Sometimes a David makes a bigger impression than a Goliath.It&#x27;s been years since I&#x27;ve worked with Ladar. However, he&#x27;s a man of great intelligence and principle. It&#x27;s not unheard of for &quot;the little guy&quot; to take on the machine and win. I believe that Ladar will prevail in the end, and I hope he&#x27;ll resume operations or come up with something even better.I&#x27;ll be donating something as soon as I finish my post.

um okay. If it is what we think it is, what makes you think that he will wrestle with Feds if Google, Facebook, Yahoo, Microsoft and other billion-dollars giants were not even interested pursuing the legal way?Most likely, this is all so secret with secret courts foreseeing secret rulings that unless he has solid capital to burn on legal defense, he won&#x27;t get far. He won&#x27;t get far probably either if he has the money. I am sure courts would stretched it in infinity. And I am sure the owner is businessman more than a libertarian.

Source: <a href="https://lavabit.com/?repost=true" rel="nofollow">https:&#x2F;&#x2F;lavabit.com&#x2F;?repost=true</a>This is very unfortunate and sad. I hope he wins in Court. The NSA&#x2F;administration are really trying to destroy the last bit of privacy in the world, and they will fight relentlessly until they do (especially if the People aren&#x27;t fighting back).

Me too. It took a long time to update all of my account information for every website and service I use. It took me a long time to get all of my friends, colleagues, etc. notified that I had switched.I now have a trail of being under my Lavabit account. Commits, patches, websites, services, friends all thinking I&#x27;m still under that account. Now I&#x27;ve got to do it once again, only a few weeks later.Sigh. I can&#x27;t blame Lavabit really. Just a situation I&#x27;d hope to avoid.

Do what I do!I have my own domain name, currently hosting with Google Apps. If I get the motivation to move to another host like myself, I can do it without changing contact information.

That&#x27;s a nightmare. However, I do feel strongly that lavabit made the only right choice. The US government is entirely to blame.

I just lost access to my primary email account.

I&#x27;m in the exact same position. It&#x27;s quite frustrating.EDIT: I turned my frustration into a $100 donation to his legal defense. I hope that more people do the same.

Run your own server, on your own hardware?

This is why I contributed to Mailpile(<a href="http://www.mailpile.is/)&#x27;s" rel="nofollow">http:&#x2F;&#x2F;www.mailpile.is&#x2F;)&#x27;s</a> fundraiser and hang out in their IRC channel. We need more, better, easy-to-use distributed, crypto-friendly mail software, and we need them yesterday. :&#x2F;

Crap, I had just recently migrated all of my accounts to my new Lavabit address, paid for a year of service, etc.Although I&#x27;ve seen some mentioned, what recommendations does HN have for a new e-mail service? Preferably something stable and also respecting of a user&#x27;s privacy. Or perhaps you can only have 1 of the aforementioned attributes.

Yes, unfortunately; I&#x27;m a student of that period of history and it&#x27;s getting pretty bad by its standards.  No proscriptions yet, though ... perhaps because that doesn&#x27;t work so well with a well armed populace.

Hopefully he would become a whistleblower, but with such a bleak outcome for Snowden I can sympathize with his not wanting to.

what would you have him do? He&#x27;s clearly under NSL, so he can&#x27;t tell you what he was asked for. This is the strongest statement he can legally make (in fact, i&#x27;m sure some US lawyers would argue that it&#x27;s actually beyond that).I guess we now know how it must have felt to watch republican institutions spiral into tyranny in ancient Rome.

You kind of have to assume that if you&#x27;re a customer.

The standard way to get the story out is via &quot;leaks&quot;.  Someone could, gasp, hack into his email, get the story, and publish it.

Aren&#x27;t gag orders challengeable? I thought they were found unconstitutional.<a href="http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi-gag-orders-violate-first-amendment" rel="nofollow">http:&#x2F;&#x2F;securitywatch.pcmag.com&#x2F;privacy&#x2F;309277-judge-says-fbi...</a>

He&#x27;s most likely under a gag order. I thought that was pretty obvious.

I&#x27;d say it&#x27;s more than rampant speculation. Shutting down his company was probably his only legal way of informing us.

It&#x27;s unlikely they asked him to decrypt and forward everything. Someone would immediately notice the change and raise the alarms.Much more likely they asked him to slip in a backdoor for some specific users. That&#x27;s much harder to detect.

I like the part where he can&#x27;t tell you why he&#x27;s shutting down. As if we won&#x27;t engage in rampant irresponsible speculation that they have told him to decrypt and forward everything to them in real time.

At first I read your comment as &quot;rather brilliant way&quot; and I agreed with it more than your actual comment :)

&quot;I can&#x27;t tell you the reason&quot; is a rather blatant way of saying &quot;National Security Letter&quot;.

This is a real shame.  10 years of work gone, and they have to ask for help for the legal bills.

&gt; “nihilists, anarchists, activists, Lulzsec, Anonymous, twentysomethings who haven’t talked to the opposite sex in five or six years”Now that&#x27;s a generalization if I ever heard one.

Former head, and he was talking about the extremists who might attack Google or Microsoft, not lobbying groups like the EFF.

He&#x27;s not the head of NSA. He&#x27;s the former head of NSA.

The head of the NSA branded them as &quot;the next terrorists&quot;.<a href="http://www.salon.com/2013/08/06/cyberscare_ex_nsa_chief_calls_transparency_groups_hackers_next_terrorists/singleton/" rel="nofollow">http:&#x2F;&#x2F;www.salon.com&#x2F;2013&#x2F;08&#x2F;06&#x2F;cyberscare_ex_nsa_chief_call...</a>

Do you mean Lavabit? There&#x27;s a donation link at the end of the post.

There is a link at the bottom of the email to a PayPal page for donations to a Legal Defense Fund.I do wonder if PayPal was a good choice for this, or just a choice of convenience. I have trouble trusting PayPal given how many horror stories about accounts being suspended, funds seized (or returned to the senders), and phantom account locks for fraud investigations.

Don&#x27;t give ideas.Too bad that he does not have donations page. I would gladly donate. Also - respect for the decision he made. If he kickstarts a campaign for restoring the service I will be there too.

<a href="https://www.techdirt.com/articles/20130626/00193023622/supporting-eff-means-youre-security-risk.shtml" rel="nofollow">https:&#x2F;&#x2F;www.techdirt.com&#x2F;articles&#x2F;20130626&#x2F;00193023622&#x2F;suppo...</a> is pretty chilling (but at least it has an entertaining picture) if you haven&#x27;t seen it.

Time to donate to the EFF.  They haven&#x27;t been branded as a terrorist charity yet, AFAIK...

The line &quot;A favorable decision would allow me resurrect Lavabit as an American company.&quot; seems to suggest that he may be working to create lavabit outside the borders of &quot;Mordor&quot;.
Can he reopen it as a foreign business?

A lot of outliers are screwing with that average. Think emails with powerpoint&#x2F;keynote attachments, rich pdfs, photos, etc.

The 70GB probably includes attachments, so quite a bit of that number could just be certain users sending large attachments on a regular basis.

If Lavabit allowed large attachments, I&#x27;d say photos.122KB is the average. The majority of emails were probably 1-2KB. Then newsletters, around 50KB. Lastly, emails with attached photos, ~5MB.Probably follows a simple Pareto distribution: 20% of emails comprised 80% of the total storage required.

Average, not median. A thousand 50KB email are easily offset by a few 30MB email with max size attachments. 122KB average isn&#x27;t unusual.

It is possibly 600k non-spam emails per day? With the 70GB including all data w&#x2F; spam. Because with ~300k accounts 600k emails per day is only 2 per account which isn&#x27;t much taking spam into account.

Most of the companies I receive email from these days have 122Kb of crap attached to the bottom by their outgoing MTA. You know: awards, disclaimers, twitter icons, facebook icons.Makes me want to fuck off back to plain text.

70 GB &#x2F; 600K emails = 122KB per email. That&#x27;s a large average even with headers. To put things in perspective, Costco&#x27;s massive marketing email sent to me this morning is 138K including headers.So the question is, what were people sending though Lavabit that averaged 122K and would have attracted attention? Therein probably lies the reason for all of this.

From 2011:&gt; Lavabit processes 70 gigabytes of data per day, is made up of 26 servers, hosts 260,000 email addresses, and processes 600,000 emails a day. That’s a lot of email.<a href="http://www.dbasoul.com/2011/1008.html" rel="nofollow">http:&#x2F;&#x2F;www.dbasoul.com&#x2F;2011&#x2F;1008.html</a>Update: According to their stats page, they had 410k email accounts hosted before shutdown <a href="https://twitter.com/georgemaschke/status/365553445538775040" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;georgemaschke&#x2F;status&#x2F;365553445538775040</a>

Perhaps such a request is why they have shut down?

This actually did happen with hushmail. It&#x27;s hosted in Canada, but the US leaned on them hard enough that they ended up backdooring the client to let the feds snoop on the targeted user.

The feds wanted to install a prism device on his network, not sure if he shut everything down to prevent that from happening or if there are other factors at play.The guy who runs the service is one of my best friends. He&#x27;s the kind of guy who would burn the server farm to the ground before he did something that violated the terms dictated in his privacy policy.

Well, he may not have been able to hand over the old data, but  he may have been asked to include an exploit for all mail going forward. That could have been as simple as the authorities inserting some middleware.

It may be simpler than that. Even if Snowden has walked away from this service, the publicity may have attracted a lot of people the authorities find interesting, including legitimate (whatever that means) persons of interest.

More likely he was compelled to turn over emails relating to the case, and he doesn&#x27;t want to have to be forced to do that again, so he&#x27;s shutting down the service.

What I find interesting is that the lavabit homepage says that the owner has been fighting this for 6 weeks, but the reporter that released Snowden&#x27;s email address did it July 13th.The Government has been trying to get into Lavabit longer than that.Although, perhaps they already knew that Snowden was using Lavabit and started the process immediately after his flight to HK.

That&#x27;s exactly what happened. He can&#x27;t afford to continue fighting the feds in court, so he&#x27;s shutting everything down. His lawyer is expensive and he will go bankrupt if he stays the course.If anyone can recommend someone who can provide counsel pro-bono let me know and I&#x27;ll forward the message along.

And this reads as if someone was trying to force him to install means to spy on his users, and it wouldn&#x27;t be surprising if the aim was to spy on Snowden directly (if he really used this service).

...which is why you encrypt the contents before you send it, yes?

What? I don&#x27;t think this is true at all. Plaintext data, email or not, can be protected with robust encryption. Your end security is the main consideration, but that has nothing to do with the protocol or content, really.

This is somewhat true. RFC3207[1] describes opportunistic TLS encryption for SMTP communications. Our postfix deployment uses this and a fair amount of our email is sent over TLS-encrypted SMTP.Of course, an MITM attack could hide the STARTTLS option and there are questions around the strength of the CA cert infrastructure, but SMTP is not just plaintext.[1] <a href="https://tools.ietf.org/html/rfc3207" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc3207</a>

It wouldn&#x27;t be resilient to interception of mail going to and coming from lavabit however, since email is essentially a plaintext public protocol.

It&#x27;s not speculation:<a href="http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/" rel="nofollow">http:&#x2F;&#x2F;www.wired.com&#x2F;threatlevel&#x2F;2007&#x2F;11&#x2F;encrypted-e-mai&#x2F;</a>&gt; a federal prosecution of alleged steroid dealers reveals the Canadian company turned over 12 CDs worth of e-mails from three Hushmail accounts, following a court order obtained through a mutual assistance treaty between the U.S. and Canada.

Hushmail is a similar service. There&#x27;s been some speculation that authorities could compel the owners to perform a sort of internal phishing scam to get the passwords.

no, they don&#x27;t open the mail, but they scan all the addresses as part of their routing process. We should assume that all postal &quot;metadata&quot; is stored forever.

There is a lot to be said for Snail Mail in that regard.  There are far more privacy guarantees (i.e. clearly defined requirements for warrants, and stricter terms) relative to electronic forms of communications.

They take a photo of the front and back of every piece of mail that is sent. Your content is safe, but they still get the metadata.

It seems like the most secure way to send a message these days might be snail mail.  While I know the feds to open it from time to time in specific cases, they definitely don&#x27;t open all.

The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company&#x27;s systems.Would you expand on this? Are you saying that a court was meddling directly with an individual company&#x27;s hierarchy?

ziplip shut down in 2005 citing an inability to maintain user privacy in light of new legislation. Their servers were in Ireland, I think.

Yup, nothing new, even in Europe (Finland).
<a href="http://en.wikipedia.org/wiki/Penet_remailer" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Penet_remailer</a>

Could you name some examples from Europe? Cases when police physically takes servers are common. But I never heard of case where police would require encryption keys for &#x27;maybe we will needed it&#x27;.

&gt; P.S. Right or wrong is a separate conversation...No it&#x27;s not. This is wrong, plain and simple. Wrong is wrong, and black is black.

I think the worst they can realistically do is 1) threaten contempt if you can comply but don&#x27;t and 2) threaten to disrupt your business operations by seizing servers. There are gag orders on certain legal requests, but you don&#x27;t have to talk about it to not comply (if you can&#x27;t comply).As long as you can&#x27;t comply, I don&#x27;t think there&#x27;s an uncounterable risk in the US, since we don&#x27;t have any key disclosure requirements (the exception being CALEA, which only applies to the PSTN; I&#x27;d skip CALEA for an interconnected VOIP system and fight them in the courts&#x2F;media, personally). Presumably they could put other weird pressure on you like threatening to investigate your nanny&#x27;s immigration status or whatever, but enh.I still maintain that if you do things properly, you can operate safely in the US while resisting pressure from USG. You can&#x27;t literally wipe your ass with an NSL in front of the agents, but if you don&#x27;t have it, and can&#x27;t get it, they&#x27;re at worst a DoS. Forcing a provider to implement a huge new logging infrastructure would be an interesting 14A issue, and one could have a system where even that wouldn&#x27;t recover customer keys.IANAL of course.

Edit: I was a PM on Exchange and Exchange Hosted Encryption for some time, so it looks like Lavabit tried to fight the government on whether they are required to release private keys. I&#x27;ve seen one other customer try to fight, and it was not pretty either. The US government in these cases are serious.Takeaway for fellow hackers: If you are building a system that stores user-generated data, prepare for the eventuality that someone other than the user will demand to see it.In general, the prevailing theory is that all companies are required to release private keys or passwords needed to unlock evidence. As a consequence of Lavabit fighting, they likely got slapped with some pretty harsh contempt of court rulings, including a demand to record all private keys needed for decryption going forward. The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company&#x27;s systems.What&#x27;s sad is that because Lavabit was such a small service provider, they never had the previous rounds of government threats and must have been caught off guard. As I&#x27;ve said in past posts (before Snowden), it is common knowledge among large-scale service providers that the local government can always come in to take a look. Doesn&#x27;t matter if you are in the US, EU, or China, you have to comply. I&#x27;ve seen the US DOJ threaten pretty harshly a customer who simply asked about &#x27;options&#x27; of how to comply.Past post with explanation: <a href="https://news.ycombinator.com/item?id=5754641" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5754641</a>P.S. Right or wrong is a separate conversation...

Apparently a business where some guy is moving paper mail icognito from one point to the ther could be a possible business. I guess lawyers may want this, especially lawyers working to defend issues related to abuse of privacy breach or executive actions. 
Of course it will be hard to advertise such business.If you&#x27;ll be trying to keep this secrect by creating small cells of people not knowing each other and smart mailboxes preventing people exchanging t identify each other, you&#x27;ll become suspect of supporting spying activity.So you better work for the minimal number of clients and charge a lot to remain sustainble.My understanding is that as long as keep the info concentrated in one spot (i.e. Paper mail) it is easy to grab it. If you dilute and spread the info using shared secret and hide it smartly in images or random text, this info would be much harder to catch but could use conventionnal transport means.Extending this idea further, turn the mail network into one big world wide hologram. The information would then be spreaded, available from everywhere, very hard to censor, and private since you need some specific reference signal to extract the info. It&#x27;s like shared secret.Note however that the need to catch evil people using such communication system for evil means is needed. Just considering our own privacy regardless of what can go wrong with such system is in my opinion selfish. We will always need method to protect against abuses.

The data may have been protected, but the senders and recipients probably were not. Similarly to SSL, it encrypts the traffic, but does not hide which websites you use.I bet that data are still valuable to the government.I have been thinking of starting a business in the privacy space. This has shown me that that all customer data needs to be periodically obliterated in safe way and that a kill switch or nuke button is needed as well to destroy everything on a moment&#x27;s notice.Where and how to host is a major concern. Cloud, etc., is obviously out of the question.

So guarantee you will be regarded as a &quot;terrorist&quot; and then put yourself somewhere in the middle of international waters?At least when the ship disappeared off the face of the earth it would be easy to figure out what happened.

IANAAL, but I&#x27;m guessing the U.S. would just pressure your flag state to revoke your license.  Then they&#x27;ll arrest you for piracy or something.  Or even better issue a letter of marque and reprisal so private citizens can hunt you down and take your stuff.

People have thought about this, and Sealand actually hosted a very secure datacenter.The problem is that you have to connect up to the Internet somewhere, and they can always get you there. Either tapping and listening in on sessions, or just plain disconnecting you.

So... there would be market for a secure email service that ran on a ship&#x2F;vessel that was permanently in the middle of international waters?(might have to have multiple vessel&#x27;s for redundancy purposes)

It&#x27;s just how encryption works; you don&#x27;t store the plain passwords or keys the users submit to decrypt their stuff, thus you have no way to access it.

Lavabit&#x27;s explanation of their security, via the Wayback Machine: <a href="http://web.archive.org/web/20130530023856/http://lavabit.com/secure.html" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20130530023856&#x2F;http:&#x2F;&#x2F;lavabit.com...</a>

It all happens on the client side. Servers only store the encrypted emails and have no idea what the contents or the keys are.

&quot;encrypt emails in such a way that they literally did not have access to the content stored on their own servers&quot;how is that possible? I&#x27;m curious to know as to how they achieved that technically. I mean if the user is reading an email in their browser, then it would&#x27;ve had to have been created on the server first.

it sounds like they were asked to modify their system to retain data

For the unfamiliar: Lavabit was a webmail service, that (claimed to) encrypt emails in such a way that they literally did not have access to the content stored on their own servers. The linked email would lend some credence to those claims. It was originally designed in contrast to gmail scanning your email for targeted advertising, but my imperfect memory says that their system should also have been resilient to &quot;we have a warrant, hand over the data.&quot;

If I could afford it I would donate, big time, to them.

I know I&#x27;ve said this before in one of the other threads, but I believe donating to their Legal Defense Fund is a sensible thing to do if you care about your rights. Link: <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_b.." rel="nofollow">https:&#x2F;&#x2F;www.paypal.com&#x2F;cgi-bin&#x2F;webscr?cmd=_s-xclick&amp;hosted_b...</a>.

It&#x27;s only the people with the least amount of power, the least pull with authorities, who get droned.

Iterated prisoner&#x27;s dilemma isn&#x27;t exactly a &#x27;perverse&#x27; way of looking at war. Taking the high road helps you more than it hurts you. And remember that a country taken with minimal casualties is going to be much less rebellious.Killing is not the goal of war.

Old European elites shared a common culture that went beyond borders, at times perversely so (e.g. the whole Geneva Convention mindset where war is all a big game in need of more gentlemanly rules). They respected each other more than they did their fellow countrymen from lower classes. It&#x27;s the same today: you&#x27;d never see a Saudi billionaire droned, even if we knew he&#x27;d been &quot;the real Osama&quot; all along.Snowden is a little fish and as such he&#x27;s being treated, as an example to his uppity peers. His friends are little fish, and as such are being burnt down without a second thought.

I watched Casablanca the other night.SPOILERSI thought about how the Gestapo had Lazlow in their midst, at the same TABLE as them, and yet didn&#x27;t do anything immediately other than deny him further travel. Of course, it&#x27;s a movie, but it was an interesting thought. Nowadays, if Snowden were known to be hiding in a foreigner&#x27;s Moroccan cafe, we&#x27;ds drone half the building.Also, I noticed the pride and the wonder that America inspired in the workers and patrons of Rick&#x27;s. It was a symbol of freedom and opportunity. I wonder how many people see it that way now.

I just signed up three days ago, and was exchanging mail with one of their reps about opening a couple more accounts with them. I went to log in last night and noticed that the service was down, which I thought was a little odd (since everything was down at once). I&#x27;m going to have to read this again later when I get a chance but for now, wow. I respect their decision but I&#x27;ll bet the timing sure was bad for a lot of people (especially those coming to Lavabit specifically to escape what&#x27;s going on here).

The difference is that the authorities in Germany don&#x27;t have the legal framework to force someone to do this and threaten them to stay silent.

If you&#x27;re German, would you prefer to be surveilled by the German government or by both the US and German governments?If you&#x27;re in the US it seems kinda pointless to try to move to overseas hosting; the NSA will probably just focus on the client side.

Encrypting is a given - obviously you&#x27;d want to only be using Saas services in Germany etc that are fully encrypted. The problem in using USA services is that even if everything is fully encrypted, the USA can and will send goons around to take your data. Encryption is simply useless when dealing with a company in the USA who is forced to hand over the keys and whose data-centers can be legally entered and modified by thugs. Once someone has physical access to the server, the game is over.Germany is a better bet. While they are no doubt tapping lines, Germany and the EU have made no moves to actually perform hostile interventions into data-centers or private servers. This means that encryption is still a very viable security measure for protecting your data in the EU. The EU simply has a far better track record with privacy related issues.It&#x27;s not about perfect security, it&#x27;s about getting the best security you can hope for - and that means moving away from anything USA hosted.

Line tapping is pretty much a given. Looks like the BND has the possibility to do so. But this is still not officially confirmed. However a german blogger (fefe) had some examples for overly detailled dementi from german companies. E.g. no foreign intelligence service can read your traffic...But in regards to cryptography and chances for legally fighting against such orders it could be better. At least on paper. The most likely outcome if lavabit would be hosted in germany would be a police raid that would take all servers for investigation with them. This happenend e.g. for poeple running Tor exit nodes.

I&#x27;d love to believe that the authorities in Germany are not also tapping lines like France or the UK. Do we have any proof that is the case? I agree this has made me think twice about hosting in the us, but also about crossing national boundaries full stop without encrypting traffic.

This part doesn&#x27;t matter. Where your cert comes from is irrelevant.

from what I know you never give your private key away, they just sign your public one. so that would be irrelevant.

There&#x27;s StartCom (StartSSL) from Israel. Have you tried them? They even offer free SSL certs, by the way.

&gt; I&#x27;m in the process of moving any Saas offerings I use off USA-affiliated companies, but it&#x27;s actually more difficult than I first thought.You should try finding a SSL cert retailer that&#x27;s outside of the US. The only ones I could find that would actually sell me certs without a phone call charged at least $200 for a basic certificate. <a href="https://swisssign.com/en" rel="nofollow">https:&#x2F;&#x2F;swisssign.com&#x2F;en</a> were the most sensible looking ones I could find.

It is just as bad or worse. You have to move the data in&#x2F;out of the country. It definitely isn&#x27;t protected when it leaves the country. The only advantage I see is that it punishes US businesses for failing to protest.

The goal is not necessarily security (I have nothing to hide (I still do hide as much as possible))-- the goal is political change. That&#x27;s the only real way out of this mess. By not using US companies, you incentivize those to lobby for better laws.

There&#x27;s not even the time factor. Western countries at least might theoretically not spy on their own citizens but the exchange data with partners intelligence services. And the US is by far not the only country that mandates surveillance cooperation for providers etc.Encryption is OK but doesn&#x27;t solve the problem. There&#x27;s always metadata and whom can your trust with your encryption? You have to assume that hardware and software you use has backdoors. Mobile phones for example has even official backdoors, your SIM card can be remotely changed and so on …

It would be really unfortunate if people started getting polarized into encryption &#x2F; social &#x2F; legal camps. All these things are necessary.

Customers and law may demand that the data is stored in the EU. For businesses with demands hosting in the US is simply not an option.This was a concern earlier but my guess is that this will only increase in the near future.

I had the impression that government does not need to decrypt anything. They just request it from a company, and the company has to comply.

I will take mine government over yours. I can atleast try to deal with mine.

Not quite. Storing ciphertext and keys in legal jurisdictions (like the US) that can be forced to turn over both is a bad idea.Also, practical key management is still an unsolved problem. The web of trust never took off and the PKI is fucked. Encryption is only as useful as the keys being used to encrypt.

No, do both.Focus on encryption, to keep ahead and protect the data.Move out of the US, because it sucks, is far from &#x27;the land of the free&#x27; anymore and needs to learn that its place in the digital world is not at the top, but more around the center. Between lots of other states that fail and fail again, in terms of surveillance..

I saw a frustrating article the other day on a mainstream news site that was saying that the economic damage to the US for the Snoden leaks was in the tens of billions of dollars because of all the non US business that will be leaving US based cloud providers.That&#x27;s infuriating. It&#x27;s the same as having an insecure system and then charging a hacker millions of dollars in restitution to re-architect the system to do it right.Those firms wouldn&#x27;t have to leave the US cloud providers if they had assurances that the US wasn&#x27;t spying on them for no good reason.

Considering what just happened to LavaBit, your advice doesn&#x27;t make any sense.If they were outside of US-and-friends jurisdiction, they wouldn&#x27;t be shut down and there wouldn&#x27;t be a gag order.

Encryption is useless when the government knocks on their door and says give us a backdoor to your system.If enough people leave US based companies for foreign companies it will put pressure on the government. I have a feeling this pressure is already underway.

The problem with encryption in this case when it comes to US companies is that the US can compel US companies to install custom backdoors while pretending they are still secure and not notify their customers that this happened.

Moving services off USA-based companies is like using two bicycle locks instead of one. A determined government is still going to get your data, they just need to spend a bit more time.Focus instead on encryption.

That sounds great. What if there were an email client that included an email server? If families left one desktop on 24&#x2F;7 they could all use it as an email server. An open source email client could also include built in PGP or OTR encryption. Anyone know if it&#x27;s feasible from a deliverability standpoint? Domain registration and DKIM signing may be tricky for the average user. As well as dealing with blacklisting, of course. But if it became prevalent maybe all of these difficulties could be overcome by instituting a new, truly decentralized infrastructure. Key exchange would still be an issue but could be achieved using a mobile app with QR code scanning.

How about a local cloud? I understand that this may seem pointless, as you&#x27;re owning and paying for all the hardware, but it would really help in deployment, scaling and maintenance just like a &quot;classic&quot; cloud service can.

The nails are already in the coffin for US internet behemoths. Any non-NSA cooperating country has strong interests in keeping their search engines, social networks, and cloud software internal to their country.Google, Microsoft, and Facebook basically have had billions of dollars shaved off of their future market capitalization -- though I have not seen anyone say this yet.For everyone abroad who is technically adept and talented, the vaults of wealth have been unlocked for you; just copy the successful offerings of American companies. Don&#x27;t worry about software patents or trademarks unless your country is complicit, you&#x27;ll have the autonomy of a oligarch (said with some sarcasm.)There is one solution here: open source, distributed software. If you want to build a company to promote real security this is your only option.

The safeguards for foreigners are much less than those for US citizens. For example, the NSA doesn&#x27;t need to go through FISA court to spy on non-citizens. So if you store your data on a non-US server, you&#x27;re probably just making it easier for them to get to it, not harder.Not to mention, most countries will pretty much cooperate with the US when it comes to intelligence. The only ones that might not are countries like Russia or China that have their own military-industrial complexes, which are just as eager to get at your data and a lot less scrupulous about using it.

I guess the obvious question to this post is:What are you doing on your own checklist? Those are some pretty extremist notions.If part of your hiring criteria was to exclude anyone who had worked for a contractor or directly for a government organization, I doubt many people would want to work for you. Not because they had violated your criteria, either.

It&#x27;s not just going to be hosting providers that are affected by this. It&#x27;s going to lawyers, software engineers, sys admins, writers and graphic designers who are going to lose work&#x2F;business from SAAS companies. Software is one of the few areas where the US economy is growing somewhat sustainably (as opposed to banking&#x2F;gambling&#x2F;housing speculation&#x2F;medical expenses for elderly). The NSA and all those NSA contractors are taking money out of our hands and destroying our professions. We should be fighting this tooth and nail.- Politically, we should punish anything associated with the NSA.- Socially, we should shun everyone from this date forward who works directly with or as a contractor for anything associated with NSA&#x2F;FBI&#x2F;CIA&#x2F;DEA&#x2F;DIA. We should not hire any programmer who, from this date point forward, has worked in those capacities. They are destroying our profession and businesses.- On the engineering front, we should be designing technologies for evading the NSA et al, and spread those technologies. We need to do everything possible to make them easy to use and make them widespread.- Any person or company who stands up to these organizations should be lionized and we should try to patronize their businesses or employee them. Especially if the suffer consequences like jail and torture.- Facebook, Google, especially Palantir are known collaborators and we should treat them as such

I&#x27;m in the process of moving any Saas offerings I use off USA-affiliated companies, but it&#x27;s actually more difficult than I first thought. I believe there might even be a very profitable market in simply duplicating the functionality of Saas offerings at a higher price with security&#x2F;privacy guarantees in Germany&#x2F;HK&#x2F;etc. Might be the next hot business to be in? You&#x27;d be surprised as to the number of people seeking alternatives at this point.EDIT: Relevant XKCD for people calling for technical solutions to the problem: <a href="http://xkcd.com/538/" rel="nofollow">http:&#x2F;&#x2F;xkcd.com&#x2F;538&#x2F;</a>

I&#x27;m also unsure of their proven effectiveness, but how could they hold you in contempt for _not_ taking an action?

This would imply that the court can order you to lie to your customers. I think this is not the case.If there is any precedence for any US court requiring public citizen to lie I definitely want to know about it.If the courts are acting like they have this power then it will greatly change my perception of how the courts, NSA, and congress are currently acting.

I don&#x27;t think canaries are effective. You can&#x27;t get around a court order just by mental gymnastics, they&#x27;ll hold you in contempt. I&#x27;d be happy to be proven wrong, but I suspect that they&#x27;d simply order you to keep updating the canary.

This presumes that the host has an actual warrant filed against them. I assume that if the feds want data from a service which is ultimately hosted on Amazon they&#x27;ll just go straight to Amazon.

The canary trick is roughly on par with &quot;I was NOT served a letter on July 20, 2013, which did NOT say the following...&quot;To be honest, I&#x27;m even a little nervous that something as innocuous as &quot;I wish I could tell you more about the circumstances leading to the decision&quot; could be seen as communicating the presence of an NSL indirectly, and lead to contempt of court.

Is this relevant?<a href="http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi-gag-orders-violate-first-amendment" rel="nofollow">http:&#x2F;&#x2F;securitywatch.pcmag.com&#x2F;privacy&#x2F;309277-judge-says-fbi...</a>and<a href="http://www.outsidethebeltway.com/judge-orders-google-to-comply-with-secret-fbi-demands-for-user-information/" rel="nofollow">http:&#x2F;&#x2F;www.outsidethebeltway.com&#x2F;judge-orders-google-to-comp...</a>

There&#x27;s an easy canary in this cases.I don&#x27;t know how FBI&#x2F;NSA notifications are received in the US. But you can communicate to your uses any FBI&#x2F;NSA&#x2F;LE notification before reading the content. Of course, the notification should be posted to a medium where you don&#x27;t have further control over, so there&#x27;s no way for you to remove the notification.

Seems like it would make sense for users to demand that any US based service includes a warrant canary, just like rsync.net&#x27;s implementation. A global canary + separate canaries for individual accounts would also make sense.<a href="https://en.wikipedia.org/wiki/Warrant_canary" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Warrant_canary</a><a href="http://rsync.net/resources/notices/canary.txt" rel="nofollow">http:&#x2F;&#x2F;rsync.net&#x2F;resources&#x2F;notices&#x2F;canary.txt</a>

Hello, I didn&#x27;t say stand up to, but for (i.e. on behalf of) . The most he can do is stand up to the government, for his users, in court, deleting servers would not be a wise move, and I wouldn&#x27;t expect it of him, would you? Just standing up and saying no in a climate like this takes some courage, for which I admire him.

&gt; Kudos for standing up for his users,Where did you get this one from? I think its a bit of a stretch to say he is &quot;standing up to his users&quot;. I would rather say he is standing up against the GOV, and that&#x27;s nice for a change, but we have no idea what has happened with all the emails residing on their servers.Knowing just a bit that I know how the us gov operates, I am pretty sure he was given two options at exact the same time: either you accept our black box, OR you will not. If you not, then you are not allowed to delete or alter any messages on your servers. Given the business lavabit was in, I am sure Feds will punish him to the extends of the law (or more) if he decides to &quot;stand up to his users&quot; and delete content of their mailboxes.

So he pretty much does say why he&#x27;s shutting down, the US gov. has demanded access and he said no. Kudos for standing up for his users, and he does raise an interesting point at the end:This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.The worst thing about this situation is that other governments like the UK, France and Germany are equally guilty.For history on lavabit, see the cache, this page is now gone:<a href="http://webcache.googleusercontent.com/search?sclient=tablet-gws&amp;site=&amp;source=hp&amp;q=cache%3Ahttp%3A%2F%2Flavabit.com%2Fhistory.html&amp;oq=cache%3Ahttp%3A%2F%2Flavabit.com%2Fhistory.html&amp;gs_l=tablet-gws.3...1877.7996.0.9385.7.7.0.0.0.0.513.1492.0j1j0j1j1j1.4.0....2...1c.1j2.24.tablet-gws-psy..3.4.1436.lIv1Hdpu5EY&amp;pbx=1" rel="nofollow">http:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?sclient=tablet-...</a>

This is a really great way to get their PayPal account frozen for sure. Abnormally high rates of Visa gift cards will absolutely trip all the fraud alarms.

I don&#x27;t know where you live, but here in the Netherlands even for these disposable credit cards you need to present a valid passport&#x2F;id.

If only there was some way to securely transfer money across the internet, psuedo-anonymously, without involving PayPal or banks. Almost like transferring coins via bits?Maybe someday someone will invent such a system. We can dream.Can you imagine how strange it would be if such a system already existed, and we failed to use it? But that could never happen.

How long until PayPal suspends their legal defense fund?On a serious note, if you want to donate to their defense fund, consider doing so anonymously. Pay cash for an Amex or Visa gift card, and use that to make your donation.

Yes, there is a strong parallel between pre-Nazi Germany and current USA. Of course, Americans will not literally follow Nazi ideology.What we see in America is an increasing merger between industry and government. Finance is the most regulated sector; hence &quot;too big to fail&quot; and all the exploits pulled by big banks. Telecom is almost completely government controlled (through the graning of regulatory monopolies). The government spies on everyone all the time now. This is the fulfillment of Progressivism: regular people are ignorant, but we can fix all social ills through government control. It is also, literally, the fascist model. I sound like an immature teenager for saying that, but I mean it in the full, intellectual sense.tl;dr the American Progressive movement occurred in parallel, but to a must greater extent, in Weimar Germany. American Neo-conservativism is Progressivism in a right-wing flavor. The modern USA is Weimar Germany all over again.As the USA&#x27;s societal ills continue to accelerate (because we&#x27;re taking anti-corrective action instead of corrective action at every step), the USA will increasingly resemble a command-and-control system like Nazi Germany.

I wonder if there is some historical regularity here. After all, my own country, &quot;Das Land der Dichter und Denker&quot; turned on its &quot;Dichter und Denker&quot; when it was at (or close to) the apex of intellectual achievement.

Takeaway:&gt; &quot;This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.&quot;It&#x27;s kind of fitting. The nation that spawned the internet is the nation that&#x27;s killing the internet biz on its own turf.

This is sort of what Sealand data haven was supposed to be.

Don&#x27;t forget a physical shell to keep the U.S. marines at bay.

Sounds like any country willing to guarantee a snoop free environment could have a lot of servers hosted there. I&#x27;m thinking the Caymen islands of data. Set up a shell company and a shell server in the Caymens to protect your money and your customers.

Iceland is a NATO country, and fairly friendly with USA.

Anything that I really care about will be. And if this is just bulk data, there&#x27;s tar -czf | gpg -e | ssh

But you have to get the data there. It most certainly isn&#x27;t protected in transit.

Eastern Europe&#x2F;Russia&#x2F;HK with a .su or .ch domain. Of course encrypt it.The alphabet gangs are really getting out of hand.

China, Russia, or North Korea, pretty sure. You have your pick of which governmental spy agency gets to snoop through your data!

<a href="http://cdn2.sbnation.com/entry_photo_images/3526356/sealand-x-4f68e86-intro-thumb-640xauto-31832_large_verge_medium_landscape.jpg" rel="nofollow">http:&#x2F;&#x2F;cdn2.sbnation.com&#x2F;entry_photo_images&#x2F;3526356&#x2F;sealand-...</a>

Nano-satellites with encrypted email servers? <a href="http://www.wired.co.uk/news/archive/2013-07/04/satellite-plasma-thruster" rel="nofollow">http:&#x2F;&#x2F;www.wired.co.uk&#x2F;news&#x2F;archive&#x2F;2013-07&#x2F;04&#x2F;satellite-pla...</a>

Are there any countries, anywhere, where a person can store data outside the reach of the US government&#x27;s illegal overreach?Any countries friendly to the US are right out. They can tap the lines, but there are ways around that.I just want to be able to park data where some twit with a piece of paper that says &quot;NSA&quot; on it can&#x27;t get it retrieved or deleted. Any suggestions?

Well, that&#x27;s it. I am now going to move everything onto my own infrastructure. I signed up for lavabit a while back, and I like them as a secondary email service; and now they just shut down!

&gt;the famous adage of shouting &quot;fire!&quot; in a crowded theater<a href="http://www.theatlantic.com/national/archive/2012/11/its-time-to-stop-using-the-fire-in-a-crowded-theater-quote/264449/" rel="nofollow">http:&#x2F;&#x2F;www.theatlantic.com&#x2F;national&#x2F;archive&#x2F;2012&#x2F;11&#x2F;its-time...</a>&gt; In 1969, the Supreme Court&#x27;s decision in Brandenburg v. Ohio effectively overturned Schenck and any authority the case still carried. There, the Court held that inflammatory speech--and even speech advocating violence by members of the Ku Klux Klan--is protected under the First Amendment, unless the speech &quot;is directed to inciting or producing imminent lawless action and is likely to incite or produce such action&quot; (emphasis mine).

Congress can legally pass laws abridging freedom of speech, and has always been able to do so. For example, if someone were to talk up and threaten my life, that is not legally protected speech. Nor is blackmail, for that matter, nor the famous adage of shouting &quot;fire!&quot; in a crowded theater.For that matter, Congress can legally restrict speech in certain national security issues, and has, again, done so for a very long time. The Supreme Court has (in my opinion, correctly) understood that restricting people handling classified documentation from repeating that information is, without extraordinary circumstances (more on that in a second), completely legal, for example.The trick here is the sheer breadth of the NSLs. I completely agree that they&#x27;re unconstitutional, and I sincerely hope they are struck down in court. But I hope that I&#x27;ve just highlighted why this isn&#x27;t a slam-dunk situation for those on the receiving end of an NSL. Add in that, at least so far, any disputes with NSLs have to be taken up with the FISA court, and even wins against NSLs don&#x27;t actually count as binding precedent, because FISA itself does not create binding precedent.Congress can, in certain circumstances, make laws restricting freedom of speech. This isn&#x27;t one of those instances. But suing our way to that conclusion will take time, money, and personal risk for the petitioner.

If Congress has passed laws abridging the freedom of speech, then those laws are illegitimate. Unfortunately, it feels as if speaking favorably of the Constitution is enough to get put on a watch list anymore.

They should open source the whole thing. We can bring it to Germany. I believe we are legally allowed to tell the NSA to GFYS.Any people who have businesses in the US need to take a serious look at the risk now posed by their own government on the success of their business.One rogue customer and business could go down the toilet, or you&#x27;ll be forced to bend your morals to suit a rogue secret fiefdom.

god, no. that weasel ran bbs systems for the whole purpose of ratting out warez users to the authorities, making money through it as he coorporated with a lawyer. he actively spied on the users. <a href="https://de.wikipedia.org/wiki/Kim_Schmitz#Werdegang" rel="nofollow">https:&#x2F;&#x2F;de.wikipedia.org&#x2F;wiki&#x2F;Kim_Schmitz#Werdegang</a>never ever trust that piece of ....

In the last few months he&#x27;s been very verbal about being pro-privacy and anti-NSA on his twitter feed [1].[1] <a href="https://twitter.com/kimdotcom" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;kimdotcom</a>

Is MEGA (<a href="https://mega.co.nz/" rel="nofollow">https:&#x2F;&#x2F;mega.co.nz&#x2F;</a>) an acceptable company? What&#x27;s the HN consensus on this? Kim Dotcom does appear a bit sketchy.

At the rate things are going, smoke signals encrypted with a one-time pad.

I&#x27;d recommend <a href="https://MyKolab.com" rel="nofollow">https:&#x2F;&#x2F;MyKolab.com</a> It is 100% Open Source and hosted in Switzerland where the world&#x27;s strongest privacy laws exist.

&gt; Let&#x27;s start with Dropbox. What&#x27;s the alternative?Seafile maybe?

afraid.org looks nice - thanks for sharing :)

I&#x27;d suggest Owncloud for that, on a server running in your own home. Encrypted file system (LUKS), the works.Pretty much identical to Dropbox and just as stable, IMHO.Pricewise? You can buy an HP Microserver for about $300 that&#x27;s capable of 12TB of storage on the top end (more if you get fancy with external arrays), whack it into a APC UPS for another $50, and just run it off your home internet connection. Hang a free domain hame at afraid.org off of it, and run a script on the box to keep the hostname pointed at your dynamic IP if your ISP won&#x27;t give you a static one on reasonable terms.

See PRISM Break: <a href="https://prism-break.org/" rel="nofollow">https:&#x2F;&#x2F;prism-break.org&#x2F;</a>

See <a href="https://prism-break.org/" rel="nofollow">https:&#x2F;&#x2F;prism-break.org&#x2F;</a>

What&#x27;s wrong with rsync or Coda or Intermezzo?

Can we get a list going of non-US alternatives of popular apps most of us use?Let&#x27;s start with Dropbox. What&#x27;s the alternative?

Thanks for the offer, unfortunately I don&#x27;t have any bitcoins so i would first have to buy them. Which I would have to do with money that can be traced back to me...

There should be a bitcoin address for donations.There&#x27;s no reason to trust me, but if you send me bitcoins, I&#x27;ll convert to dollars and send to the fund. You preserve your anonymity. I&#x27;ll convert all donations at the end of each month.173WSQxBiwswTtMBxnnhGTZJtTy2RrdLgn

Because the list of mere sympathizers, while surely long, is not nearly as bad a list to find oneself on as a list of material supporters. Squeal all you want, but if you want to speak with your wallet... Watch out. That is of course assuming that donations are even possible and that the recipient is not the target of an international banking blockade designed specifically to financially starve politically undesirable organizations.

If you&#x27;re so easily intimidated why do you still post comments about the NSA on the internet?

I had the exact same thought. The chilling effects here are tangible - I am avoiding exercising what are ostensibly my freedoms because I fear reprisal by my government.

They need to set up a Bitcoin address.Things like this remind me of the importance of anonymous (or pseudonymous) payment.

I really would want to donate to them. But you know I kind of feel weary now connecting my PayPal Account with them. I hope some kind of organisation is standing up for them. Like EFF or something. Not because I don&#x27;t trust them. But because I don&#x27;t trust the NSA. They might flag me as a terrorist or something. Then again I&#x27;m probably already on this list for having some technical involvment with something the US gov doesn&#x27;t like.I guess it purely a coincedence that Snowden used a lavabit address the last few weeks. I guess there is no relation at all.

Switched to runbox: <a href="https://runbox.com/" rel="nofollow">https:&#x2F;&#x2F;runbox.com&#x2F;</a>

I&#x27;m in the same boat. Anyone know of other services similar to Lavabit?

Assuming you&#x27;re using (and lavabit supported) custom domains, all you&#x27;d need to do is sign up for a dummy email address for now and go to your domain settings and reenter the MX records. But if it was an username@lavabit.com or something like that, then I&#x27;m afraid you&#x27;re out of luck.

I&#x27;ve had a lavabit email as one of my main emails for years (close to when they first started) and this is a major inconvenience. I&#x27;m not sure I&#x27;ll be able to change the email address associated with a lot of my various accounts now that they&#x27;re offline.

The health page is still up:<a href="http://lavabit.com/health.html" rel="nofollow">http:&#x2F;&#x2F;lavabit.com&#x2F;health.html</a>

Does the prepaid five years of service I can&#x27;t use count as a donation? :)P.S. smalltalk, you&#x27;re dead.

One of the benefits of a high-paying software industry job is that I can afford to support causes like this now. I suspect many other HN readers are in a similar position. I encourage everyone to give what they can, as standing up for our rights at the cost of ten years of labor is an incredibly difficult thing, and deserves reward.

Please donate to their defense fund. It&#x27;s not often you get a chance to directly support a cause like this. The link is at the bottom of <a href="http://lavabit.com/" rel="nofollow">http:&#x2F;&#x2F;lavabit.com&#x2F;</a>, but I&#x27;ll repost it here: <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_button_id=7BCR4A5W9PNN4" rel="nofollow">https:&#x2F;&#x2F;www.paypal.com&#x2F;cgi-bin&#x2F;webscr?cmd=_s-xclick&amp;hosted_b...</a>

Seems like a good time to hunt through the wayback machine:<a href="http://web.archive.org/web/20130116102854/http://raganwald.posterous.com/friendly-for-business" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20130116102854&#x2F;http:&#x2F;&#x2F;raganwald.p...</a>

I am speculating because I am genuinely interested.Assuming this event is the result of an NSL, what can the owners do next? An NSL would have to have been served against an organization. If said organization no longer exists, there should be no reason why another organization that performs exactly the same activity as the first could not be formed.If the answer is no, then it&#x27;s as if a coffee shop was destroyed by a hurricane, but now the government says you aren&#x27;t allowed own&#x2F;operate&#x2F;license coffee shops anymore except the hurricane is actually an arm of the government.This event really gives a new meaning to &quot;invisible hand&quot;, except this time, it&#x27;s in the shape of a fist[1].[1] <a href="https://en.wikipedia.org/wiki/Invisible_hand" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Invisible_hand</a>

Not knowing the actual crime, you cannot answer any of those questions.See, this is why &quot;secret laws&quot; are so bad: you cannot legally counteract because you don&#x27;t know what&#x27;s legal anymore.

<a href="https://www.hnsearch.com/search#request/all&amp;q=sneak+obama+foreign" rel="nofollow">https:&#x2F;&#x2F;www.hnsearch.com&#x2F;search#request&#x2F;all&amp;q=sneak+obama+fo...</a><a href="http://news.ycombinator.com/item?id=6090048" rel="nofollow">http:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6090048</a><a href="http://news.ycombinator.com/item?id=5985100" rel="nofollow">http:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5985100</a><a href="http://news.ycombinator.com/item?id=5978036" rel="nofollow">http:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5978036</a>

Some questions given the reasons why they had to shutdown:1. Can Lavabit now set up shop overseas (with a different TLD)?2. If not 1, can Lavabit license their software infrastructure in such a way such that someone overseas can set up shop for them?3. If not 2, can Lavabit open source their software such that someone anywhere else in world can start their own Lavabit?The point that I am trying to get across is that if Lavabit has been forced to shutdown through no wrongdoing of their own by the US government, a case can be made that certain American government actions are making American companies uncompetitive&#x2F;non-viable in an increasingly competitive global marketplace.TL;DR jobs are leaving the United States.

dear god I hope he open sources his codebase.

You&#x27;re talking about Assange. He&#x27;s currently running for australian senate spot. Read his book, spread the word.

Political &amp; social realities are reactions to physical realities. Physical reality is changed by technology.This kind of dragnet communication surveillance was literally impossible in the 1960s. The social world is still changing in reaction to the existence of the birth control pill. Hell our social reality has already been fundamentally changed on many levels by facebook &amp; smartphones world wide. It&#x27;s a balance of both.

You know, all these counter measures we come up with are just &#x27;patches&#x27; to a set of bugs in our society. We need to rewrite the damn thing. This will just become a cat and mouse game against our own gov&#x27;t and indirect defensive movements are meaningless without some sort of offensive to change policy. This is becoming a full blown arms race over people&#x27;s private information. The funding, the computational power, the human capital used to create these things... if the gov&#x27;t can&#x27;t or won&#x27;t listen to the people&#x27;s will and the situation is bad enough, then something will rise to replace the broken system. Someone&#x27;s got to spearhead a defense of the individual.

This is not an orderly shutdown, this is basically a civil disobedience act. As such, the more people are pissed off, the better (as long as their rage is channeled to the real culprits, i.e. the feds).

Interesting thread, thanks for sharing.  Huge difference between page 5 (when people still believe it&#x27;s just a badly-handled storage system problem) and afterwards (when the true story is revealed).

Interesting thread from Email Discussions:<a href="http://www.emaildiscussions.com/showthread.php?t=66968" rel="nofollow">http:&#x2F;&#x2F;www.emaildiscussions.com&#x2F;showthread.php?t=66968</a>If you&#x27;re a SAAS provider, be aware if you need to shutdown that many users are not prepared for this. Several posters in the linked thread rely on a recover password feature sent to e-mail for access to other accounts. Not a prudent practice but this is common for many.

Shutting down of Lavabit makes us more safe from suicide bombers!

If the mere capability of surveillance is what upsets you, then I&#x27;d recommend yoga and encryption. Investigatory powers have been used in pretty much all nations for hundreds of years and so if your big plan is to remove the very ability for governments to do that, you&#x27;re going to be in for a long and arduous slog.If instead your concern is with unchecked and expansive untargeted surveillance, we need to push hard for transparency and oversight, which is something that is politically viable and gets 99.9% of the benefit to the average person of surveillance not being possible at all.

I wonder if, more than crypto, false positives would make them work harder. They know who you are emailing too, and so likely are not going to target you in any case, since you are not part of an interesting network.But if you start talking about a movie, where they plan to detonate a dirty bomb in Times Square or something...Emacs automates this with M-x spook:morse War on Terrorism encryption Forte Blowpipe LLNL John Kerry Albright Kh-11 22nd SAS ANC Semtex SEAL Team 6 smuggle CIAAlso, everyone here from the US has placed a phone call to their representatives to politely, succinctly, and clearly state their opposition to this stuff, right? Ultimately, a political solution is best. False positives make them waste their time, and there are a lot of them who probably really do care about catching genuinely bad people who want to do bad stuff. Just that they need less secrecy, more focus, and much more oversight.

This is a brilliant suggestion actually. If I ever make a crypto messaging system I&#x27;ll surely bake in a module that sends bogus messages to random nodes in the system. Then any sorts of metadata are useless to evil people.

Make the bastards work for it.Enough people using strong encryption (both for data over the wire and data at rest) makes big-data collection (can&#x27;t dedupe random noise) and processing&#x2F;datamining prohibitively expensive if not impossible.Nobody is getting in trouble for moving their data and services offshore.Aside from that? I&#x27;d suggest finding a few friendly people in various countries and establish a constant &#x2F;dev&#x2F;urandom | ssh | &gt; &#x2F;dev&#x2F;null stream when your internet connection is idle.

My family and I have started this process already and expect to be in Central America within the year.

Don&#x27;t be delusional. Unless you have business intentions, that rely on government not knowing what your business is, it is NOT, by any stretch of imagination&quot; a reason to leave a country like USA, the more so for a Central American country. This issue is so minor to most people that many don&#x27;t even give it much thought. I am sure you can live with the government watching you and still make some kind of contribution towards solving the problem. Besides NSA spies on the whole world if you use USA services. I live in a God&#x27;s forgotten land of country you probably haven&#x27;t even heard, yet I too am spied while using popular services. So my advice would be to avoid using USA based internet services when possible to minimize any potential damage your leaked private information might do to you and, together with thousands of others, help find the solution and make it happen.

That may or may not be the best solution available to you, and one that I&#x27;ve started to consider very, very seriously as well, given that I have a EU passport.However, if you&#x27;re a US citizen, you do have other choices. I think the only real permanent solution is to organize and vote the totalitarian representatives out of US Congress. Vote out every single incumbent and vote for representatives that care about We The People rather than their own re-electability.That&#x27;ll take at least a decade, minimum, possibly much, much longer.

The only nonviolent solution I&#x27;ve found is to move away and stop paying taxes to the US war machine. Don&#x27;t use or support services that pay US taxes, either.It&#x27;s what I did.PS: It is very, very, very difficult, because most of the people you care about will not move with you.

This is why the &quot;first amendment&quot; issue might be the most important part of this - he might want to stand up and say &quot;the Govenment wants to force me to backdoor my system, and I think Congress should change the law so this can&#x27;t happen&quot;, but he&#x27;s not allowed to do so. Restricting this kind of clearly political speech is not right, is not just and is not democratic.

&gt;&gt;The democratic solution is to get people to care about your issue. If the anti-abortionists can do it, so can privacy advocates.Not quite the same thing. Abortion is an inherently sensitive topic that is susceptible to emotion. Saying something as simple as &quot;they are killing helpless babies!&quot; is enough to get a ton of people on the anti-abortion side.What&#x27;s the equivalent of privacy? How do we make the 4th amendment an emotional issue? Because there lies our victory.

The democratic solution is to get people to care about your issue. If the anti-abortionists can do it, so can privacy advocates.Also, we have no idea whether Lavabit&#x27;s operator&#x27;s real situation is (though I certainly fault the government for the ridiculous NSL scheme that prevents him from spilling the beans). Is he objecting to installing a PRISM-style scheme, or to legitimate wiretaps?

This is infuriating, and the worst part is that a clear solution isn&#x27;t in sight.Sure, we can fight this in the courts, and a few secret programs might get shut down, but operations will just continue under a different name. We can encrypt our data, move our services and data offshore, but that just paints a big target on our heads - doesn&#x27;t actually address the fundamental issue. This is supposed to be a democracy, but I don&#x27;t see any democratic way of addressing this.What do we do?

Lavabit abruptly shuts down