1

We're developing a service, that encrypt e-mail with AES algorithm.

Keys are stored in our server.

We thought about having an expiration service, that is deleting the key from our server. This means that the message would become virtually unrecoverable.

It is open worldwide, but I fear of USA :) Servers are in USA, but they can easily be moved.

Is this against some internet regulation or something?

Improve this question
1
  • 2
    you might want to add the country that this service will operate in to your question, as it will mainly be local laws that determine whether you have a problem here.
    – Rory McCune
    Commented Aug 6, 2012 at 17:44

3 Answers 3

Reset to default
3

As far as I can tell (and IANAL), all the broad-scope laws requiring information retention by corporations apply to publicly-traded corporations. Private companies are free to operate in secrecy destroy any information they see fit, except in the case of pending litigation or other court order.

Improve this answer
1
  • 1
    We need to get SE to automatically add a Wiki link and/or mouse-over definition for "IANAL". Otherwise, the Internet might think we're a bunch of sickos. Not that they'd necessarily be wrong in that assessment, but they should at least have the right reason... ;-)
    – Iszi
    Commented Aug 7, 2012 at 1:04
1

It is not against the law within the USA, though there have been attempts to pass a data retention law. However, Europe requires data retention in some areas starting at six months. So, if your company is a US company and your server is in it you're safe. Same goes to other countries without these laws. If your company or server is one of these countries, you are subject to their laws.

Wikipeida Reference

Italy:

"Internet service providers must retain all data for at least 12 months"

Slovakia:

"Telecommunication data are stored for six months in the case of data related to Internet, Internet email and Internet..."

*Note: The FBI can also request records of email addresses sent and recieved, but not the content of the message. NSL (same article)

Improve this answer
4
  • I believe that is so, possibly Europe too. Correct me if I'm wrong, but I think I saw a news article on it a few years back.
    – Travis Pessetto
    Commented Aug 6, 2012 at 18:38
  • @curiousguy I double checked and found out it was just a proposed law, however Europe is stricter updating my answer now.
    – Travis Pessetto
    Commented Aug 6, 2012 at 18:44
  • @curiousguy removed it and gave a more general reference.
    – Travis Pessetto
    Commented Aug 6, 2012 at 18:48
  • Italy "The law does not specify exactly what traffic data must be retained. There is no requirement to store the content of internet communications." So... the statement is absolutely meaningless. Data must be retained, but you don't know which data. Typically Italian! (In Italy the prison administration cannot even read letters to/from prisoners.)
    – curiousguy
    Commented Aug 6, 2012 at 19:07
1

There won't be any Internet regulation as such which would require retention, but local laws will apply.

So it will completely depend on the country which you're operating the service in and the laws applicable there.

The one I know a little about (although IANAL) is the UK, where there it's an offence to fail to provide decryption keys/passwords to the authorities under some circumstances. However I believe, that's based on the idea that you know the key. If you've destroyed it and can prove that that's the case then in my personal opinion you wouldn't fall foul of that one..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .