[liberationtech] Silent Circle Dangerous to Cryptography Software Development

[Katrin Verclas]

Having sat for the better part of the day with Phil Zimmerman with activists and journalists in a room, here is what I learned: 

On Oct 11, 2012, at 12:15 PM, Nadim Kobeissi wrote:

> On 10/11/2012 12:04 PM, James Losey wrote:
>> Hi Nadim,
>> 
>> I largely agree with your assessment of Silent Circle and I offer these
>> thoughts in an effort to increase my understanding of the issue. The
>> product is a packaged "solution" clearly targeted towards business
>> customers focused on corporate privacy. And while the company offeres
>> regular transparency statements on government requests and strives to
> 
> Unless hit by a search warrant and a gag order at the same time, or a
> federal subpoena.

Zimmerman stated that servers are located in Canada to avoid US subpoenas (not a lawyer, not sure what's that worth in the end). 

According to the Silent Circle website: 

Websites and products that don’t list the people behind the technology or where their servers are located, how the encryption keys are held or even how you can verify that your data is actually encrypted, are typical of the industry and provide only pseudo-security based on a lot of unverifiable trust.

Our secure communications products use “Device to Device Encryption” – putting the keys to your security in the palm of your hand (except for Silent Mail, which is configured for PGP Universal and utilizes server side key encryption). We DO NOT have the ability to decrypt your communications across our network and nor will anyone else - ever. Silent Phone, Silent Text and Silent Eyes all use peer-to-peer technology and erase the session keys from your device once the call or text is finished. Our servers don’t hold the keys…you do. Our secure encryption keeps unauthorized people from understanding your transmissions. It keeps criminals, governments, business rivals, neighbors and identity thieves from stealing your data and from destroying your personal or corporate privacy. There are no back doors, nor will there ever be.


More importantly, Zimmerman noted that Silent Circle code will be made available for audit.


> 
>> minimize storage of some types of data (and you're right that payment
>> info is problematic) the company is clearly interested in paying for
>> privacy assurances and seems less focused on supporting activists. 

According to Zimmerman (who was keenly interested in use cases for activists) will make licenses available to activists at no cost.  They have not figured out the process for this yet, but we'll certainly follow up with them. 


Katrin