6 ms·

I'm Icelandic. This person seems to have done more research than most, but there's a common misconception that Iceland's some sort of Internet freedom haven. It

by avar 7y ago

I'm Icelandic. This person seems to have done more research than most, but there's a common misconception that Iceland's some sort of Internet freedom haven. It isn't, and I think most of that came from foreign coverage of the IMMI back in 2010-ish[1]. That would have made Internet freedom in Iceland exceptional, but it never passed into law. Also, you should be careful in paying attention to international reports of "xyz never happens in Iceland". Yeah maybe it doesn't, but 1/3 million people live there, it could just be due to the small sample size, not that it's less likely to happen. Using Iceland to get away from the Five Eyes? Really? What does this person think Iceland's undersea network cables are connected to? Unless the traffic is local to the country it doesn't make a difference in that regard. 1. https://en.wikipedia.org/wiki/Icelandic_Modern_Media_Initiative https://en.wikipedia.org/wiki/Icelandic_Modern_Media_Initiat...

deleted 7y ago
[deleted]
pavlov 7y ago
Yeah, if you don't want to be surveilled by "Five Eyes" which includes the United States, United Kingdom and Canada, it's odd that you'd choose an island whose only high-bandwidth connections to the outside world go through those countries.
- raxxorrax 7y ago
  I do not believe that the five eyes have the ability to break modern encryption. But they probably have influence in Iceland in general. But I doubt they spoof the whole island. That would probably very noticeable.
  - mtnGoat 7y ago
    The Chinese capture everything in the country. Iceland is a piece of cake. And your be surprised what they can crack.
    - andrewxdiamond 7y ago
      Do you have any proof or other verifiable evidence of these claims? Or are you just assuming that those statements are true? As far as I'm aware, there is no evidence at all that the commonly recommend encryption algorithms have any serious vulnerabilities when used properly. Now, it's easy to say that researchers would be given gag orders if they found the "magic back door", but that's all just speculation and fear-mongering really. Additionally, it would be in the US's best interest for there to be no backdoor. Any vulnerability in RSA for example could be exploited against them.
      - mtnGoat 7y ago
        of what claims?(i only made one) the great firewall of China is well known to exist as is their activity of logging everything. I said their ability to crack things might surprise you, but did not make any claims. I do not know for sure what they can crack but I do know their capabilities are not publicly known, this is coming from those that work there as well as court filings.
  - gumby 7y ago
    (This comment to which I'm replying was apparently downvoted, presumably by people who disagree. It's a reasonable comment though I disagree with it, hence my reply) > I do not believe that the five eyes have the ability to break modern encryption. Do not be so sure. The Snowden documentation shows that they have many tools, from actual private attacks on the encryption itself to attacks on the endpoints (e.g. undocumented zero-day exploits) that can get data pre-encryption and/or post-encryption. And they don't limit themselves to endpoints in their own countries (that would be foolish for any intelligence agency to do).
    - odyssey7 7y ago
      Going beyond everyday attacks, one famous war effort gave us programmable electric computers in order to break encryption, and there is no disputing how much value came out of that for the winners of that war. Any country with the means will have been pouring in resources to recreate that advantage ever since. If private industry is on the cusp of quantum computing, then to me it’s a safe bet that intelligence agencies have had it for years. However, an advantage like this disappears the moment that evidence of its existence surfaces. It wouldn’t be used except in existential scenarios for that country.
      - mprev 7y ago
        I often read comments where people say something along the lines of, “X is considered impossible with current technology but I bet the intelligence agencies have had it for years”. It seems reasonable that incremental developments might have been made sooner by government than academic researchers or industry. Indeed, there are examples. But leaps like quantum computing? I’m not ascribing this to you but I’ve noticed that there’s often a crossover between people who, on the one hand, believe government is pretty much incapable while, on the other hand, having some near magic ability to make huge technical leaps. Wartime is different, as then it’s pretty much all hands on deck.
        odyssey7 7y ago
        DoD spending in recent decades has reflected a sense that there's perpetually an r > 0 chance that we'll be in the middle of World War III in twenty years, and that we're willing to spend what it takes to ensure technological advantages for when that happens. Throughout world history, military technology has been a determining factor in when many civilizations stopped existing. The mission of the DoD is to secure the U.S. in perpetuity, so this is their core competency. Private industries, which can only approach moonshots tepidly out of fiduciary responsibility, are already making good progress on this. My hunch is merely based on the liklihood that the DoD - which spends unfathomable amounts on R&D and does not answer to shareholders - has been going at this longer and much stronger than any private organization.
- deleted 7y ago
  [deleted]
tenderfault 7y ago
ok, so this was a "non-binding" resolution? the wiki page is so misleading for someone not familiar with the vocabulary. I read "adopted by parliament", I jump to conclusions. Maybe the page should be updated to clearly define the current status.
- CathedralBorrow 7y ago
  Kind of. Parliament can create laws, and parliament can issue parliamentary resolutions that essentially say "This parliament wants this government to do X". This was the latter, and all parliamentary resolutions are inherently much weaker than laws because they generally only apply to that particular parliament and that particular government. And we've had many changes of both since 2010.
aivisol 7y ago
Can Switzerland be an option? That's where ProtonMail is located, right? But again, where Switzerland's cables are connected to? To same 14 eyes I guess.
- thegeekbin 7y ago
  While I'm not going to disagree Switzerland is an OK option, you have to understand first why ProtonMail choose Switzerland. One point being "In the US and EU, gag orders can be issued to prevent an individual from knowing they are being investigated or under surveillance. While these type of orders also exist in Switzerland, the prosecutors have an obligation to notify the target of surveillance, and the target has an opportunity to appeal in court. There are no such things as National Security Letters, and all surveillance requests must go through the courts. Furthermore, while Switzerland is party to international assistance treaties, such requests for information must hold up under Swiss law, which has much stricter privacy provisions." I read this as, it isn't to say a government can't monitor what's going over the pipe for sigint, but if they specifically target a user for surveillance it must be disclosed to them and they have a right to appeal. Nonetheless, if you're an American connecting to Switzerland for ProtonMail, the US govt will have some sigint, even if it's just your origin -> protonmail destination. I'd go as far as to argue, as long as all communications are fully encrypted with the best possible encryption available (and no backdoors) it's fairly safe in any country for most general content. If you're extra concerned about privacy and surveillance (like I am), you should host in a country which has strong privacy laws but read up on the privacy laws, most of the time a country has good privacy laws for individuals, companies within the country, not foreigners. Just my two cents away.
  - mytailorisrich 7y ago
    > you have to understand first why ProtonMail choose Switzerland. A quick look at their Wikipedia page tells me that it was created by people who worked at CERN, and that it is headquartered in Geneva. So it's possible that the answer could simply be: Because that where the founders live (and it is also more advantageous that neighbouring France).
AdriaanvRossum 7y ago
Author here. Thanks for explaining your thoughts as you are Icelandic. Really appreciate that. It's not too easy to do research in a non English speaking country. I'm not a native English speaker, so forgive the typos. I wrote this article a few months back and since then some things changed. Somebody also enlightened me about the cooperation of Iceland with the US government [1], although no source has been linked. I think governments spying on data is something you can prevent with strong encryption and keeping the data out of the those countries that are known for it a.k.a. Five Eyes. That's what we do with our customers data. I agree with your statement that "xyz never happens in Iceland" shouldn't be a reason for choosing a country. I'm still very confident it's better not to put our servers in any Five Eyes country. For the speed I do think Iceland is not optimal. See the pings from this comment [2]. I realized this after moving to Iceland that the speeds where indeed slower than from Digital Ocean in Amsterdam. I don't think your argument about the connection with cables are relevant. If you send your data encrypted it will not be possible to read the packets, right? Or maybe I don't get your point. I'm thinking of moving our servers to Germany or The Netherlands. There are a few downsides with that for example the environmental impact. We are looking into other solutions to have no carbon footprint with Simple Analytics [3]. [1] https://news.ycombinator.com/item?id=19530972 https://news.ycombinator.com/item?id=19530972 [2] https://news.ycombinator.com/item?id=19528028 https://news.ycombinator.com/item?id=19528028 [3] https://simpleanalytics.com https://simpleanalytics.com
- mattlutze 7y ago
  5 and 9 and 14 Eyes are all apparently focused on signals intelligence: - https://protonvpn.com/blog/5-eyes-global-surveillance/ https://protonvpn.com/blog/5-eyes-global-surveillance/ - https://www.reuters.com/article/us-china-fiveeyes/exclusive-five-eyes-intelligence-alliance-builds-coalition-to-counter-china-idUSKCN1MM0GH https://www.reuters.com/article/us-china-fiveeyes/exclusive-... Which I think means watching data move across the lines. If you'd like to pull your tinfoil hat even tighter: Germany, Netherlands, Iceland are listed above as broader members of signals intelligence sharing partnerships, as well as members of NATO. They have a discussion here of their policies and activities related to Cyber Defense: - https://www.nato.int/cps/en/natohq/topics_78170.htm https://www.nato.int/cps/en/natohq/topics_78170.htm If a government wants to take your hard drives it will. Unless there's explicit laws against the seizure of physical media, you're mostly relying on them either not having a sophisticated enough internal intelligence capacity that can do it quietly, or trusting in social reaction to a mostly boring, questionable infringement of property rights.
mytailorisrich 7y ago
All of this seems quite a distraction for an analytics company. Just locate your servers where it makes business sense. Secure them against hackers and unauthorised access in general, as you should. Ignore the CIA/NSA.
- franciscop 7y ago
  Nice try CIA In more seriousness, not all is purely making money. Some people prefer to make a difference in some things they have control over even if this doesn't increase profits. I find this a lot better than e.g. getting more money and then donating to charities that try to stop what the company is contributing to.
  - briandear 7y ago
    How does this “make a difference?” It’s theatrics. There is a reason there is an accompanying blogpost and HN post.
    - franciscop 7y ago
      I haven't searched the topic well to know if it makes a difference or not, but it _seems_ like the authors are trying to improve something for ethical reasons and parent author is saying it is just a distraction and to focus only on making more money. I strongly disagree and encourage simple analytics to keep up their ethics for as long as possible. Maybe they are trying to reach more people through blogpost and HN post, but moving the servers to another country does not seem like just theatrics at all.
- briandear 7y ago
  It’s just a bunch of theatrics and virtue signaling. A lot of web users (like the one that didn’t want his requests going to the US) really overestimate their self-importance in the world of national security. NSA/CIA/FBI barely keep up with data regarding actual threats, they aren’t spending time worrying about random people on GitHub. (Referring to the commenter on the EasyList pull request.) Literally no one cares that you watch excessive amounts of fetish porn, visit socialist workers party websites, or have a secret crush on David Hasselhoff or sell a few grams of cocaine on the side. Your browsing history is uninteresting on its own. It might become interesting if you were to also a target of an investigation. But it isn’t like NSA has some red light that starts flashing in their headquarters based on the contents of a web search of some random guy in Bratislava or wherever. If you are actually a terrorist, smuggler, human trafficker, weapons dealer, you aren’t commenting on pull requests to EasyList. Most people are boring and, despite what they may think of themselves, aren’t even close to being a surveillance target. It’s also ridiculous theater to think that the country a server is physically in matters one bit. To be clear, I am not defending NSA, I am just saying that most of us are uninteresting in that regard.
e12e 7y ago
> Using Iceland to get away from the Five Eyes? Apart from the point about the cables, I'm thinking a re-read of Tom Clancy's "Red Storm Rising" might be in order...

by avar 7y ago

deleted 7y ago

[deleted]

pavlov 7y ago

Yeah, if you don't want to be surveilled by "Five Eyes" which includes the United States, United Kingdom and Canada, it's odd that you'd choose an island whose only high-bandwidth connections to the outside world go through those countries.

raxxorrax 7y ago
I do not believe that the five eyes have the ability to break modern encryption. But they probably have influence in Iceland in general. But I doubt they spoof the whole island. That would probably very noticeable.
- mtnGoat 7y ago
  The Chinese capture everything in the country. Iceland is a piece of cake. And your be surprised what they can crack.
  - andrewxdiamond 7y ago
    Do you have any proof or other verifiable evidence of these claims? Or are you just assuming that those statements are true? As far as I'm aware, there is no evidence at all that the commonly recommend encryption algorithms have any serious vulnerabilities when used properly. Now, it's easy to say that researchers would be given gag orders if they found the "magic back door", but that's all just speculation and fear-mongering really. Additionally, it would be in the US's best interest for there to be no backdoor. Any vulnerability in RSA for example could be exploited against them.
    - mtnGoat 7y ago
      of what claims?(i only made one) the great firewall of China is well known to exist as is their activity of logging everything. I said their ability to crack things might surprise you, but did not make any claims. I do not know for sure what they can crack but I do know their capabilities are not publicly known, this is coming from those that work there as well as court filings.
- gumby 7y ago
  (This comment to which I'm replying was apparently downvoted, presumably by people who disagree. It's a reasonable comment though I disagree with it, hence my reply) > I do not believe that the five eyes have the ability to break modern encryption. Do not be so sure. The Snowden documentation shows that they have many tools, from actual private attacks on the encryption itself to attacks on the endpoints (e.g. undocumented zero-day exploits) that can get data pre-encryption and/or post-encryption. And they don't limit themselves to endpoints in their own countries (that would be foolish for any intelligence agency to do).
  - odyssey7 7y ago
    Going beyond everyday attacks, one famous war effort gave us programmable electric computers in order to break encryption, and there is no disputing how much value came out of that for the winners of that war. Any country with the means will have been pouring in resources to recreate that advantage ever since. If private industry is on the cusp of quantum computing, then to me it’s a safe bet that intelligence agencies have had it for years. However, an advantage like this disappears the moment that evidence of its existence surfaces. It wouldn’t be used except in existential scenarios for that country.
    - mprev 7y ago
      I often read comments where people say something along the lines of, “X is considered impossible with current technology but I bet the intelligence agencies have had it for years”. It seems reasonable that incremental developments might have been made sooner by government than academic researchers or industry. Indeed, there are examples. But leaps like quantum computing? I’m not ascribing this to you but I’ve noticed that there’s often a crossover between people who, on the one hand, believe government is pretty much incapable while, on the other hand, having some near magic ability to make huge technical leaps. Wartime is different, as then it’s pretty much all hands on deck.
      - odyssey7 7y ago
        DoD spending in recent decades has reflected a sense that there's perpetually an r > 0 chance that we'll be in the middle of World War III in twenty years, and that we're willing to spend what it takes to ensure technological advantages for when that happens. Throughout world history, military technology has been a determining factor in when many civilizations stopped existing. The mission of the DoD is to secure the U.S. in perpetuity, so this is their core competency. Private industries, which can only approach moonshots tepidly out of fiduciary responsibility, are already making good progress on this. My hunch is merely based on the liklihood that the DoD - which spends unfathomable amounts on R&D and does not answer to shareholders - has been going at this longer and much stronger than any private organization.
deleted 7y ago
[deleted]

tenderfault 7y ago

ok, so this was a "non-binding" resolution? the wiki page is so misleading for someone not familiar with the vocabulary. I read "adopted by parliament", I jump to conclusions. Maybe the page should be updated to clearly define the current status.

CathedralBorrow 7y ago
Kind of. Parliament can create laws, and parliament can issue parliamentary resolutions that essentially say "This parliament wants this government to do X". This was the latter, and all parliamentary resolutions are inherently much weaker than laws because they generally only apply to that particular parliament and that particular government. And we've had many changes of both since 2010.

aivisol 7y ago

Can Switzerland be an option? That's where ProtonMail is located, right? But again, where Switzerland's cables are connected to? To same 14 eyes I guess.

thegeekbin 7y ago
While I'm not going to disagree Switzerland is an OK option, you have to understand first why ProtonMail choose Switzerland. One point being "In the US and EU, gag orders can be issued to prevent an individual from knowing they are being investigated or under surveillance. While these type of orders also exist in Switzerland, the prosecutors have an obligation to notify the target of surveillance, and the target has an opportunity to appeal in court. There are no such things as National Security Letters, and all surveillance requests must go through the courts. Furthermore, while Switzerland is party to international assistance treaties, such requests for information must hold up under Swiss law, which has much stricter privacy provisions." I read this as, it isn't to say a government can't monitor what's going over the pipe for sigint, but if they specifically target a user for surveillance it must be disclosed to them and they have a right to appeal. Nonetheless, if you're an American connecting to Switzerland for ProtonMail, the US govt will have some sigint, even if it's just your origin -> protonmail destination. I'd go as far as to argue, as long as all communications are fully encrypted with the best possible encryption available (and no backdoors) it's fairly safe in any country for most general content. If you're extra concerned about privacy and surveillance (like I am), you should host in a country which has strong privacy laws but read up on the privacy laws, most of the time a country has good privacy laws for individuals, companies within the country, not foreigners. Just my two cents away.
- mytailorisrich 7y ago
  > you have to understand first why ProtonMail choose Switzerland. A quick look at their Wikipedia page tells me that it was created by people who worked at CERN, and that it is headquartered in Geneva. So it's possible that the answer could simply be: Because that where the founders live (and it is also more advantageous that neighbouring France).

AdriaanvRossum 7y ago

Author here. Thanks for explaining your thoughts as you are Icelandic. Really appreciate that. It's not too easy to do research in a non English speaking country. I'm not a native English speaker, so forgive the typos. I wrote this article a few months back and since then some things changed. Somebody also enlightened me about the cooperation of Iceland with the US government [1], although no source has been linked. I think governments spying on data is something you can prevent with strong encryption and keeping the data out of the those countries that are known for it a.k.a. Five Eyes. That's what we do with our customers data. I agree with your statement that "xyz never happens in Iceland" shouldn't be a reason for choosing a country. I'm still very confident it's better not to put our servers in any Five Eyes country. For the speed I do think Iceland is not optimal. See the pings from this comment [2]. I realized this after moving to Iceland that the speeds where indeed slower than from Digital Ocean in Amsterdam. I don't think your argument about the connection with cables are relevant. If you send your data encrypted it will not be possible to read the packets, right? Or maybe I don't get your point. I'm thinking of moving our servers to Germany or The Netherlands. There are a few downsides with that for example the environmental impact. We are looking into other solutions to have no carbon footprint with Simple Analytics [3]. [1] https://news.ycombinator.com/item?id=19530972 https://news.ycombinator.com/item?id=19530972 [2] https://news.ycombinator.com/item?id=19528028 https://news.ycombinator.com/item?id=19528028 [3] https://simpleanalytics.com https://simpleanalytics.com

mattlutze 7y ago
5 and 9 and 14 Eyes are all apparently focused on signals intelligence: - https://protonvpn.com/blog/5-eyes-global-surveillance/ https://protonvpn.com/blog/5-eyes-global-surveillance/ - https://www.reuters.com/article/us-china-fiveeyes/exclusive-five-eyes-intelligence-alliance-builds-coalition-to-counter-china-idUSKCN1MM0GH https://www.reuters.com/article/us-china-fiveeyes/exclusive-... Which I think means watching data move across the lines. If you'd like to pull your tinfoil hat even tighter: Germany, Netherlands, Iceland are listed above as broader members of signals intelligence sharing partnerships, as well as members of NATO. They have a discussion here of their policies and activities related to Cyber Defense: - https://www.nato.int/cps/en/natohq/topics_78170.htm https://www.nato.int/cps/en/natohq/topics_78170.htm If a government wants to take your hard drives it will. Unless there's explicit laws against the seizure of physical media, you're mostly relying on them either not having a sophisticated enough internal intelligence capacity that can do it quietly, or trusting in social reaction to a mostly boring, questionable infringement of property rights.

mytailorisrich 7y ago

All of this seems quite a distraction for an analytics company. Just locate your servers where it makes business sense. Secure them against hackers and unauthorised access in general, as you should. Ignore the CIA/NSA.

franciscop 7y ago
Nice try CIA In more seriousness, not all is purely making money. Some people prefer to make a difference in some things they have control over even if this doesn't increase profits. I find this a lot better than e.g. getting more money and then donating to charities that try to stop what the company is contributing to.
- briandear 7y ago
  How does this “make a difference?” It’s theatrics. There is a reason there is an accompanying blogpost and HN post.
  - franciscop 7y ago
    I haven't searched the topic well to know if it makes a difference or not, but it _seems_ like the authors are trying to improve something for ethical reasons and parent author is saying it is just a distraction and to focus only on making more money. I strongly disagree and encourage simple analytics to keep up their ethics for as long as possible. Maybe they are trying to reach more people through blogpost and HN post, but moving the servers to another country does not seem like just theatrics at all.
briandear 7y ago
It’s just a bunch of theatrics and virtue signaling. A lot of web users (like the one that didn’t want his requests going to the US) really overestimate their self-importance in the world of national security. NSA/CIA/FBI barely keep up with data regarding actual threats, they aren’t spending time worrying about random people on GitHub. (Referring to the commenter on the EasyList pull request.) Literally no one cares that you watch excessive amounts of fetish porn, visit socialist workers party websites, or have a secret crush on David Hasselhoff or sell a few grams of cocaine on the side. Your browsing history is uninteresting on its own. It might become interesting if you were to also a target of an investigation. But it isn’t like NSA has some red light that starts flashing in their headquarters based on the contents of a web search of some random guy in Bratislava or wherever. If you are actually a terrorist, smuggler, human trafficker, weapons dealer, you aren’t commenting on pull requests to EasyList. Most people are boring and, despite what they may think of themselves, aren’t even close to being a surveillance target. It’s also ridiculous theater to think that the country a server is physically in matters one bit. To be clear, I am not defending NSA, I am just saying that most of us are uninteresting in that regard.

e12e 7y ago

> Using Iceland to get away from the Five Eyes? Apart from the point about the cables, I'm thinking a re-read of Tom Clancy's "Red Storm Rising" might be in order...