The general consensus seems to be that if you are specifically targeted, there is very little in your power you can do. Few people are going to throw away any e

The general consensus seems to be that if you are specifically targeted, there is very little in your power you can do. Few people are going to throw away any electronic device they own when they have the slightest suspicion about it. My opinion is that specific goals should be acknowledged and agreed upon. These are things that will do little or nothing to protect dangerous criminals but will prevent dragnet surveillance, political blackmail, and what essentially amounts to a consolidation of power by kleptocrats (which is either the state the US is in now, or will soon be.) The following are goals, each representing its own layer. A) would be a very good start. Each additional layer is helpful, but the first priority is A. A) The end of plain text communication. There is no reason two parties communicating digitally should have their communication readable by anyone with access to the data stream. Ignore the NSA for a moment, any nation your data passes through you should assume is being spied on -- very serious espionage concerns for any business public or private. B) Client side end to end encryption when two parties are communicating with each other. Currently this would put an end to contextual email advertising, stifle history, search indexing, and usage metrics collecting. However, there are potential options here such as Crypton.io. C) Open source software as a service. Lavabit, Silent Circle, and others have a big dilemma -- they can not prove they are not spying on their users. If a software-as-a-service provider is the one doing the encryption, even "client side", there is the possibility of a security compromise, through a court order or otherwise, by modifying how the software executes. Most certainly an astute security researcher would discover something was amiss. The average user may not. The more serious issue is rather the destruction of that business's credibility when a problem is discovered (this is hacker news after all, presumably you are here because you run a start up or internet business.) The best solution -- separate the encryption layer from the service provider. Dropbox (allegedly soon to be complicit with PRISM) can't provide a lot when a user syncs a TrueCrypt volume. What about Silent Circle? Is it really secure? Or Spideroak? We don't know. While their work is admirable, forced automatic updates could break the security. Lack of source code means lack of public auditing. Both Silent Circle and Spideroak could alter their business models to become substantially more secure. For example, if a particular country has a draconian data retention law and you operate in that country, then your business should not store data nor have any business interest in storing data. There are numerous trends that have made security slide out of fashion. We want metrics on everything to optimize our UX. We want deep demographic, behavioral, and contextual data to maximize the amount of money advertisers can spend. Users want plug and play software that just works with the press of a button. View all of these as both obstacles and opportunities to build better versions of what exists today. Software development is getting cheaper, easier, and faster by the day, unlike, say, drilling for oil. Good luck.