4 ms·

My latest startup is Efficito (a Limited Company, registered in the UK). The web site is http://www.efficito.com http://www.efficito.com and our servers are al

My latest startup is Efficito (a Limited Company, registered in the UK). The web site is http://www.efficito.com http://www.efficito.com and our servers are all in Europe. We have built the service up with a very careful eye for security (why we are going hosted cloud first, and multi-tenant is still in the works). You have just given me what I think is a very good possibility regarding a marketing message, namely that we are not subject to NSA orders, and that we take security extraordinarily seriously. We are still looking into whole disk encryption for virtual instances, but key management is a non-trivial problem there to get right. For those who want it I can be pretty sure we'd be happy to work with you to find a way of making the system meet your needs. (Of course given a few customers, we could work with a server in Australia too.) But I also think it goes beyond shipping the data overseas. Suppose you do business with an American company that has servers in Australia (for the record we are registered in the UK, not the US), and they get a FISA warrant? Of course they will send the info over. So you can't only look at where the business's servers are but also where what legal authorities they are obviously subject to.

Silhouette 13y ago
You have just given me what I think is a very good possibility regarding a marketing message, namely that we are not subject to NSA orders, and that we take security extraordinarily seriously. You certainly won't be the first with that idea. I've now lost count of how many blog posts, tweets, forum posts and so on I've seen in the past week that essentially say, "Is the next big selling point for European service companies that we're not subject to US laws?"
dmix 13y ago
The UK has quite a strong military sector with their own secret agencies and a strong relationship with America. Could that make them capable of similar monitoring? Does the UK have stronger information privacy laws that the US doesn't?
- einhverfr 13y ago
  The laws are build on different principles making them somewhat different. However, one of the things that we pay a lot of attention to is security resilience. The question is, "what has to be compromised before your data is compromised? and is there a way to detect it?" The storage is still something we are working on but you can believe it is a design goal. The EU has very different approaches again to privacy law. I don't know you can compare them. They tend to be more lax with collection and stronger with use. However, we can also help you install the software (open source, reviewed by developers all over the world) on your premises if you would prefer. So our best shot is only for those who really want to cloud host.
AlexeiSadeski 13y ago
If you're outside of the US, then yes you are not subject to NSA orders. But your data will still be accessed by the NSA, as the NSA won't require an order to read what you've got.
- einhverfr 13y ago
  The point is they cannot get a court to compel you to hand it over. Yes, they can take what they can get.
  - AlexeiSadeski 13y ago
    And my point is that what they can get without a court order is more than they can get with one.
    - einhverfr 13y ago
      But the return on investment is likely to be far less. If it is harder, more resources have to be spent, then they will be more selective if just because it would be prohibitive to bug every system across the world, at least at present.
      - lsc 13y ago
        >But the return on investment is likely to be far less. I am not so sure about that. The internet... well, many of the wide-open holes have been closed... BGP hijacking isn't as trivial as it was in '08[1], mostly because filtering has been implemented in some places, but it's still something that could be done by someone of, say, my resources. It's trivial to anyone with real resources. And there are all sorts of other possible attacks. Hell, even ignoring the (probably easy, for one of the three letter agencies) possibility of putting a backdoor in the firmware shipping on popular routers, well, most ISPs end up using ancient router firmware revisions on their routers[2] Yeah; read over that BGP hijacking attack; it sounds way easier than setting up a collector at every ISP. (You'd still need local collectors to not add too much latency, but a single (/very/ well connected) collector could cover a reasonable region) [1]http://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-pilosov-kapela.pdf http://www.defcon.org/images/defcon-16/dc16-presentations/de... [2]Cisco charges an arm and a leg for firmware upgrades... they give you some of the really old stuff? but usually the choice is used $BIGNAME hardware without firmware updates, or you roll-your own quagga. (at the 10G/sec traffic level my upstreams can push, quagga/vyatta work just fine... that's what I use.)
atirip 13y ago
"Suppose you do business with an American company that has servers in Australia (for the record we are registered in the UK, not the US), and they get a FISA warrant? Of course they will send the info over" There's a way out. Those server offshore must be handled by subsidiary. Then the parent company in US does not have the data and they can not also command subsidiary to handle it over.
- justincormack 13y ago
  The big US companies have made it clear that they will give out data held by subsidiaries, even if this is illegal eg under European law.
  - einhverfr 13y ago
    That means the best option is not to use wholely owned subsidiaries and instead have a partnership with the parent owning a large plurality but non-controlling interest (say 10 partners from various countries, with the parent owning 49.9% of the subsidiary). You can set the agenda, more or less run things how you want, but anything you try to do as shareholder can be vetoed by the other 9 acting in unison.
  - jjh42 13y ago
    Is this true? genuine question - have these companies stated this or done so in the past?
    - justincormack 13y ago
      Yes, this has been an issue for a few years now eg see http://www.zdnet.com/blog/igeneration/eu-demands-answers-over-microsofts-patriot-act-admission/11290 http://www.zdnet.com/blog/igeneration/eu-demands-answers-ove...
vidarh 13y ago
The UK is not exactly an ideal location to make a fuss about this from, given that the Regulation of Investigative Powers Act (2000) gives extensive rights to the government to demand covert surveillance, which includes requirements of confidentiality over interception warrants to the extent that they in some circumstances can not even be revealed in court. On top of that Part III of RIPA makes it an offense to fail to disclose your encryption keys to the government in certain circumstances, and the court does not need to actually prove that you have the keys in order to sentence you for failure to produce them.
MoOmer 13y ago
Before anyone else gets this idea, I'd encourage you to look at your organizations' resident country laws before thinking & acting on this. Companies based in the UK, for example, can not make the claim found above ( http://m.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html http://m.washingtonpost.com/investigations/us-intelligence-m...). I'm not a lawyer, but you could lose all credibility if you act on that and get it wrong.

Silhouette 13y ago

You have just given me what I think is a very good possibility regarding a marketing message, namely that we are not subject to NSA orders, and that we take security extraordinarily seriously. You certainly won't be the first with that idea. I've now lost count of how many blog posts, tweets, forum posts and so on I've seen in the past week that essentially say, "Is the next big selling point for European service companies that we're not subject to US laws?"

dmix 13y ago

The UK has quite a strong military sector with their own secret agencies and a strong relationship with America. Could that make them capable of similar monitoring? Does the UK have stronger information privacy laws that the US doesn't?

einhverfr 13y ago
The laws are build on different principles making them somewhat different. However, one of the things that we pay a lot of attention to is security resilience. The question is, "what has to be compromised before your data is compromised? and is there a way to detect it?" The storage is still something we are working on but you can believe it is a design goal. The EU has very different approaches again to privacy law. I don't know you can compare them. They tend to be more lax with collection and stronger with use. However, we can also help you install the software (open source, reviewed by developers all over the world) on your premises if you would prefer. So our best shot is only for those who really want to cloud host.

AlexeiSadeski 13y ago

If you're outside of the US, then yes you are not subject to NSA orders. But your data will still be accessed by the NSA, as the NSA won't require an order to read what you've got.

einhverfr 13y ago
The point is they cannot get a court to compel you to hand it over. Yes, they can take what they can get.
- AlexeiSadeski 13y ago
  And my point is that what they can get without a court order is more than they can get with one.
  - einhverfr 13y ago
    But the return on investment is likely to be far less. If it is harder, more resources have to be spent, then they will be more selective if just because it would be prohibitive to bug every system across the world, at least at present.
    - lsc 13y ago
      >But the return on investment is likely to be far less. I am not so sure about that. The internet... well, many of the wide-open holes have been closed... BGP hijacking isn't as trivial as it was in '08[1], mostly because filtering has been implemented in some places, but it's still something that could be done by someone of, say, my resources. It's trivial to anyone with real resources. And there are all sorts of other possible attacks. Hell, even ignoring the (probably easy, for one of the three letter agencies) possibility of putting a backdoor in the firmware shipping on popular routers, well, most ISPs end up using ancient router firmware revisions on their routers[2] Yeah; read over that BGP hijacking attack; it sounds way easier than setting up a collector at every ISP. (You'd still need local collectors to not add too much latency, but a single (/very/ well connected) collector could cover a reasonable region) [1]http://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-pilosov-kapela.pdf http://www.defcon.org/images/defcon-16/dc16-presentations/de... [2]Cisco charges an arm and a leg for firmware upgrades... they give you some of the really old stuff? but usually the choice is used $BIGNAME hardware without firmware updates, or you roll-your own quagga. (at the 10G/sec traffic level my upstreams can push, quagga/vyatta work just fine... that's what I use.)

atirip 13y ago

"Suppose you do business with an American company that has servers in Australia (for the record we are registered in the UK, not the US), and they get a FISA warrant? Of course they will send the info over" There's a way out. Those server offshore must be handled by subsidiary. Then the parent company in US does not have the data and they can not also command subsidiary to handle it over.

justincormack 13y ago
The big US companies have made it clear that they will give out data held by subsidiaries, even if this is illegal eg under European law.
- einhverfr 13y ago
  That means the best option is not to use wholely owned subsidiaries and instead have a partnership with the parent owning a large plurality but non-controlling interest (say 10 partners from various countries, with the parent owning 49.9% of the subsidiary). You can set the agenda, more or less run things how you want, but anything you try to do as shareholder can be vetoed by the other 9 acting in unison.
- jjh42 13y ago
  Is this true? genuine question - have these companies stated this or done so in the past?
  - justincormack 13y ago
    Yes, this has been an issue for a few years now eg see http://www.zdnet.com/blog/igeneration/eu-demands-answers-over-microsofts-patriot-act-admission/11290 http://www.zdnet.com/blog/igeneration/eu-demands-answers-ove...

vidarh 13y ago

The UK is not exactly an ideal location to make a fuss about this from, given that the Regulation of Investigative Powers Act (2000) gives extensive rights to the government to demand covert surveillance, which includes requirements of confidentiality over interception warrants to the extent that they in some circumstances can not even be revealed in court. On top of that Part III of RIPA makes it an offense to fail to disclose your encryption keys to the government in certain circumstances, and the court does not need to actually prove that you have the keys in order to sentence you for failure to produce them.

MoOmer 13y ago

Before anyone else gets this idea, I'd encourage you to look at your organizations' resident country laws before thinking & acting on this. Companies based in the UK, for example, can not make the claim found above ( http://m.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html http://m.washingtonpost.com/investigations/us-intelligence-m...). I'm not a lawyer, but you could lose all credibility if you act on that and get it wrong.