8 ms·

If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and y

by comboy 4y ago

If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. I don't think it should be like this but as far as I understand it is the current state of affairs. Even if they shouldn't be able to force you to do some things the best you can do is take them to court, still completely outside public eye, and they can provide some plausible reasons regarding say national security which are likely pretty much impossible to verify.

johnchristopher 4y ago
> If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. There is some nuclear options https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
- silviot 4y ago
  Even if you go the nuclear option, you might risk being arrested: > Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
  - capableweb 4y ago
    > Even if you go the nuclear option, you might risk being arrested: Surely, in a free society, you are free to close down your business for whatever reason you want? Someone might feel like the business is no longer fun to run for X reason, it just happen to have coincided with law enforcement wanting to add wiretaps.
    - DistractionRect 4y ago
      He is free to close down his business//not take on new customers, but that doesn't change his non compliance with a warrant for previous customer information. Much like you are free to destroy your belongings in general, but not once their is or there will be a legal order for their surrender (I.e. Destruction of evidence).
    - rad_gruchalski 4y ago
      > Surely, in a free society, you are free to close down your business for whatever reason you want? Sure, but it’s not something you can do within a day. You need to settle your legal obligations.
- edm0nd 4y ago
  My favorite memory of this is when the founder provided his private keys but as a print out in like size 0.5 font. The Lavabit founder made the right decision instead of letting law enforcement tap his servers.
  - shard 4y ago
    Regarding printing it in 0.5 font, I don't think this kind of passive-aggressive rebellious act accomplishes anything, and actually highlights how powerless he is. It caused extra work and frustration for the poor guy who got handed the job of transferring the private key from paper, but nobody else was bothered. His shutting down the service was much more of a stance.
    - edm0nd 4y ago
      I mean good. The NSA request was unjust so fuck the person having to type in the private keys lol.
midasuni 4y ago
Which government?
- jonatron 4y ago
  Remember when Reddit removed the warrant canary?
  - aaaaaaaaata 4y ago
    Aaron Swartz.
- comboy 4y ago
  Do you know of any where that wouldn't be the case?
  - midasuni 4y ago
    It’s unlikely a Russian vpn provider would respond to a demand from a US government
jokowueu 4y ago
Read about Lavabit
tinus_hn 4y ago
This can be mitigated by incorporating and hosting in a country that has a government that doesn’t do this.
- deleted 4y ago
  [deleted]
- dewey 4y ago
  Do you know any countries where this actually works? Usually if a powerful country wants something from a small supposedly independent country, this doesn't really apply anymore. One well documented example is how the US lobbied Sweden into raiding The Pirate Bay (https://torrentfreak.com/pirate-bay-investigator-to-cash-in-at-warner-bros-080423/ https://torrentfreak.com/pirate-bay-investigator-to-cash-in-...)
  - tinus_hn 4y ago
    The Pirate Bay was openly defying copyright as defined in just about every country except Sweden with barely any legitimate use. It’s a household name for lawlessness. That’s really not comparable to a vpn service if a significant proportion of users are using it to legitimately protect against privacy invasion when using an open WiFi network.
    - dewey 4y ago
      > if a significant proportion of users are using it to legitimately protect against privacy invasion when using an open WiFi network How do you know? It could also just be "terrorism" and "child pornography" and that's often reason enough. Similar to the current discussion about banning Telegram in Germany: https://www.euronews.com/my-europe/2022/01/26/germany-considers-banning-telegram-app-accused-of-facilitating-hate-speech https://www.euronews.com/my-europe/2022/01/26/germany-consid...
      - tinus_hn 4y ago
        You don’t need to actually know, it’s enough to extrapolate from their own advertising material and the general public sentiment. Besides, if it’s “terrorism” and “child pornography” the vpn endpoints would attract attention quickly enough. It’s not like a VPN is a magical anonymous entry into the internet, it just changes the location and mixes your traffic with other customers’.
JumpCrisscross 4y ago
> government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it Eh, this is unsettled law [1]. If you have logs and the U.S. asks for them, you must turn them over. But it's unclear the U.S. can compel you to write new software. [1] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute#Legal_arguments https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute#L...
- deleted 4y ago
  [deleted]
- rekoil 4y ago
  Plus, Mullvad is jurisdictionally in Sweden, and to my knowledge Swedish authorities have no legal right to force developers to write any software.
  - rad_gruchalski 4y ago
    > Swedish authorities have no legal right to force developers to write any software. “A party which conducts activities which are subject to a reporting obligation pursuant to Chapter 2, section 1 of the Electronic Communications Act (2003:389) ("LEK") is obligated, upon request of the enforcement agency, to cooperate in connection with the enforcement of covert surveillance of data.” https://mullvad.net/en/help/swedish-covert-surveillance-data-act/ https://mullvad.net/en/help/swedish-covert-surveillance-data...
    - rekoil 4y ago
      > 2. What significance does the law have for the Mullvad service? > Mullvad cannot be made subject to a duty to cooperate in connection with the enforcement of a decision authorising covert surveillance of data since VPN services are not an activity subject to a reporting obligation pursuant to Chapter 2, section 1 of the LEK. Same page.
      - 4y ago
stjohnswarts 4y ago
I personally feel that mullvad would just shut down if they felt pressure like that from a state actor. I believe they said as much.
JoachimS 4y ago
Depends on the jurisdiction. As far as I know, this is what NSLs etc can force you to do if being an company in USA. But the thing you propose would require quite a few changes to Swedish law to be possible to happen. Mullvad is a Swedish company.
onetimeusename 4y ago
There is also the distinct possibility that a government would just hack your system secretly if they thought it was a worthwhile target. I would assume that is the case for these well known VPN companies that operate outside US jurisdiction. The actual attacks that might be used are a different discussion but I don't think this is a remote possibility. I think it's quite likely the US government would target companies like these.

by comboy 4y ago

johnchristopher 4y ago

> If government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it even with your best intentions. There is some nuclear options https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...

silviot 4y ago
Even if you go the nuclear option, you might risk being arrested: > Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
- capableweb 4y ago
  > Even if you go the nuclear option, you might risk being arrested: Surely, in a free society, you are free to close down your business for whatever reason you want? Someone might feel like the business is no longer fun to run for X reason, it just happen to have coincided with law enforcement wanting to add wiretaps.
  - DistractionRect 4y ago
    He is free to close down his business//not take on new customers, but that doesn't change his non compliance with a warrant for previous customer information. Much like you are free to destroy your belongings in general, but not once their is or there will be a legal order for their surrender (I.e. Destruction of evidence).
  - rad_gruchalski 4y ago
    > Surely, in a free society, you are free to close down your business for whatever reason you want? Sure, but it’s not something you can do within a day. You need to settle your legal obligations.
edm0nd 4y ago
My favorite memory of this is when the founder provided his private keys but as a print out in like size 0.5 font. The Lavabit founder made the right decision instead of letting law enforcement tap his servers.
- shard 4y ago
  Regarding printing it in 0.5 font, I don't think this kind of passive-aggressive rebellious act accomplishes anything, and actually highlights how powerless he is. It caused extra work and frustration for the poor guy who got handed the job of transferring the private key from paper, but nobody else was bothered. His shutting down the service was much more of a stance.
  - edm0nd 4y ago
    I mean good. The NSA request was unjust so fuck the person having to type in the private keys lol.

midasuni 4y ago

Which government?

jonatron 4y ago
Remember when Reddit removed the warrant canary?
- aaaaaaaaata 4y ago
  Aaron Swartz.
comboy 4y ago
Do you know of any where that wouldn't be the case?
- midasuni 4y ago
  It’s unlikely a Russian vpn provider would respond to a demand from a US government

jokowueu 4y ago

Read about Lavabit

tinus_hn 4y ago

This can be mitigated by incorporating and hosting in a country that has a government that doesn’t do this.

deleted 4y ago
[deleted]
dewey 4y ago
Do you know any countries where this actually works? Usually if a powerful country wants something from a small supposedly independent country, this doesn't really apply anymore. One well documented example is how the US lobbied Sweden into raiding The Pirate Bay (https://torrentfreak.com/pirate-bay-investigator-to-cash-in-at-warner-bros-080423/ https://torrentfreak.com/pirate-bay-investigator-to-cash-in-...)
- tinus_hn 4y ago
  The Pirate Bay was openly defying copyright as defined in just about every country except Sweden with barely any legitimate use. It’s a household name for lawlessness. That’s really not comparable to a vpn service if a significant proportion of users are using it to legitimately protect against privacy invasion when using an open WiFi network.
  - dewey 4y ago
    > if a significant proportion of users are using it to legitimately protect against privacy invasion when using an open WiFi network How do you know? It could also just be "terrorism" and "child pornography" and that's often reason enough. Similar to the current discussion about banning Telegram in Germany: https://www.euronews.com/my-europe/2022/01/26/germany-considers-banning-telegram-app-accused-of-facilitating-hate-speech https://www.euronews.com/my-europe/2022/01/26/germany-consid...
    - tinus_hn 4y ago
      You don’t need to actually know, it’s enough to extrapolate from their own advertising material and the general public sentiment. Besides, if it’s “terrorism” and “child pornography” the vpn endpoints would attract attention quickly enough. It’s not like a VPN is a magical anonymous entry into the internet, it just changes the location and mixes your traffic with other customers’.

JumpCrisscross 4y ago

> government comes to you and says you must send data here and there or log this and that and you must not tell anybody about it, then you have to comply and you can't do much about it Eh, this is unsettled law [1]. If you have logs and the U.S. asks for them, you must turn them over. But it's unclear the U.S. can compel you to write new software. [1] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute#Legal_arguments https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute#L...

deleted 4y ago
[deleted]
rekoil 4y ago
Plus, Mullvad is jurisdictionally in Sweden, and to my knowledge Swedish authorities have no legal right to force developers to write any software.
- rad_gruchalski 4y ago
  > Swedish authorities have no legal right to force developers to write any software. “A party which conducts activities which are subject to a reporting obligation pursuant to Chapter 2, section 1 of the Electronic Communications Act (2003:389) ("LEK") is obligated, upon request of the enforcement agency, to cooperate in connection with the enforcement of covert surveillance of data.” https://mullvad.net/en/help/swedish-covert-surveillance-data-act/ https://mullvad.net/en/help/swedish-covert-surveillance-data...
  - rekoil 4y ago
    > 2. What significance does the law have for the Mullvad service? > Mullvad cannot be made subject to a duty to cooperate in connection with the enforcement of a decision authorising covert surveillance of data since VPN services are not an activity subject to a reporting obligation pursuant to Chapter 2, section 1 of the LEK. Same page.
    - 4y ago

stjohnswarts 4y ago

I personally feel that mullvad would just shut down if they felt pressure like that from a state actor. I believe they said as much.

JoachimS 4y ago

Depends on the jurisdiction. As far as I know, this is what NSLs etc can force you to do if being an company in USA. But the thing you propose would require quite a few changes to Swedish law to be possible to happen. Mullvad is a Swedish company.

onetimeusename 4y ago

There is also the distinct possibility that a government would just hack your system secretly if they thought it was a worthwhile target. I would assume that is the case for these well known VPN companies that operate outside US jurisdiction. The actual attacks that might be used are a different discussion but I don't think this is a remote possibility. I think it's quite likely the US government would target companies like these.