After Edward Snowden blew the whistle on NSA’s mass-surveillance program last year, so called ‘Privacy as a Service’ became a real attractive business and companies like HideMyAss, Hotspot Shield, CyberGhost VPN or ZenMate, which offer anonymous browsing and VPN-like connectivity on the web, got a lot of attraction and customers.
And money, too. ZenMate just raised $3.2 million from a group of Venture Capital funds at the beginning of October.
But Robert Knapp, co-founder and CEO of CyberGhost VPN says he turned down such offers because he doesn’t want a VC on his back, unless he finds one who understands what it means not to treat people like products. Instead, he went on Indiegogo crowdfunding platform asking people to finance his product.
He also is not afraid to speak his mind on delicate subjects like internet regulation, cybercrime and privacy vs. security. So we asked him how long is his bet on this new Privacy as a Service business.
How to Web: How did CyberGhost VPN begin and how did you benefit from the NSA mass-surveillance scandal that started in June 2013?
Robert Knapp: The first version of CyberGhost VPN started as a list of proxy servers mainly used to watch American TV shows. Basically, the product scanned the proxies, but the problem was that proxies were online, then offline and so on… So we did a script that was constantly searching online for available proxies – like a robot – and that was the first version of the product. It wasn’t even a VPN.
But they were slow, not fast enough to distribute streamed content. So we developed further our first version of CyberGhost by renting our own server and putting it on this server and we became a VPN provider. And then people started to use us as such because VPN was practically built in. It was a free version and then we added more servers… And then Edward Snowden showed up and that helped a lot!
How did that help?
It was not a huge increase in subscriptions, but we didn’t have to explain our business to the people anymore. That was the most positive thing about it.
So you re-marketed and advertised CyberGhost VPN accordingly?
We changed from just being a streaming services company to a security company slowly, by a taking few steps, and the first was asking our users how they use the service.
Surprisingly, the majority used CyberGhost VPN for other reasons than video streaming from blocked sites, like browsing more securely, more anonymously. We realized that we became a security company. Our users taught us to be what we are today.
When did you realize that being based in Germany and not USA would be an advantage?
That was very soon. First of all, we were not running away from America in Germany, we ran away from Germany to Romania in 2010, because Germany implemented a data retention law that demanded ISP’s to collect all users’ data and store it for no longer that six months – that’s because the European Union decided to have a Data Retention Legislation and all the member states had to comply.
Well, we thought that was crappy, because you can’t run an anonymity service and collect user data, because that means that there’s a backdoor. Even back then, CyberGhost VPN was still safe because our technology was based on the anonymity given by huge number of users. You know, if you are alone in a room and wearing a mask, I will know it’s you, but if there are 100.000 people wearing the same mask there’s no way they could get you.
But that motivated law enforcement people to investigate. So we had a police raid in our office – a bunch of crazy people in uniforms without any knowledge of what they do, who took our servers into custody. And what did they do? They started to take our computers thinking that any PC is a server…
And why did you move to Romania?
We said it was too risky to run our business from Germany – too risky for our customers and for us as a provider. So we searched for an opportunity to move the business. US, even back then before Snowden whistleblowing, was not an opportunity, so we scanned the European landscape and there were few countries that fought against data retention programs in a pretty clever way, and one was Romania, the first country that turned down data retention.
The Constitutional Court is very reliable and strong here and, at the same time, I found an article on TechCrunch about the hiring problem of skilled programmers there and the title was about whether the universities in Bucharest would be able to solve the Silicon Valley’s problem. So I said to myself: if the American entrepreneurs are looking here for people and this place is only a 2h flight away from Germany, we should come here.
Services like CyberGhost VPN can be used by anyone, good or bad guys. In the US there was the case of a similar service – No-IP.com, which was literally taken over by Microsoft who shut down their servers! This is a delicate matter… Do you feel morally responsible at least for what happens through your service?
Yes and no. Bad things happen every day, crimes are committed all the time – welcome to the real life! We’re talking about the internet, so we all have to realize that the internet is part of our life not a place that can be separated from our life, or that can follow any other rules.
We have two options right now: one is to run services that protects the good guys, the other is to run services that have backdoors to prevent crimes at any possible moment. We decided to run a service that protect the good guys. This is possible only if you don’t open backdoors because if you do, they will be opened for the bad guys too.
The only way to make sure that the people are safe on our servers is not to store anything. This is how we understand security and privacy online.
Pretty bold statement…
Well, we have to make a decision as a society on how do we want to deal with the internet. I also think that ‘digital crime’ (a.k.a cybercrime, Ed.) does not really exist. If someone ‘digitally’ steals money from your wallet, it happens in the real world, where real money is moved from your bank account.
Terrorists don’t blow up websites. They blow up buildings, move bombs from A to B. And child pornography doesn’t happen ‘digitally’, just because pictures are exchanged online.
We should stop talking about crimes happening on the internet, they happen in the neighbourhood, in public places. That’s where the police has to investigate, not by mass surveillance and scanning digital things. And we, as a society, have to help them.
Some other folks saw this as a business opportunity too, so competitors of CyberGhost VPN are out there with products like VPNBook, VPN Direct, ZenMate…
Yeah, ZenMate, which recently raised 3.2 million US Dollars from a VC Fund!
Exactly! And you went on… Indiegogo? Come on, why not try a VC funding?
We were talking with VC’s and, by the way, in amounts bigger than 3.2 million, but… there’s a ‘but’. Indiegogo is, for us right now, the best way to get funded because I think that, if you are a Privacy as a Service provider, it’s not important only how you run your business, but also how you fund it. At the end of the day we are fighting against a world that sees people as products.
The mass-surveillance problem has a cause – we as people started to let our whole digital lives out on channels like Facebook, Google and such… We agreed to use services for free and in exchange we accepted the fact that we became products. That our personal data is for sale, that they make money with it.
We think that it’s not ok that people are products, this has to be changed. That’s why we are a paid service. If we raise money from a Venture Capitalist we must find someone that understands that we don’t sell our shares and make our customers a product, but that’s is precisely what a VC expects – return on their money as soon as possible.
But what’s the next step then? You asked for $70,000 on crowdfunding platform Indiegogo and you got…
Yes, we asked for 70,000 and we raised so far over 160,000 USD, so we are overfunded by more than 160% (campaign will end on the 3rd of November, Ed.). The next step is that we’ll build the first no-spy proxy server, we are running the beta test on the next generations of what CyberGhost wants to be – we added beside VPN some other features like antivirus and firewall.
Will I still be able to use CyberGhost VPN with some other’s provider antivirus?
Yes. It will be like a Unified Threat Management system, running from the cloud not on your machine.
So you’re moving towards a security company…
Yes. We are already a security company, but we’ll have a fully integrated product.
Will you target businesses as well?
No. Only consumers. And the next step is our own device, which is a router that is fully configured and secured, which people can just plug or connect their device, mobile phone, computer.
Will I be able to use it for my whole Internet of Things connected house?
Yes, exactly that’s the idea, we are trying to bring it to the market at the end of this year or the beginning of the next year.
How did you deal with the growth that all these politically troubled markets brought to you? Clients were actually searching in advance for your product – it is a completely different business model…
Surprisingly for many people, we don’t spend money on advertising. We have a strong social media presence, a big data base of emails, our free product and that’s what we use.
We are bootstrapping, we are still in a stage when we grow fast. We’re still hacking our growth, we are still looking into how people use our service and we are still building the basis of our construction.
How much money will you make this year? Can you give us an estimation?
Typically October, November and December are our strongest months, so we are expecting somewhere between 1 and 3 million euros for 2014, it really depends on these three months.