When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.
- Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them.
- Announce what is going on anonymously. Plenty of avenues for this.
- Announce what is going on, publicly. See if they do indeed want to take you to court.
- Quit.
- Take down the service. Much easier if the service is only a part of your company. Helps a lot if you don't retain the information they're looking for.
- Lie.
- Destroy records (this is by far the riskiest action here, above a simple public announcement).
- Delay. And delay more.
- Keep information outside the jurisdiction, possibly controlled by a third party who will not comply with orders.
- Misunderstand ("Is that a one, or an ell?")
Most of these will get you into trouble, a few won't. Most of these are really difficult roads.
I've given this some thought before. If I found a backdoor in a product, I would remove it with a tracking bug and a checkin, and send internal email about a really bad bug that I'd just fixed; the more internal people that know, the better. And if a VP showed up and berated me, I'd just tell them to fuck off, and quit if it came to that.
These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable.
Further, you don't know what motivated these actions. Is it intelligence about a specific threat? Has the government identified how a specific adversary operates? You could be impeding the investigation into a deadly plot. You have no way of knowing this.
This isn't a game. We have real enemies who would gladly kill all of us. We have processes as a society for deciding how we defend ourselves. If you don't like our current policies, then exercise your vote, exercise your right to speak and publish and assemble. But don't usurp the sovereignty of the people of this country.
problem is, that's the excuse that's always going to be given by the intelligence community for even the most obviously unconstitutional intrusive privacy invading stuff, like the NSA's "opticnerve" program.
You either missed the entire 'democratic legitimacy' part of my point, or don't actually know anything about the Nazis in the late 30s.
Ans: Tens of thousands of NSLs and other secret actions make it really improbable that a small set of refusals to cooperate will result in great harm. Or that the game the government is playing is really about "bad guys" most of the time.
"No really, this is about an actual bad guy this time!"
The government has lied repeatedly about this stuff. It has covered up the fact that it performs unlawful surveillance on its "sovereign people". If this is about a bad guy this time, rather than all the other times when it has been lies or cover-ups, then that's just too damned bad, isn't it? See also: The Boy Who Cried Wolf.
I have a fundamental disgust with arguments that attempt to appeal to blind loyalty. That "sovereignty of the people" you wrote about has been invoked too many times by scoundrels to be respected.
Sure, there are indeed bad guys who are trying to kill us. But that doesn't justify a wholesale surveillance state, or tens of thousands of NSLs, or secret courts. That's just stuff the powers-that-be want, and have used the bad guys as an excuse to get.
We have warrants for that. Subpoena Yahoo for specific records. I'm not willing to trade the freedom of an entire country for a single investigation. This isn't an episode of 24 and there is no Jack Bauer.
The fourth amendment was sold as follows:
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
I'm not a constitutional lawyer. I'm sure the actual amendment can be interpreted to mean whatever George W and Co want it to mean. But that's not how it was sold, and this government is not legitimate as far as I'm concerned. Not as long as it runs dragnet surveillance over the American people. Snowden is a patriot and the U.S gov't is betraying the public.
The judiciary is not meaningfully overseeing the parts of the state where law enforcement and national security intelligence mix. The FISC is a great example: it pisses off the agents and attorneys who have to deal with it, because it imposes an unholy amount of drag: they're trying to do their jobs, catch bad guys, etc.---and a FISC submission takes weeks of full-time work. But the FISC only exercises drag, not control. It can't steer---we see this because it never refuses a request. I suspect that's all one-sided proceedings can do, given the way we train our lawyers and judges. So it fails the needs of the citizens, and it doesn't protect liberty.
The FISC, and NSLs, will someday be looked at with the same light as Adams' Alien & Sedition Acts: as fundamental betrayals of the American promise by an executive too scared of what might go wrong to trust the country to go right.
Look, there's a lay assault on their legal and democratic authority: NSLs are not obviously a legitimate exercise of Federal authority. And for all that, if I were at the FBI and chasing a terrorist cell on American soil, I'd use one in an instant.
There are issues with FISC(like lack of transparency), but this specific point is unclear to me. Here are some possible scenarios where a low refusal rate wouldn't be a problem:
* The judge could informally tell the agent that the request needs to be amended before he'll grant it.
* FISC could publish clear guidelines on what is and is not allowed, so agents are never surprised and only submit legal requests.
* Agents only make requests in extraordinary circumstances, so every request comes with a lot of legwork and investigation done making it clear why it is necessary.
FISC is a court in name only. There is no oversight (I don't count the political appointees in the Senate as oversight), there are no checks and balances, there are no appeals. Calling it a court beggars the term.
It's difficult to reconcile this idea of democratic sovereignty with the utter secrecy in which the operations under discussion are performed.
This is imho the untold truth about why most communist / socialist regimes failed: people at all levels of society started doing their work gradually worse and worse, pissed off and stressed out by the lack of freedom and constant interference from state organs, until everything collapsed, and people now live in better economies and freer because they've destroyed their previous systems. Yeah, most of the people who performed such "low level sabotage" will not even recognize to themselves that they did it. And yeah, bad governments were also helped to fail by external interference and external sabotage, but imho a "socialist regime where the people would truly believe in socialism/communism" could have worked out and had good economic performance, problem is that when "good economic performance" can only be had at too high of a cost of "individual personal freedom", people will start, even subcounsciously motivated, without admitting even to themselves what they are doing, and with insect-like non-communicative coordination, to slowly and methodically weaken the system they live in from within, until it crumbles, even at the cost of their own lives sometimes.
This was America's secret weapon that helped "win the cold war" - people's inner "instinct for freedom or death" - thank god we all have it and a race of subhumans lacking it has not yet been engineered! It might also be the reason why so many Americans "voted for Trump", though this was probably engineered by some really smart "puppet masters" - the guy is clearly a "man of the establishment" despite it's clown persona...
Of course, there is no "monument to the lazy and drunk soviet worker that helped take down communism". And there will be no monument for the Google employee that writes a subtle bug in the "government reporting module XYZ" :) Of course, if the gov doesn't abuse its power and asks for too much, that poor programmer might not be so "overwhelmed" by it's duties so as to make stupid "mistakes" with dire consequences...
Probably one of the worse and most mentally damaging ways to enact social change. Now you have democracy, but also a society with 50% of the seniors infected with a toxic mentality that will stay with them until they die - once you do something over and over again it becomes a habit and a habit of subtle systemic and self sabotage is horrible. And some of it managed to pass it on to younger generations, hence extra laziness and crime. Almost like the fallout of a "mental nuclear war" that keeps lingering and "irradiating people's minds" long after the old problems disappeared.
I'm just remarking that in its slow and lives-wrecking way, this... works!
There absolutely should be mechanisms to challenge or appeal against any action of government, and when there isn't as seemed to be the case with NSLs that's a very good indication that the system is being grossly abused by government agencies.
> Misunderstand
see also: https://www.schneier.com/blog/archives/2016/06/1944_cia_sabo...
https://www.cia.gov/news-information/featured-story-archive/...
http://www.joeydevilla.com/2015/10/15/how-to-sabotage-your-w...
"general interference with procedures"
[1] http://www.slu.edu/Documents/law/Law%20Journal/Archives/Dugg...
Don't do it in an obtuse manner; let them know in advance that you will be sending it following the meeting, maybe even get them to suggest the wording of it if you aren't convinced of the security of internal mail.
It's easy for either side to forget the exact points raised during a conversation like that, so good for everyone to have a written record.
In the event that you are asked to do something illegal, it may be illegal or inadmissible to mention that you were ordered to do so by the government (Matrix-Churchill trial passim)
From my reading of the case law, the crux would be that right to counsel can only be invoked "at or after the time that judicial proceedings have been initiated against him, whether by formal charge, preliminary hearing, indictment, information, or arraignment."
Does an NSL constitute adversarial proceedings? Also, how does right to counsel work with other legal gag orders (e.g. if I'm cooperating to provide information on a criminal case but have been ordered not to inform the targets)?
That's actually exactly why we have counsellors.
The nature of such an order requires you to be able to tell the people who need to do it what it is that you need them to do, even if you can't tell them why.
Additionally, anybody with the power to veto such a change also must be provided with a good reason why they can't veto this one. Your legal counsel needs to understand why the change must happen, so he can respond appropriately to questions from pissed off developers and ensure that your company is complying with the letter of the demand (and no more).
(They, of course, are bound to not share it further.)
- CEO gets a Letter. Does the CEO start learning Python/C++/PHP and Cisco configuration? Or does he tell a worker bee "Shhh! And read this Letter" ?
- Worker bee starts making changes to production code and systems. Suddenly he starts needing automated code reviews, and reconfiguration alerts go out when he frobs the firewalls. These changes are indistinguishable from an infiltrator with the worker-bee's credentials and ideally things are set up so that changes are generally shared around, a normal review process, to catch out-of-control worker bees.
- The build lab scripts are modified (by who?) to insert bad code. Oh, but the build checkers catch this ("Hey, we found a compiler bug!" / "Umm, no you didn't..."). Everybody starts handing around links to "Reflections on Trusting Trust".
- Things get even more exciting when the internal monitoring systems discover (say) equipment attached to the network that ain't supposed to be there. "Wot's all this then," says the network engineer, and he yanks the cables to the SkankSec-1000 that someone hot-wired into a rack. "Oh yeah, blue fiber is for NSA, green is for CIA, yellow is for GCHG, and black is for Russians, what else?" He leaves it unplugged. Let's ignore the security camera footage in the datacenter, since this is a thought experiment.
In an environment with self-monitoring for health and intrusion detection, applying changes for user surveillance requires quite a lot of internal cooperation and communication. No wonder the Yahoo stuff looked like a Bad Guy who got in.
We can probably extend the internal defenses to alerting on odd access patterns to sensitive database rows, too . . .
I don't know how Yahoo is organized but if teams works in silos, without any visibility on other teams, it is probably not that hard to introduced changes that are undetected.
Access to critical data should be similarly protected.
These are relatively tame intrusion detection systems that you would have to make changes to in order to remain undetected. That should be really hard to hide.
Edit: But seriously, I'd take the job loss in a heart beat if my company was doing this crap.
I realize this stuff is easier said than done, but there's a lot of tough talk about the ethics of many things on HackerNews. How many people here work for companies like Yahoo or Facebook or many smaller shops that are legitimately harming people with these sorts of things?
This is why I've given it some thought. This is something that you probably need to spend a little time thinking about if you're in a similar situation, because things are not going to get better.
It's a personal decision. I can't tell you it's worthwhile to quit your job or risk legal action. But if you're responsible for the privacy and rights of millions of people, you should consider what your actions will be.
Yahoo may still be court ordered to implement it, just hopefully not with their best and brightest developers. I also have a theory that a lot of the recent terrible news coming out of Yahoo is due to staff complying with the letter of the legal order but not the entire thorough spirit of it, intentionally doing a quick, shoddy bug ridden job.
While I've never had to make such a choice, I can tell you that my personal attitude towards what I would and wouldn't do changed the day this restriction was removed.
The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team.
The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team who was unaware) but the ones who obeyed and pushed something they believed was wrong.
Whether it is public shaming or having a permanent stain on their reputation next time they go job hunting, we need a way to retaliate.
Right now, they can fuck us and get away with it and what's their excuse? "the government told me to do it. Just doing my job. I had no choice."
There are no societal consequences to cooperating with the government even when we believe it's wrong.
Create a climate of "snitches get stitches" and maybe they will think twice before selling out the lives of a billion people. The same way these government officials hide behind patriotism when they mean blind obedience to my authority.
If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your anger. Not everyone is in so privileged of a position to be taking your specific moral high ground over their own well being.
Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality?
In which case, keep voting and I'm sure you will see the changes you want reflected in legislation just so they can be ignored in by secret courts and intelligence services.
In the real world, people respond to threats (e.g prison). That's what the government uses. Why are we expected to behave differently?
It's an expression. How about "Losing your livelyhood." It's a real thing for some people.
> Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality?
You're way off on my morality. It's more centered on not causing harm to others, which is what you're suggesting people do, to others that don't fit your sense of morality.
> In which case, keep voting and I'm sure you will see the changes you want reflected in legislation just so they can be ignored in by secret courts and intelligence services. In the real world, people respond to threats (e.g prison). That's what the government uses. Why are we expected to behave differently?
Do you really think voting or threats are the only two methods to enact change? Neither work particularly well. What does work well is changing the opinion of the majority, and until you do that, you must question whether your minority opinion is actually the correct one, and provide reasons for others to change their opinion of you believe it to be so. Taking the low road and suggesting punishing people who aren't the cause will get you nothing but negative comments on hackernews.
In a capitalist system, where your alternatives are "work or stave", yes.
"I just did what the authority figure told me to" is one the oldest excuses in the book.
The main connotation which invoked my response was equalling the resentment of following the law unilaterally to the mindset of a criminal organization.
2/ In any case "the law" is only the result of a very imperfect process; it's not the word of God: it can be changed (it often is) and it doesn't have any special moral value. Your moral code is yours, it's dictated by your conscience and should not be taken whole from texts written by other people.
In the 20th century, many crimes have been committed by people following the law, and not just in Nazi Germany. French Jews were arrested and delivered to the German authorities by members of the French police who were simply following orders. The ones giving the orders have indeed been tried after the war, but not the ones following them; in fact they never had to suffer any consequence for their actions. But the truth is, had there been no cops willing to participate, there would have been no deportations.
"I'm just doing my job" or "I was just following orders" is NOT a valid excuse. It's a cop out (pun intended).
"Privilege" doesn't enter into it. Everybody has the option to do the right thing, if they're willing to accept the consequences. Not everybody will of course, but there's nothing truly preventing one from doing so.
I didn't see anybody say that, so I'm not sure what your point is.
At the end of the day, sometimes doing "the right thing" has horrific consequences. Some people can and will accept that, some can't or won't. But the choice is always available.
Consider that the Founding Fathers of the US had "Give me Liberty or Give me Death" as a rallying cry, not "Give me Liberty, or erm, well no more than minor inconvenience". Sometimes you have to be willing to accept death, imprisonment, etc. for a cause you believe in. Look at Edward Snowden, who did what he though to be "the right thing" even though he knew the most likely consequence involved death, imprisonment or torture (or some combination of all of the above).
Committing crimes against people who defect is obviously not going to work. They'll just arrest you for it.
But suppose we create a certification. To get certified all you have to do is promise not to work on a specific list of things: Mass surveillance, backdoors, etc. To lose certification forever all you have to do is work on one of those things.
Then we can have companies offer to put it in their contracts with their international customers that they'll only hire employees and contractors with that certification. Any companies that aren't actually working on mass surveillance etc. are happy to do this because it gives their customers more confidence that they aren't, and if it becomes popular then any companies that don't will become suspicious and lose business.
Then all employees at all companies will have to think twice before working on such things, because it would mean giving up any possibility to work at any of the companies who won't hire such people, which with success will constitute most of the industry.
There, fixed that for you. That small detail is why your attractive idea wouldn't work in real life. How many years it took for the car industry scandal about tampering with emission tests to be revealed? And it only got to ruin the the reputations of the few engineers involved in the forgery.
The same goes for theft and graft and murder. You don't get punished if you don't get caught. But you could get caught, and you don't know ahead of time whether you will or not.
I fear you may be making a potentially dangerous assumption about how engineering works in a compartmentalized environment. Engineers do not always know the purpose of the systems on which they work.
Once upon a time in Texas I spent several years working on a system to run a binary sample through a series of plugins that produced analysis of the binary sample. I was told that this was to help detect malware - and it could certainly do that.
Did I know that for certain? No. Were there other possible uses, such as to determine how detectable a given piece of experimental malware was? Yes. Did I have any way, shape, form, manner, or means of finding out what 100% of uses were? No.
A lot of software has more than one possible use.
While on topic, if they threaten you with prison if you don't do their bidding (with no due process, etc), doesn't that make them the terrorists (eg: they're using terror/fear to get people to do what they want).