Correct that Google has no protection against NSLs, but that's like saying that you should always drive your car because planes are common targets for terrorism

Correct that Google has no protection against NSLs, but that's like saying that you should always drive your car because planes are common targets for terrorism. I'm deeply troubled by the activities of the NSA et al, but realistically you are far, far more likely to be targeted for actual harm by malicious hackers than by the NSA. Even if you are targeted by the NSA, there's a better than average chance that they'll be able to get the data you care about anyway - consider how often you send an e-mail to something that doesn't end up on a server that's vulnerable to NSLs - they can compromise you on either end of the conversation, and that's not even considering the fact that governments are out there buying zero day exploits on the open market. My point is that taking an inherently insecure (at least with respect to data privacy) protocol like the ones we use for e-mail now and putting it on your own server (and thus taking responsibility for patching, avoiding zero days, etc) is not an answer to the problem of data privacy. The way forward in my opinion is the development of communication protocols which by their very nature are trustless. If you're just interested in protecting content, then if you're using end-to-end encryption, you could use LegitimateBankSiteNumberOne.ru as your e-mail provider and it wouldn't matter. The protocols for doing this are already well-known, it's just a matter of adopting them.