6 ms·

Edit: I was a PM on Exchange and Exchange Hosted Encryption for some time, so it looks like Lavabit tried to fight the government on whether they are required t

by yajoe 13y ago

Edit: I was a PM on Exchange and Exchange Hosted Encryption for some time, so it looks like Lavabit tried to fight the government on whether they are required to release private keys. I've seen one other customer try to fight, and it was not pretty either. The US government in these cases are serious. Takeaway for fellow hackers: If you are building a system that stores user-generated data, prepare for the eventuality that someone other than the user will demand to see it. In general, the prevailing theory is that all companies are required to release private keys or passwords needed to unlock evidence. As a consequence of Lavabit fighting, they likely got slapped with some pretty harsh contempt of court rulings, including a demand to record all private keys needed for decryption going forward. The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems. What's sad is that because Lavabit was such a small service provider, they never had the previous rounds of government threats and must have been caught off guard. As I've said in past posts (before Snowden), it is common knowledge among large-scale service providers that the local government can always come in to take a look. Doesn't matter if you are in the US, EU, or China, you have to comply. I've seen the US DOJ threaten pretty harshly a customer who simply asked about 'options' of how to comply. Past post with explanation: https://news.ycombinator.com/item?id=5754641 https://news.ycombinator.com/item?id=5754641 P.S. Right or wrong is a separate conversation...

anoncowherd 13y ago
> P.S. Right or wrong is a separate conversation... No it's not. This is wrong, plain and simple. Wrong is wrong, and black is black.
rdl 13y ago
I think the worst they can realistically do is 1) threaten contempt if you can comply but don't and 2) threaten to disrupt your business operations by seizing servers. There are gag orders on certain legal requests, but you don't have to talk about it to not comply (if you can't comply). As long as you can't comply, I don't think there's an uncounterable risk in the US, since we don't have any key disclosure requirements (the exception being CALEA, which only applies to the PSTN; I'd skip CALEA for an interconnected VOIP system and fight them in the courts/media, personally). Presumably they could put other weird pressure on you like threatening to investigate your nanny's immigration status or whatever, but enh. I still maintain that if you do things properly, you can operate safely in the US while resisting pressure from USG. You can't literally wipe your ass with an NSL in front of the agents, but if you don't have it, and can't get it, they're at worst a DoS. Forcing a provider to implement a huge new logging infrastructure would be an interesting 14A issue, and one could have a system where even that wouldn't recover customer keys. IANAL of course.
sillysaurus 13y ago
The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems. Would you expand on this? Are you saying that a court was meddling directly with an individual company's hierarchy?
- yajoe 13y ago
  (Forgive a 5-year-old memory of one of many cases -- I probably have the numbers wrong) It went something like this: The director of engineering approved a log retention plan that kept access logs for 7 days or something. They wanted to reduce costs and issues with log files were the top reasons for getting called to support the service. The government needed to demonstrate that someone had accessed the service 14 days ago, and the government could not understand why the 'minimum' of 30-day access logs were not present. I think something else was missing, too. There was a back-and-forth, and since the company couldn't produce the logs as requested the government got a contempt of court with the understanding that the director would be demoted to an IC and not be anywhere near the production service. I think the company lawyers agreed to the conditions to make a worse outcome go away. If it's not clear, there were strong personalities involved. One way to tell the story is the director went out of his way to poke a bear and got mauled. Another way to tell the story is that a bear went walking down main street looking for trouble ("How do we know you didn't change the retention policy to protect the individual?"). In both cases the guy lost his hand and the bear is still loose.
  - fragsworth 13y ago
    Software/technology is quickly becoming a place full of dangerous legal landmines.
    - Shivetya 13y ago
      so no matter how good encryption gets, government will simply ratchet up the penalties; financial and/or prison time; to keep pace. we simply can be guilty hiding the nothing we have to hide
hindsightbias 13y ago
ziplip shut down in 2005 citing an inability to maintain user privacy in light of new legislation. Their servers were in Ireland, I think.
- deleted 13y ago
  [deleted]
Sami_Lehtinen 13y ago
Yup, nothing new, even in Europe (Finland). http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer
qwerta 13y ago
Could you name some examples from Europe? Cases when police physically takes servers are common. But I never heard of case where police would require encryption keys for 'maybe we will needed it'.
- DanBC 13y ago
  Regulation of Investigatory Powers Act (RIPA) in the UK is relevant here. (http://www.pcpro.co.uk/news/361693/teenager-jailed-for-refusing-to-reveal-encryption-keys http://www.pcpro.co.uk/news/361693/teenager-jailed-for-refus...)
- northwest 13y ago
  Also, what prevents the guy from setting up that service in a European country (Switzerland is not subject to EU laws)? I don't see why his 10 years of work would be lost.
  - draugadrotten 13y ago
    He might not want to relocate. It's risky to relocate the servers in another country. You will have to obey the other country's laws, but the US gov will still claim jurisdiction if the staff and/or owner is in the US. The US will even claim jurisdiction as soon as you use a ".com" domain [1] Of course the hosting nation will also claim jurisdiction. So relocating your servers to one country while staying in another will expose you to two national laws as well as any international agreements between these nations. [1] Richard O’Dwyer, a UK citizen who ran a UK-based web site, was facing extradition to the U.S. because he used a .com domain. - http://www.theguardian.com/law/2011/jun/17/student-file-sharing-tvshack-extradition http://www.theguardian.com/law/2011/jun/17/student-file-shar...
    - northwest 13y ago
      He could still just sell it to someone in another country. Neither the service nor his 10 years of work would be lost.

by yajoe 13y ago

anoncowherd 13y ago

> P.S. Right or wrong is a separate conversation... No it's not. This is wrong, plain and simple. Wrong is wrong, and black is black.

rdl 13y ago

I think the worst they can realistically do is 1) threaten contempt if you can comply but don't and 2) threaten to disrupt your business operations by seizing servers. There are gag orders on certain legal requests, but you don't have to talk about it to not comply (if you can't comply). As long as you can't comply, I don't think there's an uncounterable risk in the US, since we don't have any key disclosure requirements (the exception being CALEA, which only applies to the PSTN; I'd skip CALEA for an interconnected VOIP system and fight them in the courts/media, personally). Presumably they could put other weird pressure on you like threatening to investigate your nanny's immigration status or whatever, but enh. I still maintain that if you do things properly, you can operate safely in the US while resisting pressure from USG. You can't literally wipe your ass with an NSL in front of the agents, but if you don't have it, and can't get it, they're at worst a DoS. Forcing a provider to implement a huge new logging infrastructure would be an interesting 14A issue, and one could have a system where even that wouldn't recover customer keys. IANAL of course.

sillysaurus 13y ago

The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems. Would you expand on this? Are you saying that a court was meddling directly with an individual company's hierarchy?

yajoe 13y ago
(Forgive a 5-year-old memory of one of many cases -- I probably have the numbers wrong) It went something like this: The director of engineering approved a log retention plan that kept access logs for 7 days or something. They wanted to reduce costs and issues with log files were the top reasons for getting called to support the service. The government needed to demonstrate that someone had accessed the service 14 days ago, and the government could not understand why the 'minimum' of 30-day access logs were not present. I think something else was missing, too. There was a back-and-forth, and since the company couldn't produce the logs as requested the government got a contempt of court with the understanding that the director would be demoted to an IC and not be anywhere near the production service. I think the company lawyers agreed to the conditions to make a worse outcome go away. If it's not clear, there were strong personalities involved. One way to tell the story is the director went out of his way to poke a bear and got mauled. Another way to tell the story is that a bear went walking down main street looking for trouble ("How do we know you didn't change the retention policy to protect the individual?"). In both cases the guy lost his hand and the bear is still loose.
- fragsworth 13y ago
  Software/technology is quickly becoming a place full of dangerous legal landmines.
  - Shivetya 13y ago
    so no matter how good encryption gets, government will simply ratchet up the penalties; financial and/or prison time; to keep pace. we simply can be guilty hiding the nothing we have to hide

hindsightbias 13y ago

ziplip shut down in 2005 citing an inability to maintain user privacy in light of new legislation. Their servers were in Ireland, I think.

deleted 13y ago
[deleted]

Sami_Lehtinen 13y ago

Yup, nothing new, even in Europe (Finland). http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer

qwerta 13y ago

Could you name some examples from Europe? Cases when police physically takes servers are common. But I never heard of case where police would require encryption keys for 'maybe we will needed it'.

DanBC 13y ago
Regulation of Investigatory Powers Act (RIPA) in the UK is relevant here. (http://www.pcpro.co.uk/news/361693/teenager-jailed-for-refusing-to-reveal-encryption-keys http://www.pcpro.co.uk/news/361693/teenager-jailed-for-refus...)
northwest 13y ago
Also, what prevents the guy from setting up that service in a European country (Switzerland is not subject to EU laws)? I don't see why his 10 years of work would be lost.
- draugadrotten 13y ago
  He might not want to relocate. It's risky to relocate the servers in another country. You will have to obey the other country's laws, but the US gov will still claim jurisdiction if the staff and/or owner is in the US. The US will even claim jurisdiction as soon as you use a ".com" domain [1] Of course the hosting nation will also claim jurisdiction. So relocating your servers to one country while staying in another will expose you to two national laws as well as any international agreements between these nations. [1] Richard O’Dwyer, a UK citizen who ran a UK-based web site, was facing extradition to the U.S. because he used a .com domain. - http://www.theguardian.com/law/2011/jun/17/student-file-sharing-tvshack-extradition http://www.theguardian.com/law/2011/jun/17/student-file-shar...
  - northwest 13y ago
    He could still just sell it to someone in another country. Neither the service nor his 10 years of work would be lost.