Re:Ask HN: How do you ensure trust in infra?
by LinuxBender on Saturday November 04, 2023 @11:37AM
(#38142015)
In light of Lawful interception
Are you asking how to evade lawful interception or how to comply with it without the legal process being side-stepped?
existance of corrupt law enforcement agencies
It would help if you provided some specific examples that pertain to (un)lawful intercept.
There will always be those that try to take whatever shortcuts they can get away with. In attempt to answer your question and trying to not sound defeatist and to try to force governments to follow the law warrants, etc... would require owning ones own datacenters and having physical security teams and lawyers that can not be intimidated by fear tactics and that do not just perform check-box security and the like. This would also require not expecting a dependency on scratch each others backs mentality that many corporations ascribe to. Some corporations will permit governments to bend the law if they feel it will benefit them in the future and should they wish to get away with bending the law themselves. So I suppose the best one could do is own and operate all of their own datacenters including the entire physical properties and having redundant sources of power that governments can not easily subvert using intimidation tactics. It would probably also help to have multiple physical datacenters in multiple countries that are not in full cooperation with one another and force everything to be Active-Active N+2. Even then there are 3rd party services that could not be protected in this manor such as domain names, CDN's, DNS providers assuming you are not your own DNS and anti-ddos. And then there is the issue of BGP filtering that could be imposed on such a hardened setup. So in conclusion one would need multiple datacenters under their full control, fearless people with integrity and services that do not depend on DNS and in some way indirectly do not depend on public IP addresses associated with that infrastructure.
To my knowledge there are no corporations that provide what I just described. This would be getting closer to the territory of oligarchs and organized crime that could afford to build such a setup in my opinion.
Are you asking how to evade lawful interception or how to comply with it without the legal process being side-stepped?
existance of corrupt law enforcement agencies
It would help if you provided some specific examples that pertain to (un)lawful intercept.
There will always be those that try to take whatever shortcuts they can get away with. In attempt to answer your question and trying to not sound defeatist and to try to force governments to follow the law warrants, etc... would require owning ones own datacenters and having physical security teams and lawyers that can not be intimidated by fear tactics and that do not just perform check-box security and the like. This would also require not expecting a dependency on scratch each others backs mentality that many corporations ascribe to. Some corporations will permit governments to bend the law if they feel it will benefit them in the future and should they wish to get away with bending the law themselves. So I suppose the best one could do is own and operate all of their own datacenters including the entire physical properties and having redundant sources of power that governments can not easily subvert using intimidation tactics. It would probably also help to have multiple physical datacenters in multiple countries that are not in full cooperation with one another and force everything to be Active-Active N+2. Even then there are 3rd party services that could not be protected in this manor such as domain names, CDN's, DNS providers assuming you are not your own DNS and anti-ddos. And then there is the issue of BGP filtering that could be imposed on such a hardened setup. So in conclusion one would need multiple datacenters under their full control, fearless people with integrity and services that do not depend on DNS and in some way indirectly do not depend on public IP addresses associated with that infrastructure.
To my knowledge there are no corporations that provide what I just described. This would be getting closer to the territory of oligarchs and organized crime that could afford to build such a setup in my opinion.