6 ms·

To the founders of CryptoSeal. When you first set up, did you consider not being a US headquartered company? If so, what were the overriding factors that made

by amirmc 13y ago

To the founders of CryptoSeal. When you first set up, did you consider not being a US headquartered company? If so, what were the overriding factors that made you stay US-based? I ask because in a recent blog post from Silent Circle (a secure comms company), they explicitly state "we are not a U.S firm" [1]. I'm beginning to think any company that wants to offer security products like this has to place their Global HQ outside the US's legal jurisdiction. I doubt it solves all the problems but it probably helps to some extent. [1] http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-year-silent-circles-first-anniversary/ http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-y...

gonzo 13y ago
Silent Circle "isn't a US company", but has their US HQ in Washington DC. They have software engineers in "Silicon Valley". What makes you think they're "outside the US' legal jurisdiction"?
- amirmc 13y ago
  Apologies, I wasn't clear enough. What I'm trying to refer to is the legal jurisdiction of the Global HQ and what effect that has (if any) on receiving court orders like the one described in this discussion. Having wholly-owned subsidiaries in the territories in which you operate is a requirement and puts part of the company within that jurisdiction but I'm curious to know if having the parent company elsewhere offers some form of insulation (or not). Perhaps this is a question I should direct at the other company but I wondered if it was something that the CryptoSeal folks had considered.
rdl 13y ago
There are multiple concepts of jurisdiction. It does very little good to just "incorporate offshore" and still have US operations, US principals, etc. If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught. While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US. The silent circle guys are basically all US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.
- amirmc 13y ago
  Thanks for the additional context. On the surface it doesn't seem that there are any benefits to having the parent company offshore. I agree with the sentiment of trying to change the system, which won't happen if people (and companies) simply try and leave.
- hannibal5 13y ago
  As far as I know, US citizens can't be ordered to violate laws when they operate in foreign countries. If they receive compliance letter requesting them to use foreign company with servers located in that country to break those laws, they can point out that it's outside US jurisdiction.
  - rdl 13y ago
    There would probably be an argument about "instrumentality", and the US person sitting in the US would be in an exceptionally uncomfortable position.
  - rdouglas 13y ago
    You're right. Legally setup foreign businesses can't be forced to comply with US law, unless it's fraud or other criminal activity. There's still a few safe places out there to do business legally and protect your data. The Bahamas comes to mind.
- qq66 13y ago
  Sounds like what the market needs is a provider that is truly offshore: foreign principals, headquarters, operations.
  - rdl 13y ago
    That's only a limited success, because I still trust the US Government, even NSA, more than almost any foreign government. (NSA has more resources, but there's at least some semi-effective political and thus popular oversight). The ultimate solution is providers which can prove their operational security to end users continuously, through technical controls.
danesparza 13y ago
I am not a lawyer. However, as a US company or a non-US company with US customers, I wonder if cryptography export laws come into effect: http://en.wikipedia.org/wiki/Cryptography_export_laws#Current_status http://en.wikipedia.org/wiki/Cryptography_export_laws#Curren...
- rhubarbquid 13y ago
  If you're a non-US company with US customers, I don't think you're technically exporting anything (unless it's code that was written in the US and then moved out of the country). (I'm also not a lawyer)
anseljh 13y ago
Perhaps you missed the intentionally vague part of the criminal complaint against Ross Ulbricht of Silk Road fame. The FBI managed to get a foreign country to seize servers for it. How much due process do you think was involved in that unnamed foreign country? Abandoning the US isn't the solution to your problems. Fixing the law is, and you have a better chance of doing that in the US than elsewhere.

by amirmc 13y ago

gonzo 13y ago

Silent Circle "isn't a US company", but has their US HQ in Washington DC. They have software engineers in "Silicon Valley". What makes you think they're "outside the US' legal jurisdiction"?

amirmc 13y ago
Apologies, I wasn't clear enough. What I'm trying to refer to is the legal jurisdiction of the Global HQ and what effect that has (if any) on receiving court orders like the one described in this discussion. Having wholly-owned subsidiaries in the territories in which you operate is a requirement and puts part of the company within that jurisdiction but I'm curious to know if having the parent company elsewhere offers some form of insulation (or not). Perhaps this is a question I should direct at the other company but I wondered if it was something that the CryptoSeal folks had considered.

rdl 13y ago

There are multiple concepts of jurisdiction. It does very little good to just "incorporate offshore" and still have US operations, US principals, etc. If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught. While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US. The silent circle guys are basically all US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.

amirmc 13y ago
Thanks for the additional context. On the surface it doesn't seem that there are any benefits to having the parent company offshore. I agree with the sentiment of trying to change the system, which won't happen if people (and companies) simply try and leave.
hannibal5 13y ago
As far as I know, US citizens can't be ordered to violate laws when they operate in foreign countries. If they receive compliance letter requesting them to use foreign company with servers located in that country to break those laws, they can point out that it's outside US jurisdiction.
- rdl 13y ago
  There would probably be an argument about "instrumentality", and the US person sitting in the US would be in an exceptionally uncomfortable position.
- rdouglas 13y ago
  You're right. Legally setup foreign businesses can't be forced to comply with US law, unless it's fraud or other criminal activity. There's still a few safe places out there to do business legally and protect your data. The Bahamas comes to mind.
qq66 13y ago
Sounds like what the market needs is a provider that is truly offshore: foreign principals, headquarters, operations.
- rdl 13y ago
  That's only a limited success, because I still trust the US Government, even NSA, more than almost any foreign government. (NSA has more resources, but there's at least some semi-effective political and thus popular oversight). The ultimate solution is providers which can prove their operational security to end users continuously, through technical controls.

danesparza 13y ago

I am not a lawyer. However, as a US company or a non-US company with US customers, I wonder if cryptography export laws come into effect: http://en.wikipedia.org/wiki/Cryptography_export_laws#Current_status http://en.wikipedia.org/wiki/Cryptography_export_laws#Curren...

rhubarbquid 13y ago
If you're a non-US company with US customers, I don't think you're technically exporting anything (unless it's code that was written in the US and then moved out of the country). (I'm also not a lawyer)

anseljh 13y ago

Perhaps you missed the intentionally vague part of the criminal complaint against Ross Ulbricht of Silk Road fame. The FBI managed to get a foreign country to seize servers for it. How much due process do you think was involved in that unnamed foreign country? Abandoning the US isn't the solution to your problems. Fixing the law is, and you have a better chance of doing that in the US than elsewhere.