Swedish VPN vendor Mullvad is facing a backlash from some customers after co-founder Daniel Berntsson personally donated SEK 5 million (£385,000, $519,000) to the controversial populist Örebropartiet, which is running in Sweden’s national elections for the first time.
Berntsson has this week published a blog post explaining the donation, alongside posts titled “Immigration,” “Political individualism,” and “Moral individualism.” Before that, he had not posted since 2019.
The flurry of posts follows weeks of customer criticism over the donation – for example, Finnish blog Moonwriting’s post “I’m done with Mullvad.” Another blog, Unutterable, is more direct: “Mullvad funding the far-right and the problem with tech company ownership.” The Hacker News discussion thread about the donations has reached a remarkable 1,784 comments so far.
Mullvad was co-founded and is still jointly owned and run by two CEOs, Berntsson and Fredrik Strömberg. Its name, as reflected in the company’s logo, is Swedish for “mole.” It also offers the Mullvad Browser, a privacy-enhanced fork of Firefox ESR co-developed with the Tor Project. Swedish socialist newspaper Flamman (“The Flame”) revealed the donation in its story “High-profile techie gives millions to the Örebro Party.”
In a post on X, the company said it was devoted to freedom of speech and tolerance, saying: “It should be obvious that Daniel’s private donation to a political party is not part of Mullvad’s values or mission, in the same way that someone’s opinions on animal rights, taxes or public healthcare policy isn’t.”
IVPN
IVPN is based in Gibraltar, which is a British Overseas Territory and whose laws are the same as Britain except were Gribraltar passed their own laws to override it.
Unless proven otherwise (by finding actual laws passed in Gibraltar to block it) treat any VPN based in Gibraltar as being subjected to the same kind of secret mass surveillance orders from Information Courts as those based in Britain.
Just great, there are barely any good alternatives to mullvad
Jurisdiction doesn’t matter, it’s an myth spread by Protonmail marketers so everyone thinks their privacy is ensured by some strict Swiss privacy laws.
Although privacy laws are pretty mild everywhere. Even GDPR is quite outdated and is barely enforced.
Proton, Tuta and others do it because “Swiss privacy” or “EU-based” brand is much more recognizable and easier to sell people on, compared to “we do metadata obfuscation” or “here is our 50 page long security audit”.
However, what actually matters more is security architecture. Signal is US based, but they thought through how to retain as little data on users as possible, so when FBI asked them for info, Signal could only give them date of account registration, user ID, and last login.
TLDR ignore country of registration and HQ location, evaluate on the merits