Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As a UK-based founder (of a service with more than 10,000 users, which I guess could be targeted): what real steps could I take to make it technically impossible to comply with an order like this?

I would sooner leave the UK than sell out on our users and be forced to keep quiet and carry on.



Use your imagination.

The key tool in the box, I think, is to give people orders that you expressly state can't be later revoked. You can use this to construct something like the human equivalent of an HSM. (An HSM, after all, is something that you give orders that in general can't later be superceded, namely about how to control access to cryptographic keys, thus allowing you to reason strongly about the security it provides.)

These people will need to be outside the UK, and be people you trust doubly: firstly to secure whatever cryptographic materials you escrow with them, and secondly because they can by virtue of that escrow hold your company hostage.

Some possibilities include setting things up so they have to review all source code changes (making it impossible for you to sneak anything by them); and some manner of non-duress verification protocol. One possibility off the top of my head for such a protocol is to declare that a failure to state a certain password in any conversation constitutes a duress indication. Obviously for this to work all such conversations must be secure. The idea is that when you're the subject of a notice and are asking them to backdoor things with the government breathing down your neck (possibly literally), the person on the other end starts acting oddly mutinous, but you appear to be doing everything you can to get them to comply. So long as the government can't prove you've done anything to be unhelpful - can't prove the existence of the non-duress password - it seems like it would be hard to find a case to prosecute you.


It doesn't sound like you can. Once you've created a secure system you can't be forced to open, the government will simply tell you to add a backdoor and not allow you to talk about it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: