I've received a subpoena from Cook County before regarding a site on Neocities. Related to Tor, actually. Easily the stupidest thing I've ever seen in my life.<p>The person that signed the subpoena was in the news for allegations of corruption, and so was her husband (it's called Crook County for a reason). They spelled the name of my company wrong (noahcities.com or something like that), and when I sent a letter to the designated agents requesting they fix it (I control neocities.org, not noahcities, how can I respond to legal requests addressed to a different web site?), they never responded, and the subpoena basically just died.<p>If they had followed up, they would have gotten a tor exit IP address somewhere outside of their jurisdiction (read: another country). I told them this before they filed it, and they told me "That decision is for someone above my pay grade, man". You can't spend 5 minutes to google for Tor because of your "pay grade"?<p>Oh, and they also love to put unlawful (but unfortunately, not illegal) gag orders in their subpoenas. I chose not to waste our lawyer's time (and our money) on this piece of trash, so we didn't make too big of a deal about it.<p>The take home lesson for me was that crooked regional governments abusing the subpoena system are just as big of a problem as the NSA, if not worse.<p>So, now you know the story behind this commit <a href="http://github.com/neocities/neocities/commit/4983a9b24eac00b8d8bfd300a18cdcee0152a271" rel="nofollow">http://github.com/neocities/neocities/commit/4983a9b24eac00b...</a><p>It's not good enough for the NSA, but it will prevent these idiots from ever figuring it out. And there's no US data retention laws for web sites, so it's completely legal.<p>This is textbook Neocities business philosophy. Instead of raising money to hire more lawyers and take the legal risk individually fighting bad John Doe subpoenas, we changed our code to make the data they can actually get worthless to them, so we can just serve them (if they're valid) while still protecting our users' privacy. If we get dragged into court over it, our liability insurance kicks in, we pay a (relatively) small deductible, and then we can use the precedent we set there to throw out any new cases for everybody with this problem, not just us. Way more sustainable.<p>Phase 2 is that I delete the hashes after a few months. I haven't gotten to it yet, but it's in the ticket tracker.