6 ms·

Speaking as a foreigner, I now have very little trust for basically any major US tech corporation. The NSA claims it deals responsibly with data relating to US

• nwh 13y ago
  That's the part that's always amused me. They claim they only spy on foreigners, which is well, me. Reassuring stuff.
  • hepek 13y ago
    "...The state then is the most flagrant negation, the most cynical and complete negation of humanity. It rends apart the universal solidarity of all men upon earth, and it unites some of them only in order to destroy, conquer, and enslave all the rest. It takes under its protection only its own citizens, and it recognizes human right, humanity, and civilization only within the confines of its own boundaries." Mihail Bakunin
• pjmlp 13y ago
  How well do you trust secret services in you own country? This is overblown out of proportions, anyone that ever had any contact with secret services knows, the only rules they follow is their own, regardless of the country.
  • frio 13y ago
    I don't :). For what it's worth, our government very recently passed laws granting our GCSB much further reaching powers. It's been a media circus; one particularly hypocritical politician's currently up in arms because a bunch of his data was compromised -- but in a staggering display of cognitive dissonance, Mr. Dunne voted for the law anyway. Basically, I've always accepted that whatever I do online is public anyway. That doesn't mean I endorse that, and I'd rather give my money to local companies than endorse the US at this time.
  • Zigurd 13y ago
    Would you rather have the American NSA with the size of their budget and capabilities, trying to get at your data, or the Estonian equivalent, with their budget and capabilities?
    • mpyne 13y ago
      Well for starters which one gets to talk to the Estonian state police? But either way surveillance is either good or it's bad, I've never understood the reasoning of people who say that it's OK for their own state to do surveillance as they're "probably inept" anyways. Would you be OK with NSA surveillance if the NSA were inept? No, you wouldn't, so apply the same standard to your own nation as you do to the USA.
      • dlisboa 13y ago
        There's a much higher probability of your data being compromised by the NSA than by any other surveillance institution. Not sure why you don't understand that, not all surveillance is equally successful. The very principle is wrong, but if we assume everyone is surveilling us (which is what is being discussed as people make excuses for the US government doing it), then you'd want to be surveilled by the ones who are the least likely to actually hurt you. It's obvious no one is thinking their own government will never try to break laws just because they're national, but the extent to which they'll do it is far, far less than the US government. For the very practical reasons of political capital, budget, technological and intellectual capabilities.
        • pjmlp 13y ago
          My own country had a dictatorship until 1974. I am old enough to have gotten the last bits of it, as we learned to move to democracy, so I would call our secret services anything but inept.
      • Zigurd 13y ago
        I would not call the Estonian Navy inept. But neither would I be worried about them getting an aircraft carrier.
• personlurking 13y ago
  The only issue with that, speaking as a US citizen living abroad, is that at some point you will likely interact with a person or service based in the US, at which point you can consider your communication intercepted, as it were. We're all dealing with 'unknown unknowns', that which we don't know we don't know because it's so secretive. If it were a 'known unknown' (such as "What is water made of?"), we could at least know where to go to find out such information (and actually find it out).
  • jaggederest 13y ago
    There's no unknown unknowns in the NSA surveillance - that's for things where you don't know what the risks are. This is a case of known unknowns - you don't know if any given piece of digital information about you has been collected and investigated, but an easy way is to simply assume that it all has. Same with encryption backdoors - we know they're possible, we just don't know where they exist. What's more, we even have examples of these kind of things existing from things like the Great Firewall. Unknown unknowns would be (for example) a sufficiently general P = NP proof rendering crypto as it exists today obsolete, efficient large qubit quantum computing clusters running Shor's algorithm, or mind-reading at a distance apparatus, or genuine telepathy, or anything that's completely off the charts. Assume all the certificate authorities based in the US are compromised, all the cryptography implementations from the US are backdoored, and all the communications transiting in the US in any form are available to search by whomever you least want to see them.
    • shabble 13y ago
      The problem with "assume the maximum worst everything" case is that it places constraints on you that are essentially certain to be overly broad. Building a workable threat model & defending against it isn't practical (or necessary) if you assume worst case everything. For example, have they recorded all IP traffic ever? It's possible, but absolutely overwhelmingly unlikely. But all IP traffic originating from $small_anti-US_country_x in the last year? That's a whole lot more plausible, and thus probably worthwhile to defend against. Also, does that mean non-US CAs are trustworthy? Are non-US comms also subject to tapping, modernday Ivy Bells[1] style? Also, you have no real idea of exactly if/how they're analysing their captured data in order to extract "threat metrics" or whatever. Posting in a reddit thread about kittens would seem utterly innocuous to virtually everyone; but suppose their steganography detection throws a false positive on your image and by random coincidence they also have hits from some IP once used by a 'terror organisation' in the same thread. Should threats of that nature be considered, purely because they're possible? How do you clear your name? Why won't you give up the password to the bomb plans claimed to be embedded in your image file? Is it because you're protecting other commie mutants[2]? How much paranoia is reasonable? [1] https://en.wikipedia.org/wiki/Operation_Ivy_Bells https://en.wikipedia.org/wiki/Operation_Ivy_Bells [2] https://en.wikipedia.org/wiki/Paranoia_%28role-playing_game%29 https://en.wikipedia.org/wiki/Paranoia_%28role-playing_game%...
• jgreen10 13y ago
  It's not really about US vs. non-US. They can see everything.
  • syjer 13y ago
    but voting with your money is a powerful tool. If the US companies lose money because of this issue, they will pressure the government to do something about it. Just think about the use of microsoft os/programs in the government and how much they could lose.
  • frio 13y ago
    I understand that if I was targetted for investigation, nothing within my power can really prevent that. Having worked in an ISP's operations department, I've seen both sides of the coin. I'm under no illusions here :). Still, I'd rather my money went to local interests, and my data stayed within a sphere I have some control of.
    • mpyne 13y ago
      > Still, I'd rather my money went to local interests, and my data stayed within a sphere I have some control of. Yeah, that has an appeal all its own completely independent of what you feel about spying in general. The USA certainly does the same in reverse, there's always a big push for buying things "Made in the USA" so it's fair to push for it the other way. :)
  • Zigurd 13y ago
    Unless they have the NSA's budget, the NSA mathematicians, the NSA's history of accumulating the NSA's capabilities, they can't. If you want to visualize this, think of the world's navies. Who else but the US navy can even operate globally? Who has naval aviation? You might come to think there is a qualitative difference in the ability to do spying.
    • jgreen10 13y ago
      Sorry, by "they" I meant the NSA. I really don't think it matters where you are for the NSA to spy on you.
• altero 13y ago
  For non-US companies this is even worse. We could actually get sued for not securing our data, if we use hosting in US. Already happened to Irish Google.
  • coldcode 13y ago
    It could actually result in people being sued in the US as well. There are many standards that require protection of user data (like PCI and HIPPA) that could be compromised by the NSA. Yet there is no simple defense since you can't point a finger at a secretive government agency. If you are legally required to demonstrate the data is protected, yet it appears to be available to any random contractor of the NSA, it might make it impossible to provide that guarantee.
• UVB-76 13y ago
  Ditto. I can't believe "we only spy on communications involving foreigners" is actually an acceptable argument in the United States.
  • mhurron 13y ago
    Name a country where it is not.
    • pedrocr 13y ago
      When you're talking about spying on communications over the wire I agree, but that's not the scandal here. The scandal here is that the USG's position is that "we can obtain from the service provider without a warrant the data of any user or corporation as long as they are foreign, even if that data is stored in a non-US datacenter". Imagine the same kind of position in the physical world. A multinational storage company would be forced by the USG to open up a client's storage locker somewhere in Europe, copy all the documents in it and send them to the US. If nothing else this is a very serious threat to the US as the global provider of tech services.
      • mhurron 13y ago
        Again, name one country in the world that does not have this position. You tried to change the topic to law enforcement, we're talking about spy agencies. They operate on different rules. MI5/6 doesn't go 'oh poppycock, they've hopped on the chunnel and fled to France.' They talk to the French agencies or if it's too secret, they go and do it them self. Mossad doesn't give a damn where in the world you are. 'Everyone, everywhere, our laws only exist in our country' is, and has been for a long time, standard operating procedure for these agencies in every country for basically their entire existence.
        • pedrocr 13y ago
          >Again, name one country in the world that does not have this position. You tried to change the topic to law enforcement, we're talking about spy agencies. They operate on different rules. I didn't change the topic at all. I can't quote the relevant laws in this case but as far as I know the law in Europe is that you need a warrant to get the information and that requirement doesn't disappear if the owner of the information is a foreigner. That's what's truly amazing in the USG's position. I agree that everyone tries to spy on information on the wire, but the idea that you can demand any information at rest from any company as long as the owner of the information is a foreigner is an amazing position to hold. There are two other reasons to move your data to your own jurisdiction from US services. 1) the US has the most well funded military so your local spooks probably have less capabilities 2) if one of your local spooks spies on you at least you're in the same jurisdiction and have a small amount of agency (the courts, the vote).
• sschueller 13y ago
  I am doing the same. It is a lot of extra work and cost but there is now zero trust in any US company. Can anyone recommend a Linode alternative not US based?
  • frio 13y ago
    I use affinity.net.nz -- it's run by a friend :). Probably not the greatest if you're not in New Zealand though, as our international bandwidth charges are pretty high.
    • taproot 13y ago
      I think he was asking for a non 5 i's partner, even if he did only say "non-US"
  • dingaling 13y ago
    Gandi.net offer VPS with virtual networking between your instances, it's decent and inexpensive. Flexible pricing. But ensure you choose their French data center and not the one they now have in Baltimore... No affiliation other than being a Gandi customer for six years.
• bsullivan01 13y ago
  "Speaking as a foreigner, I now have very little trust for basically any major US tech corporation" Speaking as an American, if they do this to US tech companies, imagine what they do non-US companies.
  • pedrocr 13y ago
    I imagine that a foreign company not operating in the US doesn't give a damn about threats by the US, which is what I assume the OP meant. What do you mean?
    • bsullivan01 13y ago
      No threats, they'll just copy your data one way or another. If US corps and people have x protections, others have zero.
      • pedrocr 13y ago
        How does the NSA copy the data from a server hosted in Germany by a German company?
        • shabble 13y ago
          Depends how badly they want it. Use a 0-day remote exploit to get a login, exfiltrate data. Use a known, unpatched exploit to do same. Use 0-day/known local exploit with sophisticated spear-phish trojan to do same. Use leverage over domestic software suppliers to ship a customised exploitable (or directly backdoored) update to target company. Ditto domestic hardware manufacturers. Black-bag (or diplomatic quid pro quo) tap of external or internal comm links, to get either raw traffic or encrypted. If the latter, apply other complementary techniques to obtain keys. Infiltrate company with agent who can deploy local exploit via physical access, or who can bug/exploit workstations of users to obtain privileged access to server. Bully/dupe the German government into raiding & seizing the server as part of an international terror/crime investigation. Acquire disk image from seized machines via direct or complementary techniques. Purchase/acquire German company via a domestic front company. Demand IT infrastructure be 'harmonised' with acquirer and moved to US. ...and many, many more. The only reason not to do most of these things is because the cost/benefit analysis doesn't make it worthwhile to do universally without any prior suspicion.
• criley2 13y ago
  If having your own government spy on you instead of the US, and if having US spyware secretly installed doesn't bug you, then feel free to run. But just remember: everyone is spying. We're all in this together, and running from one nationality to another will only change the name and face of who is watching you.
  • Zigurd 13y ago
    Everyone is spying to the extent their budget allows. Keep in mind US military spending is larger that the rest of the world combined. Nobody else on the planet has the ability to bribe or coerce equipment and software makers like the NSA.
  • route66 13y ago
    There is without doubt an asymmetry at play. Try to read the following headlines with reversed roles: http://news.firedoglake.com/2012/01/06/us-ambassador-to-spain-made-threats-to-force-spanish-government-to-pass-anti-piracy-legislation/ http://news.firedoglake.com/2012/01/06/us-ambassador-to-spai... In many countries the patience is running out. If that turns out to have political consequence remains to be seen. But I do not believe that all governments are the same in that respect.
  • fourletterword 13y ago
    Agreed. However, there is a thing called economic espionage. Depending on what you're doing, having your own government spy on you can be a very different thing from having a foreign government spy on you. And no, I don't believe for a second the NSA isn't involved in economic espionage: http://news.bbc.co.uk/2/hi/820758.stm http://news.bbc.co.uk/2/hi/820758.stm
  • dominotw 13y ago
    > everyone is spying. Gut feeling? Not all countries have can afford an expensive program like NSA.
    • mc32 13y ago
      Then, what you do, is what Cuba, Vietnam, Venezuela did/does, you organize local watch committees. These bodies are set-up so that neighbors rat on neighbors. No big budgets necessary. You trust on one and by and large, you outwardly toe the party line.