Countries to host a hidden service

Across the globe, governments have adopted policies of seizing domain names as a way to shut down content they find objectionable. This has become a primary censorship tactic of the United States government (through the Secret Service, Immigrations and Custom Enforcement, DHS, and the Department of Justice, via the FBI and the DEA).

Even more worryingly, we've recently seen the United States Justice Department work with Western European nations in a coordinated effort to crack down on the Tor anonymity software and capitalize on the inherent weaknesses of Tor to attack and pinpoint hidden services.

To address this problem, it is important to consider hosting your hidden service in a country that hates your potential adversary. That way even if somebody breaks into the webserver and breaks out of the VM, they're still faced with a frustratingly long bureaucratic step. As for this guide, we can immediately rule out the nations that took part in the recent Operation Onymous, which includes Bulgaria, Czech Republic, Finland, France, Germany, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Netherlands, Romania, Spain, Sweden, Switzerland, United Kingdom.

Before we make our list, we need to define some criteria for what we're after. We aren't just interested in a finding a country to host our onion site for our potentially suggestive content, but also one which will also stand resistance against political attacks, as well as logistical ones. So, let's get started.

What we don't want

Avoid:

Small countries.
Countries with military mutual defense agreements (NATO, etc).
Countries with high levels of corruption.
Members of the ECHELON signals interception/monitoring pact (AUS/CAN/NZ/UK/US).
Countries with large amounts of debt.
Countries that maintain close ties with the US (including ones that have a MLAT treaty with the US)

What we do want

Look for:

Countries without debt.
Countries of medium size.
Militarily neutral countries.
Liberal countries with a high freedom index.
Countries with high levels of law and order.
Countries that have complicated relations with the US or other Western European nations (particularly the UK)

Basically, look for countries that have low levels outside influence, financially and militarily. Greece and Estonia, for instance, are probably some lousy choices for obvious reasons in this regard. Unfortunately, we're also forced to rule out Iceland, as although they're trying very hard to position themselves as a pro-transparency, pro-press-freedom and generally hacker-friendly nation, their recent cooperation with US LE regarding the seizure of the original Silk Road has tarnished this reputation. ^[1]

So what does that leave us with?

Countries to consider

This is by no means meant to be an exhaustive or authoritative list, but here are some candidates which meet all or most of the criteria which we have laid out.

Switzerland

The most neutral country in the world, Switzerland seems like an obvious choice. The infamous Wikileaks is hosted in Switzerland as well as the controversial Encyclopedia Dramatica.

After the Edward Snowden incident, web hosting company Hostpoint reported a 45% increase in customers. Now, telecom company Swisscom is building a Swiss-based cloud for data privacy. While the US government covertly gathers internet user data using FISA and the Patriot Act, Switzerland requires a formal request to be filed by prosecutors to get internet data. Switzerland’s Federal Act on Data Protection attempts to maintain one of the highest data privacy standards in the world.^[2]

Despite their reputation, if you are planning on hosting illegal content, know that Switzerland will not stand up to US LE or Europol and protect you, they are on record as having participated in Operation Onymous.^[3]

Norway

Financially independent and socially liberal with a high index of law and order, Norway is a good choice. While Sweden web hosting company Banhhof reportedly hosts Wikileaks, Norway surpasses Sweden in data privacy and freedom of the press rankings. Despite sharing many of the European values of data privacy, Norway is not a member of the EU, which means it has been free to craft its own privacy laws free from Eurozone interference. Web hosts in Norway, called “webhotell”, are a bit more expensive but offer greater protections than a US web host. Cloud storage services like Runbox operate from Norway, and Jottabox brags how its pure Norwegian ownership allows it to protect its clients’ data from US law in a way that US companies operating European data centers can’t. This assertion is based on the need for foreign governments to get permission from a Norwegian court to access any private data.^[4]

Perhaps most importantly, Norway does not have a MLAT with the United States. ^[5]

Sweden

This is a pretty obvious one as well. They're an independent country with low debt, high stability and they're the birthplace of the political pirate movement.

It's also worth noting that even though the founding members of the Pirate Bay were tried and convicted in Sweden, ThePirateBay.se is still alive and kicking, showing just how resilient a Swedish domain can be.

United Arab Emirates

The UAE is a rich country with progressive values by middle eastern standards. Their oil power gives them a high degree of autonomy and resilience to external pressure, and I can't imagine they care all too much about Western politics and criminal law.

Also does not have a MLAT with the United States. ^[6]

Mauritius

The island nation of Mauritius off of the coast of Africa is an independent nation with a European history and may be a great choice.

China

China, like Russia, has complicated relations with the US, and has no extradition treaty with the United States.^[7] Although government surveillance is prevalent, the Chinese government would be unlikely to cooperate with the USDOJ.

Bhutan

According to the Unites States Department of State, "The United States and the Kingdom of Bhutan have not established formal diplomatic relations; however, the two governments have informal and cordial relations." However, informal contact is maintained through the U.S. Embassy in New Delhi to the mountainous country of Bhutan.^[8]

Bhutan does not have a MLAT with the United States. ^[9]

Cuba

Although the island country of Cuba is a close neighbor to the United States, the U.S. only interacts with Cuba via a U.S. Interests office at the Swiss Embassy in Havana and Washington D.C. The U.S. broke diplomatic relations with Cuba on January 3, 1961. ^[10]

Taiwan

Taiwan is not recognized as an independent country by the U.S. since the island nation claimed by the mainland People's Republic of China. Unofficial commercial and cultural relations between Taiwan and the United States are maintained through an unofficial instrumentality, the Taipei Economic and Cultural Representative Office, with headquarters in Taipei and field offices in Washington D.C. and 12 other U.S. cities.^[11]

Iran

Iran remains an option simply due to its complicated relations with the West. Iran was the location of Black Market Reloaded's forums when a seizure notice was put up, although it was unconfirmed and may have just been a smokescreen by BMR founder backopy.

Iran does not have a MLAT with the United States.

Romania

Romania has some of the fastest internet speeds in the world, and is an emerging destination for hiring a virtual assistant for internet work. But Romania’s position in less-regulated eastern Europe gives it an advantage not only in its central location close to Europe and Asia, but also with its personal and data privacy laws. Unlike The Land of the Free, which cloaks its privacy-killing measures in patriotism, Romania has established agencies such as The National Supervisory Authority For Personal Data. Freedom of the Press in Romania is approaching that of the US, as well.^[12]

Like Switzerland, if you are planning on hosting illegal content, know that Romania will not stand up to US LE or Europol and protect you, they are on record as having participated in Operation Onymous.^[13]

Russia

Although Russia does have a MLAT, the recent diplomatic complications between them and the US, highlighted by the granting of temporary asylum to international fugitive Edward Snowden, makes them a viable option to host onion services.

Onion hosting

Anonymous onion hosting is also another choice, here are some reputable onion hosting options:

Freedom Hosting II - Anonymous Freehosting with PHP/MySQL Support
Fuck You Hosting - Tor hidden service hosting, 100% free and ad-free
Deep Web Hosting - Secured and anonymous. Linux PHP hosting 100MB and Unlimited Bandwidth.
TorWeb The largest hosting company on TOR. Offering webhosting and VPS packages
Hidden Hosting - Publish your Service on the .onion net with full Service. We provide static webspace accessible only in the TOR-network. 10 Free .onion Domains.
bittit, clearnet - Host and sell your original pictures for Bitcoins.
Liberty's Hackers - Service and Hosting Provider in onionland - php5/mysql support, new address for the liberty's hackers hidden service.
CYRUSERV - Hosting service with an emphasis on security.
TorVPS Shells -- Free torified shell accounts, can be used for .onion hosting, IRC, etc.
TorSafe - Secure Anonymous Hosting and Collaborative solution (Free & commercial). Launched 11/30/2013
Web Hosting — Web Hosting - Apache, PHP5, MySQL, SFTP Access, .onion Domain, Bitcoin server.24 hours free hosting.
Real Hosting — Apache, PHP5, MySQL, SFTP Access, xxxxxxxxxxxxxxxx.onion Domain, Bitcoin server.
Kowloon Hosting Services — Stealth TOR hosting. PHP + MySQL + Control panel. 256 MB to 1 GB. * FREE TRIAL ACCOUNTS *

Countries to avoid

United States

For obvious reasons, the United States is a poor choice of location to host potentially objectionable content where server raids and gov't surveillance are prevalent.

United Kingdom

If there was a place worse for hosting a hidden service than the US, it would be the UK, where the GCHQ as well as the NCA have nearly free reign in eroding the privacy of anyone under their jurisdiction.

Canada

See Hushmail. Canada is like the little brother of the US, if the US says "jump", Canada says "how high?"

Bulgaria

Not only does Bulgaria have a MLAT with the United States, they played a leading role in the recent onion seizures. ^[14]

Netherlands

Although the Netherlands was previously lauded for its liberal privacy laws, they have also recently been in the news for cooperating with US LE in seizing onion domains. ^[15]^[16] Avoid.

France

Although France and the United States may have strained relations regarding legal matters (failed extradition of Roman Polanski), France was recently implicated in playing a role in the recent 2014 Operation Onymous. ^[17] Avoid.

Germany

Despite strong privacy protection laws, Germany is in full cooperation with both US and European LE and also played a role in Operation Onymous.^[18] Avoid.

Czech Republic

Took part in Operation Onymous.^[19] Avoid.

Spain

Took part in Operation Onymous.^[20] Avoid.

Ireland

Took part in Operation Onymous.^[21] Avoid.

Luxembourg

Took part in Operation Onymous.^[22] Avoid.

Latvia

Took part in Operation Onymous.^[23] Avoid.

Lithuania

Lithuania hosted Silk Road 2.0 where Lithuanian officials imaged the server and sent it to the FBI for investigation. ^[24] Avoid.

Hungary

Took part in Operation Onymous.^[25] Avoid.

Finland

Took part in Operation Onymous.^[26] Avoid.

Why Where You Host Your Site Matters Legally

An issue of jurisdiction

Jurisdiction is a basic legal concept that gives a certain government or political body authority or responsibility over a matter. The term refers both to areas of law that sometimes separate responsibilities (such as state vs. Federal crimes) and also geographic areas of responsibility, such as national and state borders.

Typically, the actions you take are the jurisdiction of wherever you are. Your city, state, country, etc. is responsible for policing your behavior or resolving any disputes that arise from it.

However, there are many ways that you can subject yourself to a jurisdiction that is somewhere else. For example, often times when you do business with someone else in another jurisdiction, you may subject yourself to their jurisdiction, either implicitly, just by the act itself, or explicitly, for example, through a contract.

You can also subject yourself to another jurisdiction by doing something within it. In the tangible world, that may be difficult but on the Web it isn’t. If you set up a hosting account in another country, your server and your data reside within that country’s borders. As such, both are within their jurisdiction, even if you physically are not.

This has a lot of potential implications for you and showcase why you should be wary of making such a move, at least until you’ve thoroughly researched the country’s laws and how they may apply to you.^[27]

References

1 }}

     | references-column-width 
     | references-column-count references-column-count-{{#if:1|{{{1}}}}} }}
   | {{#if: 
     | references-column-width }} }}" style="{{#if: 
   | {{#iferror: {{#ifexpr: 1 > 1 }}
     | Template:Column-width
     | Template:Column-count }}
   | {{#if: 
     | Template:Column-width }} }} list-style-type: {{#switch: 
   | upper-alpha
   | upper-roman
   | lower-alpha
   | lower-greek
   | lower-roman = {{{group}}}
   | #default = decimal}};">

[1] ttp://www.theverge.com/2013/10/14/4836994/dont-host-your-virtual-illegal-drug-bazaar-in-iceland-silk-road

[2] ttp://nomadcapitalist.com/2013/12/15/top-5-best-countries-host-website-data-privacy/

[3] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[4] ttp://nomadcapitalist.com/2013/12/15/top-5-best-countries-host-website-data-privacy/

[5] ttp://www.state.gov/j/inl/rls/nrcrpt/2012/vol2/184110.htm

[6] ttp://www.state.gov/j/inl/rls/nrcrpt/2012/vol2/184110.htm

[7] ttp://blogs.findlaw.com/blotter/2013/06/5-countries-with-no-us-extradition-treaty.html

[8] ttp://geography.about.com/od/politicalgeography/a/nodiplomatic.htm

[9] ttp://www.state.gov/j/inl/rls/nrcrpt/2012/vol2/184110.htm

[10] ttp://geography.about.com/od/politicalgeography/a/nodiplomatic.htm

[11] ttp://geography.about.com/od/politicalgeography/a/nodiplomatic.htm

[12] ttp://nomadcapitalist.com/2013/12/15/top-5-best-countries-host-website-data-privacy/

[13] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[14] ttps://www.reddit.com/r/DarkNetMarkets/comments/2lu33p/bulgarian_host_hosting_all_the_onions_most_likely/

[15] ttp://www.usatoday.com/story/news/nation/2014/11/06/feds-shut-down-silk-road-copycat/18591155/

[16] ttp://www.independent.co.uk/life-style/gadgets-and-tech/utopia-no-more-drug-marketplace-seen-as-the-next-silk-road-shut-down-by-dutch-police-9126063.html

[17] ttp://www.usatoday.com/story/news/nation/2014/11/06/feds-shut-down-silk-road-copycat/18591155/

[18] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[19] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[20] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[21] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[22] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[23] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[24] ttp://www.deepdotweb.com/2014/11/12/silk-road-2-sever-was-located-at-lithuania/

[25] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[26] ttps://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network

[27] ttp://www.blogherald.com/2011/07/29/why-where-you-host-your-site-matters-legally/

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

[25]

[26]

[27]