Cisco’s Attempt to Dodge Responsibility for Facilitating Human Rights Abuses
eff.org
eff.org
Thats ... pretty messed up.
[0]https://www.eff.org/files/2016/01/12/113_second_amended_comp...
I respect your opinion greatly. Why do you disagree with the EFF's assertion that Cisco's actions violate the Alien Tort Statue (the "ATS") [1]?
If Cisco knew, or should have reasonably known, that the technologies they were developing for the Chinese government would be used in contravention of the United Nations Convention Against Torture [2], which the U.S. ratified and would thus be covered under the ATS, then it would seem like this would fall under "aiding and abetting.
[1] https://www.law.cornell.edu/uscode/text/28/1350 28 U.S.C. § 1350
[2] https://en.wikipedia.org/wiki/United_Nations_Convention_agai...
Separately, we should pass a federal law outlawing the knowing sale of technology for the purpose of persecuting groups of people based on their race/ethnicity/religion. Once that law exists, it will be a crime to do what Cisco did, and I'll be happy about that.
Until then, discussing what Cisco did as "criminal" is dangerous. It should be harder to stretch our existing laws to make criminal cases, not easier.
If it had any teeth, such a law would do serious damage to the US arms exports industry.
Once that law exists, it will be a crime to do what Cisco did, and I'll be happy about that.
Until then, discussing what Cisco did as "criminal" is dangerous. It should be harder to stretch our existing laws to make criminal cases, not easier.
This sort of thing has been illegal for a while, so long as you're not considered too powerful to prosecute...
> > It's not criminal. It could and should be outlawed, but hasn't been.
>
> I respect your opinion greatly.
Conspiracy to assist the unethical law enforcement operations of another country is not, in fact, a crime in the US. I wish it were. But to be guilty of a crime, it has to be a crime when you commit it. It doesn't work retroactively --- that's one of the first safeguards against despotism the founders came up with.
Couching it in "unethical law enforcement operations" doesn't really change the fact of the matter, does it?
It is far from clear-cut that when US corporations assist regimes where the US officially has serious problems with their human rights record, that laws against torture and other human rights violations would not apply to those enabling and assisting those violations. Some law enforcement operations are not merely unethical, or "different" from those that are legal here.
Are you arguing that we should pass another act, like the FCPA, that criminalizes the knowing and deliberate sale of technologies that will be used to harm people in violation of the UDHR? I'm right there with you.
Which is aking of FB/GOOG collecting metadata of your activities and having "paid likes", but being used in a more specific and direct way.
That sounds like something that's especially fun to argue on an Internet message board and not all that illuminating anywhere else.
So, basically you're saying that even though Cisco has shown a willingess to work with a corrupt government in China, that willingness to work with corruption does not translate to the US, simply because the US doesn't run a 'great firewall'?
But there is some blocking. It's mostly been DNS poisoning, against "piracy" and such. I don't recall specifics, but at times there have been sites that were reachable with IP addresses, but not using public DNS servers. There have been, for example, Firefox plug-ins with hard-coded lookups.
But it is an invalid comparison snce it isn't the GFW that is gettng people killed, it's the packet inspection and traffic monitoring.
It's also not what they said, at all. If anything, you could say they argued it might be happening because it's more effective.
From seeing the things people and companies do openly, from marketing to politics, I see no reason to believe that moral qualms is what would keep them from doing more. And while I don't know about MITM attacks, that seems like something that would be done on an individual basis; as for astroturfing and "troll armies", the logic is rather "if it makes sense, works, is cheap, has been reported on multiple times, then yeah, it's probably happening", at least for me, can't speak for the other poster.
And is anyone honestly debating that
> there are many much more subtle and effective ways to stifle free speech and human rights than a big firewall
is true? Because refuting a straw man is not the same thing.
And here too I'm sure I could find reading material if required, I'm sure. From the candid beginnings of marketing and public relations to all sorts of musings, short stories and probably even Star Trek episodes about how a prison you can see, one you know you're in, is much less insidious and effective than one where you think you're free, where you never try the door or don't even realize there is one. I remember a short story in my 8th grade textbook or something that was about a prison without walls. You can say and do what you want, sure, and you think you came up with what you want all by yourself, too, it's just you didn't. That's the general idea.
Walls, like murder, are just very crude tools, they are not the zenith of oppression and exploitation. If you see huge concentrations of power, skepticism is always warranted. How could there be smoke without fire? It doesn't prove anything, sure, and even if I could prove that "there has to be a fire", then that doesn't make any wild fantasies about the nature of it correct. But still, to muse about causes one can't prove (yet) seems a lot less foolish than to for example say "oh look, a huge blob of smiling friendly power, it just has to be everything it says on the tin". I'd rather be wrong about something I investigated for the right reasons, than guess right by sheer dumb luck.
But personally I prefer to think of useful ways that would also nip some fires in the bud anyway. I don't need to know if we are being manipulated, I know critical thought is required and I know group think can be dangerous even when not manipulated, which it is so readily. So why not catch one real and one potential bird with one stone that is obligatory? I don't know how much of a problem global warming is, but I know that renewable energies are a good idea regardless, at "worst" we simply get to use fossil fuels for more plastic and fertilizer rather than burning them. I don't know how many people the planet can sustain, but I know something that needs to grow to not collapse cannot work on a finite planet, and that we need to rethink that at least until we get out of the solar system and split up into a gazillion humanities that will do whatever. I don't need to know if someone is trying to guess my password, I simply generate a long random one anyway. And so on.
Likewise, I don't know if there will ever be the kind of oppressive societies here and where you are that were the norm throughout history and are still plentiful in the world, and I can't prove the exact levels of fuckery we are under right now, much less my idle suspicion that the West might fall get phased out in favour of the Chinese model -- but I still strive to be the best and most free I can be. Certain things should not be a response to pressure from the outside, they should be growing anyway. If there is nothing on the outside trying to opppress, everybody is happy. If there is, it gets to pop, and everybody who matters is happy. Win/win?
Let me ask you this, what precisely would suffice as proof, in your opinion, of such activities?
On the internet, maybe there really is no such thing as undeniable "proof" that anyone did anything, considering how easy it is to fabricate evidence. [1]
https://en.wikipedia.org/wiki/Argument_from_ignorance
Open and shut case, Johnson!
You said that "there are many much more subtle and effective ways to stifle free speech and human rights than a big firewall," such as "MITM attacks, botnet troll armies, astroturfing, etc. etc."
If you're not asserting that such techniques are being deployed, then ok. But if you are, and follow that up with "Good luck finding proof of that though," as though that's a perfectly reasonable excuse for not being able to back up what you're alleging, then you are yourself asserting "a proposition is true because it has not yet been proven false."
Here is an example of one such attack, which the researchers called "Censorship 2.0".
https://www.reddit.com/r/netsec/comments/38wl43/we_used_sock...
See also:
https://en.wikipedia.org/wiki/Hacking_Team#Use_by_repressive...
http://i.imgur.com/FQNYhED.png
Isn't that interesting? The story above this one is roughly as old, has half the upvotes, and more comments. The one just below it is a lot older, and has a lot more comments than upvotes. Conspiracy? No, just the audience I guess, but all the same: QED.
> Unpopular ideas can be silenced, and inconvenient facts kept dark, without the need for any official ban. Anyone who has lived long in a foreign country will know of instances of sensational items of news — things which on their own merits would get the big headlines-being kept right out of the British press, not because the Government intervened but because of a general tacit agreement that ‘it wouldn’t do’ to mention that particular fact. So far as the daily newspapers go, this is easy to understand. The British press is extremely centralised, and most of it is owned by wealthy men who have every motive to be dishonest on certain important topics. But the same kind of veiled censorship also operates in books and periodicals, as well as in plays, films and radio. At any given moment there is an orthodoxy, a body of ideas which it is assumed that all right-thinking people will accept without question. It is not exactly forbidden to say this, that or the other, but it is ‘not done’ to say it, just as in mid-Victorian times it was ‘not done’ to mention trousers in the presence of a lady. Anyone who challenges the prevailing orthodoxy finds himself silenced with surprising effectiveness. A genuinely unfashionable opinion is almost never given a fair hearing, either in the popular press or in the highbrow periodicals.
I guess a transparent firewall is not a firewall?
Here's an excerpt from Cisco: [0]“Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices.”
I dunno if our disagreement is about the semantics of what a "transparent firewall" is, but the NSA has been shown to filter a majority of the traffic that traverses the USA, so your statements that the USA has nothing like the GFW seems a bit off...
[0]: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/conf...
Everyone going through that gate can be monitored, recorded, held for questioning, etc.
And jumping out of the metaphor, every packet passing through the gate can be copied and stored for later.
And, by the way, the idea that you can trivially evade the GFW using a VPN? That's an extremely dangerous assumption.
>And, by the way, the idea that you can trivially evade the GFW using a VPN? That's an extremely dangerous assumption.
I think that part of your reply was meant for someone else. (I agree with the part I quoted.)
https://tools.ietf.org/html/rfc3924
https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...
That's not correct, csco _implemented_ lawful-intercept, the protocol is an integral part of 3gpp spec I.e. All companies playing in the epc/telecom market would most likely support this e.g Ericsson, Nokia (nsn), Alcatel-lucent etc etc
it's like suing intel because they made the 1GbE NIC in a server seized for kiddie porn.
Note: One fun fact of layer 2 Ethernet is it's insecure enough by itself that many just tap straight into the lines somewhere. Led to development of MACsec standard.
Anyway, you're not going to see a switch subverted by pro's in action. They won't blow that cover. They'll use it to facilitate a normal attack and plant evidence it came through a normal vector. That's how subversion works at pro level.
Oh wait...
It would not be wrong, as in illegal or subject to any civil penalty, if Cisco sold that internet filter to the United States' agencies.
so that highlights the delicious irony in your retort
Second, if you're selling something to a known person, and you have a good reason to know what they're going to do with it. And let's be clear, Cisco totally knew what they were going to be used for in this case. Then you're an accessory.
Is that stated as a fact in the case? I didn't find anything that makes that suggestion.
Reading the abstract of brief, it looks like "built" is being used to me "specifically sold and configured hardware." So it's not necessarily some special asic, but rather machines configured specifically to target and identify Falun Gong members. Anyway, in the 21st century, the line between hardware and software that runs on dedicated hardware is pretty ill defined.
When reading such a court document, remember it is written by a lawyer (or team of laywers) with the intent (explicit or otherwise) of conflating many ideas.
Creative naming of artefacts, systems, roles, organisations, etc. are all employed to paint a picture - the most vivid, influential, negative picture possible - whilst still being technically factually.
Critical reading of the submission, filtering for technical details suggests that yes, there was indeed integration into existing networks (obviously), and existing databases/systems of record, maybe related to Falun Gong, but frankly the majority of the technical data looks like a description of any intercept network - whether for troubleshooting, traffic analysis, or lawful intercept.
the only thing I responded to.
They also censored Benghazi related video on Youtube at the request of the State Department, which, while not really an "abuse of human rights," and only a temporary block, still amounts to propaganda and censorship.
[0]https://wikileaks.org/clinton-emails/emailid/12166#efmAMoAbj
[1]http://www.breitbart.com/tech/2016/03/22/leaked-clinton-emai...
More like attempts to get a civil penalty in the United States for business in another country should fail
Also, do you think it matters that one of the plaintiffs is a US citizen?
bring it up when I run for office
The objection is that it undermines competitiveness in corrupt business environments. Business environments that are inherently corrupt whether the US entity participates or not. Kickbacks are a way of doing business in many jurisdictions, and then the US government levies a charge against you that is solved with: YOU GUESSED IT, ANOTHER KICKBACK. But its okay because the SEC and DOJ call it a settlement.
A totally unnecessary law that is enforced at the discretion of the administration.
Anyway, when I referred to your "objection", it seemed like you were saying any laws affecting business outside the country are pointless and wrong. I don't think I know enough about the FCPA to discuss it specifically.
US citizens can be prosecuted for some serious crimes committed abroad. It doesn't make sense to treat companies differently.
Unfortunately, the government is a hypocrite in this case, by treating its own mass surveillance as legal.
[0] https://www.acm.org/about-acm/acm-code-of-ethics-and-profess...
You can't blame a creator for how a finished product is used. Their vision might greatly differ or it might not exist at all.
Monitor, perhaps. But that's very different. It's also not exactly specified what they built - was it generic and something they might be able to sell to corporations or other governments who want traffic monitoring or something designed only for this purpose?
Well them they've been living under a rock. It's been officially banned for 17 years, and there's literally a wikipedia article about it. https://en.wikipedia.org/wiki/Persecution_of_Falun_Gong
Surely Tor developers could have guessed it would be used for child pornography - should that have stopped them?
People with anonymity aren't "known actors"?
You could just as easily argue willful blindness with Tor or end to end cryptography devs. And that's how I'm worried that a case like this will be used if it's successful.
Are we supposed to forbid companies from complying with customer requests, even if they're unaware or just don't really care how those will be ultimately used? I know I'd implement similar things if it were requested of me.
I doubt this will be a popular opinion on HN, but I don't think Cisco was in the wrong here. Once traffic crosses your network boundary, it's fair game.
"Unaware" is a red herring because Cisco knew exactly what they were doing. From the court filing:
174. In October 2002 and September of 2003, 2005, 2006, 2007, 2008, and 2010, Cisco shareholder resolutions identified concerns regarding potential human rights abuses arising from Cisco network technology solutions provided to foreign countries, including and especially China, and called for investigation into Defendant Cisco’s complicity in these abuses. These resolutions were presented to the Cisco Board of Directors, including Defendant Chambers, and in each instance, the Board of Directors issued a statement recommending that shareholders reject the proposal. Well after this point, Defendant Cisco continued to help the Party and Public Security officers to suppress Falun Gong through use of the Golden Shield.
175. Cisco’s Golden Shield files include several court and prosecutorial reports identifying the douzheng of Falun Gong and other “hostile elements” as one of the five tasks of the Strike Hard campaign created to suppress Falun Gong with the Chinese for the term “element” designating targets of persecutory campaigns in the PRC.
176. Cisco’s marketing materials in China repeatedly boasted that Cisco’s technology solutions could guard against Falun Gong, block and track Falun Gong, monitor and profile Falun Gong, and in other ways persecute Falun Gong.
If someone "just doesn't really care" about actively helping a foreign government to capture its political enemies and torture them to death, I have no problem making a moral judgment about them.
Note that none of the things you list include torture. You've shown nothing more than a tangential possibility of awareness. Without showing their direct knowledge of the torture and a direct link to requests from Cisco, you've proven nothing.
In fact, if anything you've shown they really went the extra mile to look into it. That's way more work than I would have done at least . the reality is that looking into something like this makes it more likely you'll get screwed over if it comes up legally later.
What do you think about manufacturers of end to end encryption tech? Certainly there's evidence that it can be used for bad things too. I worry that cases like this, if successful, could be used against Signal or similar next.
I think one can distinguish between laissez-faire that amounts to "leave human beings to live as they will" and another concept that is "everything is permitted to the powerful". Actually IMHO it is a corruption to consider the latter to even be related to laissez-faire. However, many people conflate the two propositions, and would like the rest of us to conflate them as well.