Annoyed at crypto, Brazilian judge orders mobile carriers to block WhatsApp
arstechnica.com
arstechnica.com
And Facebook Brasil just claims is another company. But the counter court order that removed the block the other times was filled by Facebook Brasil.
So Facebook Brasil + Whatsapp are obviously on an arrogant position with very unprofessional response to the court orders. If a proper brazilian lawyer was hired to properly react to the court orders I doubt that any of the 3 blocks would ever have happened, moreso because they have strong technical and ethical reasons on their side. At a minimum there would be a long judicial dispute. Even the judge that overruled the other block stated that Whatsapp didn't act the proper way while dealing with the previous court order.
WhatsApp might have the HN crowd sympathy on this, but they brought these issues to themselves by being unprofessional on their response to brazilian justice.
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
You imply that Brazilian authority extends overseas, over the entire Internet.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
Edit:
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system: http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.
The first couple times that WhatsApp was blocked in Brazil, the reason was that they denied access to certain logs.
This time, they explicitly mention they want encryption to be turned off and demand WhatsApp to reply to Brazilian requests in Brazilian terms. The problem is that WhatsApp, as stated before, do not operate in Brazil as has exactly zero obligation to answer Brazilians court orders.
Now it's time for the country to discuss, as are many other places in the world, where does the right to investigate crimes by prying into someone or some groups communications begins and where does the right to privacy of the population ends.
The Supreme Court judge who suspended the block argued that it violated basic rights of the people, which is good, but already there is talk of a political project to establish what those in power all over the world want: access to communications and access to the ability to punish those who don't obey, the later in the form of an obligation for the companies involved to have an arm in Brazil.
That's not true. If the user receiving the message is not online how is the message supposed to be delivered? Obviously the server holds it until the user comes online. So yes, there is data.
The only data that needs to be stored by WhatsApp is `Sent` and not the message itself, which can be stored locally by the Messenger.
[Messenger] <--> [Sent Succesfully?] <--> Recipient
When the Recipient receives a message - they alert WhatsApp that the message has been received which can then alert the Messenger that the message has been sent. If it comes back with a failure, the Messenger will attempt to send the message again in `${Time}` until it sends. The message itself never has to hit WhatsApp's servers.
I'm not sure Whatsapp has everyone's sympathy here; not mine at least. If I live in democratic country X where the law says Y, then I want my government to uphold that law in my country. If company Z refuses this, banning company Z from the country as a last resort seems like the right course of action.
Now if the majority of said country's citizens does not like law Y because it causes trouble for company Z, then they have to make that known. That's democracy as far as I know.
I'm quite firmly on Brazil's side, though I can see Whatsapp's point as well.
As for democracy ~96% of Brazilians with access to a smartphone use WhatsApp as their primary method of communication. There was a fair bit of outrage in Brazil. Though I may personally be more aware of it as its the those with smart phones were the people I heard the most from.
Thank you, sir.
"Out of spite" is ridiculous indeed, but I sustain my guess that if a proper brazilian lawyer had addressed the case, no block would ever be ordered.
(I am having a No True Scotsman[1] kind of a reaction to this phrase, with a side serving of Kafka[2].)
Their lawyers answering the judge's court order are from this american firm: https://www.zwillgen.com/
That's not how the internet works.
That means that it is not universal or obvious that this kind of blocking would be practiced or accepted. (For example, if a Brazilian company ignored a subpoena from a U.S. court, there would not be a legal basis for the U.S. court to order ISPs to prevent Americans from accessing that company's services.)
Some portion of Brazilians think it is "obvious" that a government would never allow its citizens to access Internet services that allow or commit violations of local law, or are simply not subject to local jurisdiction at all. But it's not obvious at all.
blocking whatsapp because they are being uncooperative with Brazil's legal system is completely fair.
> They asked for access to data WhatsApp has no access to, and then blocked the service when they didn't get it.
Are they required to be able to provide such data when asked if they want to operate in brazil?
Did they respond to the request in a reasonable fashion?
No, WhatsApp is not subject to the judge's jurisdiction. They do not have to cooperate, respond in reasonable fashion or anything.
The power of law has limits.
The name "Facebook Brasil" makes me wonder: what's the relationship between Facebook (the USA company), Facebook Brasil, and Whatsapp? Does anyone here know the details?
Everybody seems to be assuming that "Facebook Brasil" and "Facebook (parent company of Whatsapp)" are the same, but is that really the case? And how does that affect the jurisdictional questions involved in these cases? The decision mentions a law that says that foreign companies that have one "agência, filial ou sucursal" in Brazil are considered as having domicile in Brazil, but would that affect a different subordinate of the same parent company? Does it depend on which kind of subordinate it is?
This is exactly the claim of Facebook Brasil legal team.
WhatsApp is a Delaware Corporation based in the USA, with no operations in Brazil.
Do you mean that they claim they are based ouside of Brazil? I guess from the context that that's what you meant, but unfortunately "based out of" means "based in." I know, crazy language we have.
Not mine. But Brazilian courts, with their over-arching powers, have even less sympathy; Brazilian bureaucracy, with their disregard for individual freedom, have even less sympathy; and lawmakers, with their disdain for those without as much command of the laws, the least of all my sympathy. That someone is not doing their every bidding - oh, I'm sorry, not treating them "the proper way" - is something that must be hard to muster. I guess their contempt made them blind to what makes sense and what doesn't.
Brazil doesn't get a free pass in something no one else in the civilized world is asking for.
And yes, it's also possible that it's just an arrogant law firm (always a possibility), but it's also possible that their counsel advised them specifically not to retain a Brazilian-speaking attorney, or sworn translator into Brazilian Portuguese (who typically would have some ties to the country).
Another possibility, frankly, after the last time ended up with one of their executives arrested for contempt of court, is that Facebook/WhatsApp may not have wanted to risk the freedom of some poor freelance translator in Brazil, who risked being hauled off to jail for having his name on the translation (required for legal translations in most countries).
I never had any sympathy for Watsapp, and still have none. But I can't have any for this judge either. Good thing the Supreme Court already overruled her.
But I hope that at least part of the conversation can be brought back to the issue of encryption in Brazil. This case is simultaneously also about whether encrypted communications are okay in Brazil, because the Brazilian government wants a company abroad to put backdoor features into their software. That means that no Brazilian may have secure communications without backdoors.
I cannot imagine that Brazilians trust their government anymore than Americans. I propose that any government will always be able to lift any privilege (aka right) in the legitimate or illegitimate pursuit of its interests, but that the citizen should not voluntarily forfeit their ability to secure themselves, especially with something as non-violent and social as communication security.
Also, even when a government is legitimately pursuing its interests in determining the criminality of a citizen, if Brazilian prosecution is anywhere near as hostile and adversarial as the US, then the Brazilian individual ought not voluntarily yield themselves to government investigation, even if they are innocent or righteous.
http://www.conjur.com.br/2016-jul-19/stf-derruba-decisao-jud...
We need a whole generation full of such applications and services, all of which have no access to user data, so that jurisdictions get used to the idea that user data is owned by the users, and that there's no point in going after the service. And with enough such essential services woven into everyday life, it'll become less feasible or politically acceptable to attempt to block them.
Consider the very short list of countries that block Google, or YouTube, or Wikipedia, and what properties those countries have in common, versus the much larger set of countries making attacks on encryption right now. Consider the expected length of a political career in a reasonable country for someone who tried to block YouTube, versus the disturbing lack of backlash against attacks on encryption. We need to make attacking encryption a political third-rail.
If email was created today it would be one company and they would call it a platform. More than one company is trying to co-opt email in to their own app and do just this. May be it would be totally free at first but gradually exposure would decrease and eventually companies would have to pay to ensure that their customers saw their messages. If a gag order was attached with the backdoor, no debate would even happen.
This isn't an anti-business rant. Every tech company today has benefitted tremendously because of open standards - from Linux powering servers to http to the peering among internet providers. What if every free piece of the pie came at a cost?
There are a lot of funded tech companies right now creating free services in an attempt to grow their platforms as large as possible. Then, when they hit the critical mass of the network effect they either start charging or do something to cash in.
This means that the next generation of tools not only have the potential to "tax" the next generation of businesses for every little piece they have, but it also brings immense cross-border regulatory exposure increasing the risk of broken dependancies. What a different story it would be if the headline read "Brazilian judge orders mobile carriers to block the internet." We would all laugh.
The laughably tiny adoption of GPG, and even TLS between SMTP servers for that matter, should make it abundantly clear that voluntary extensions aren't good enough. A federated system which respects peers' "freedom" to not react adequately to a changing threat profile is somewhere between irresponsible and actively malicious to its end-users.
I, for one, celebrate the death of open standards like email in favor of mechanisms that can actually be improved (i.e. by forcing people to upgrade on pain of being locked out of the network) in response to new developments in security.
> We are only requesting disabling cryptography and intercepting data, mirroring messages real time in one of the ways suggested by the Ministério Público [1] - in addition to forwarding the messages received by the user but not yet encrypted; in other words, the exchanged messages must be forwarded in real time before encryption is implemented, in a manner similar to phone tapping.
(This is a direct quote from the court order.)
This is ridiculous. Judges shouldn't have the power to force software authors to install backdoors. Nobody should. What's next? Outlawing encryption?
[0] http://jota.uol.com.br/justica-rj-determina-novo-bloqueio-wh...
[1] https://en.wikipedia.org/wiki/Public_Prosecutor%27s_Office_(...
I also found it interesting that Facebook's lawyers (which appears to be from https://www.zwillgen.com/) asked for:
> If possible, please provide responses in English as that will significantly improve our ability to analyze and process your request in a timely manner.
> 1. Is this a criminal matter?
> 2. What organization is conducting the investigation (Federal Police, Civil Police, Prosecutor’s Office)?
> 3. What is the nature of the crime being investigated (corruption, drug trafficking, gun violence/homicide, child exploitation, terrorism, etc.)?
> 4. What are the specific WhatsApp accounts that are the target of this legal process (including all applicable country codes)? > > 5. What data are you requesting for each of the targets listed above?
I wonder if this was only to keep internal statistics.
I think I'm with the judge on this one. I found this really lazy and of bad taste on Facebook's part. The firm representing Facebook won't afford a translator for one of their top 3 countries (I'm guessing) in number of Whatsapp users? Really?
Insensitive and foolish move on Facebook's part, sure, but come on. Let's put things in context here...
Doesn't change the fact Facebook lawyers are in the wrong when it comes to this specific issue (and, of course, that doesn't mean the judge is right about everything else).
You conduct business in the language of the land. If you don't speak it, hire someone who does to translate for you.
A question to ask politicians "How do you outlaw math?".
Plenty of countries outlaw certain uses of words, which is not much different.
I'll go be sick in the corner now from writing the truth of it.
To me, the most eyebrow-raising part is "[...] além do encaminhamento das mensagens já recebidas pelo usuário e ainda não criptografadas [...]" (page 4, rough translation: "and also the forwarding of messages already received by the user but not yet encrypted"). Do they believe that the messages are encrypted only after being received either by the user or by a central server? I get the feeling that they think that the encryption is done by a central server, and that the messages can be intercepted there before the encryption (while in reality, they're probably encrypted by the sender's phone, so intercepting would mean pushing a software update).
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system: http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.
So, a judge required Whatsapp to put a backdoor to realtime wiretap some users before the payload is encrypted. I personally dont think Whatsapp should comply.
Whatsapp isnt secure, anyway, the default config is to store all the messages and the key on icloud or google. Also, the server knows your contact list, (and bans you if you dont sync), and someone could tap your wifi to get your contact list.
The judges here are annoyed that the lawyers requested info that is under a gag order, and that they answered in English, and that Facebook, who has a local office plays dumb and insists that "Whatsapp is out of my jurisdiction" when Brazil has the 2nd bigger userbase of the app. They are hitting them where it hurts - blocking 7 billion usd of their assets. http://link.estadao.com.br/noticias/empresas,justica-brasile...
Wouldn't they also have a contact log for each user?
That plus the contact list is a pretty nice chunk of data for use by their parent company.
And also, it would surely be useful for law enforcement. Has it been shared with the courts?
Also, the judge requested that "messages in the server that still haven't been encrypted" be handed over.
It just shows the complete lack of understanding of how it works by the judge.
[2] http://techcrunch.com/2015/12/01/whatsapp-is-blocking-links-...
The problem is that a Judge here in Brazil cannot be fired based on the number of reformed decisions.
As a french man once said, Brazil is not a serious country.
EDIT:
http://www.ibtimes.co.uk/whatsapp-blocking-encrypted-calls-s...
Is this what you're referring to? This deosn't indicate that they're disabling encryption, but that they're blocking all calls to Saudi numbers. A different issue.
There's an expectancy that we(I'm Brazilian) can understand and live with the consequences of Encryption, as any other democratic state.
But, in Brazil, Judges have a lot of power and they can make "undemocratic" decisions witch will be overruled by the superior instance.
Brazil do not follow (broadly) the stare decisis system in witch low instance judges must follow precedent upper decision.
In special repetitive cases, the Supreme Court can edit some enunciates called "súmulas vinculantes" that bind every branch of power (except legislative) to follow their statement but that's a exceptional measure.
As of today, there's only 55 "súmulas vinculantes".
It is unrealistic to expect WhatsApp to 'correctly respond' to every little despot's 'court orders' worldwide.
They may very well ignore brazilian justice. It is their choice. What they can't do is to ignore brazilian justice and continue to operate in the country.
No, really, this has always been the means, we are going after "criminals" and once that is possible, then it's everybody else.
As an example, here in Georgia you can theoretically be ticketed for going too slow and too fast at the same time; traffic law says don't impede the flow of traffic, even if said traffic is going 20+ over the limit. So if you're going 5 over and everyone else is going 20 over, you're at risk of getting both tickets.
I realize that traffic infractions are not what most consider crimes, but it scales to misdemeanor and even felony offenses as well. "Show me the man and I'll show you the crime."
http://www.cato.org/policy-report/januaryfebruary-2010/crimi...
It's exactly what this is. Trying to show off and make people bend over backwards.
Sad that it usually works with less fortunate people and companies that can be swallowed by a mountain of bureaucracy and undecipherable legalese. That a company is standing up for it should be cause for celebration.
Unless WhatsApp traffic is explicitly denied at the ISP level (this order) their packets can float all over Brazil without say-so. That's the Internet, baby.
How does one even measure that? Is it measured in units of polpots or what?
Yes but how they get access is important. A judge could order someone who has critical information to be tortured, but at least in democratic societies, most wouldn't. Of course the ramifications of using torture are clear, technically illiterate people might not understand the risks of banning encryption.
http://oglobo.globo.com/rio/juiza-agredida-no-bep-ganhou-ape...
Unfortunately, tech-related ignorance is common across ages and genders.