8 ms·

> Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does? They don't have th

> Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does? They don't have the information Google does because it's on an e-mail server under your bed. And you enjoy certain legal protections as a citizen in your home country. It's not a particularly enticing solution but it does have its upsides.

thrownaway2424 13y ago
If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.
- superuser2 13y ago
  It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.
  - cinquemb 13y ago
    Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).
    - betterunix 13y ago
      Why wipe the hard drives? Use WDE, and have the alarm (a) unmount the drive, (b) overwrite the system's RAM with 0s (or at least the portion of RAM where the keys are stored), and (c) power down the system. That is a lot faster that making a backup and wiping the drives; by the time an agent has snuck in and located the computer, the process should be over. Also, it might help to install a security camera, so you can tell the difference between a rat triggering the alarm and an FBI agent (I'll leave it to the audience to make a few jokes). Alarm is triggered, the camera starts sending pictures of the intruders to your smartphone or to Usenet (encrypted, using a key you keep on a smartcard) or whatever.
    - superuser2 13y ago
      Evidence tampering is a federal felony. In this case it doesn't matter how well you covered your tracks - if they can prove you rigged a failsafe, you're going to jail anyway.
      - cinquemb 13y ago
        >if they can prove you rigged a failsafe, you're going to jail anyway Because if someone is willing to go to those lengths on their own system, there's no possibility for the odds to be stacked in their favor…
      - betterunix 13y ago
        I think it might be hard to prove the evidence tampering charge. It is not at all unreasonable to claim that you were trying to protect important secrets from criminals who might break into your home or office. To put it another way, this is not an illegal device: http://www.ironkey.com/en-US/secure-portable-storage/250-personal.html http://www.ironkey.com/en-US/secure-portable-storage/250-per...
        superuser2 13y ago
        If you had video confirmation that it was the police who tripped your alarm before firing a degausser, that would be pretty cut and dried. If it were automatic, maybe not.
  - betterunix 13y ago
    It is also worth noting that the problem here is how easily the FBI can access your mail from GMail. Sneaking into a house requires sending agents into the field, watching a person to make sure they are not going to walk in on you, being very careful not to leave a trace or wind up on a security camera they set up, etc. The FBI only has so many people it can dedicate to these sorts of activities. They are not going to be able to do this to you, and your friends, and their friends; it's too costly and runs too high a risk of tipping off the target. With GMail, the agents do not even need to leave their desks. Just fax the court order to Google, and a few hours later you have thousands of emails waiting for you to read. Want to read the emails of the targets' acquaintances? Just send another fax! Nobody has to know, just call it a national security matter!
    - superuser2 13y ago
      Relying on inefficiency as protection against the government is rarely a good bet. We've already seen a dramatic increase in national security spending; they will obtain the resources they need. We need a new Wiretap Act to apply to non-voice communications.
      - betterunix 13y ago
        Inefficiency is the most important protection we have against tyranny. The entire design of our government reflects this: three branches, two houses of congress, checks and balances, limits on how laws can be enforced, etc. Inefficiency is the only thing that ever stood between the USA and tyranny. The real problem is that we have allowed the government to become far too efficient over the past few decades.
- Wilya 13y ago
  The NSA isn't the almighty spirit of the internet. They can't just clap their hands and magically get access to any server on earth. And even if they can, it certainly doesn't make the evidence obtained that way acceptable in court. I don't like this argument that since the NSA is almighty, avoiding Gmail for security reasons is stupid. For the US government, accessing emails stored under my bed may not be impossible, but it's orders of magnitude more difficult than if they were on Gmail servers.
  - jholman 13y ago
    Yes and no. In some circumstances I agree with you, in other circumstances I think you have it backward. I shall enumerate some cases (note that US citizens always count as "inside the US" in this case breakdown): * inside the US, old-school warrant exists * inside the US, secret warrant exists * inside the US, no legal authority * outside the US, no legal authority * outside the US, weird US-logic legal authority 1) If you're inside the US, and the cops have a non-gag-order warrant, you're no safer with your own server. With your server, they serve you, you know about it; with gmail, they serve Google, and Google tells you about it. No difference. 2) If you're inside the US, and they use a secret warrant, in this case your own server might be better. They can probably still do something tricky to you, without you knowing, but using GMail makes it slightly easier for them to get your information without your knowledge. 3) If you're inside the US, and they have no legal authority, then you're fine in both cases. Unless they break into your server illegally. In this case, their job will be orders of magnitude easier if you run your own server. 4) If you're outside the US, and they have no legal authority at all, same as the previous point: if they try to break in, their job will be orders of magnitude easier if you run your own server. 5) If you're outside the US, they might get FISA clearance to get your stuff. In this case, I think you're better off with your own server. This is comparing Google's legal pushback vs breaking into your server. It's totally possible that breaking into your server is orders of magnitude harder than convincing Google that they have legal authority. In an ideal world, this last case would only apply to political enemies of the US. You'd be able to figure out for yourself if it applied to you, and act accordingly. What kind of idiot uses a US company to plan terrorist attacks on US interests, amirite? Or to leak things to wikileaks (categorize that however you like). But what is much much less clear is whether the US does in fact use this type of surveillance to unethically benefit US corporations, for example. We've heard unsubstantiated accusations to that effect; nothing in my life experience helps me to know if I do or do not live in that kind of world.
- daurnimator 13y ago
  At least then you know. Also it requires a much harder to get warrant as well as cost approvals.

thrownaway2424 13y ago

If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.

superuser2 13y ago
It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.
- cinquemb 13y ago
  Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).
  - betterunix 13y ago
    Why wipe the hard drives? Use WDE, and have the alarm (a) unmount the drive, (b) overwrite the system's RAM with 0s (or at least the portion of RAM where the keys are stored), and (c) power down the system. That is a lot faster that making a backup and wiping the drives; by the time an agent has snuck in and located the computer, the process should be over. Also, it might help to install a security camera, so you can tell the difference between a rat triggering the alarm and an FBI agent (I'll leave it to the audience to make a few jokes). Alarm is triggered, the camera starts sending pictures of the intruders to your smartphone or to Usenet (encrypted, using a key you keep on a smartcard) or whatever.
  - superuser2 13y ago
    Evidence tampering is a federal felony. In this case it doesn't matter how well you covered your tracks - if they can prove you rigged a failsafe, you're going to jail anyway.
    - cinquemb 13y ago
      >if they can prove you rigged a failsafe, you're going to jail anyway Because if someone is willing to go to those lengths on their own system, there's no possibility for the odds to be stacked in their favor…
    - betterunix 13y ago
      I think it might be hard to prove the evidence tampering charge. It is not at all unreasonable to claim that you were trying to protect important secrets from criminals who might break into your home or office. To put it another way, this is not an illegal device: http://www.ironkey.com/en-US/secure-portable-storage/250-personal.html http://www.ironkey.com/en-US/secure-portable-storage/250-per...
      - superuser2 13y ago
        If you had video confirmation that it was the police who tripped your alarm before firing a degausser, that would be pretty cut and dried. If it were automatic, maybe not.
- betterunix 13y ago
  It is also worth noting that the problem here is how easily the FBI can access your mail from GMail. Sneaking into a house requires sending agents into the field, watching a person to make sure they are not going to walk in on you, being very careful not to leave a trace or wind up on a security camera they set up, etc. The FBI only has so many people it can dedicate to these sorts of activities. They are not going to be able to do this to you, and your friends, and their friends; it's too costly and runs too high a risk of tipping off the target. With GMail, the agents do not even need to leave their desks. Just fax the court order to Google, and a few hours later you have thousands of emails waiting for you to read. Want to read the emails of the targets' acquaintances? Just send another fax! Nobody has to know, just call it a national security matter!
  - superuser2 13y ago
    Relying on inefficiency as protection against the government is rarely a good bet. We've already seen a dramatic increase in national security spending; they will obtain the resources they need. We need a new Wiretap Act to apply to non-voice communications.
    - betterunix 13y ago
      Inefficiency is the most important protection we have against tyranny. The entire design of our government reflects this: three branches, two houses of congress, checks and balances, limits on how laws can be enforced, etc. Inefficiency is the only thing that ever stood between the USA and tyranny. The real problem is that we have allowed the government to become far too efficient over the past few decades.
Wilya 13y ago
The NSA isn't the almighty spirit of the internet. They can't just clap their hands and magically get access to any server on earth. And even if they can, it certainly doesn't make the evidence obtained that way acceptable in court. I don't like this argument that since the NSA is almighty, avoiding Gmail for security reasons is stupid. For the US government, accessing emails stored under my bed may not be impossible, but it's orders of magnitude more difficult than if they were on Gmail servers.
- jholman 13y ago
  Yes and no. In some circumstances I agree with you, in other circumstances I think you have it backward. I shall enumerate some cases (note that US citizens always count as "inside the US" in this case breakdown): * inside the US, old-school warrant exists * inside the US, secret warrant exists * inside the US, no legal authority * outside the US, no legal authority * outside the US, weird US-logic legal authority 1) If you're inside the US, and the cops have a non-gag-order warrant, you're no safer with your own server. With your server, they serve you, you know about it; with gmail, they serve Google, and Google tells you about it. No difference. 2) If you're inside the US, and they use a secret warrant, in this case your own server might be better. They can probably still do something tricky to you, without you knowing, but using GMail makes it slightly easier for them to get your information without your knowledge. 3) If you're inside the US, and they have no legal authority, then you're fine in both cases. Unless they break into your server illegally. In this case, their job will be orders of magnitude easier if you run your own server. 4) If you're outside the US, and they have no legal authority at all, same as the previous point: if they try to break in, their job will be orders of magnitude easier if you run your own server. 5) If you're outside the US, they might get FISA clearance to get your stuff. In this case, I think you're better off with your own server. This is comparing Google's legal pushback vs breaking into your server. It's totally possible that breaking into your server is orders of magnitude harder than convincing Google that they have legal authority. In an ideal world, this last case would only apply to political enemies of the US. You'd be able to figure out for yourself if it applied to you, and act accordingly. What kind of idiot uses a US company to plan terrorist attacks on US interests, amirite? Or to leak things to wikileaks (categorize that however you like). But what is much much less clear is whether the US does in fact use this type of surveillance to unethically benefit US corporations, for example. We've heard unsubstantiated accusations to that effect; nothing in my life experience helps me to know if I do or do not live in that kind of world.
daurnimator 13y ago
At least then you know. Also it requires a much harder to get warrant as well as cost approvals.