> You run this website, the US govt. comes knocking at your door looking for records - what do you do?

You truthfully say that you don't have any records to provide, because responsible privacy services don't log their customers' activities. I think that's the one part of this situation that I don't understand: why were there records in the first place?

Regardless, a lot of his customers -- the ones providing half of his revenue for this business -- are now aware that the service monitors their activities.

I assume the FBI pieced that crime together based on this data. I honestly don't know much more than that, or what he has been up to in the past 2 years. I just know him from previously doing work for him, and thought I could give some insight to who he is and what he's like.

I'll take your word for it that he's a decent person. I certainly have no reason to think otherwise. But that doesn't change that his service is recording information that it ought not to be.

A responsible business that wishes to comply with tax law and other important parts of making a living needs to have record of income.

HMA does not bill by the minute. Nice snark, though.

What's annoying is the disconnect between saying "We help you avoid censorship" and "we comply with correctly formed law enforcement documents".

Hushmail states all this clearly, allowing new customers to make an informed choice.

Is this not just some deploy script on a bunch of VPSs?

I'm not sure what you're referring to in "this website", but I can tell you that jurisdictional arbitrage, and being able to protect my customers data in exactly this situation is something I spend a lot of time thinking about.

Of course, nobody wants to fight a powerful government, so a better strategy is to make it such that the powerful government never comes knocking on your door, or you don't have any useful information for that powerful government, or your site infrastructure is in the jurisdiction of a government that has no interest in rolling over to that powerful government, like say, singapore.

The US government can try to swing its weight around in singapore and will likely be told to go pound sand. And if the singapore government agrees with the US government, then what you hand over may not contain any sensitive client information (because you don't keep sensitive client information when you don't have to. If you have to, it is a different matter.)

I think every one of us working on web services should think long and hard about how we're going to deal with the reality that the US government, without cover of law, regularly demands information (using the PATRIOT act) that it doesn't have the legal right to, and regularly censors (the torrent site takedowns, etc.) content providers who have never even been charged, let alone convicted of violating the law.

You don't want your business shut down, that's true. (also a reason not to domicile your business in the USA, or keep your banking there.)

These are issues you should think about before, or early, in the period of starting your business.