Comment by yajoe | Hacker News Reader

Comment by yajoe | Hacker News Reader

Parent Full thread

Edit: I was a PM on Exchange and Exchange Hosted Encryption for some time, so it looks like Lavabit tried to fight the government on whether they are required to release private keys. I've seen one other customer try to fight, and it was not pretty either. The US government in these cases are serious.

Takeaway for fellow hackers: If you are building a system that stores user-generated data, prepare for the eventuality that someone other than the user will demand to see it.

In general, the prevailing theory is that all companies are required to release private keys or passwords needed to unlock evidence. As a consequence of Lavabit fighting, they likely got slapped with some pretty harsh contempt of court rulings, including a demand to record all private keys needed for decryption going forward. The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems.

What's sad is that because Lavabit was such a small service provider, they never had the previous rounds of government threats and must have been caught off guard. As I've said in past posts (before Snowden), it is common knowledge among large-scale service providers that the local government can always come in to take a look. Doesn't matter if you are in the US, EU, or China, you have to comply. I've seen the US DOJ threaten pretty harshly a customer who simply asked about 'options' of how to comply.

Past post with explanation: https://news.ycombinator.com/item?id=5754641

P.S. Right or wrong is a separate conversation...

The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems.

Would you expand on this? Are you saying that a court was meddling directly with an individual company's hierarchy?

(Forgive a 5-year-old memory of one of many cases -- I probably have the numbers wrong) It went something like this: The director of engineering approved a log retention plan that kept access logs for 7 days or something. They wanted to reduce costs and issues with log files were the top reasons for getting called to support the service. The government needed to demonstrate that someone had accessed the service 14 days ago, and the government could not understand why the 'minimum' of 30-day access logs were not present. I think something else was missing, too. There was a back-and-forth, and since the company couldn't produce the logs as requested the government got a contempt of court with the understanding that the director would be demoted to an IC and not be anywhere near the production service. I think the company lawyers agreed to the conditions to make a worse outcome go away.

If it's not clear, there were strong personalities involved. One way to tell the story is the director went out of his way to poke a bear and got mauled. Another way to tell the story is that a bear went walking down main street looking for trouble ("How do we know you didn't change the retention policy to protect the individual?"). In both cases the guy lost his hand and the bear is still loose.

Software/technology is quickly becoming a place full of dangerous legal landmines.

so no matter how good encryption gets, government will simply ratchet up the penalties; financial and/or prison time; to keep pace.

we simply can be guilty hiding the nothing we have to hide

Don't be so bleak. If you're going to do something that will get the attention of any government, here's a simple rule to follow. Don't use 3rd parties. And if you must, do it in a way that can never be traced back to you in the "real world". It isn't hard and it isn't even illegal.

http://www.amazon.com/How-Be-Invisible-Protect-Children/dp/1...

Step 1: Don't buy a book called "How to be Invisible" from Amazon.

Is there a legal precedent for minimum time that logs must be kept, say for an email service or messaging service? I'm talking about US policy, if that makes it more clear.

Generally speaking unless you are specifically required to keep records for a regulatory purpose (i.e. tax), you don't have to keep logs at all. Lavabit used to keep logs for a limited time (I think a week?).

More concerning are key disclosure laws [1] and their crazy penalties that seem to be creeping in all over the world.

[1] https://en.wikipedia.org/wiki/Key_disclosure_law

No, but you must follow your own policy.

You also need to take reasonable measures to preserve relevant data when you have reasonable cause to suspect that litigation or an investigation will begin.

Not having a policy can hurt you. If you have no deletion/retention policy, and happen to destroy data for some random reason when a litigation begins, you or your company may be in trouble.

Note: IANAL, and different industries or data categories have specific legal requirements or best practices for retaining things.

It was likely agreed on (possibly via contract) to meet the compliance policy of the government agency. So I could see breach of contract. I don't know about legal precedent for logs per se, but there is precedent for retention of other files. For instance HIPAA involves some well known regulations around keeping and destroying medical data.

Yup, nothing new, even in Europe (Finland). http://en.wikipedia.org/wiki/Penet_remailer

ziplip shut down in 2005 citing an inability to maintain user privacy in light of new legislation. Their servers were in Ireland, I think.

I think the worst they can realistically do is 1) threaten contempt if you can comply but don't and 2) threaten to disrupt your business operations by seizing servers. There are gag orders on certain legal requests, but you don't have to talk about it to not comply (if you can't comply).

As long as you can't comply, I don't think there's an uncounterable risk in the US, since we don't have any key disclosure requirements (the exception being CALEA, which only applies to the PSTN; I'd skip CALEA for an interconnected VOIP system and fight them in the courts/media, personally). Presumably they could put other weird pressure on you like threatening to investigate your nanny's immigration status or whatever, but enh.

I still maintain that if you do things properly, you can operate safely in the US while resisting pressure from USG. You can't literally wipe your ass with an NSL in front of the agents, but if you don't have it, and can't get it, they're at worst a DoS. Forcing a provider to implement a huge new logging infrastructure would be an interesting 14A issue, and one could have a system where even that wouldn't recover customer keys.

IANAL of course.

Could you name some examples from Europe? Cases when police physically takes servers are common. But I never heard of case where police would require encryption keys for 'maybe we will needed it'.

Also, what prevents the guy from setting up that service in a European country (Switzerland is not subject to EU laws)?

I don't see why his 10 years of work would be lost.

He might not want to relocate.

It's risky to relocate the servers in another country. You will have to obey the other country's laws, but the US gov will still claim jurisdiction if the staff and/or owner is in the US. The US will even claim jurisdiction as soon as you use a ".com" domain [1]

Of course the hosting nation will also claim jurisdiction. So relocating your servers to one country while staying in another will expose you to two national laws as well as any international agreements between these nations.

[1] Richard O’Dwyer, a UK citizen who ran a UK-based web site, was facing extradition to the U.S. because he used a .com domain. - http://www.theguardian.com/law/2011/jun/17/student-file-shar...

He could still just sell it to someone in another country. Neither the service nor his 10 years of work would be lost.

Depending on how bad the government wants the data, that's essentially just charging a high premium to get all the data instead of a specific user's data.

If the purchasing party is less scrupulous, you've thwarted nothing. In extreme cases (or for smaller companies), the purchaser could even be a government front.

I'm pretty sure there are known entities offshore you could sell to who are unlikely to be government fronts. Imagine selling to someone Wikileaks affiliated...

Regulation of Investigatory Powers Act (RIPA) in the UK is relevant here.

(http://www.pcpro.co.uk/news/361693/teenager-jailed-for-refus...)

> P.S. Right or wrong is a separate conversation...

No it's not. This is wrong, plain and simple. Wrong is wrong, and black is black.

Reply on news.ycombinator.com