Internet Privacy Company, CryptoSeal, Hopes To Revive Service With Protections Intact

CryptoSealCryptoSealThe other day I wrote that CryptoSeal, a company offering virtual private network (VPN) services, joined the ranks of companies shutting down privacy-enhancing offerings for fear they'd be forced to surrender user data or even compromise their technology by order of the U.S. surveillance state. Ryan Lackey who, along with Tom Sparks, is one of the men behind CryptoSeal, tells me that there may still be hope for the company's consumer service.

In an email, Lackey wrote that the company is working on a way to be compliant with the law while still protecting user data to the extent possible—that is, to mimize whatever is surrendered under legal pressure.

The goal for the system to launch in 2014 is that the Government will be able to demand records on any user (under pen register), and will receive the bare minimum (ideally, a username only, in response to a username….so basically nothing), but realistically name and billing info, possibly anonymous or incorrect).  They can demand more under a warrant, and will receive similarly helpful levels of information (since we don’t retain anything).

Any changes made to the system will cause end-user-visible changes.  We’re still working on whether it’s “all or nothing” or “per user” — i.e. if changes made to a single user’s account will be visible to all users or just that one user.  This protects against both a pen trap order and a warrant (and NSL, and whatever else)

This stuff is all incidental to protecting users from insider threats (e.g. if one of our staff is forced by a criminal gang at gunpoint to subvert the system), but it happens to protect against governments as well, which might be a statement about government’s true nature…  Also protects against the company being sold, outside hackers, etc.  Hoping to do more than just a VPN with the technology.

The idea, then is to minimize the data the company possesses, so that full compliance with legal orders is minimally revealing. If this can be made to fly under the current legal regime, it should offer about the most confidence you can expect from a firm working subject to U.S., or any similarly intrusive, jurisdiction.

Lackey hopes, though, for legislative or judicial solutions to tighten up restraints on the government. He describes himself as "a bit more minarchist vs. anarcho-capitalist than I was in the past," so he's open to something in the form of a strong interpretation of the Fourth Amendment—much stronger than what we have now.

Meanwhile, as I've pointed out, snooping by the NSA and other U.S. government agencies creates an opening for overseas competitors. After my last piece, a representative of CryptoExpress, a British company, wrote me to say his firm "offers similar services" (though only at the corporate level) to those once offered by the American firms that have been shutting down, and that it "is not subject to the USA legal system." The company has a nonfunctional Website and a sparse online presence, so buyer beware. Not to mention that U.K. legal protections aren't necessarily any better than those in the states.

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  • Dave Krueger||

    Lackey hopes, though, for legislative or judicial solutions to tighten up restraints on the government.

    The government has already proven that legislative and judicial restraints on their activities don't work. They use secrecy to avoid getting caught violating the law and even when they do get caught, there are no real penalties.

  • Ken Shultz||

    "This stuff is all incidental to protecting users from insider threats (e.g. if one of our staff is forced by a criminal gang at gunpoint to subvert the system), but it happens to protect against governments as well, which might be a statement about government’s true nature..."

    The framers understood such things about the government's true nature. I wish Lackey were running for office in my state.

  • DEATFBIRSECIA||

    None of this shit is going to work until we've repealed both the Patriot Act and NSL.

    What a joke our country has become.

  • Fist of Etiquette||

    Look, do you want protected from terrorists or not?

  • DEATFBIRSECIA||

    Not.

  • Fist of Etiquette||

    Well, you're going to be protected anyway.

  • Dweebston||

    Come on, everyone knows it's a puppet company run by the NSA.

  • ||

    It really says something about how trustworthy a government is, when the precautions you'd need to take against a criminal gang putting a gun to your sysadmin's head and the precautions you'd take against that government are absolutely identical.

  • WTF||

    It simply illustrates the true nature of government.

  • R C Dean||

    It never ceases to astonish me that almost nobody seems to realize that anything the government does is essentially a demand made at gunpoint. Because if you refuse to do what the government does, you'll wind up looking down the barrel of a gun. Every time.

    That non-criminal ordinance or regulation that you got fined for refusing to comply with? Refuse to pay your fine, and they will get an order to seize your property to pay it. Refuse to allow them to seize your property, and hello SWAT team. Its really that simple, even for the most innocuous-looking government rule.

    And almost nobody seems to get it anymore.

  • Kid Xenocles||

    The corollary to that is that Clausewitz got his famous maxim backwards. War isn't an extension of politics; politics is an extension of war. War results when rivals with power have opposing goals. Politics results when there is a local effective monopoly on power. 99%+ of the time opponents to the monopoly's policy just concede the game and go along.

  • np||

    Any changes made to the system will cause end-user-visible changes. We’re still working on whether it’s “all or nothing” or “per user” — i.e. if changes made to a single user’s account will be visible to all users or just that one user. This protects against both a pen trap order and a warrant (and NSL, and whatever else)

    This will be huge if they can pull it off, where any compromise to user's security will automatically trigger notification of "something's changed" to the user.

    rsync.net uses a manual canary system to try to get around NSLs, but it's not foolproof as it's not technologically tied into their system.

  • Paul.||

    In an email, Lackey wrote that the company is working on a way to be compliant with the law while still protecting user data to the extent possible—that is, to mimize whatever is surrendered under legal pressure.

    Why does this short statement make me lose confidence in the whole concept?

  • Paul.||

    "is not subject to the USA legal system.

    ...But is subject to the British legal system. What are the fourth amendment protections you receive in Britain?

  • Will Nonya||

    And the EU regime as well.

  • 0x90||

    "They can demand more under a warrant, and will receive similarly helpful levels of information (since we don’t aren't secretly/retroactively-legally-bound to retain anything yet)."

  • Will Nonya||

    "a strong interpretation of the Fourth Amendment"

    Doesn't he know that referencing the constitution has become so passé that its practically a joke among politicians?

GET REASON MAGAZINE

Get Reason's print or digital edition before it’s posted online

  • Progressive Puritans: From e-cigs to sex classifieds, the once transgressive left wants to criminalize fun.
  • Port Authoritarians: Chris Christie’s Bridgegate scandal
  • The Menace of Secret Government: Obama’s proposed intelligence reforms don’t safeguard civil liberties

SUBSCRIBE

advertisement