7 ms·

Moving services off USA-based companies is like using two bicycle locks instead of one. A determined government is still going to get your data, they just need

by meritt 13y ago

Moving services off USA-based companies is like using two bicycle locks instead of one. A determined government is still going to get your data, they just need to spend a bit more time. Focus instead on encryption.

techtalsky 13y ago
The problem with encryption in this case when it comes to US companies is that the US can compel US companies to install custom backdoors while pretending they are still secure and not notify their customers that this happened.
fnordfnordfnord 13y ago
It is just as bad or worse. You have to move the data in/out of the country. It definitely isn't protected when it leaves the country. The only advantage I see is that it punishes US businesses for failing to protest.
- smtddr 13y ago
  I don't blame the companies; they're about as much a victim of USgov as we are IMHO. That being said, if all the online-storage/cloud-server/email-providers/social-whatever companies in US start going out of business because nobody trusts them I strongly suspect something will have to change. It's just too bad we have to do a "scorched earth"[1] to bring about change. 1. http://en.wikipedia.org/wiki/Scorched_earth http://en.wikipedia.org/wiki/Scorched_earth
  - drivingmenuts 13y ago
    > I don't blame the companies; they're as much a victim of USgov as we are IMHO. While it's true that they are victims, they are in a far better place to demand change or to defend themselves. Money buys the ears of lawyers that the average person couldn't even afford to speak to.
    - deleted 13y ago
      [deleted]
  - sixothree 13y ago
    This is where I disagree. I do blame companies like Google for not fighting this more. At the very least they make users aware that these laws exist, even if they cannot detail specifics related to their surveillance involvement.
    - MrKurtz 13y ago
      You can't convincingly make that argument since you don't know what lawyers have been doing behind the closed doors of secret court rooms nor do you have knowledge of their relevant lobbying, you're just assuming things. No to forget that Google was the first to publish a transparency report in which it publishes the number of NSLs, so there is that - it's not correct to use "Google" as a shorthand for "US tech companies".
    - smtddr 13y ago
      See this comment : https://news.ycombinator.com/item?id=6182179 https://news.ycombinator.com/item?id=6182179 Fighting the USgov isn't a decision to take lightly regardless of how much money & resources you have. I cannot condemn a company that backs down from that battle. It could hurt an employee(s) significantly, or the whole company. While I agree they have the most resources to fight it, they're not immune to harm from USgov.
    - eliasmacpherson 13y ago
      Do you remember google asking for your telephone number? They knew what they were doing.
- smegel 13y ago
  You say that as an American obviously. It makes a lot of sense for everyone else.
  - fnordfnordfnord 13y ago
    >It makes a lot of sense for everyone else. Absolutely!
- LekkoscPiwa 13y ago
  Dual US/Polish citizen here. Just wanted to say that in many cases abroad (i.e. Poland) the case isn't about the laws protecting your privacy but rather about the Government having no means (technical, resources, know-how, etc) to enforce ridicolous things like reading and storing email contents of all the people. Even with court order just to read stuff in your inbox, I would imagine that the Polish police would have big time difficulties doing anything. These are guys making 700usd a month and the Government doesn't have money and/or the need/desire to hire folks who could execute these things. And I can just imagine that in places like Ukraine the law may say whatever but what happens is this what the highest bidder asked for ;-) Remember, not the whole world works the way the first world or the USA does. Unless of course, what you referred to is that most of the traffic goes via the US soil anyway. But then again, why to stay in the US? Move whole business and yourself abroad :-)) Ironically, I found much, much, much more freedom in post communistic Poland than - oh irony! - Land of the Free.
  - kbart 13y ago
    I second to that. If you want security (at least on a servers/ISP level) choose some 3rd world country which government (preferably not very fond of USA) does not have technical means on surveillance. I live in a small EU country and government’s IT forces are just laughable, so I can just imagine that in less civilised countries it should be close to non-existent. Combined with strong encryption to protect data in broad Internet it should do, at least for a while..
    - DominikR 13y ago
      The problem is that most 3rd world countries will just come knocking on your doors and take everything away, if the US goverment requests it. After all, those countries wouldn't be 3rd world countries, if they had the power to resist US threats/requests. Or they are part of the "axis of evil" (or whatever the current propaganda term is), in which case the internet connection to that country could either be cut off, or be heavily censored, if it isn't already happening.
      - 13y ago
computer 13y ago
The goal is not necessarily security (I have nothing to hide (I still do hide as much as possible))-- the goal is political change. That's the only real way out of this mess. By not using US companies, you incentivize those to lobby for better laws.
- res0nat0r 13y ago
  Much of the data traveling over the internet passes through NAPs controlled and owned by the USA.
  - dasil003 13y ago
    Did you respond to the right comment? He said the goal was not security, it was political change.
- ippisl 13y ago
  Political change on it's own won't work. They will still keep the infrastructure in case they need to spy on someone(with a court order). But if they have the infrastructure , conceptually it's just a press of button again to full blown illegal surveillance.
  - LekkoscPiwa 13y ago
    there has been infrastructure to read snail mail contents for 200 years. Doesn't matter, the US Gov isn't routinely reading snail mail because of politics. I think he's right, make it a political issues. Actually, more: make it political issue, encryption issue, hosting issue, social issue (denied nsa contracting recently based on Snowden), I mean total war - make their life as difficult as possible using all means possible. As long as it's legal of course.
    - jlgreco 13y ago
      Mass reading of snail-mail has traditionally been a question of manpower. You don't just flip the switch on that without anybody noticing.
chmars 13y ago
There's not even the time factor. Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. And the US is by far not the only country that mandates surveillance cooperation for providers etc. Encryption is OK but doesn't solve the problem. There's always metadata and whom can your trust with your encryption? You have to assume that hardware and software you use has backdoors. Mobile phones for example has even official backdoors, your SIM card can be remotely changed and so on …
- claudius 13y ago
  > Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. Hoping that this is true, moving to services from one’s home country would make some sense. Of course, this is more easily possible for people from larger countries than, say, Luxembourg.
Joeboy 13y ago
It would be really unfortunate if people started getting polarized into encryption / social / legal camps. All these things are necessary.
Bootvis 13y ago
Customers and law may demand that the data is stored in the EU. For businesses with demands hosting in the US is simply not an option. This was a concern earlier but my guess is that this will only increase in the near future.
shn 13y ago
I had the impression that government does not need to decrypt anything. They just request it from a company, and the company has to comply.
realrocker 13y ago
I will take mine government over yours. I can atleast try to deal with mine.
sneak 13y ago
Not quite. Storing ciphertext and keys in legal jurisdictions (like the US) that can be forced to turn over both is a bad idea. Also, practical key management is still an unsolved problem. The web of trust never took off and the PKI is fucked. Encryption is only as useful as the keys being used to encrypt.
darklajid 13y ago
No, do both. Focus on encryption, to keep ahead and protect the data. Move out of the US, because it sucks, is far from 'the land of the free' anymore and needs to learn that its place in the digital world is not at the top, but more around the center. Between lots of other states that fail and fail again, in terms of surveillance..
- muyuu 13y ago
  Yep, as an added bonus you stop financing the US war and terror machine.
deftnerd 13y ago
I saw a frustrating article the other day on a mainstream news site that was saying that the economic damage to the US for the Snoden leaks was in the tens of billions of dollars because of all the non US business that will be leaving US based cloud providers. That's infuriating. It's the same as having an insecure system and then charging a hacker millions of dollars in restitution to re-architect the system to do it right. Those firms wouldn't have to leave the US cloud providers if they had assurances that the US wasn't spying on them for no good reason.
- Karunamon 13y ago
  Infuriating? It's awesome (if you extend it out further). Pocketbook damage is the only thing that governments and mega-corps understand.
rorrr2 13y ago
Considering what just happened to LavaBit, your advice doesn't make any sense. If they were outside of US-and-friends jurisdiction, they wouldn't be shut down and there wouldn't be a gag order.
eyeareque 13y ago
Encryption is useless when the government knocks on their door and says give us a backdoor to your system. If enough people leave US based companies for foreign companies it will put pressure on the government. I have a feeling this pressure is already underway.

by meritt 13y ago

techtalsky 13y ago

The problem with encryption in this case when it comes to US companies is that the US can compel US companies to install custom backdoors while pretending they are still secure and not notify their customers that this happened.

fnordfnordfnord 13y ago

It is just as bad or worse. You have to move the data in/out of the country. It definitely isn't protected when it leaves the country. The only advantage I see is that it punishes US businesses for failing to protest.

smtddr 13y ago
I don't blame the companies; they're about as much a victim of USgov as we are IMHO. That being said, if all the online-storage/cloud-server/email-providers/social-whatever companies in US start going out of business because nobody trusts them I strongly suspect something will have to change. It's just too bad we have to do a "scorched earth"[1] to bring about change. 1. http://en.wikipedia.org/wiki/Scorched_earth http://en.wikipedia.org/wiki/Scorched_earth
- drivingmenuts 13y ago
  > I don't blame the companies; they're as much a victim of USgov as we are IMHO. While it's true that they are victims, they are in a far better place to demand change or to defend themselves. Money buys the ears of lawyers that the average person couldn't even afford to speak to.
  - deleted 13y ago
    [deleted]
- sixothree 13y ago
  This is where I disagree. I do blame companies like Google for not fighting this more. At the very least they make users aware that these laws exist, even if they cannot detail specifics related to their surveillance involvement.
  - MrKurtz 13y ago
    You can't convincingly make that argument since you don't know what lawyers have been doing behind the closed doors of secret court rooms nor do you have knowledge of their relevant lobbying, you're just assuming things. No to forget that Google was the first to publish a transparency report in which it publishes the number of NSLs, so there is that - it's not correct to use "Google" as a shorthand for "US tech companies".
  - smtddr 13y ago
    See this comment : https://news.ycombinator.com/item?id=6182179 https://news.ycombinator.com/item?id=6182179 Fighting the USgov isn't a decision to take lightly regardless of how much money & resources you have. I cannot condemn a company that backs down from that battle. It could hurt an employee(s) significantly, or the whole company. While I agree they have the most resources to fight it, they're not immune to harm from USgov.
  - eliasmacpherson 13y ago
    Do you remember google asking for your telephone number? They knew what they were doing.
smegel 13y ago
You say that as an American obviously. It makes a lot of sense for everyone else.
- fnordfnordfnord 13y ago
  >It makes a lot of sense for everyone else. Absolutely!
LekkoscPiwa 13y ago
Dual US/Polish citizen here. Just wanted to say that in many cases abroad (i.e. Poland) the case isn't about the laws protecting your privacy but rather about the Government having no means (technical, resources, know-how, etc) to enforce ridicolous things like reading and storing email contents of all the people. Even with court order just to read stuff in your inbox, I would imagine that the Polish police would have big time difficulties doing anything. These are guys making 700usd a month and the Government doesn't have money and/or the need/desire to hire folks who could execute these things. And I can just imagine that in places like Ukraine the law may say whatever but what happens is this what the highest bidder asked for ;-) Remember, not the whole world works the way the first world or the USA does. Unless of course, what you referred to is that most of the traffic goes via the US soil anyway. But then again, why to stay in the US? Move whole business and yourself abroad :-)) Ironically, I found much, much, much more freedom in post communistic Poland than - oh irony! - Land of the Free.
- kbart 13y ago
  I second to that. If you want security (at least on a servers/ISP level) choose some 3rd world country which government (preferably not very fond of USA) does not have technical means on surveillance. I live in a small EU country and government’s IT forces are just laughable, so I can just imagine that in less civilised countries it should be close to non-existent. Combined with strong encryption to protect data in broad Internet it should do, at least for a while..
  - DominikR 13y ago
    The problem is that most 3rd world countries will just come knocking on your doors and take everything away, if the US goverment requests it. After all, those countries wouldn't be 3rd world countries, if they had the power to resist US threats/requests. Or they are part of the "axis of evil" (or whatever the current propaganda term is), in which case the internet connection to that country could either be cut off, or be heavily censored, if it isn't already happening.
    - 13y ago

computer 13y ago

The goal is not necessarily security (I have nothing to hide (I still do hide as much as possible))-- the goal is political change. That's the only real way out of this mess. By not using US companies, you incentivize those to lobby for better laws.

res0nat0r 13y ago
Much of the data traveling over the internet passes through NAPs controlled and owned by the USA.
- dasil003 13y ago
  Did you respond to the right comment? He said the goal was not security, it was political change.
ippisl 13y ago
Political change on it's own won't work. They will still keep the infrastructure in case they need to spy on someone(with a court order). But if they have the infrastructure , conceptually it's just a press of button again to full blown illegal surveillance.
- LekkoscPiwa 13y ago
  there has been infrastructure to read snail mail contents for 200 years. Doesn't matter, the US Gov isn't routinely reading snail mail because of politics. I think he's right, make it a political issues. Actually, more: make it political issue, encryption issue, hosting issue, social issue (denied nsa contracting recently based on Snowden), I mean total war - make their life as difficult as possible using all means possible. As long as it's legal of course.
  - jlgreco 13y ago
    Mass reading of snail-mail has traditionally been a question of manpower. You don't just flip the switch on that without anybody noticing.

chmars 13y ago

There's not even the time factor. Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. And the US is by far not the only country that mandates surveillance cooperation for providers etc. Encryption is OK but doesn't solve the problem. There's always metadata and whom can your trust with your encryption? You have to assume that hardware and software you use has backdoors. Mobile phones for example has even official backdoors, your SIM card can be remotely changed and so on …

claudius 13y ago
> Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. Hoping that this is true, moving to services from one’s home country would make some sense. Of course, this is more easily possible for people from larger countries than, say, Luxembourg.

Joeboy 13y ago

It would be really unfortunate if people started getting polarized into encryption / social / legal camps. All these things are necessary.

Bootvis 13y ago

Customers and law may demand that the data is stored in the EU. For businesses with demands hosting in the US is simply not an option. This was a concern earlier but my guess is that this will only increase in the near future.

shn 13y ago

I had the impression that government does not need to decrypt anything. They just request it from a company, and the company has to comply.

realrocker 13y ago

I will take mine government over yours. I can atleast try to deal with mine.

sneak 13y ago

Not quite. Storing ciphertext and keys in legal jurisdictions (like the US) that can be forced to turn over both is a bad idea. Also, practical key management is still an unsolved problem. The web of trust never took off and the PKI is fucked. Encryption is only as useful as the keys being used to encrypt.

darklajid 13y ago

No, do both. Focus on encryption, to keep ahead and protect the data. Move out of the US, because it sucks, is far from 'the land of the free' anymore and needs to learn that its place in the digital world is not at the top, but more around the center. Between lots of other states that fail and fail again, in terms of surveillance..

muyuu 13y ago
Yep, as an added bonus you stop financing the US war and terror machine.

deftnerd 13y ago

I saw a frustrating article the other day on a mainstream news site that was saying that the economic damage to the US for the Snoden leaks was in the tens of billions of dollars because of all the non US business that will be leaving US based cloud providers. That's infuriating. It's the same as having an insecure system and then charging a hacker millions of dollars in restitution to re-architect the system to do it right. Those firms wouldn't have to leave the US cloud providers if they had assurances that the US wasn't spying on them for no good reason.

Karunamon 13y ago
Infuriating? It's awesome (if you extend it out further). Pocketbook damage is the only thing that governments and mega-corps understand.

rorrr2 13y ago

Considering what just happened to LavaBit, your advice doesn't make any sense. If they were outside of US-and-friends jurisdiction, they wouldn't be shut down and there wouldn't be a gag order.

eyeareque 13y ago

Encryption is useless when the government knocks on their door and says give us a backdoor to your system. If enough people leave US based companies for foreign companies it will put pressure on the government. I have a feeling this pressure is already underway.