Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recent events like the Lavabit case have shown that it is no loger possible to host a server in the United States and guarantee your users that you will keep their data confidential, because the US government can force you or your hoster through a National Security Letter to spy on your users for them while forbidding you to say that you are being forced.

Which countries are still an option when you want to be able to guarantee your users that their data will be confidential but also offer reliability and performance to users in North-America and Europe? Maybe Canada? Are EU countries save?

share|improve this question
The Moon, I'm afraid. – Deer Hunter Aug 28 '13 at 13:36
what about iceland? – that guy from over there Aug 28 '13 at 13:59
@thatguyfromoverthere Can you provide some information about the situation in Iceland? – Philipp Aug 28 '13 at 14:11
The EU Data Retention Directive is implemented in Icelandic law. The national act 78/2005 introduced a requirement for e-mail providers to store communication meta data for 6 months. In addition, providers of electronic communication services must provide appropriate interception interfaces to authorized authorities. – jarnbjo Aug 28 '13 at 17:25

Realistically none. That's the point of cryptography. If the government asks, then most (effectively all) companies are going to comply if sufficiently legally threatened. Cryptography makes it so that the information isn't accessible even if hardware is seized, but you have to be ready to pay the consequences of not cooperating in unlocking it.

share|improve this answer
In the US you can always declare that there is self incriminating content on there, and you can't be prosecuted for not aiding in decryption (warrants for passwords are unconstitutional, it's been tested in court). Of course that assumes there's self incriminating content, that can't be separated from the desired content. – FakeRainBrigand Aug 28 '13 at 18:45
@FakeRainBrigand - encryption keys however have been ordered to be produced before by judges. – AJ Henderson Aug 28 '13 at 20:02
Only in one US case I can find, and it was because law enforcement had seen the content; they just turned off the computer and got locked out :-) – FakeRainBrigand Aug 28 '13 at 21:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.