there is "an unwritten rule that Mastercard and Visa don't accept file-hosting sites that have an affiliate program and PayPal has thrown out nearly all cyberlockers in recent months."
But although VPN use may facilitate illegal activity, like copyright infringement, a VPN is a tool of many uses. Corporations frequently use VPNs to secure sensitive, privileged communications. In addition, VPNs can be used as virtual firewalls, preventing direct attacks to a known IP address since only the VPN server IP can be seen. Most importantly, with the increase in online data collection -- including by oppressive governments -- individuals use VPNs to keep their web browsing and other online activities private.
Using a VPN to disguise their IP addresses, users can access websites that have been restricted in their country. In China, where more than 2,600 websites are currently or have been blocked, VPNs allow the public to view and spread communications that would otherwise remain unseen. Turkey experienced a government crackdown on Facebook, Twitter, and other social media networks, with Turkish Prime Minister Recep Tayyip Edrogan referring in June to social media as "the worst menace to society." Anticipating a shutdown, users in Turkey turned to VPN services; iPhone and Android VPN installs increased by 3,000 percent in one weekend, and installations of the free Hotspot Shield VPN software saw a 1,000 percent increase.
Without VPN services, there is no doubt that a huge amount of this communication could have been censored, leaving viewers unable to access and respond to the severe situation that occurred. In pressuring payment providers to block VPN services that permit activity contrary to their interests (or, more likely, their clients' interests), Visa and Mastercard are also interfering with a primary tool for access to content blocked by restrictive governments. They are using financial pressure to shut down these services without considering the broader effects.
Even worse, these recent actions echo past efforts to use control over payment processing as an intentional means of stifling speech. In 2010, PayPal, Mastercard, and Visa all blocked payments to Wikileaks, likely in response to U.S. government pressure, after the whistleblowing website released classified diplomatic cables. Amazon got on board as well, discontinuing its cloud hosting service to the website.
Visa and Mastercard's recent efforts have created an arbitrary, nonlegislative "process" to block (or at least limit) channels for access to content. The extensive worldwide usage of these payment services gives them leverage over online payment providers, giving the credit card companies wide discretion and a huge amount of power to influence Internet behavior. Using this financial pressure to shut down websites presents a heavy imbalance in -- and abuse of -- market control.
Rebekah Bradway is an intern at the Digital Media Law Project and a rising 3L at the S.J. Quinney College of Law at the University of Utah.
(Photo courtesy of Flickr user jericho1ne pursuant to a Creative Commons CC BY-NC-SA 2.0 license.)
