I'm Icelandic. This person seems to have done more research than most, but there's a common misconception that Iceland's some sort of Internet freedom haven. It isn't, and I think most of that came from foreign coverage of the IMMI back in 2010-ish[1]. That would have made Internet freedom in Iceland exceptional, but it never passed into law.
Also, you should be careful in paying attention to international reports of "xyz never happens in Iceland". Yeah maybe it doesn't, but 1/3 million people live there, it could just be due to the small sample size, not that it's less likely to happen.
Using Iceland to get away from the Five Eyes? Really? What does this person think Iceland's undersea network cables are connected to? Unless the traffic is local to the country it doesn't make a difference in that regard.
Author here. Thanks for explaining your thoughts as you are Icelandic. Really appreciate that. It's not too easy to do research in a non English speaking country. I'm not a native English speaker, so forgive the typos.
I wrote this article a few months back and since then some things changed. Somebody also enlightened me about the cooperation of Iceland with the US government [1], although no source has been linked. I think governments spying on data is something you can prevent with strong encryption and keeping the data out of the those countries that are known for it a.k.a. Five Eyes. That's what we do with our customers data.
I agree with your statement that "xyz never happens in Iceland" shouldn't be a reason for choosing a country. I'm still very confident it's better not to put our servers in any Five Eyes country.
For the speed I do think Iceland is not optimal. See the pings from this comment [2]. I realized this after moving to Iceland that the speeds where indeed slower than from Digital Ocean in Amsterdam.
I don't think your argument about the connection with cables are relevant. If you send your data encrypted it will not be possible to read the packets, right? Or maybe I don't get your point.
I'm thinking of moving our servers to Germany or The Netherlands. There are a few downsides with that for example the environmental impact. We are looking into other solutions to have no carbon footprint with Simple Analytics [3].
Which I think means watching data move across the lines.
If you'd like to pull your tinfoil hat even tighter: Germany, Netherlands, Iceland are listed above as broader members of signals intelligence sharing partnerships, as well as members of NATO. They have a discussion here of their policies and activities related to Cyber Defense:
If a government wants to take your hard drives it will. Unless there's explicit laws against the seizure of physical media, you're mostly relying on them either not having a sophisticated enough internal intelligence capacity that can do it quietly, or trusting in social reaction to a mostly boring, questionable infringement of property rights.
The parent's point is this. You don't own the undersea cables and Iceland doesn't either. How many companies own these cables that come into Iceland? Are those companies all from Five Eyes countries? What if the undersea cable company says stop sending traffic to this domain or we cut off your access from the data center or ISP provider side? What happens if the Five Eyes place travel/trade restrictions on Iceland unless physical data related to some alleged incident is turned over? The point being that sure no physical access is an improvement but maybe not a panacea. You may have protected data but how does that help you if it can't leave or enter your servers? The internet doesn't have to remain as free and open as it is now.
I suppose that the encryption is relevant no matter where you operate from. Does that protect metadata? I assume that all they can learn is that person X is visiting a site that uses your service, which is pretty unhelpful for spooks. In that case, the main security or privacy concern probably revolves around government data requests and/or data center security
Yeah, if you don't want to be surveilled by "Five Eyes" which includes the United States, United Kingdom and Canada, it's odd that you'd choose an island whose only high-bandwidth connections to the outside world go through those countries.
I do not believe that the five eyes have the ability to break modern encryption. But they probably have influence in Iceland in general. But I doubt they spoof the whole island. That would probably very noticeable.
(This comment to which I'm replying was apparently downvoted, presumably by people who disagree. It's a reasonable comment though I disagree with it, hence my reply)
> I do not believe that the five eyes have the ability to break modern encryption.
Do not be so sure. The Snowden documentation shows that they have many tools, from actual private attacks on the encryption itself to attacks on the endpoints (e.g. undocumented zero-day exploits) that can get data pre-encryption and/or post-encryption. And they don't limit themselves to endpoints in their own countries (that would be foolish for any intelligence agency to do).
Going beyond everyday attacks, one famous war effort gave us programmable electric computers in order to break encryption, and there is no disputing how much value came out of that for the winners of that war. Any country with the means will have been pouring in resources to recreate that advantage ever since.
If private industry is on the cusp of quantum computing, then to me it’s a safe bet that intelligence agencies have had it for years.
However, an advantage like this disappears the moment that evidence of its existence surfaces. It wouldn’t be used except in existential scenarios for that country.
> ... it’s a safe bet that intelligence agencies have had it for years.
I'm not so sure; indeed there are examples of that (consider NSA setting the s-box parameters to make DES more secure) but at the same time there are so many "experiments" under way just I the course of everyday business (that happen to apply to dual use tech) that the military often finds itself a generation or so behind COTS / consumer tech.
> However, an advantage like this disappears the moment that evidence of its existence surfaces. [Thus] It wouldn’t be used except in existential scenarios for that country.
We've become more sophisticated since operation mincemeat (http://www.themanwhoneverwas.com). Such tech can be used for parallel construction: I discover via magic snooping that odyssey7 is planning something I don't like, and is doing it with odyssey6 who has poor security. I snoop on odyssey6 and build my case from that. Or I also learn that odyssey7 smokes pot, so break their car's tail light, have a cop stop them, search car, and magically find evidence used to build the real charge. Or whatever. The real breakthrough is hidden.
I often read comments where people say something along the lines of, “X is considered impossible with current technology but I bet the intelligence agencies have had it for years”.
It seems reasonable that incremental developments might have been made sooner by government than academic researchers or industry. Indeed, there are examples. But leaps like quantum computing?
I’m not ascribing this to you but I’ve noticed that there’s often a crossover between people who, on the one hand, believe government is pretty much incapable while, on the other hand, having some near magic ability to make huge technical leaps.
Wartime is different, as then it’s pretty much all hands on deck.
DoD spending in recent decades has reflected a sense that there's perpetually an r > 0 chance that we'll be in the middle of World War III in twenty years, and that we're willing to spend what it takes to ensure technological advantages for when that happens. Throughout world history, military technology has been a determining factor in when many civilizations stopped existing. The mission of the DoD is to secure the U.S. in perpetuity, so this is their core competency.
Private industries, which can only approach moonshots tepidly out of fiduciary responsibility, are already making good progress on this. My hunch is merely based on the liklihood that the DoD - which spends unfathomable amounts on R&D and does not answer to shareholders - has been going at this longer and much stronger than any private organization.
The aggregate amount spent does not mean the government pays individuals more. I'm pretty sure the NSA can't compete with private industry for salaries. So that would cast some doubt on whether they can utilize the most talented.
Do you have any proof or other verifiable evidence of these claims? Or are you just assuming that those statements are true?
As far as I'm aware, there is no evidence at all that the commonly recommend encryption algorithms have any serious vulnerabilities when used properly. Now, it's easy to say that researchers would be given gag orders if they found the "magic back door", but that's all just speculation and fear-mongering really.
Additionally, it would be in the US's best interest for there to be no backdoor. Any vulnerability in RSA for example could be exploited against them.
of what claims?(i only made one) the great firewall of China is well known to exist as is their activity of logging everything. I said their ability to crack things might surprise you, but did not make any claims. I do not know for sure what they can crack but I do know their capabilities are not publicly known, this is coming from those that work there as well as court filings.
All of this seems quite a distraction for an analytics company.
Just locate your servers where it makes business sense. Secure them against hackers and unauthorised access in general, as you should. Ignore the CIA/NSA.
It's mostly a piece of content marketing. The service he provides is mostly about respecting user's privacy. Reminds me a bit of Duckduckgo's strategy.
In more seriousness, not all is purely making money. Some people prefer to make a difference in some things they have control over even if this doesn't increase profits. I find this a lot better than e.g. getting more money and then donating to charities that try to stop what the company is contributing to.
I haven't searched the topic well to know if it makes a difference or not, but it _seems_ like the authors are trying to improve something for ethical reasons and parent author is saying it is just a distraction and to focus only on making more money. I strongly disagree and encourage simple analytics to keep up their ethics for as long as possible.
Maybe they are trying to reach more people through blogpost and HN post, but moving the servers to another country does not seem like just theatrics at all.
It’s just a bunch of theatrics and virtue signaling. A lot of web users (like the one that didn’t want his requests going to the US) really overestimate their self-importance in the world of national security. NSA/CIA/FBI barely keep up with data regarding actual threats, they aren’t spending time worrying about random people on GitHub. (Referring to the commenter on the EasyList pull request.) Literally no one cares that you watch excessive amounts of fetish porn, visit socialist workers party websites, or have a secret crush on David Hasselhoff or sell a few grams of cocaine on the side. Your browsing history is uninteresting on its own. It might become interesting if you were to also a target of an investigation. But it isn’t like NSA has some red light that starts flashing in their headquarters based on the contents of a web search of some random guy in Bratislava or wherever.
If you are actually a terrorist, smuggler, human trafficker, weapons dealer, you aren’t commenting on pull requests to EasyList.
Most people are boring and, despite what they may think of themselves, aren’t even close to being a surveillance target. It’s also ridiculous theater to think that the country a server is physically in matters one bit.
To be clear, I am not defending NSA, I am just saying that most of us are uninteresting in that regard.
Nobody cares about your fetish porn and cocaine now. If you ever decide to run for president, suddenly a lot of people will care, and by then that info is already in the wrong hands.
You can play the statistics game and say that this will never matter for 99.9% of people, but when multiplied by all people who have info that'd hurt them if it became public (everybody!), it makes for a very powerful tool for oppression.
While I'm not going to disagree Switzerland is an OK option, you have to understand first why ProtonMail choose Switzerland.
One point being "In the US and EU, gag orders can be issued to prevent an individual from knowing they are being investigated or under surveillance. While these type of orders also exist in Switzerland, the prosecutors have an obligation to notify the target of surveillance, and the target has an opportunity to appeal in court. There are no such things as National Security Letters, and all surveillance requests must go through the courts. Furthermore, while Switzerland is party to international assistance treaties, such requests for information must hold up under Swiss law, which has much stricter privacy provisions."
I read this as, it isn't to say a government can't monitor what's going over the pipe for sigint, but if they specifically target a user for surveillance it must be disclosed to them and they have a right to appeal.
Nonetheless, if you're an American connecting to Switzerland for ProtonMail, the US govt will have some sigint, even if it's just your origin -> protonmail destination.
I'd go as far as to argue, as long as all communications are fully encrypted with the best possible encryption available (and no backdoors) it's fairly safe in any country for most general content. If you're extra concerned about privacy and surveillance (like I am), you should host in a country which has strong privacy laws but read up on the privacy laws, most of the time a country has good privacy laws for individuals, companies within the country, not foreigners.
People really have an unhealthy fascination with SIGINT. It's really not the disproportionate threat people think it is, or should be most concerned with.
Tools such as encryption, privacy-focused messaging mediums, VPNs, etc might serve to complicate an investigation by local law-enforcement agencies, but will not be able to defend against a more sophisticated targeted attack. While absolutely best practice, this is analogous to using an armored car to deliver messages from someone living on a park bench to someone living in a cardboard box.
I absolutely agree with the use of these tools, as long as you know their limitations and the threat profile they're targeted against. A messaging medium that does not store chat history will absolutely aid you in the event that your phone/computer is seized by law-enforcement to be forensically examined. However, the biggest problem is the endpoints. Using a zero-day/backdoor to root a device on the end of the messaging chain is orders of magnitude easier than trying to break encryption. Why bother using all that computing power when you can just use a rootkit to read the screen buffer in real-time?
You might be using all the best encryption tools, etc... but if SIGINT is really what you're concerned about then you'd be best off treating your PC/Phone as being the chief vulnerability.
It’s also good marketing to invoke Swiss privacy voodoo as a market differentiator. “Your email securely stored in France,” just doesn’t have the same ring to it.
I'm not saying it's warranted, but I could see there being a lingering perception of "hey, if they were willing to hang onto all that art the Nazis stole for so long they'll probably stay out of my email."
My perception is that the general perception is that the Swiss have a reputation for neutrality, especially in regards to the contents of bank accounts and lock boxes.
Before continuing I want to make it super clear that I'm not endorsing the Nazi's stealing art/gold/whatever. With that said, were Swiss banks handing over assets to the Nazis that had been previously held for Jewish families, or were they only holding assets for the Nazis which the Nazis themselves took from Jewish families? (This question is not intending make one option sound more morally acceptable.) My perception is the latter, but I could be ignorant. If I'm not ignorant (in this domain), I don't see why these events would call into question the ability of the Swiss to securely hold assets.
That is, I think I read long ago that the confidentiality of Swiss bank accounts was compromised during WWII for the benefit of the Nazis. I thought it was common knowledge.
However, I seem to be having difficulty finding a reference with Google at the moment.
ok, so this was a "non-binding" resolution? the wiki page is so misleading for someone not familiar with the vocabulary. I read "adopted by parliament", I jump to conclusions. Maybe the page should be updated to clearly define the current status.
Kind of. Parliament can create laws, and parliament can issue parliamentary resolutions that essentially say "This parliament wants this government to do X".
This was the latter, and all parliamentary resolutions are inherently much weaker than laws because they generally only apply to that particular parliament and that particular government. And we've had many changes of both since 2010.
Also, you should be careful in paying attention to international reports of "xyz never happens in Iceland". Yeah maybe it doesn't, but 1/3 million people live there, it could just be due to the small sample size, not that it's less likely to happen.
Using Iceland to get away from the Five Eyes? Really? What does this person think Iceland's undersea network cables are connected to? Unless the traffic is local to the country it doesn't make a difference in that regard.
1. https://en.wikipedia.org/wiki/Icelandic_Modern_Media_Initiat...