Hacker News Reader

Comment by thisisit | Hacker News Reader

The trial seems to be ongoing right now, live tweets can be found here:

But this doesn't look good for Uber at all:

https://twitter.com/CSaid/status/935558449324212230

“Jacobs became aware that Uber thru Clark & Henley, had a sophisticated strategy to conceal, cover up or destroy docs w intent to impede govt investigations."

and

https://twitter.com/CSaid/status/935569588309327878

"Judge quotes Jacob's atty letter: Uber employees went to Pittsburgh to educate the AV group about ephemeral, encrypted communications "to prevent Uber's unlawful schemes from seeing the light of day""

I have seen people wonder on HN whether Uber gets flak due to their nature or are they inherently worse than other giants. While other companies are no saints the constant stream of stupid decisions makes it seem that Uber has (had?) a culture of always trying to find shady way of doing things.

View on HN

I think that most companies have 'N-month email retention policies', where N is somewhere between 1-6.

Did the malfeasance happen more than a few months ago? Gee, sorry, no internal communications; that's policy. Did someone keep incriminating communications from more than a few months ago? Oooh, that's against policy - the recalcitrant employee has since been terminated and clearly does not represent our lofty ideals.

But I don't think that most companies go out of their way to use encrypted platforms to shield communications which they know are likely illegal from investigators.

For Google, at least, I believe it's 18 months. And that's quite new, it happened after the Oracle fiasco, which had all sorts of goodies like:

Subject: Java class libraries

With talks with Sun broken off[,] where does that leave us regarding Java class libraries? Ours are half-ass at best. We need another half of an ass.

That came out in discovery.

It is such a shame groklaw is no longer a thing. Another Snowden casualty.

I missed that, how was groklaw connected to Snowden?

https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-...

https://www.csoonline.com/article/2133906/privacy/groklaw-sh...

http://www.zdnet.com/article/privacy-concerns-cause-pj-to-cl...

You can read the post at the top of groklaw.net still, in case that ever changes (unlikely) here is a perma link [0]

Basically the author decided that she would rather disconnect from the internet than be spied on.

[0] http://www.groklaw.net/article.php?story=20130818120421175

I consider it a failure of journalism editing. Pamela (the author of groklaw) earnestly believed that her communications were being monitored and read by American intelligence services, which was a rational conclusion to draw from the prevailing news stories in The Guardian, The Washington Post, and The New York Times.

She was so disillusioned with the perceived trampling of 4th amendment rights that she stopped posting to her blog and moved her email to Lavabit.

Such was the breathless nature of the reporting, that the editors and ombudsmen didn't consider that the reporting drew conclusions and made unfounded allegations based off of slide decks. Other countries' government secrets being taken through computers == "they monitor everything."

Now with the benefit of the Shadow Brokers leaks, we see that the NSA is severely constrained by manpower, processes, and software bugs. It's practically a joke compared to its perceived might in 2013.

I hope that she returns to writing, but I understand if she still feels privacy concerns with the internet.

> It's practically a joke compared to its perceived might in 2013.

But it's a lot worse than we thought before Snowden. And with stuff like this erring on the side of caution seems like a pretty good idea.

I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan.

Erring on the side of caution is a rational individual strategy in many cases, but it has disastrous collective implications.

In a sense, if the editors of those publications had erred on the side of caution, then they could have reduced the drag on commerce and free expression that exaggerated claims yielded.

> I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan.

That's nothing to do with the subject, which is an individual no longer comfortable with their online communications. Dragging all this other stuff in has no bearing on that.

Besides the fact that quite a few of those entries have absolutely nothing to do with 'erring on the side of caution'.

I wouldn't have brought them up if they weren't examples:

TSA: making searches mandatory just in case there's a hijacker

DHS: vastly expanding federal police powers just in case there's a terrorist in the country

War on Drugs: fund expensive and invasive federal and state police operations just in case someone overdoses

Iraq invasion: invade Iraq just in case there are weapons of mass destruction

Afghanistan occupation: stay there just in case the Taliban permits Wahhabi radicals to use the country as a home base for planning and training.

Okay, in this instance, it's "avoid doing stuff online just in case newspapers are right that my government is surveilling my actions." In this case, it's a radical life change that has little upside. She did not abandon her blog on a whim; she hated that she felt she was forced to do so.

But the risk was overblown: when the police kick down the door of Pamela Jones, I assure you they already have me and perhaps you (in the Netherlands) in prison as well.

TSA: Feel good security theater, practically quite useless.

DHS: Powergrab using terrorism as an excuse

War on Drugs: Paraphrased slightly: War on colored people, way to keep the prisons filled.

Iraq Invasion: Pretext to use large amounts of toys so MIC profits, nobody actually believed Iraq had WMDs.

Afghanistan Occupation: Belated attempt to go after Osama Bin Laden who actually was holed up in Pakistan.

I'm in full agreement with all those except for Afghanstan, you might want to re-check the time line.

I'm just saying that "erring on the side of caution" was how all these bad decisions were pitched to the public, and they agreed to it.

I keep hearing this here, but AFAIK there's plenty of record keeping regulation which won't allow for that. No?

I assume many companies auto-clean the user-facing mailboxes for different reasons, but they probably all are required to archive the emails on some type of long-term storage for a few years.

But maybe that's just industry-specific regulations...

But a lawsuit changes that. You don't get to delete stuff that's relevant to the lawsuit, no matter what your retention policy is.

Still the policy makes it <date of litigation hold> minus X months, rather than everything since the creation of the company.

Correct. And "litigation hold" is the term that I knew existed, but didn't come up with.

While working at a pharmaceutical co I was backing up a drive onto the os drive of our local pc for general it support / utilities when I got a call from the user. She forgot to tell me she was on legal hold. I stopped the backup, went through the e-discovery process on her drive, rebuilt the pc and did e-discovery on our pc as well, because it was now also covered by her legal hold. You don't want to involve yourself in a case by ignoring those discovery laws, they are very serious about enforcement in court.

structural engineers are required to keep all communications, notes, etc for seven to ten years, depending on the jurisdiction.

These super short email retention policies seem extremely unethical to me.

Same goes for financial firms.

Only for official RFIs though right? Not all email communication. (speaking from my experience as a structural engineer in Australia, things may be different here)

The Sony Pictures hack of 2014 caused a lot of companies to reflect on their data retention policies. Uber's special in that they set their retention policy to subvert criminal investigations, not to protect "trade secrets"

I agree about structural engineers being an ideal though--old school engineers get "accountability" better than anyone

These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their own in order to hide illegal activity. Having a retention policy of X months then cuts both ways. If you delete data before 18 months, well that looks awfully suspicious.

Prior to even being sued the opposing sides lawyer can give you notice of a possible lawsuit and it is your responsibility to not destroy any documents related to it regardless of your companies retention policies.

I use Keybase, Signal, even Snapchat daily. I wonder if a lawyer could pervert that into ‘shady’ behavior.

If you suffix that sentence with "...so the IRS will have trouble taking me to court for money-laundering", the lawyer wouldn't even have to "pervert" it. Privacy is not suspicious. Privacy with the explicit, stated intent of concealing illegal behavior is perfectly reasonably suspicious. Similarly - I would not bat an eye at the average car purchase, but I would think hard if someone asked me to recommend a car that would not be damaged if it hit someone. I would not give a friend access to my computer if they said they were going to use it to send spam email. Etc.

This isn't about the privacy tech. This is about Uber being evil, knowing that they are doing evil, and trying to hide their evil from the courts. The fact that they worked at a high level to hide their evil destroys any pretense that it was accidental or unintentional.

> If you suffix that sentence with "...so the IRS will have trouble taking me to court for money-laundering", the lawyer wouldn't even have to "pervert" it. Privacy is not suspicious. Privacy with the explicit, stated intent of concealing illegal behavior is perfectly reasonably suspicious.

[meme][1] Can't lose privacy [/1][2] If you don't tell people what you're doing in private [/2][/meme]

But seriously, it's a bit of a catch-22; engaging in privacy preserving behaviour but later falling under suspicion of some illegal act shouldn't imply that you engaged in those behaviours for the intent of covering up suspected but not proven illegal acts. It's a real issue -- but it someone were so stupid as to say "haha, I did x so you couldn't prove it!" ... well, that's basically an admission of guilt, isn't it.

The IRS doesn’t care about money laundering, they just want you to pay your taxes. The FBI in the other hand...

I think that that's an issue regardless of the action you're taking. I buy nice kitchen knives on Amazon because I cook. Lots of people buy nice kitchen knives on Amazon because they cook. But if I stab someone with a nice kitchen knife the day after it arrives in the mail, I bet that that purchase is going to get a reaaaaaaally careful look when the "premeditated" bit comes up in court.

(There's another issue here about normal everyday things being painted as unusual and bad. I think that that's what drove the post that I originally responded to, and I can't fault the overreaction - too many people have in seriousness said things like "if you have nothing to hide". For the listed reasons, however, I don't think that that's what's going on here, and I'd prefer to avoid giving the anti-privacy group ammunition in the form of weak arguments.)

“Evil”... I think the word you’re looking for is illegal (maybe not even that). There is not an objective moral code. I (and many others) view Uber challenging unethical laws as morally beneficial. I admit that’s my own personal opinion though and that there is no global concept of good/evil. Really odd to see this very conservative thinking creeping into the tech industry that in the past was very much against the establishment.

If you look at CSaid's twitter stream, it looks a lot better for Uber now and Waymo looks like it might be in the judge's crosshairs.

Are you sure she didn't just mistype? There's nothing that supports Waymo being in trouble.

"Judge: Turns out Uber's server is only for the dummies, the real stuff goers on on the shadow system. There's enough under oath here for me to believe there's a 50-50 chance this will turn out to be something v bad for Uber; or 50-50 it's a dry hole"

"Judge to Waymo lawyers: You’re making the impression this is a total cover-up. Your client is in a bad way now. You’ve made me upset. U should be saying we’ll open our doors, get to the bottom of this. Instead you’re fighting every little thing."

"Media coalition argues for open courtroom. Waymo says it needs to shield info re deals with 7 entities, including Lyft. Judge says: I want the public to see how hypocritical this is. Waymo wants all the dirt on Uber to come out. But no no no, they don’t want any dirt on Waymo."

I think it's pretty clear that she meant to write Uber in the second tweet.

If you check anyone else that was livetweeting, it's clear that csaid mistyped the second tweet. Alsup addressed those comments at Uber's lawyers.

> “Jacobs became aware that Uber thru Clark & Henley, had a sophisticated strategy to conceal, cover up or destroy docs w intent to impede govt investigations."

What does that even mean?

Does this mean that all Uber employees have been trained to 'communicate carefully', that their e-mails get deleted after X months, and that sensitive conversations that could hypothetically, and out of context, be held in person, as opposed to electronically?

If that's all it does, I would like to remind everyone - that's the kind of training that everyone in any Fortune 500 company receives.

> "Judge quotes Jacob's atty letter: Uber employees went to Pittsburgh to educate the AV group about ephemeral, encrypted communications "to prevent Uber's unlawful schemes from seeing the light of day""

Which parts of that are verbatim?

If someone who went through that training actually put the words 'our unlawful schemes' in an e-mail... Well, they are a complete idiot.

If it were anyone but Uber, this would be too comically inept to be true.

The article relaying the whole communication has been published:

http://www.sfchronicle.com/business/article/Uber-Waymo-case-...

> The unit acquired leaked code from competitors via Github, dug up information on overseas drivers and researched global competitors, he said. While he didn’t believe that work was illegal, “I had questions about the ethics of it,” Jacobs testified.

> Tactics included use of attorney-client privilege on written documents, and encrypted, ephemeral communications.

> It also used “non-attributable devices” to communicate with third parties providing on-the-ground intelligence about threats to Uber, and to research Uber protestors, he testified.

Fair point... But I'm not sure this has any bearing on Waymo vs Uber. This can, however, expose them to all sorts of patent litigation from the parties whose code they looked at.

> Tactics included use of attorney-client privilege on written documents, and encrypted, ephemeral communications.

I'm not sure about the former, but the latter is SOP at any company that has a legal department and regulatory concerns.

> It also used “non-attributable devices” to communicate with third parties providing on-the-ground intelligence about threats to Uber, and to research Uber protestors, he testified.

Shady shit, but not sure what bearing this has on Waymo vs Uber.

You don't understand. The problem is the letter itself, not even necessarily what it says. The letter should have been handed over as part of discovery. It wasn't. It only came to the judge through an independent case.

And therefore, since Waymo just now finds out about this, they get more time to see if there's anything in this that affects their case. And Uber has nobody to blame but themselves for the delay.

Too late to edit my other reply.

But I want to add a correction here. If I understand correctly, it didn't come to the judge through an independent case. It came to the judge because the judge referred the situation (Uber hiring Levandowski after Levandowski took documents from Waymo) to federal prosecutors. Those federal prosecutors got back to the judge with stuff that Uber should have turned over as part of discovery, but didn't. The judge is not amused.

From SFChronical: http://www.sfchronicle.com/business/article/Uber-Waymo-case-...

> While he didn’t believe that work was illegal, “I had questions about the ethics of it,” Jacobs testified.

> He confirmed that Uber used encrypted, ephemeral messaging “to protect sensitive information and ensure we didn’t create a paper trail that would come back to haunt the company in any potential criminal or civil litigation.” It also used “non-attributable devices” to communicate with third parties providing on-the-ground intelligence about threats to Uber, and to research Uber protestors, he testified.

...sound like "Just another Fortune 500" to you?

Sounds like union busting activities from the 1870s well into the 1940s, so business as usual in the neo-gilded age.

Actually, yes. I have seen Fortune 500 C-level execs use this exact behavior. When there is a merger in the works, use of burners and anonymous e-mail accounts are commonplace.

Not that it excuses Uber's behavior, but corporate execs don't trust that their comms aren't being monitored (by either the govt or hackers in their systems). I-banks and traders have spied on them for years, so it's not an unfounded fear.

> When there is a merger in the works, use of burners and anonymous e-mail accounts are commonplace.

That's to prevent leaks from driving the stock price up, and causing the buyout cost to increase. That's a little different than using it to hide the fact that they were knowingly breaking the law. Do you understand the difference?

> That's to prevent leaks from driving the stock price up, and causing the buyout cost to increase. That's a little different than using it to hide the fact that they were knowingly breaking the law. Do you understand the difference?

You're making the assumption that they did it for that reason. It could be that covering up the crimes was just a side effect.

I keep all my e-mail in gmail forever, and it's delivered substantial business benefits. If someone asks me for details of something I did fifteen years ago, I can pull it up with ease.

Other than covering up crimes, what advantage do you imagine would be worth the loss of those benefits?

Well, in the current context, deleting stuff that could be used against you in a lawsuit. Doesn't need to be something you did that was wrong but maybe just something you wrote that expressed doubts about a strategy, for example.

But there's also just cleaning out all the cruft which makes finding useful stuff harder. Since going all-in on Gmail, I delete far less than I used to and that's not entirely a bad thing but I also have to sift through a lot more stuff when I'm looking for something.

> deleting stuff that could be used against you in a lawsuit.

> Doesn't need to be something you did that was wrong

Deleting something that can be produced of evidence of wrong-doing is illegal all by itself.

Leaks can be incredibly expensive. Millions of dollars of lost revenue.

Yes I do; and the F500 Cs I know use it for both purposes. There's somewhat of a code of honor between F500-level execs that anything said in private stays private; you need to be able to have frank backchannel conversations without worrying about antitrust or regulatory problems. Most common is when a communication is rather innocent, but taken out of context or worded in the wrong way it could look very bad.

If the objection is to the technology: Lots of companies use special techniques to avoid creating a paper trail.

It's called "phone calls" and "talking privately". Using that to do bad stuff is bad, but conducting certain matters in a way that doesn't leave a paper trail is not by itself objectionable. I don't know any workplace that tries to ensure all communications leave a paper trail (though I did have a Facebook friend who insisted he only worked at such places, which must be false, since he's employed).

>If they objection is to the technology: Lots of companies use special techniques to avoid creating a paper trail. It's called "phone calls"

I had a friend who worked at a nonprofit who always knew when the general counsel wanted to discuss something sensitive - because he'd call on your office phone. (I suspect he thought it was harder to record a phone call than a 1:1 convo)

What's funny is he didn't realize that the mere chain of calls contained metadata. For example, if the first workday after a boozy company party the HR rep in charge of the interns gets a call, then an intern, then the intern goes into HR, then a senior staffer gets a call, then the senior staffer goes in to speak with HR... certain inferences can be drawn.

Ya, but only inferences. Anyways, it’s much harder for discovery than a complete conversation.

Once you put everyone under oath, unless everyone agrees to the same story, it's not too difficult to make the truth come out.

>Does this mean that all Uber employees have been trained to 'communicate carefully', that their e-mails get deleted after X months, and that sensitive conversations that could hypothetically, and out of context, be held in person, as opposed to electronically?

>If that's all it does, I would like to remind everyone - that's the kind of training that everyone in any Fortune 500 company receives.

Both of the Fortune 500 companies I've worked for have also followed that up with something to the tune of "and if you don't want it quoted in the New York times you should think about why you're discussing it in the first place."

Having worked at multiple large companies I can say this is unusual behavior. Most companies want to maintain a paper trail to defend their actions because on average it's a net gain, not assume their actions are problematic and by default remove all evidence as soon as possible.

Not a lawyer, but I don't think it's unusual to have a retention policy that says when documents should be deleted. This is apparently legal as long as it's a blanket policy. (For example, by default all email gets deleted after a year, unless someone takes action to save it.) Of course anything under legal hold has to be kept.

It's also not unusual to make sure employees know about attorney-client privilege and how to use it properly, or that you should avoid discussing legal matters in a discoverable medium under the assumption it may be used against the company in a lawsuit. This is basic employee training stuff.

So, yeah, no. Sometimes maintaining a paper trail is the thing to do but this isn't the only thing companies do.

While a specific retention policy is always a good idea 1 year is very short and would often cost you information for any annual process. Their are various standards like 5 years in banking or 7 years in healthcare. And some industry's are required to maintain records for significantly longer than that

I worked for a big pharma (#2 in the world by most measures), and their email retention policy was 90 days. If you have built any enterprise messaging software, you know you have to support retention policy or it won’t sell to the big companies. Slack can be configured to be aggressive as delete-after-one-day

Not to call big parma ethically challanged, but international documents are more likely to Hirt them than help.

this is so downvoted that I can't even read it.

Drag your mouse over it to highlight the text.

that doesn't improve readability for me, instead of light grey on lighter grey, it becomes isoluminant light grey on light blue

Then either something got screwed up in your config or your monitor is severely miscalibrated. Highlighted text should not be hard to read, and the blue should not be light at all.

Toss something like this in usercontent.css?

  ::selection { color:white; background:black;}
  ::-moz-selection { color:white; background:black;}

Reply on news.ycombinator.com