ExpressVPN bought for $1bn by Brit biz with an intriguing history in adware

September 14, 2021 TH Author

UK-headquartered Kape Technologies announced on Monday it has acquired ExpressVPN in a $936m (£675m) cash and stocks deal, a move it claims will double its customer base to at least six million.

In a canned statement, Kape said combining the two companies would “create a premium consumer privacy and security player,” and that the acquisition “further positions Kape to define the next generation of privacy and security protection tools and services to return greater control over the digital sphere to consumers.”

Express VPN, meanwhile, tweeted:

We are delighted to share we will be joining Kape, a London Stock Exchange-listed company, to form the global leader in digital privacy.

Thank you to everyone who has supported us in building a more private, secure, and open internet over last 10 years.https://t.co/tMtASfJXPL

— ExpressVPN (@expressvpn) September 13, 2021

People use VPNs for a whole bunch of reasons ranging from accessing region-locked entertainment to evading internet censorship to connecting to remote secure networks to a desire to avoid snooping and filtering by ISPs. In China, for instance, a VPN may allow access to Western social media sites – at least until Beijing finds a way to block the connection. We can well imagine the use of VPNs around the world has grown with the COVID-era surge in time spent stuck at home online as folks seek to swerve geo-blocking and so on.

You can set up your own VPN system if you’re confident you know what you’re doing, using Algo, Outline, or OpenVPN, for example. Alternatively, there are services like ExpressVPN that make it easier for those who want to avoid deploying and configuring server- and client-side software.

(And we’re talking about setting up VPNs for personal use here; enterprise and businesses is another ballgame.)

Bear in mind VPNs aren’t a privacy or security panacea: they are a means for, simply put, steering at least some of your internet traffic around the globe and encapsulating it in encryption to protect it. You have to ultimately trust your VPN provider isn’t doing the same monitoring and filtering that you’re seeking to avoid.

Founded in 2009 and based in the British Virgin Islands, ExpressVPN is generally known for being one of the best VPN providers on the market.

Let’s take a look at its new owner. Kape used to be known as Crossrider until it changed its name in 2018 to move away from its advert-slinging past and reinvent itself as a cybersecurity outfit. Crossrider was founded in 2011, and in 2012, billionaire Teddy Sagi took control of it for $37m.

In 2015, a joint study by the University of California, Berkeley and Google identified Crossrider as a major affiliate of ad injectors, including SuperFish that you may remember from the laptop adware fiasco.

Crossrider made tools for building browser extensions and applications for Windows PCs and Macs that could be monetized by forcing ads onto people’s screens. It could be, and was, used by developers to make add-ons for browsers that injected adverts into the webpages users were looking at. These extensions would be bundled with installers for other software, typically.

As the joint study put it, “Crossrider is a mobile, desktop, and extension development platform that enables drop-in monetization via major ad injectors. Crossrider provides its affiliate ID to ad injectors while separately tracking kick-backs to developers.”

In response, Crossrider criticized Google for attacking rival internet advertising businesses, and claimed it was trying to keep the ad-injection industry clean. MalwareBytes, meanwhile, dubbed Crossrider a type of adware.

In the year Crossrider became Kape, its CEO Ido Erlichman vowed that his company had “completely broken away from the ad-tech world.”

Kape now owns VPN services CyberGhost VPN as well as ZenMate and Private Internet Access, and with ExpressVPN onboard, that apparently takes its subscriber count up to six million.

The ad-tech shenanigans are water under the bridge for ExpressVPN, which stated:

And ExpressVPN veep Harold Li told The Register: “Ensuring that Kape shared our commitment to privacy and doing right by users was a non-negotiable in our due diligence process, and we were thorough in our assessment. Based on what we saw and heard, we are confident about working with Kape.”

“Kape has moved on from those times,” he added, referring to the ad-injection days.

“They now have a new team and suite of products focused solely on privacy and security. Their revenue, reporting in public filings for all to see, also reflects that, coming 100 per cent from the digital privacy and security segments. And the way they’ve operated those products has absolutely demonstrated a commitment to user privacy, as well as transparency – Kape’s track record with Private Internet Access and CyberGhost speaks for itself.”

For now, at least, Kape plans to operate ExpressVPN services independently: it will still be legally based in the British Virgin Islands (BVI) and run as its own unit, and continues to promise not to collect people’s connection logs.

“ExpressVPN will remain a separate service from other Kape brands, and everything you’ve come to know and love about ExpressVPN will only continue to improve: our award-winning speed and reliability, premium global server network and bandwidth, 24/7 live chat, BVI jurisdiction, policy of not collecting activity or connection logs, independent third-party audits, and more,” wrote ExpressVPN. ®