Hacker News Reader

> Delay

> Misunderstand

https://www.cia.gov/news-information/featured-story-archive/...

http://www.joeydevilla.com/2015/10/15/how-to-sabotage-your-w...

"general interference with procedures"

In a large company, a useful thing to do if something fishy is going on is to go see the company's general counsel.[1] If they didn't know about it, they should be told. Their job is to keep the company out of legal trouble. In many cases they have a legal obligation to do something about it. An attorney will rarely tell you to do something illegal; they can be disbarred for that. If they tell you it's OK, then they've given you legal advice as an employee, which gives you some protection when things come unglued. You're also unlikely to be fired for talking to the company's general counsel.

[1] http://www.slu.edu/Documents/law/Law%20Journal/Archives/Dugg...

I'd suggest following up any conversation of substance with general counsel (or even the likes of HR for that matter) with an email detailing the conversation you just had.

Don't do it in an obtuse manner; let them know in advance that you will be sending it following the meeting, maybe even get them to suggest the wording of it if you aren't convinced of the security of internal mail.

It's easy for either side to forget the exact points raised during a conversation like that, so good for everyone to have a written record.

But wait! The emails are being intercepted by the NSA and CIA...

You might as well just quit if you think HR is there to help you at all. HR is there to protect the company from you.

Corporate counsel != HR.

In the case of NSLs, or UK orders from the security services, it may be illegal to tell anyone who isn't mentioned in the order. Including the company's general counsel.

In the event that you are asked to do something illegal, it may be illegal or inadmissible to mention that you were ordered to do so by the government (Matrix-Churchill trial passim)

Would be interested to hear a legal opinion on this. In the US, you do have a constitutional right to counsel (Assistance of Counsel clause of the Sixth Amendment), generally of your choice.

From my reading of the case law, the crux would be that right to counsel can only be invoked "at or after the time that judicial proceedings have been initiated against him, whether by formal charge, preliminary hearing, indictment, information, or arraignment."

Does an NSL constitute adversarial proceedings? Also, how does right to counsel work with other legal gag orders (e.g. if I'm cooperating to provide information on a criminal case but have been ordered not to inform the targets)?

IMHO you have a right to counsel because as a normal citizen, you can't be expected to actually understand if the letter is valid, legal, etc.

That's actually exactly why we have counsellors.

If you're the CEO or some other exec in receipt of such an order, you're not going to be able to single-handedly implement a backdoor without anyone noticing, even if you possessed the skill to do so in the first place.

The nature of such an order requires you to be able to tell the people who need to do it what it is that you need them to do, even if you can't tell them why.

Additionally, anybody with the power to veto such a change also must be provided with a good reason why they can't veto this one. Your legal counsel needs to understand why the change must happen, so he can respond appropriately to questions from pissed off developers and ensure that your company is complying with the letter of the demand (and no more).

My understanding is that US requests explicitly include a clause that exempts your counsel from the NDA requirement, in that you're permitted to show it to and discuss it with them.

(They, of course, are bound to not share it further.)

That almost has to be the case. Otherwise, I get this "legally binding" order that I don't understand but looks scary, but I can't discuss it with my counsel? How am I supposed to tell the difference between that and a con job?

I wonder how they think this is supposed to work.

- CEO gets a Letter. Does the CEO start learning Python/C++/PHP and Cisco configuration? Or does he tell a worker bee "Shhh! And read this Letter" ?

- Worker bee starts making changes to production code and systems. Suddenly he starts needing automated code reviews, and reconfiguration alerts go out when he frobs the firewalls. These changes are indistinguishable from an infiltrator with the worker-bee's credentials and ideally things are set up so that changes are generally shared around, a normal review process, to catch out-of-control worker bees.

- The build lab scripts are modified (by who?) to insert bad code. Oh, but the build checkers catch this ("Hey, we found a compiler bug!" / "Umm, no you didn't..."). Everybody starts handing around links to "Reflections on Trusting Trust".

- Things get even more exciting when the internal monitoring systems discover (say) equipment attached to the network that ain't supposed to be there. "Wot's all this then," says the network engineer, and he yanks the cables to the SkankSec-1000 that someone hot-wired into a rack. "Oh yeah, blue fiber is for NSA, green is for CIA, yellow is for GCHG, and black is for Russians, what else?" He leaves it unplugged. Let's ignore the security camera footage in the datacenter, since this is a thought experiment.

In an environment with self-monitoring for health and intrusion detection, applying changes for user surveillance requires quite a lot of internal cooperation and communication. No wonder the Yahoo stuff looked like a Bad Guy who got in.

We can probably extend the internal defenses to alerting on odd access patterns to sensitive database rows, too . . .

The easiest way is probably to create a bullshit project with a few people. We are only creating a new dashboard for X, this is cost reduction project, etc.

I don't know how Yahoo is organized but if teams works in silos, without any visibility on other teams, it is probably not that hard to introduced changes that are undetected.

In a place where everything is monitored, down to the MAC address of machines and their network traffic, ideally it would be difficult to sneak in a monitor.

Access to critical data should be similarly protected.

These are relatively tame intrusion detection systems that you would have to make changes to in order to remain undetected. That should be really hard to hide.

This is apparently pretty much what happened at Yahoo! when the security team found out the rootkit.

I'm in a right to work state, so they'll just find something else to fire me for.

Edit: But seriously, I'd take the job loss in a heart beat if my company was doing this crap.

In other words, act the same way that most govt legislators would act when asked about any non public relations information...."but sir, I was just following your example..."

>Options: - Refuse to take action.

I realize this stuff is easier said than done, but there's a lot of tough talk about the ethics of many things on HackerNews. How many people here work for companies like Yahoo or Facebook or many smaller shops that are legitimately harming people with these sorts of things?

I've worked on products with tens of millions of customers, in a position to know if something nefarious was going on, and also in a position to be able to do something about it.

This is why I've given it some thought. This is something that you probably need to spend a little time thinking about if you're in a similar situation, because things are not going to get better.

It's a personal decision. I can't tell you it's worthwhile to quit your job or risk legal action. But if you're responsible for the privacy and rights of millions of people, you should consider what your actions will be.

I'm all for taking the high road in these situations. But I would highly disrecommend option 2. NSL and the like are targeted narrowly and they will find you... so you might as well get some public kudos for speaking out. But speaking of, regarding option 3 - they definitely will take you to court and definitely win and throw you in jail. Not to mention in both cases, they will likely cease & desist/gag/NSL whatever media you speak out in right quick, so unless you have legit media connections there's no guarantee your announcement will go viral and spread beyond their ability to douse it.

I think it's reasonable to expect a reasonable level of (legal) pushback from service providers against government warrants or mandates. It's unreasonable to expect of them to risk their entire business.

But they're doing that anyway, in bits and bobs, when they erode the trust of their customers.

I think maybe this is something that can only be solved by elected officials being pressured by the public. Expecting companies to go up against the government is not reasonable.

Or...leave! Mine are Kerala and São Paulo.

Take it up with the people who thought it was a good idea. All the above is sneaky. Just talk with people up the chain if someone is following orders from someone else. If that means you end up in the white house, so be it.

Be found in contempt and go to jail... you first?

No - Nelson Mandela first. Martin Luther King first. There's a precedent of people going to jail for standing up to civil rights violations.

Mandela went to jail for acts of violence not for standing up for human rights.

All that would accomplish is that you and everyone you sent this letter to would now be subject to another NSL with a gag order, and your fix would be undone.

I don't see how a gag order can scale to hundreds of people without the subject matter becoming common knowledge.

Lots of secrets scale to hundreds of people just fine, and are enforced weaker than with a prison sentence. As far as any of those people are concerned, they are now actively monitored in the name of national security (same reasoning as why the NSL was issued).

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that.

These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable.

Further, you don't know what motivated these actions. Is it intelligence about a specific threat? Has the government identified how a specific adversary operates? You could be impeding the investigation into a deadly plot. You have no way of knowing this.

This isn't a game. We have real enemies who would gladly kill all of us. We have processes as a society for deciding how we defend ourselves. If you don't like our current policies, then exercise your vote, exercise your right to speak and publish and assemble. But don't usurp the sovereignty of the people of this country.

> You could be impeding the investigation into a deadly plot.

problem is, that's the excuse that's always going to be given by the intelligence community for even the most obviously unconstitutional intrusive privacy invading stuff, like the NSA's "opticnerve" program.

When your argument can also be used unchanged by the Nazis in the late 30s, it's probably not the best way to go.

>When your argument can also be used unchanged by the Nazis in the late 30s, it's probably not the best way to go.

You either missed the entire 'democratic legitimacy' part of my point, or don't actually know anything about the Nazis in the late 30s.

I don't see a whole lot of "democratic legitimacy" in FISA courts or black budgets in the tens to hundreds of billions of dollars.

Recall democratic legitimacy isn't necessarily moral authority. "The tyranny of the majority", etc.

"How do you know it's not really about a truly bad guy?"

Ans: Tens of thousands of NSLs and other secret actions make it really improbable that a small set of refusals to cooperate will result in great harm. Or that the game the government is playing is really about "bad guys" most of the time.

"No really, this is about an actual bad guy this time!"

The government has lied repeatedly about this stuff. It has covered up the fact that it performs unlawful surveillance on its "sovereign people". If this is about a bad guy this time, rather than all the other times when it has been lies or cover-ups, then that's just too damned bad, isn't it? See also: The Boy Who Cried Wolf.

I have a fundamental disgust with arguments that attempt to appeal to blind loyalty. That "sovereignty of the people" you wrote about has been invoked too many times by scoundrels to be respected.

Sure, there are indeed bad guys who are trying to kill us. But that doesn't justify a wholesale surveillance state, or tens of thousands of NSLs, or secret courts. That's just stuff the powers-that-be want, and have used the bad guys as an excuse to get.

> You could be impeding the investigation into a deadly plot.

We have warrants for that. Subpoena Yahoo for specific records. I'm not willing to trade the freedom of an entire country for a single investigation. This isn't an episode of 24 and there is no Jack Bauer.

The fourth amendment was sold as follows:

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

I'm not a constitutional lawyer. I'm sure the actual amendment can be interpreted to mean whatever George W and Co want it to mean. But that's not how it was sold, and this government is not legitimate as far as I'm concerned. Not as long as it runs dragnet surveillance over the American people. Snowden is a patriot and the U.S gov't is betraying the public.

George W? He's been out of the picture for coming up on a decade. There's another guy in there now who could have fixed all this, if he wanted to.

I'm not so sure of that. For example, it's not clear that Congress has the authority to create NSLs, a sort of not-a-warrant. It's not clear that they can issue gag orders like this. Even if they could do these things with warrants, they're not---and that matters.

The judiciary is not meaningfully overseeing the parts of the state where law enforcement and national security intelligence mix. The FISC is a great example: it pisses off the agents and attorneys who have to deal with it, because it imposes an unholy amount of drag: they're trying to do their jobs, catch bad guys, etc.---and a FISC submission takes weeks of full-time work. But the FISC only exercises drag, not control. It can't steer---we see this because it never refuses a request. I suspect that's all one-sided proceedings can do, given the way we train our lawyers and judges. So it fails the needs of the citizens, and it doesn't protect liberty.

The FISC, and NSLs, will someday be looked at with the same light as Adams' Alien & Sedition Acts: as fundamental betrayals of the American promise by an executive too scared of what might go wrong to trust the country to go right.

Look, there's a lay assault on their legal and democratic authority: NSLs are not obviously a legitimate exercise of Federal authority. And for all that, if I were at the FBI and chasing a terrorist cell on American soil, I'd use one in an instant.

> It can't steer---we see this because it never refuses a request.

There are issues with FISC(like lack of transparency), but this specific point is unclear to me. Here are some possible scenarios where a low refusal rate wouldn't be a problem:

* The judge could informally tell the agent that the request needs to be amended before he'll grant it.

* FISC could publish clear guidelines on what is and is not allowed, so agents are never surprised and only submit legal requests.

* Agents only make requests in extraordinary circumstances, so every request comes with a lot of legwork and investigation done making it clear why it is necessary.

The US court system is an adversarial one. You make arguments in court. There are two sides.

FISC is a court in name only. There is no oversight (I don't count the political appointees in the Senate as oversight), there are no checks and balances, there are no appeals. Calling it a court beggars the term.

But don't usurp the sovereignty of the people of this country.

It's difficult to reconcile this idea of democratic sovereignty with the utter secrecy in which the operations under discussion are performed.

> You could be impeding the investigation into a deadly plot. That's the "think of the children" of security agencies. You think they are so clueless that they need to read all mail of Yahoo or only follow some accounts?.

Not an american, but the idea is that passive aggressiveness / mild-sabotage from citizens is just another way of expression, just like voting. And it works for the purpose and/or towards democracy!

This is imho the untold truth about why most communist / socialist regimes failed: people at all levels of society started doing their work gradually worse and worse, pissed off and stressed out by the lack of freedom and constant interference from state organs, until everything collapsed, and people now live in better economies and freer because they've destroyed their previous systems. Yeah, most of the people who performed such "low level sabotage" will not even recognize to themselves that they did it. And yeah, bad governments were also helped to fail by external interference and external sabotage, but imho a "socialist regime where the people would truly believe in socialism/communism" could have worked out and had good economic performance, problem is that when "good economic performance" can only be had at too high of a cost of "individual personal freedom", people will start, even subcounsciously motivated, without admitting even to themselves what they are doing, and with insect-like non-communicative coordination, to slowly and methodically weaken the system they live in from within, until it crumbles, even at the cost of their own lives sometimes.

This was America's secret weapon that helped "win the cold war" - people's inner "instinct for freedom or death" - thank god we all have it and a race of subhumans lacking it has not yet been engineered! It might also be the reason why so many Americans "voted for Trump", though this was probably engineered by some really smart "puppet masters" - the guy is clearly a "man of the establishment" despite it's clown persona...

Of course, there is no "monument to the lazy and drunk soviet worker that helped take down communism". And there will be no monument for the Google employee that writes a subtle bug in the "government reporting module XYZ" :) Of course, if the gov doesn't abuse its power and asks for too much, that poor programmer might not be so "overwhelmed" by it's duties so as to make stupid "mistakes" with dire consequences...

That's an extremely rose-tinted narrative.

Well, Stanislav Petrov won a Nobel Prize for refusing to follow orders ...

No he didn't. He won the Dresden prize, whatever that is.

Nothing rose tinted about it... yeah, the system got from state A to a less bad state B. And millions of people suffered and died in the process.

Probably one of the worse and most mentally damaging ways to enact social change. Now you have democracy, but also a society with 50% of the seniors infected with a toxic mentality that will stay with them until they die - once you do something over and over again it becomes a habit and a habit of subtle systemic and self sabotage is horrible. And some of it managed to pass it on to younger generations, hence extra laziness and crime. Almost like the fallout of a "mental nuclear war" that keeps lingering and "irradiating people's minds" long after the old problems disappeared.

I'm just remarking that in its slow and lives-wrecking way, this... works!

How does the old Soviet saying go - "We pretend to work - they pretend to pay us"

Their legal and democratic authority is absolutely assailable, within the laws of the United States and within it's democratic processes. That's why the US system of governance contains within it checks and balances between the different institutions.

There absolutely should be mechanisms to challenge or appeal against any action of government, and when there isn't as seemed to be the case with NSLs that's a very good indication that the system is being grossly abused by government agencies.