Norwegian backup provider promises NSA-free data storage using Norwegian laws

http://www.jottacloud.com/its-your-stuff-guaranteed/

by jensen2k • 13 years ago

215 114 13 years ago

jottacloud.com

dotsid2• 13 years ago

I'm moving away from Dropbox today. Thanks for this jensen2k.

chanux• 13 years ago

For me though, no linux support :(

e3pi2• 13 years ago

I run linux into Dropbox. It's tedious having to manually select/enter files without the dragging the others get. There's language Dropbox API modules that automate this too.

e3pi2• 13 years ago

If you crypt, Dropbox is fine. People need to use encryption. Every popular computer language has encryption routines, scroll through the source code until you find something accessible, twiddle something to personalize it while keeping it functional, perhaps convince yourself it will remain secure, etc, of course be cautious about that. Or simply, there's double encryption, fold it again. Know big 100 meg, gigabyte file size encryption, becomes vulnerable. Wikipedia is the best general crypto introduction I've see.

negrit• 13 years ago

Any recommendations and best practices to encrypt data ?

dotsid2• 13 years ago

I'm not hiding state secrets or anything! For me it's the principle. I want to move away from hosting things in American servers.

toyg4• 13 years ago

The main selling point of Dropbox is cross-platform support for umpteen platforms, so you'd need to find an encryption tool that will work on all platforms; say bye to iOS...

gyardley• 13 years ago

'Twiddle something'?

Don't mess with publicly-vetted crypto code - you're far more likely to introduce a weakness. Instead, just follow the documentation and use it correctly.

toyg4• 13 years ago

The whole computer security business couldn't have paid billions for the sort of free advertising they got this week...

atirip• 13 years ago

From the article "U.S. law enforcement could use the USA PATRIOT Act on a U.S.-based organisation, like Microsoft, Google, Dropbox or Amazon, for example, to force its local subsidiary companies across the world into handing over user data to U.S. authorities."

Exactly how? By my understanding a company in EU operates under EU law and US parent company is only stock owner. Stock owner can not by my understanding force the company to do anything if the company does not want. Lets assume that US company does not want to force daughter company, how can NSA to make them?

EDIT: I'm fully aware that by harassment or blackmail anything can be done, no question here. What I meant to inquiry, out of curiosity, is, is there a legal way to _force_. I know that parent company can control and fire board etc, but can they be forced to do so. Or more broadly, can some US agency take full control of US company and run it like they please. Can f.e. NSA if they really-really wan't to rise McDonalds burgerflippers salary by twofold? Does Patriot Act or something allow that?

DannyBee2• 13 years ago

Your understanding is false. A sole stockholder (for example, the parent of an independent subsidiary), always has control, even if not by specific direction.

They can, after all, fire the entire board, and elect a new one that will direct the company to do what they want.

Not to mention in most cases, parent companies do in fact, maintain control over subsidiaries (IE they are not independent subsidiaries), and thus can directly control activities.

Kimmono6• 13 years ago

The way company law is set up in Norway, you cant as a board member do anything else than what is best for the company you are board member in. Doing something different would mean you could be held responsible. They could fire the board, but the next board have the same rules to go by.

Filligree• 13 years ago

Privacy laws in Europe are a bit of a mess (there being >1 country involved), and possibly stricter than the companies want to deal with.

So the information they're storing is, at least nominally, stored on computers owned by the american branches.

Drakim• 13 years ago

As long as they have a presence in the US, it's in their best interest to act according to US laws. I don't think saying "while we have many US customers, we are technically positioned in Ireland" is going to cut it.

mtgx• 13 years ago

Lets assume that US company does not want to force daughter company, how can NSA to make them?

How can you still ask that question right now? Have you missed the whole Wikileaks scandal? All it took was one phone call for Amazon to take down their website. They didn't even need a court order or something.

I don't know what the laws are exactly, but in practice, and thanks to post-9/11 culture in law enforcement agencies, they can do whatever they want as long as they wave "national security" in front of them.

peteri• 13 years ago

Microsoft have already admitted this with respect to office 365.

http://www.zdnet.com/blog/igeneration/microsoft-admits-patri...

toyg4• 13 years ago

US parent company is only stock owner

That is rarely the case. In most arrangements, foreign subsidiaries are still under direct control of the main company - do you really think "Google US" doesn't have a say in how "Google Ireland" operates?

There are tons of accountancy rules dealing exclusively with partially-owned-fully-controlled foreign companies, but when it comes to the Patriot Act, as long as there is even a shred of control from an American company, then all data held by the controlled company is subject to US laws, regardless of actual location. This is far from an expansive interpretation of the Act, tbh; it's just one of the many that have been tested in court.

arkitaip• 13 years ago

This might become a major trend in the EU if hosting/storage providers play their cards right. Sure the low prices, performance and flexibility of US providers are very tempting but surrendering your data to US intelligence agencies and god knows who else might no longer be a viable option, especially for government agencies and major corporations that might be targets of industrial espionage.

toyg4• 13 years ago

It is already a trend, but until last week it was the realm of huge companies, bureaucrats, weapon manufacturers and other security-industry types. Now there's potential for going mainstream.

This said, I wouldn't trust a French provider or an Italian provider with anything too sensitive: their police forces have a history of being incredibly heavy-handed when dealing with data. I remember one occasion in mid-00's when the Italian police investigating G8 riots (or something like that) raided a data centre, took home all disks they could find, cloned them all, then went through them with a fine comb, all because one mailing list hosted on one of those servers might have been tangentially related to whatever they were investigating. I'd be surprised if things were much better in other European countries, to be honest, but I guess Norway is one of the best bets (with UK/Ireland being among the worst, of course).

brasetvik2• 13 years ago

"In Norway, privacy stands firm like the mighty mountains of Jotunheimen.".

Let's not flatter ourselves too much: http://no.wikipedia.org/wiki/Datalagringsdirektivet (in Norwegian, http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...), or the less detailed http://en.wikipedia.org/wiki/Data_Retention_Directive

jensen2k• 13 years ago

As mentioned in a comment on the post, The EU Data Retention Directive does not apply to cloud storage providers. Not yet at least.

zokier4• 13 years ago

I don't think DLD/DRD is conflicting with the statements given in the post, as DLD only concerns itself with metadata (and yes, that can be harmful), and the article talks about the actual data. Both are important, but different, topics.

brasetvik2• 13 years ago

I was more objecting the very marketing-y-and-not-very-truthy quote.

That said, digging a bit more into Jottacloud does not make me any more likely to use the service, for anything I would be concerned to store at, say, Dropbox:

Their FAQ is (intentionally?) vague. How do they encrypt stuff?

"all datatraffic between your computer and Jottacloud is encrypted with 256 bits AES high grade encryption, which makes it virtually impossible for unauthorized persons to use the information being sent.".

And then:

"If you log into www.jottacloud.com it’s possible to download, view pictures and share files with friends and colleagues"

Right, so they would have the keys anyway.

e12e4• 13 years ago

Well, after reading Snowden's comments about what is available (everything) - it would seem that DLD goes hand in hand with storing all traffic for a limited time -- you would need help searching that to actually recover something.

qw3• 13 years ago

They provide an English version here: http://www.jottacloud.com/its-your-stuff-guaranteed/

jgrahamc3• 13 years ago

If you want to have data storage that's secure from the NSA then you are going to need to do client side encryption. Moving your data to a company/country that promises not to access it isn't going to cut it.

noarchy• 13 years ago

I have to agree. The user needs control over their encryption.

Taking advantage of Norway's laws is fine, until the day that those laws go sour on you.

switch007• 13 years ago

Don't you need a combination of encryption AND no law forcing you to reveal the key?

at-fates-hands• 13 years ago

The slippery slope in all of this is the application of the law.

Sure, if the government was going after someone like Steve Muller (http://www.wired.com/threatlevel/2008/04/gsm-researcher/) you'd want him to be able to keep his stuff from prying eyes.

What about a Suadi National accused of plotting terror attacks in NYC? Would you want the same laws applied to him? Or would you want to able to force someone like this to de-crypt their files in order to stop an attack?

I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys.

andreaso• 13 years ago

While I mostly agree I also think that having some legal/jurisdictional protection is a good thing. If nothing else for the case where there turn out to be an exploitable weakness in the client side encryption you are using.

s1kx• 13 years ago

Good suggestion, I've been using Amazon Glacier with the CloudBerry backup software which supports client-side AES encryption (http://www.cloudberrylab.com/amazon-glacier-backup-software....) and couldn't ask for more. Of course you will have to trust CloudBerry not to put a backdoor in their Software, but it seems there are no OSS alternatives right now that work as easily.

jgrahamc3• 13 years ago

tarsnap

richdougherty• 13 years ago

Duplicity (http://duplicity.nongnu.org/) and its nice frontend Déjà Dup (https://launchpad.net/deja-dup). Client-side encryption, multiple backends.

qw3• 13 years ago

According to the FAQ they are encrypted client side

http://www.jottacloud.com/faq/

"Yes, all datatraffic between your computer and Jottacloud is encrypted with 256 bits AES high grade encryption, which makes it virtually impossible for unauthorized persons to use the information being sent."

xmcri• 13 years ago

I believe this refers to HTTPS.

meritt• 13 years ago

That is just referring to SSL.

gizzlon• 13 years ago

If you want to have data storage that's secure from the NSA then you are going to need to do client side encryption

Better not use an encryption with ties to the US government then ;)

downandout2• 13 years ago

Encryption won't help you, since a judge will simply throw you in jail for contempt until you cough up the key or give them a copy of the decrypted data. Honestly, in this hostile government environment, if you have something worth protecting you need to have a "dead man switch" on your data. Unless you take an action every few days (which you can't if in jail) then your data gets deleted.

pronoiac• 13 years ago

I may be misreading this, but I think there's a big difference between "being readily accessible to the NSA" and "taking a judge to make it available."

sreitshamer• 13 years ago

Yes. If you want your data to be secure, secure it yourself.

chris_mahan• 13 years ago

Which goes back to the old saying: If you want something done right, do it yourself.

rsync• 13 years ago

Agreed.

A provider can give you all the assurances in the world, but the real assurance is using your own encryption with your own best practice and controlling the data store as it exists on the providers filesystem.

This is why it's important to give users a raw, open filesystem that they can manipulate any way they see fit, and not a fancy, highly abstracted backing store with a pretty GUI on the front.

Without a substantive commitment to open standards and open platforms, this is just a PR move.

contingencies• 13 years ago

NSA.no!

honzzz• 13 years ago

This is nice. But I think that the long term solution needs to be based on something that does not depend on the ability of your host to protect your data. The US is strong enough to pressure (almost?) any country to jump through hoops for them (we have seen leaks about their pressure on Sweden [1] or Spain) so just being out of their jurisdiction is not enough.

1. http://falkvinge.net/2013/01/06/banana-republic-justice-behi...

pydanny• 13 years ago

I agree 100%. Your country or company isn't going to make a difference when the people maintaining it are threatened or bribed by a force that can and does leverage power outside their jurisdiction. Honestly, the problem has to be addressed at the source, not with bandaids applied by the hopeful or naive.

CRidge• 13 years ago

"Vi vil ikke overlevere brukerdata til myndighetene om vi ikke mottar en kjennelse fra norsk rettsvesen"

meaning

"We will not hand over user data to the government if we do not receive a ruling from the Norwegian judicial system"

which is pretty much the same thing as the Patriot Act in the US...

But as far as PRISM goes - that's a whole other matter!

zokier4• 13 years ago

Well for better or worse you can not really escape that. Best to my knowledge most (western) countries have the concept court orders/warrants or equivalents.

zokier4• 13 years ago

I thought that the NSA surveillance was at least partially illegal. Laws (Norwegian or US) don't stop TLAs doing what they want.

Also in a related note I find the following fairly unconvincing:

"We will not hand over user data to authorities unless a warrant issued by the Norwegian court of law is presented"

Warrants are in my view more about providing a paper trail than actually preventing abuse.

Ultimately I think the only protection against surveillance is well-employed cryptography. Especially if the law offers some protection for encryption keys and/or passwords.

simplexion• 13 years ago

Spideroak...

znowi• 13 years ago

The US has a great deal of influence in the west, especially NATO members. They will readily comply to avoid complications. No country wants to find itself on the US "terrorist" list.

pinaceae• 13 years ago

erm, isn't this assbackwards?

intelligence agencies, aka spies, exist to spy. that's their entire purpose. now there are some laws to protect their own citizens, at least in the US.

once it's a foreign entity, it's fair game. zero fucks about legality given - see any info ever about clandestine services. so if you store your data in a non-US entity, you're more likely to be monitored.

do you think STUXNET was LEGAL?

the NSA, CIA, MI6, BND, KGB, Mossad all ignore the laws of the countries they are acting in. or what do you think a spy is?

vidarh3• 13 years ago

As a Norwegian, let me just say:

Yeah, right.

1. The Norwegian security services have a long history of violating Norwegian law (and when, for example, extensive illegal politically motivated surveillance of mostly left wing politicians was uncovered in the 90's they then had the gall to place an MP and member of the committee investigating them under surveillance while he was working on the report about their illegal surveillance), and have always been extremely cosy with the US.

2. Most bandwidth to Norway goes via Sweden. Sweden is not a safe country to pass data through if you want to avoid surveillance. See the FRA law: http://en.wikipedia.org/wiki/FRA_law ; unless they guarantee that they get their bandwidth via alternative means, this is a risk. Sure, you can encrypt the data, but if you trust that this is sufficient, then hosting your backups in the US should not a problem either. If you think Sweden's neutrality means a shit in this case, consider that Sweden has admitted to having been complicit with renditions of political asylum seekers to the CIA in direct violation of Swedish laws, so clearly they do not worry about cooperating with US intelligence agencies. To hand your data over to the NSA would not even require them to break any laws, and they've already demonstrated they don't have the moral backbone to stand up to far worse requests.

3. Norway is subject to the EU data retention regulations, and otherwise likes to bend over backwards to comply with EU directives despite not being an EU member (we're a member of the EEA, which means we get all the directives, but don't have a say - how anyone thought that was a better alternative is beyond me). In fact, Norway is "best in class" when it comes to implement EU directives - ahead of most EU countries... This doesn't impact this to a great extent, except it means all your communications with this company will be subject to retention laws, and if you consider it important enough to avoid the reach of the NSA for your hopefully encrypted backup data, this is worth keeping in mind too.

In other words: If you encrypt your communications and backup files well enough that you believe it is safe from the NSA in Norway, they'll likely be just as safe from the NSA in the US.

Kimmono6• 13 years ago

Well, what you say is not correct. First of all the Data Retention Directive have to be valid for you. I work for the Norwegian email provider Runbox and the EU Data Retention Directive is not applicable for us. It is only valid for carriers that own their own infrastructure down to the data center, called "communication providers". We even have it confirmed by both Kripos (FBI-ish) and Post- og Teletilsynet (Norwegian Post and Telecommunication Authority). We have tried to explain a bit why here: http://www.runbox.com/why-runbox/email-privacy-offshore-emai...

vidarh3• 13 years ago

And you don't believe your data passes through a "communications provider"?

By the argumentation on your page, almost none of the electronic data targeted by the data retention directive would in fact be retained if the directive is not also applied to data that merely transit a providers network, given that the vast majority of e-mail addresses in use today are not hosted by "communications providers". If that is indeed an actual loophole, it will be closed quickly if/when everyone realizes that they're not getting the data they expect.

This is in any case a minor point, as in terms of dealing with backup data, it's the two first points of my message that are by far the most serious. And I don't think they're that serious, in that I don't really believe there are any suitable alternatives that are safe enough that you can prevent surveillance based on location, so you'll depend on the crypto, and the combination of the two makes the location of the data rather moot.

e12e4• 13 years ago

This sounds strange, as far as I understand it:

http://www.lovdata.no/ltavd1/filer/sf-20130514-0484.html#1-2 http://www.lovdata.no/ltavd1/filer/sf-20130514-0484.html#2-6

together states that if you provide email services, you are required to store metadata (which is what the Data Retention Directive is all about).

On a side note, if the secret services cooperate to do massive ingress/egress storage of data on the network level (say for 6 months) -- having easily passable meta-data would help turn that massive data dump into useful information (assuming index and organization around ip/date or something similar).

As for being safe from NSA outside of the US (even with an ally) -- that makes no sense. While it is against Norwegian law to hack into Norwegian businesses - the NSA isn't subject to Norwegian laws, their subject to US law. The secret services are explicitly set up to preform illegal actions in foreign territories (which is why the NSA story is about spying on Americans, rather than on spying in general).

ra• 13 years ago

Is there a jurisdiction on the planet where data is safe from domestic wiretapping [1] (i.e. international espionage not withstanding)?

Serious question.

1. Clarification: I mean warrantless wiretapping.

wslh• 13 years ago

It seems like we need an independent project Loon but with servers attached to the balloons!

brown9-2• 13 years ago

It seems like it would be hard to find a jurisdiction where data is immune to the government breaking their own laws.

snowwrestler• 13 years ago

No. Job #1 for a national government is national security, and governments inherently have the power to intrude upon privately operated companies.

I think that in the long run, the U.S. is still a good place to keep data.

U.S. citizens have an instinctual distrust of government that Europeans often mock, but in this case I think is an advantage.

In addition the U.S. has some of the strongest protections for freedom of expression in the world, which means that everyone can learn and argue openly about intel programs and other sub-topic of freedom vs. security.

gasull2• 13 years ago

Not a jurisdiction, but your data is pretty safe from warrantless wiretapping in a Tor .onion server.

rdl• 13 years ago

The US and Canada are actually some of the better places for a privacy-protecting provider, as long as you want to use strong cryptography. CALEA in the US is the main impediment to making a system where the operator intentionally can't disclose information, and that can be solved (for now) by not being a CALEA-covered provider (essentially, PSTN or VOIP interconnected with PSTN, or some kind of broadband physical access layer).

pasbesoin• 13 years ago

Thank you for taking the time to describe this. I'd been, naively, hoping -- yet to research -- that Norway might be somewhat better than Sweden.

I'm coming to the impression that none of the Scandinavian countries may be particularly friendly to data privacy advocates.

Kimmono6• 13 years ago

How did you come to that conclusion?

ryangripp• 13 years ago

read• 13 years ago

What is the best country that you know of to store data safely in?

pilsetnieks• 13 years ago

In the developed world? Your own. Hopefully then the data doesn't come in contact with any other jurisdiction with different laws and there are much fewer hops between you and the place data is stored, thus limiting the chances that it is intercepted along the way. However, there is the issue that if you store data with a local company, they may be forced to comply to the local law enforcement while a foreign company may or may not comply.

gbrindisi• 13 years ago

If you are in EU, Norway is pretty much transparent from a legislative pov. For example: http://www.autistici.org/ai/crackdown-2010/

alan_cx• 13 years ago

Encrypt all you like. It boils down to this: Will a government make you prove a negative, and if you don't, will it lock you up?

If you have encrypted files, there must have been or still be a key to decrypt it. You will be asked for the key. You will either given them the key, say no, or say you don't have it. The first two are no good, so all you have is the denial that you have the key. If government cant find the key, you will be asked to hand it over.

And that's the crux.

What then does the government do? All it can then do is make it an offence to withhold a key. How do they prove you have the key, if they themselves can't find it? You then have to prove the impossible, that you do not have the key, a negative. Which, even if you are telling the complete god's truth, you can never, ever, prove.

So, having an encrypted file, that you cannot or will not decrypt on demand is or will become a criminal offence. All encryption does, in the eyes of government, act as evidence of guilt. The suspect has an encrypted file, we can verify its contents, she wont give us the key, there for she has "something to hide", and there for must be guilty.

I can well imagine encrypted files being stored like athletes blood samples, waiting to be tested or decrypted by future methods.

We can not win unless we accept so risk and stop expecting our governments to do everything to stop the bad people. If a bomb goes off in Whatevercity, we must not be angry if it happened because the NSA were NOT collecting mass data, or something similar. We must make it clear to government that we are prepared to trade the risk of being blown up for our privacy and freedom, and that if that freedom contributed to the attack, we MUST accept that, and not suddenly switch and blame government. And the NSA, and the likes, must be allowed to say, "look we could have acted, here is the evidence, but we had to respect freedom and privacy", and not be lambasted for it. We have to reply, "OK, fair enough, we understand and accept that." Equally, of course, we need to know they did everything else legally and morally possible.

Question is, are we as a people able to do that? Or do we expect zero risk lives?

And all that is assuming there is zero risk from the powers government wants. Such laws and thinking creates a whole new avenue of risk.

Which is why I for one am quite prepared to say to government, cool it down, back off, set some limits, respect those limits, and if you fail because of that, I both accept it and forgive you, because I want to be free.

BTW, one of the few countries I have been to is Norway. Beautiful, stunning, country and fantastic people. If I wanted to or had to leave the UK, it would be one of the first places I would consider. I'd love Norway to be the savior of privacy and freedom, but I sadly cant see it.

sigil2• 13 years ago

You will either given them the key, say no, or say you don't have it.

There's a 4th option: give them a key that decrypts innocuous material.

http://www.truecrypt.org/hiddenvolume

MrSourz• 13 years ago

I think the thing this is supposed to be analogous to is carrying around an encrypted drive with your stuff on it. As in just trying to deal with the problems of not physically holding onto the drive (that is if there is client side encryption).

Basically what this would prevent would be data collection if you were caught in a web of general surveillance. I agree that if you're in a situation where a government is making a case against you you're fucked. But that requires specific targeting of you.

qw3• 13 years ago

The link should be updated to point to their own English version

http://www.jottacloud.com/its-your-stuff-guaranteed/

ryguytilidie• 13 years ago

United States Government:

-We are serious about creating jobs and supporting great American companies. -Makes the most lucrative young companies in the US unusable in the name of spying on their own citizens.

What in the actual fuck?

Havoc• 13 years ago

The memory stick under my pillow is pretty NSA proof too. Well unless someone in combat gear rocks up at my house...then all bets are off.

Norwegian backup provider promises NSA-free data storage using Norwegian laws

Related Stories