Update: The Swedish authorities answered our protocol request

Since the events of the search warrant by the Swedish police at Mullvad’s office in Gothenburg, we have tried to get hold of documents and protocols tied to the operation.
This is what the authorities came back with.

On 18th April at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They left without taking anything and without any customer information.

Since then, Mullvad has requested the search warrant signed by the prosecutor, as well as the house search protocol by the police (which is obligated to be drawn according to Swedish law). We requested the documents to better understand why the police chose to visit us with a search warrant at this time. In all the years up until now it has been clear to them that they are not able to seize non-existing data.

We have now received a response from the Swedish Prosecution Authority and the prosecutor in charge of the operation, who told us that the search warrant was a decision made in international legal cooperation with Germany. However, the Swedish Prosecution Authority does not want to give any more details and we were not given any protocols with reference to confidentiality.

See the letter from the prosecution office in its entirety below:

Translation:

“Regarding your request for copies of decisions and reports

The Swedish Prosecution Authority has received a request for an international
judicial cooperation from another state, Germany, regarding a case ongoing in
that state. In accordance with this request, on February 17, 2023, I granted a
search of the premises of Mullvad VPN AB and Amagicom AB. This decision
was implemented on April 18, 2023.
According to Section 17, Chapter 18 of the Swedish Public Access to
Information and Secrecy Act, secrecy applies in activities relating to judicial
cooperation at the request of another state for information relating to an
investigation according to the provisions on preliminary investigation in
criminal cases or matters that concern coercive measures, if it can be assumed
that it was a prerequisite for the other state’s request that the information
should not be disclosed.
Your letter also states that the question has previously been raised with the
Swedish Prosecution Authority regarding this event. Unfortunately I can find
no such request or inquiry.”

We have not got any more information from the National Operations Department (NOA) of the Swedish Police, but they gave an interview on Swedish television (SVT). The Swedish television also got a comment from the German prosecutor:

"According to Paul Pfeiffer, prosecutor in the city of Rostock in northern Germany, the operation was connected to a blackmail attack that hit several municipal institutions in the state of Mecklenburg-Western Pomerania in October 2021. As a result of the attack, the institutions were not able to carry out their tasks.

– During the investigations, which are still ongoing, an IP address was found that led to the VPN service Mullvad. The investigation is not directed towards the VPN service, the prosecutor writes in an email.”

In the television feature, the Swedish police (NOA) also answers the question "You sent six police officers to Mullvad and you didn't get hold of anything, because the data you requested did not exist. Would you still say it was a successful operation?”

NOA: "Based on the investigation order we received, we consider that we did what they requested."

During the house search we argued that they (NOA) had no reason to expect to find what they were looking for and any seizures would therefore be illegal. After demonstrating that this is indeed how our service works and them consulting the prosecutor, they left without taking anything and without any customer information.

However, had they taken something, it would not have given them access to any customer information.

These are the national laws that makes it possible to run a privacy-focused VPN service in Sweden:

Electronic Communications Act (2022:482) (LEK) Does not apply to Mullvad VPN AB

According to LEK’s definitions, LEK does not apply to Mullvad since we, as a VPN service provider are not regarded as an electronic communications network nor an electronic communications service.

Act (2012:278) on Collection of Data in Electronic Communication in the Crime Combating Authorities’ Intelligence Service (IHL)

This law can only be used to request user data from businesses having the LEK reporting obligation. This means authorities cannot use LEK nor IHL to request information from Mullvad.

The Swedish Code of Judicial Procedure (1942:740) (RB)

According to this, a search of premises may be instigated not just on the individual who is suspected on reasonable grounds but on anyone, provided that there is a factual circumstance and that it can be tangibly demonstrated that there is a reasonable expectation of finding items subject to seizure, or other evidence of the offense in question. Objects may also be seized if they are believed to have importance for the investigation.

Summary

Since Mullvad VPN by law is not required to collect any data related to our users’ activities online – and since the pure purpose of our service is to protect users from collection of such data – it is in our interest, our customers interest, all our employees and owners’ interest to not collect any data and therefore there is no reasonable grounds to doubt that we do not collect any data about our users’ activities online.

Read all about our no-logging and privacy policies.