4 ms·
Iceland, Switzerland, New Zealand, Hong Kong, and a few other places do look really interesting (and Switzerland and Hong Kong have pretty good infrastructure).
by rdl 13y ago
Iceland, Switzerland, New Zealand, Hong Kong, and a few other places do look really interesting (and Switzerland and Hong Kong have pretty good infrastructure). Investigating a few more as well.
One consideration, though, is that we're all US citizens, and so even if we set up a Hong Kong company with Hong Kong servers, we'd be at risk to US court orders or any civil/criminal action. So for US citizens, the only real solution is technical controls, or legal/legislative reforms in the US.
- gonzo 13y agoDo US citizens have to install pen registers on their own service(s)?
- rdl 13y agoIf so ordered by a court of competent jurisdiction. Essentially from lavabit it appears if you don't have technical capabilities inside the service already in place to provide pen trap level realtime reporting, they can compel you to install a pen trap device, and provide all keying/etc. required to make it work.
- gonzo 13y agoYou're likely wrong. On June 10, the federal government served a court order on Lavabit issued under 18 USC 2703(d), a 1994 amendment of the Stored Communications Act. The Stored Communications Act (SCA, codified at 18 U.S.C. Chapter 121 §§ 2701–2712) is a law that addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party internet service providers (ISPs). It was enacted as Title II of the Electronic Communications Privacy Act (ECPA, Pub.L. 99–508, 100 Stat. 1848, enacted October 21, 1986). (emphasis mine) Users generally entrust the security of online information to a third party, an ISP. In many cases, Fourth Amendment doctrine has held that, in so doing, users relinquish any expectation of privacy. The Third-Party Doctrine holds "…that knowingly revealing information to a third party relinquishes Fourth Amendment protection in that information." It doesn't follow that a private individual can be compelled to install a pen register on his/her own infrastructure.
- rdl 13y agoI thought he meant "do us citizens operating services for third parties have to install pen registers". If it is your own service for yourself, they just go a layer down the stack and get your hosting provider or carrier to do so.
- easytiger 13y ago> New Zealand Are you kidding!?
- hannibal5 13y agoFive Eyes countries (US, CA, UK, NZ, AU) have very deep intelligence cooperation and sharing agreements. I don't think NZ is particularly good choice for this reason.
- consonants 13y ago>New Zealand. Hahahaha. NZ bent over backwards to let the US decimate mega. Let's be honest, we have/had basically each of those countries be complicit in extraordinary rendition, extradition, or compliance with US IP-law. What do you honestly think will happen when we, in the name of international security and terrorism prevention, ask them to hand over a few computers instead of, well, people? Advertised cryptography/anonymizing services really can't exist in a climate where all rules are thrown out the window because terrorists.
- tobiasu 13y agoSwitzerland is far from being innocent saints when it comes to surveillance: The Swiss SIGINT equivalent is called PTSS: https://www.li.admin.ch/en/ptss/index.html https://www.li.admin.ch/en/ptss/index.html https://www.li.admin.ch/en/ptss/legal.html https://www.li.admin.ch/en/ptss/legal.html https://en.wikipedia.org/wiki/Swiss_intelligence_agencies https://en.wikipedia.org/wiki/Swiss_intelligence_agencies And don't get me started in HK, NZ or Iceland. If you really want to protect Osamas IRC server and worse with your VPN service, you require specific political protection from the host country.
- bandushrew 13y agoIm from NZ. NZ is not a good place to trust your private data. The NZ government has no hesitation in breaking whatever laws it needs to in order to satisfy US requests.
- hrrsn 13y agoSee also: Kim Dotcom raids, GCSB amendment bill.
- rdouglas 13y agoDon't forget The Bahamas, Ryan! :-) If you need advice from experts at setting up a legal foreign business, LMK, and I'll send you a few referrals.
- malandrew 13y agoHow about having one employee in each of those jurisdictions and setting up a way so that nothing can be done such as deploys and code changes, etc. without one employee from each jurisdiction using their key together. There is no way that a government is going to be able to compel like four citizens from four different countries from complying if it is possible. A US admin could give up their key to the US government and it would still be useless if they can't get the an admin from Iceland, Switzerland, New Zealand and Hong Kong to also participate in the change. It would allow people to comply with the letter of the law to avoid comtempt of court since they gave up their key as asked.
- harshreality 13y agoWouldn't that require N principals, one for each jurisdiction, which is an unusual organizational structure, and requires a lot of trust and shared vision even if it's an n-of-m authorization system?
- mcherm 13y agoSort of. Just because N people from different countries and time zones each need to enter their password in order to make a production change doesn't mean that the organizational structure needs to follow that. For all we care, only the subteam that does production deployments would need to be set up this way. They would, however, need highly trusted agents in several legal jurisdictions. Agents who they trusted with the ability to bring the company down. Still... I think I might pay for a service like that, if some of the principle participants were people I trusted so I was sure it wasn't a honeypot.