We’re nearing spring, and you know what that means. It’s time for our Q1 Transparency Report for 2023.
Despite more and more countries pushing for legislation that restrict digital freedom, we’re noticing a decrease in the requests we received since the beginning of 2023. This could be due to the fact that law enforcement authorities and tech companies are still catching up to the new laws.
The digital landscape might be changing, but our commitment to our credo of a free and open internet stays the same. We operate under a strict No Logs policy. This means that we never store any user data. Because of our policy we’re unable to comply with the legal requests we received these past three months.
Let’s have a more in-depth look at our numbers for the first three months of 2023.
Legal Requests — Q1 Edition
In the first quarter of 2023, we received a total of 224,021 requests. This marks a 12% decrease compared to our previous edition from 2022.
This seems to be a recurring trend for our Q1 reports. We previously noticed a similar 15% decrease in 2022 and a 30% decrease in 2021. There could be several factors, and we’ll go through them in more details below.
As usual, we’ll be grouping these requests into 3 main categories. These are:
-
-
-
-
- Digital Millennium Copyright Act (DMCA) Complaints
- Malicious activity flags
- Police requests
-
-
-
Normally, the requests we receive ask for identifying user data, like IP address, DNS requests, or browsing history. Which, remember, we don’t have due to our air-tight No Logs policy.
Since we’re headquartered in privacy-friendly Romania, we’re under no legal obligation to store user data or monitor web traffic. We operate under the Privacy by Design principles, which means we designed our service to prevent data retention.
Because of this, we’re unable to honor these requests. We don’t have any user data to share. This means that we’re unable to comply.
A monthly breakdown of all requests looks like this.
| January | February | March | |
| DMCA Complaints | 36,460 | 28,928 | 26,469 |
| Malicious Activity Flags | 67,092 | 38,450 | 26,622 |
| Police Requests | 0 | 0 | 0 |
Most notably, we received no police requests this quarter. This means the numbers are slightly different from our usual reports.
Similar to 2022’s Q4 report, malicious activity flags make up the majority of all requests. Let’s dive in, and look closely at the numbers.
DMCA Complaints
DMCA complaints pertain to what you might as the copyright act. The act protects intellectual property.
We receive this type of complaint when copyright holders throughout the entertainment industry signal that one of our IP addresses has been used to distribute copyrighted material. Normally, they validate the complaints by providing the port used and a time stamp.
| January | February | March |
| 36,460 | 28,928 | 26,469 |
DMCA complaints make up 41% of all requests we received these past three months. Not only is this slightly less than our previous quarter at 49%, but we’re also noticing a decrease in the monthly number of complaints.
This is likely because February and March weren’t particularly popular for streaming compared to January. In January, many highly-anticipated shows like The Last of Us, That ‘90s Show, and Velma premiered on popular streaming services like HBO Max and Netflix. A number of Oscar-nominated movies also were made available online during this period, but their popularity quickly faded in the months that followed.
TV often makes a comeback in households during this time, according to Nielsen statistics, in favor of streaming services due to popular events like The Academy Awards and NCAA March Madness.
It’s also worth noting popular torrent site Pixelados was shut down. Pixelados was the result of a merger between two popular Spanish trackers HD-Spain and HDCity.
Malicious Activity Flags
We receive this type of request when authorities signal that one of our IP addresses was used in a cyberattack. This can include anything from botnet attacks to DDoS attacks to automated spam or suspicious login attempts.
| January | February | March |
| 67,092 | 38,450 | 26,622 |
Similarly to our previous report, malicious activity flags make up the majority of overall requests. This time, they sit at 59% of overall inquiries. Compared to our previous report’s 50% we noticed a small increase in this type of requests.
Given the timeline, we notice a peak in January followed by a steady decline in requests.
The time around the winter holidays seems to be especially lucrative for cybercriminals, as more people shop online or are on vacation using unsecure Wi-Fi networks. This might explain the decrease in numbers starting February.
Police Requests
This quarter marks a milestone we haven’t observed since May 2013. These past three months we received no police requests.
We normally receive police requests when law enforcement agencies inform us a criminal investigation led them to one of our IP addresses. Authorities ask for data that could help aid in their investigation.
| January | February | March |
| 0 | 0 | 0 |
In the previous edition, we received 17 police requests, which made 0.1% of all requests we received. We can notice a dramatic decrease in police requests this quarter. Only time will tell if this trend holds.
Our server team has also worked beyond the scenes to inhibit the use of illegal domains on our servers.
New Year, New Projects on the Horizon
These past three months, we focused on security. Not just on improving our service but sharing our knowledge on cybersecurity with students from Bucharest, Romania.
Our Bug Bounty Program Is Going Strong
In our previous edition, we mentioned we had launched our Bug Bounty Program. We’re happy to report that we’ve continued to receive submissions from cybersecurity specialists worldwide. These past three months, we received 154 submissions, with 70 of these issues being unique. In total, 10 of these were valid, with the others noted as false positives.
We Released a Security Patch for Our Linux App
Thanks to a submission through our Bug Bounty program, we worked with a talented security researcher and improved our Linux CLI app. We released a security patch available from version 1.4.1 for Ubuntu 20.04, Ubuntu 22.04, Mint 20, CentOS 7, PopOS, and Kali. You can download it through your online account.
We Added Servers in Brisbane, Australia
Aussie Ghosties, this one’s for you. We expanded our server fleet to give you more locations to choose from. Secure your Wi-Fi on TransLink buses, or catch up on ABC Radio Melbourne when you’re traveling. Our servers in Brisbane, Melbourne, and Sydney will let you enjoy fast speeds and secure connections no matter where you go.
We Hosted an Open Day for Curious Students
We had the pleasure of welcoming 15 students from the Tudor Vianu National College of Computer Science, located in Bucharest, Romania. Our team gave the students a crash course into cybersecurity and tackled subjects like VPNs, cloud data, and networking. It was a fun day, and we’re honored to have shared our knowledge and experience with bright and ambitious students.
We’re Seeing Worrying Privacy-Invasive Trends
2023 isn’t off to a good start in the digital world. We’re still dealing with the economic and social aftereffects of the global Covid-19 pandemic, and some actors take advantage of the uncertainty many people face. Under the guise of security, we see legislators push for more surveillance, and tech companies innovating without concern for online safety.
Louisiana Started Requiring Age Verification to Watch Adult Material Online
Louisiana’s HB 142 law came into effect in January. It stipulates any website hosting more than 33.33% adult material has to verify their users’ age by having them upload a government-issued ID. Giving away personal information to third-party companies is a recipe for disaster. More worryingly, other states followed suit and proposed similar bills.
ChatGPT Trained to Write Malicious Code
Check Point Research went through a few popular cybercrime forums, and found a few posts detailing their exploits through ChatGPT-generated malware. Luckily, most of the code was a mixed bag of functions, which requires some technical knowledge to comb out. That said, we should keep in mind ChatGPT isn’t a static entity. It’s built to learn and evolve. As more seasoned cybercriminals feed the algorithm, ChatGPT might just become a dangerous tool.
The UK Tries to Undermine Encryption
The UK’s Online Safety Bill, first proposed by Boris Johnson, is set to come into force in fall 2023. The bill will impact private communication, since it puts a big responsibility on tech companies to protect people from illegal and harmful content. It’s still not clear how we’d define “harmful” content. As we’ve seen with similar proposals, like Article 13 or the Digital Economy Act, this bill would require a great degree of surveillance and private message monitoring to properly implement.
The US Pushes for More Online Control with the RESTRICT Act
This act made headlines as it would effectively ban TikTok. While TikTok is a data-harvesting machine, it’s not the end goal of the RESTRICT Act. It would allow the US government to restrict tech products that threaten national security but it would also allow lobbyists like Meta and Google to serve on an advisory committee. The committee oversees how foreign apps and hardware should be handled. By having a say in competitor products, this act will also manipulate the free market and restrict consumer digital freedom.
Fighting for an Uncensored Internet Culture
Since our inception we’ve defended privacy as a basic human right. It’s what drives us to push forward, and make CyberGhost VPN a tool to safeguard your online data and digital identity. Our fight against censorship and digital surveillance continues in 2023.
We’re committed to improving our service and building the right tools for you to protect your online privacy and freedom. We’re here to push the conversation around digital privacy, and the first to that is being open about the measures we implement to protect your data.
This is why we’re focused on providing quarterly Transparency Reports, right here on the Privacy Hub. Make sure to tune in, and keep up with the latest numbers.
Missed our previous quarterly reports? See our 2022 editions here:
For the bigger picture on the steps we take to protect our Ghosties’ privacy, check out our yearly Transparency Report. You’ll also find some key statistics about our infrastructure, and learn more about our hardware.
Until next time, stay safe and secure!
Leave a comment