Controversial Hosting Onshore, Offshore, or Online?

1. Controversial HostingOnshore, Offshore, or Online? Ryan Lackey HavenCo, Ltd. <ryan@havenco.com> HAL 2001 10 August 2001

2. General Hosting Background • Hosting in-house vs. colocation • Primary factors: bandwidth, computation (either shared or rent space and hardware), support • Big market – by definition, anything available on the Internet is hosted somewhere, even if without conscious thought • Various concerns: convenience, maintenance, upfront and continuing cost…legal issues and security are often low

3. Introduction: What Characterizes Controversial Data? • Potentially unpopular: with governments, corporations, or influential groups • Often on legally uncertain ground; new media applied to older laws • Must have a critical mass of interest before people really bother; either really objectionable (kiddie porn) or really widely publicized (napster)

4. Examples of Controversial Data

5. What is essential to hosting in general

6. Technical Taxonomy • Static sites with low bandwidth requirements • High-bandwidth media objects, static • Interactive low bandwidth (transactional) • Interactive high bandwidth (multimedia)

7. What kinds of hosting are possible? • Onshore: Hosting in home jurisdiction, or a jurisdiction closely allied; most major nations are a unified regime • Offshore: Hosting in specialized offshore jurisdictions • Online: Using cryptography, replication, distribution, and other techniques to obfuscate where data is hosted, or make it technically infeasible to censor

8. Onshore • Exemplified by traditional colocation and managed hosting – exodus, rackspace.com, etc. • Has high-quality technical infrastructure, support staff • Low cost/high efficiency; very developed markets • Very substantial regulatory overhead; existing regulations, and constantly-added new regulations (DMCA, CALEA, etc.)

9. Offshore • Specialized providers which are based in smaller markets/jurisdictions, offering jurisdictional/regulatory advantages • Examples: Offshore Information Services (AI), HavenCo (SX, etc.), and for some people, CA, US or NL carriers are “offshore” (pornography, cryptography mainly) • Physical security and trust are important issues, as legal remedies are virtually nil • Works best with actual support from local regulatory authorities; otherwise laws can be changed on a whim or election • Often used in conjunction with offshore corporate structure, payment processing, etc.

10. Online • “p2p” systems, like napster, gnutella, etc. • Generally, only capable of static hosting; incapable of secure computation • Highly unreliable in in microstructure, but in the aggregate, theoretically highly robust; able to withstand damage without being destroyed • In practice, most systems have some central avenues of attack, even if mostly distributed

11. Threats • Governments • Corporations • Semi-governmental organizations • Hackers • Private individuals

12. Threat model • Legal or extralegal action against principals • Complete shutdown of site • Compromise of data integrity • Degradation of user experience • Attacks on profitability and public relations

13. What fits best?

14. Success Stories • Onshore – most sites on the Internet • Offshore – PublicData.ai, offshore gaming all over, payment systems with HavenCo • Online – music trading

15. Horror Stories • Onshore: publicdata got forced out of the US, napster was effectively emasculated, casinos have been prosecured • Offshore: lots of casinos have had low security and reliability • Online: software development debacles with no real user-useful applications

16. Open Questions • Will onshore laws continue to get worse? • How far can offshore hosting go without either getting shut down or causing onshore laws to change? • Will online systems get better? Can they do secure transactions and add payment?

17. Summary • The next 5-10 years will be very interesting • A few major cases will definitely be able to change the course of history; important to choose the right battles