Seppuku

Seppuku (切腹, "stomach-cutting", "abdomen-cutting") is a form of Japanese ritual suicide by disembowelment. [wikipedia]

I was recently referred to an interesting page on the idea of Corporate Seppuka: https://www.cryptostorm.org/viewtopic.php?f=9&t=2954

A number of companies, when faced with orders to become a real-time participant in ongoing, blanket, secret surveillance of their customers, have pledged to refuse, and if necessary wind up the company. Indeed, several recent cases have happened as listed on that site. I am impressed.

As people know, at A&A, we take this stuff seriously, but it is probably worth clarifying a little. If ever we got such an order I don't have the money to just wind up the company the day we get an order, and it would not be fair on customers that would need to find another service, or the staff that need jobs.

So what would happen?

Well, firstly, we have the canary of sorts. Anyone can ask me in irc if we have any "black boxes", and I will happily confirm that we do not. I hereby re-confirm that is still the case. We are assuming that the law cannot compel me to actually lie, especially where it is key to our business and so such a lie would itself be criminal fraud (lying for some gain).

This should mean that any such order is no longer "secret" at the very least. I am sure people would post quite quickly if I refused to answer.

It would probably be a good clue if we started trying to raise money for some unspecified legal challenge.

Of course, if an order is not actually secret, we'll tell people exactly what is happening and when, and what we are doing about it.

Would my staff know?

Of course, depending on the order, my staff may not know as I may not be allowed to tell them. However, they do audit the data centres, and have orders to remove anything not recorded correctly on the equipment database. It is therefore quite possible that some expensive black boxes would be connected, briefly, and then suddenly being very publicly sold on ebay by my staff. I would be powerless to stop them as I would be subject to a gagging order. Ooops.

But what then? Would we really install black boxes?

Not if we can help it. I am very keen that we would not. Any such order would take time. We'd start with challenging the order in the courts. There are many resources we can use and people that would help. This would delay matters at the very least. If what we are asked to do is breaching EHCR, as mass surveillance has been shown to be in the past, we should be able to delay matters a long time.

Whack-a-mole!

We'd also look at fragmenting the parts of the company - something we keep considering for all sorts of reasons. E.g. making a wholesale and retail part and so on. A bit like what BT do, but with actual separate companies. This would make an order on what then is only one of the companies harder to be effective. Indeed, the company with the order may suddenly not actually have any network equipment under its control. Obviously a judge may not be happy with what would effectively be delaying tactics, but as long as what we do at each stage is legal, we can do it. It would mean that the services the company offers would be a mix and match set of companies, contracts and network equipment. Any company ordered to monitor can be swapped out with another new company that has not had any such order, re-assigning contracts and selling equipment as necessary. It should be possible to make it a game of whack-a-mole.

What else?

There are then interesting possibilities with encryption. Sadly the technology is not quite as cheap and simple as we would like yet, well, not to scale up, but it is getting there. It ultimately becomes possible to offer a higher grade of service to customers where traffic is encrypted (in another country) and sent to kit at the customer site where it is decrypted. This could be done with us having no tracking to associate traffic with customers or for the company doing the encryption to know either. Indeed, we have already considered steps that do not involve expensive encryption but just involve several distinct companies in such a way that no one company knows enough to associate a specific customer with specific traffic and DPA prevents these companies telling each other the missing pieces. That would not stop a targeted investigation against an individual suspect, which is fair enough, but it stops mass surveillance and trawling data later.

Would we every wind up things?

We already work in the hardware development of the FireBrick, and sourcing or developing in-line encryption systems is a potentially sensible business proposition for us, and one we could expand. If we can no longer, in good conscience, sell broadband because of such orders, we have areas we can move the business in to, and wind down the compromised business (probably sell it off). Just that it could not happen over night. Not quite Seppuku, but a step in the right direction.

Of course, in the mean time, if any monitoring box did exist, it would be very easy for it to be DDOS'd, and for deliberate random traffic to be sent to it to create vast amounts of mis-direction data.

I hope that explains where we stand, and at least puts off any authority from trying anything with us. With any luck we stay small enough to be no concern.