Category: Uncategorized

Over the weekend I left my car in an unusual spot. A few hours later my phone buzzed with a text from “Regitra”:

“Jūsų automobilis užregistruotas kaip pažeidęs parkavimo tvarką. Peržiūrėkite dokumentą čia: [link]”

(Your vehicle has been registered as violating parking rules. View the document here.)

My heart rate jumped. For a second, I believed it. I had parked somewhere odd, so the message fit my situation perfectly.

Then I looked at the link and remembered what Regitra actually does: vehicle registration and driver’s licences. Parking fines aren’t their job. They come from the police or municipal authorities. The domain was also a jumble of characters, nothing like an official address. I deleted the message and moved on.

The timing was pure coincidence, but that’s exactly why it’s worth writing about.

Why it almost worked

Scammers don’t need to be clever. They need to land a message at a moment when you’re primed to believe it. This one used three levers:

• Authority: a name you recognise and trust, in this case a state institution.
• Context: a plausible reason to be contacted. Most of us drive, and most of us have parked badly at some point.
• Urgency and fear: a fine implies a deadline, a penalty and a mistake you’ve made.

When all three line up, your brain reacts before it analyses. The emotional jolt comes first, and the rational check (“wait, does Regitra even do this?”) comes second, if at all. Scammers are counting on you to tap before the second step.

How these scams work behind the scenes

This type of attack is called smishing, which is phishing by SMS.

Here’s the typical chain:

• Mass sending. Criminals send thousands or millions of texts to numbers they’ve bought, scraped or simply generated. They don’t know who owns a car or where it’s parked. Some people will always happen to match, and that’s all they need.
• A lookalike link. The URL imitates a real institution with extra characters, a different domain ending, or random numbers. On a phone screen, where the address is truncated, it’s easy to miss.
• A fake page. The link opens a convincing copy of an official site or payment portal. It may ask you to “confirm the fine”, log in with your bank or e-government credentials, or enter card details to pay a small amount.
• Data harvesting. Whatever you type goes straight to the attacker. Some pages also ask for the one-time code your bank sends, which lets the criminal approve a transaction in real time while you think you’re paying a €15 fine.

Some of these messages can even appear in the same thread as genuine messages from the real sender, because SMS sender names can be spoofed. A familiar sender name is not proof.

What the consequences can be

• A small “fine” can be the entry point to something much bigger:

• Direct financial loss: drained bank accounts or unauthorised card payments, sometimes within minutes.
• Identity theft: names, ID numbers, addresses and vehicle details are enough to open accounts or run further scams in your name.
• Account takeover: if you reuse passwords, one stolen login can unlock your email, social media and online shopping.
• Malware: some links install malicious apps or prompt you to grant permissions that give attackers access to your phone.
• Follow-up attacks: once you’ve engaged, you may be flagged as a “responsive” target and hit with more convincing scams, such as a fake call from “your bank’s fraud department”.
  What to do instead

Before you click:

Ask whether this organisation actually handles this matter. Regitra deals with registration and licences, not parking enforcement.

Never trust the link. Open the official website by typing the address yourself, or use the official app, and check for any real fine there.

Look at the domain character by character. Extra numbers, odd spellings and unfamiliar endings are red flags.

Be suspicious of any message that creates pressure to act immediately.

If you’ve already clicked or entered details:

1. Call your bank right away. Block your cards and ask them to review recent transactions. Speed matters most here.
   
2. Change your passwords for any account you entered, and for any other account that uses the same password. Turn on multi-factor authentication.
   
3. Check your phone. If you installed anything or granted permissions, remove the app and consider running a security scan.
   
4. Report it. Tell the police and your national cybersecurity authority (in Lithuania, the National Cyber Security Centre). The real institution being impersonated often wants to know too, as it helps them warn others.
   
5. Watch for follow-ups. Expect suspicious calls or messages in the following days and treat them with extra caution.
   The takeaway

I didn’t avoid this because I’m especially savvy. For a moment, my pulse went up like anyone’s would. What saved me was a habit: pause, then ask who actually handles this and where the link really goes.

Scammers rely on speed. A five-second pause is one of the strongest defences you have, so build it into the way you read messages.

Share this with someone who might tap before they think. And if you’ve had a close call yourself, I’d like to hear about it in the comments.

User: ‘Why did I get disconnected?’ Me, staring at empty logs: ‘Great question. I literally cannot tell you.’ This is the no-logs promise in action.

Our VPN has a strict no-logs policy. We don’t track user activity. We don’t store connection logs. We don’t identify individual users.

This is exactly what our users want—and need.

But here’s the challenge nobody talks about:

How do you improve service quality when you’ve deliberately blinded yourself?

In traditional IT service management, troubleshooting looks like this:
→ User reports an issue
→ Pull their connection logs
→ See exactly what happened
→ Fix the root cause

With a no-logs policy, troubleshooting looks like this:
→ User reports an issue
→ We have… aggregated metrics? Maybe?
→ Try to reproduce the problem
→ Hope we get lucky

The questions we can’t answer:

1. Why did this specific user get disconnected?
2. Which server was performing poorly for them?
3. What route did their traffic take?
4. When exactly did the authentication fail?
5. What was their actual experience?

All the data that would help us debug? Gone by design.

So how do we maintain quality without compromising privacy?

We’ve had to get creative:

1. Aggregate everything
– Server-level metrics (not user-level)
– Regional performance patterns (not individual sessions)
– Device type trends (anonymized)
– Time-based connection success rates

2. Build feedback loops that preserve privacy
– In-app quality surveys (voluntary, anonymous)
– Connection success/failure counts (no identifying info)
– Automated health checks from monitoring nodes worldwide

3. Proactive monitoring instead of reactive troubleshooting
– If we can’t debug individual issues, we prevent them
– Synthetic monitoring from every region
– Continuous infrastructure testing
– Predictive capacity planning

4. Statistical pattern recognition
– When 50 anonymous users from Brazil report issues at 3 PM, we know – something’s wrong
– We don’t need to know WHO they are to fix the WHAT

The hard truth:
We probably catch problems slower than competitors who log everything.
We definitely have blind spots they don’t have.
Some issues we simply cannot root-cause with certainty.

But here’s what we gain:
User trust. Real privacy. The confidence that we CAN’T betray their data because we DON’T HAVE IT.
And that’s a trade-off I’m willing to manage.

The question that keeps me up at night:
How much service quality are users willing to sacrifice for true privacy? Where’s the line?

Why your VPN works perfectly in London but barely connects in Jakarta isn’t a bug—it’s geography.

After managing VPN services across 100+ countries, I’ve learned that “global coverage” on a map tells you nothing about actual user experience. The world isn’t flat when it comes to internet infrastructure. And that reality shapes everything we do in IT service management.

Let me show you what I mean:

Western Europe: The Easy Mode
-Dense fiber infrastructure
-Multiple tier-1 ISPs competing
-Predictable network paths
-Strong data center presence
Result: Sub-100ms latency, 99%+ connection success rates

Southeast Asia: The Archipelago Challenge
-Traffic often routes through Singapore—even between neighbouring countries
-Undersea cable dependency (and occasional breaks)
-ISP throttling of encrypted traffic varies wildly
-Government filtering adds latency layers
Result: Same server, 3x different experiences depending on which island you’re on

Middle East: The Regulatory Maze
-VPN protocols blocked or throttled by national policy
-Limited peering between countries—traffic goes to Europe and back
-Port blocking forces protocol switching
-Deep packet inspection at national gateways
Result: What works in UAE might not work 200km away in Saudi Arabia

Sub-Saharan Africa: The Infrastructure Reality
-Limited local server options
-International bandwidth costs much more than Europe
-Last-mile connectivity highly variable
-Power infrastructure affects data center reliability
Result: It’s not about our service quality—it’s about foundational infrastructure gaps

Even within the same city, user experience varies by ISP:
-Some throttle VPN traffic aggressively
-Some have better international peering
-Some use outdated equipment
-Some actively interfere with encrypted connections

We can’t control the ISP. We can only adapt to it.

What this means for service management:
→ One-size-fits-all SLAs don’t work.
→ Server placement isn’t just about coverage—it’s about understanding local internet topology.
→ Protocol flexibility is mandatory. What works in Germany won’t work in Vietnam.
→ Regional monitoring is essential. Global averages hide local disasters.
→ User education matters. Sometimes “slow VPN” isn’t our fault—it’s a 3G connection on a remote island.

The hardest conversation I have:

Why is your service slow in “my country”?

The honest answer: “Because your country’s internet infrastructure is fundamentally different, and there are limits to what we can overcome.”

But we try anyway. Different protocols. Different routing. Different server strategies. Different expectations.

Geography isn’t just physical distance. It’s regulatory environments, infrastructure investment, ISP behaviour, and political decisions.

And all of it lands on the IT Service Manager’s desk – making sure that regardless of all of the obstacles, our user could enjoy the best service available.

We’re all gamblers, whether we acknowledge it or not. Life itself is a game of chance, and every decision we make is, at its core, a bet. From the mundane – choosing what to eat for lunch, to the monumental – deciding where to live or which career to pursue, life is a series of wagers with uncertain outcomes.

No matter how much you learn or prepare, the world is too vast and complex for anyone to fully understand. We gather inputs, analyze options, and place our bets. Decisions we hope will lead to positive outcomes. But honestly – none of us can see the future. Will the decision turn out to be good or bad? What will the consequences be? The truth is, no one knows for sure.

The biggest milestones in life and work – buying a home, choosing a career path, starting a business, or launching a new product – are all high stakes gambles. Even small, seemingly inconsequential decisions carry risks, and over time, these small bets add up to shape the course of our lives.

The key to navigating this uncertainty is risk management. Every gambler knows that success isn’t just about luck – it’s about understanding the odds, making informed choices, and preparing for the consequences of failure. Are you comfortable with what might happen if things don’t go as planned?

The hard truth is that most people aren’t great at managing risk. We’re prone to overconfidence, cognitive biases, and decision making shortcuts that can cloud our judgment. But that doesn’t mean we’re powerless. You can improve your odds by doing the work:

• Educate yourself. Gather as much relevant information as you can. Learn from experts, analyze past outcomes, and stay curious.

• Calculate the risks. Assess the potential downsides realistically. What’s the worst that could happen? Can you live with it?

• Prepare for the unexpected. Even the best-laid plans can go wrong. Do you have a contingency plan?

At the end of the day, life’s gambles are unavoidable. But how you play the game is up to you. Instead of fearing uncertainty, embrace it. See every decision as an opportunity to grow, learn, and adapt.

So, as you face this your challenges, ask yourself: what are you doing to improve your odds?

Good luck out there.

As 2023 draws to a close, I find myself in a reflective state, contemplating about the year and planning the year 2024. A central theme that recurs throughout this reflection is the course we’re steering, which is shaped by strategy or, sometimes, the conspicuous absence of it. I recently read a book named Good Strategy Bad Strategy (Goodreads) by Richard P. Rumelt, which I consider essential for anyone looking to grasp how strategic thinking can channel collective efforts for the greater good. Here, I’d like to highlight a few essential insights from the book.

The premise is simple yet profound: by harnessing our existing resources and circumstances, we can navigate the complexities of the world much more effectively. The recipe for a solid strategy involves a three-step process: diagnosing the challenge (1), formulating guiding policies (2), and executing the coherent actions (3). Think of the diagnosis as identifying a disease, while the guiding policy serves as the well-conceived treatment plan that must be consistently implemented until it is cured. The author does an exceptional job of demystifying the concept of strategy:

1. This step involves recognising the hurdles your business currently faces, something you are typically aware of to some extent. The key is to extract the complexity of your reality into a few essential components.

2. Once the critical issues are identified, it’s time to think of a broader approach to tackle them. These approaches are your guiding policies that provide direction.

3. Finally, you must define specific initiatives that align with the guiding policies. These actions should complement each other and be integrated across all parts of the organisation, internal & external processes and most importantly – user journey of the product you’re creating.

While this may sound overly simplistic, it is far from it. If done correctly, the outcome, as Richard P. Rumelt asserts, is what constitutes a ‘Good Strategy’. He expands in greater detail all of these aspects, provides detailed examples and ways to think about the kernel of strategy. Give it a read, highly recommend.