Hacker News Reader

Comment by paxy | Hacker News Reader

It isn't really about encryption, as the title implies, but about deleting communication records (whether encrypted or not).

> However, companies have an obligation to preserve records that may be reasonably seen as relevant to litigation or that fall under data retention rules set by industry regulators

Seems pretty clear that Uber violated this.

View on HN

If they switched to using phone calls to discuss sensitive information and didn't record them, would they still be violating the rules?

There are numerous legitimate reasons for wanting to speak out loud for a conversation. But, if they said "let's do a call so that we can avoid putting possibly incriminating material to disk" then that would violate the rules, and is analogous to what is being alleged here.

IANAL, but the rule must be more subtle than that, because I lost the count of times I saw "Everyone please stop responding to this email. If anybody has a question please call us." while I was at $(huge SV company). Or something like "This conference will not be recorded due to the sensitivity of the topic."

(Not the exact wording, but the intent was clear. They even educated every employee on the importance of not writing down stuff that may be later quote-mined in a lawsuit.)

>(Not the exact wording, but the intent was clear. They even educated every employee on the importance of not writing down stuff that may be later quote-mined in a lawsuit.)

There's a MASSIVE difference between not writing stuff down because you have no idea if your competitors may use it against you in a future lawsuit, and not writing stuff down because you know what you're discussing is illegal.

> because you know what you're discussing is illegal.

How can you know that if you are not a lawyer?

Outside of the fact that's a ridiculous question because I could cite COUNTLESS things the every day man knows is illegal - it's not the point. The point is if you aren't writing stuff down because you BELIEVE what you're discussing is illegal, and it violates your own retention policies - if you aren't outright breaking a law in your state, you're actively engaging in a massive ethics violation.

Then you should from the start make a policy not to keep any logs. The only use of those logs is to prove that you are guilty so it makes no sense to keep them.

Even if you didn't do anything illegal, they can be used against you anyway.

That's the reasoning behind data retention policies. Lawyers don't see data older than N months. Even if you're not guilty lawyers can be costly when they need to analyze large amounts of data.

I guess the difference is how obvious it is to everyone involved that you're engaging in an illegal activity.

no. that's why most corporate lawyers prefer you call them instead of email

What is a phone call, if not "a conversation that self-destructs after it's done"?

Not commenting on how the law (which was written before "apps" existed) treats it, but on the true nature of a phone call vs. a messaging app.

There are many many records of phone calls. I can ask your phone provider for them. I can subpoena you and make you testify to their content, etc.

If your specific conduct is under investigation, sure.

This stuff is more about opposing counsel searching for keywords and finding something that adds supposed context to whatever they are suing about. If you send an inappropriate picture of a woman and make some crude comment, that can be used to bolster a harassment claim or establish a pattern of boorish behavior. If you make crude comments on the phone, that isn’t going to as easily reappear 5 years later.

I believe the difference is intent--a phone call self destructs by default. They are not meant to be recorded (we even have laws here that prohibit it without consent of both parts). Messaging apps have, traditionally, kept logs, in both ends and in the server.

Entirely agreed, though it is true that intentionally-private messaging apps have, traditionally, not kept logs. That's a tradition worth keeping!

No, that is why you see the legal disclaimer--either attorney work product or "privileged communication".

If you are talking with a lawyer, it's different than talking with a non-lawyer

IANAL, but have dealt with ediscovery.

Generally speaking you have latitude to do what you normally do within a medium. If you routinely delete mail every quarter, that’s ok. If you routinely record phone calls that’s ok. But there is no requirement to talk or write.

Once you reasonably suspect that you are in the scope of an investigation or litigation, you need to take steps to preserve relevant things. Guidance from counsel is a good idea.

Discovery is a double edged sword. Moving deliberative activity to phone calls or meetings doesn’t mean there is no record of the encounter. To the contrary, one or more parties are probably taking notes that align with their perceptions. (And self interest!) It all depends on the situation.

In most cases no, but the difference is only due to the greater challenge of recording conversations "in the field." There are plenty of cases where phone calls must be recorded.

The way this works is that the law (lawmakers, courts, police) take a dim view of loopholes, as it's a threat to their own power. So they sit down and decide whhether you were in compliance with the spirit of the law and write laws in a way to criminalize that to the extent possible. It's not code.

It depends how important your phonecall is from National Security point of view. If its a matter of bribery or even kidnapping, nothing can be done, but if its about some proven terrorist plot, ATT can recover your calls (so do probably all other vendors; we just don't know the details, aka black boxes)

https://en.wikipedia.org/wiki/Room_641A

Which has absolutely nothing to do with whether Uber itself is required to record them.

for sure more than your comment had.

The concept of spoliation of evidence is usually well-established. Is that the charge against Uber here?

Or is the charge that they in general did their communication on Wickr?

What happens if the service I am using has an inherent 24-hour window after which all data is erased? What if that window is 0 hour now? No data storage.

If FB deleted all data about a druglord (who used FB for some nefarious purposes) after she deleted his profile, will FB be considered guilty of deleting evidence that could have been used to incriminate her?

I think the big problem, in my opinion, is not that they had disappearing messages so much as it is that they started requiring disappearing messages specifically so they could avoid being caught for anything illegal.

In your example, I don't think FB would be at fault here any more than Wickr is at fault. The problem is with Uber (or the druglord), not the tool that happened to do the deleting.

"... started requiring disappearing messages _specifically_ ..."

But that's an insinuation. Just like the govt can insinuate that people using encrypted communication are doing so to hide illegal activities.

Is there specific evidence that Uber asked employees to use Wickr in order to hide talks of illegal activities?

> Richard Jacobs, a security analyst whom Uber fired in April and now consults for the company, testified Tuesday that up to dozens of employees were trained to used ephemeral messaging systems, including Wickr, to communicate so that their conversations would be clandestine and could not surface in any “anticipated litigation.”

Literally from the article.

Maybe he provided proof of that... maybe it was just his understanding?

Legal departments know it's impossible to be 100.00% legal (who has never trespassed a single law?), and they're tasked with avoiding any legal risk. To them, it's probably just risk mitigation to ask employees to avoid leaving unnecessary evidence.

There’s a line between managing risk and abetting. Uber likes to push or cross boundaries in many other areas, so it stands to reason that perhaps they did that here.

Except if they can be found guilty because of suppositions.

I guess it's just a case where the law makes no sense: you can't prove you've innocently suggested to use a secure communication tool for the right reasons, so there will always be a doubt about your sincerity.

It’s more like when you claim that you don’t remember anything, but the investigators find out that the email trail (which jogged your memory) mysteriously stops at a time when you are suspected to have engaged in illegal activity.

Then the investigators find that email stopped when you decided to use a “secure” messenger tool that automatically self-destructs messages.

What inference would any rational human draw?

Agree... Why not insinuate that people who use phone calls instead of emails are simply covering their tracks? And the worst, those who prefer face-to-face communication?

Even simple logic fails so often with law/justice/government.

Wickr: 'Secure Communications for Teams and Enterprises'... The law isn't OK with the concept of security I think (except security it can bypass of course).

It doesn't surprise me that the government isn't OK with the concept. After all, it makes their life tougher.

It does amuse me though that HN isn't OK with it, because it's a corporation doing it.

Governments are supposed to be in service of the people. People's security should be their goal, not a hindrance. They shouldn't abuse the power we gave them to enslave us.

The more the world is upside down, the harder it is to respect the law for normal honest citizens.

> But that's an insinuation.

No, they're not just insinuating, but ironically you are.

When you are told you are under investigation you have an obligation to not delete anything, even if the automatic window expires.

My company has a policy that outlook will expire all messages in my inbox after 30 days (saved messages folders have a different policy). However when we get legal notice IT quickly changes a setting and now it is not possible for that person to delete any existing email. (eventually legal will review every email you have saved, they will then let you delete the ones that are not affected, but they err on the side of keeping anything) Even if you hit delete, the system will not let you delete the message. Our IM system makes it hard to save conversations, in part of make it hard for investigators to get access to conversations.

As for Facebook, that is complex, depending on which situation. If the "evil person" deleted his account with no knowledge that he was under investigation than Facebook is safe. However the evil person could be in trouble if he knew he was under investigation. If Facebook knew about the investigation they could not legally delete all his data, I presume they have something in place for this situation.

Of course in most cases evil people don't know they are under investigation. This mostly is a factor when a company is sued.

I wonder why should email be different (why should you change the expiration policy?) Is it explicitly called out in some law that it has to be treated differently? What about if you always use a service that auto-deletes communication every few hours (and it is well-known that this is what the service does and you have no control over it), will that be treated like you are using the phone service for communication?

I think the right question is, "Why should a phone call be different?" What intrinsic quality of a phone call makes it not subject to data retention, whereas an E-mail or a text message would be?

Not sure what you mean -- everyone knows that a phone call is not routinely recorded and there is no expectation that it be recorded when an investigation is on and businesses routinely use a mix of phone calls and emails (and other means) for communication. Why should there be a "by default" expectation that you would increase retention just because there is an investigation in progress (which is why I asked if there is some explicit law/requirement for emails).

And the answer boils down to: in a phone call you can blurt out shit such that, if it were written down in an edit window, you wouldn't click "Send".

Also: a phone call can capture surrounding audio not intended to be part of the phone call. That audio can either leak information itself, or reveal the originator's location.

These are post-facto justifications that are not sound because the same concerns don't hold for other mediums. You can write shit you would regret later in emails too.

And privacy should NOT be about just protecting you from shit that you might regret.

Suppose that instead of using e-mail or instant messaging you use BSD ntalk, where every keystroke you type is immediately seen by the other party; they can see you backspacing over everything, fixing typos, rewording. You are saying that you will not say less shit in ntalk than in an e-mail?

It's not a question of what medium will make me more likely to say shit. It's a question of whether my choice of that medium should be, de facto, considered incriminating. It's a question of whether a company can ask its employees to use ephemeral mediums to communicate.

See, if we get down to brass tacks, I personally would be willing to put my money on Uber being guilty as sin.

But that doesn't mean that I think a company should not be allowed to ask employees to prefer a confidential or ephemeral medium of communication.

a phone call can capture surrounding audio not intended to be part of the phone call. That audio can either leak information itself, or reveal the originator's location.

So can email headers, though.

The audio carries that information in-band even if it is stripped of all meta-data.

Most people delete their email messages as soon as they read it. This has been changing in the last few years as storage becomes cheap enough that it is possible to save everything, but most people are still subject some sort of maximum bytes in saved messages. (gmail was an early pioneer in the never delete space so some of you might be used to this)

It’s about typical practices. Most people don’t record phone calls, so it’s reasonable to not record them.

If you normally delete email, that’s ok until there is litigation.

Thanks for sharing a real world experience.

> However when we get legal notice IT quickly changes a setting and now it is not possible for that person to delete any existing email.

Do you get a list of people that you need to change the retention policy or just disable deletion for all employees?

Specific people. We have ~60,000 people. There are ~100 cases in progress at any giving time where someone has a legal no delete on their email. Doing this company wide would mean nothing gets destroyed ever.

The problem isn't how they communicated, and the article acknowledges this. Wickr and other "secret" apps are perfectly fine. But at the end of the day if the court asks you for records relevant to a case, you are obligated to hand them over. "Oops the app deleted them" might not work for a judge.

But what if those logs didn't exist to begin with? Surely you are not suggesting that literally every communication that takes place in a company (verbal, written, or via gestures) be recorded and retained?

It's not whether the logs exist, but whether the conversation was deliberately had using an ephemeral messaging service, in order to evade statutory data retention obligations.

That's the criminality — the evasion, itself; not which tool was used, but why.

People use phones instead of email sometimes for sensitive conversations. Do phones count as ephemeral messaging services? What about voice mail?

If the conversation is "sensitive" because you are trying to avoid recording evidence of your illegal activity, then yes, it's illegal.

So... if you're doing something illegal, and you know your phone is tapped by the police, it is MANDATORY to use this phone to discuss your illegal activities. Otherwise you'll be prosecuted for it.

I hate how stupid laws can get...

Phones have a record of the call having been made, and are subject to wiretapping.

Ephemeral messaging services have neither.

You seem to be fixating over the specifics of individual communication mechanisms, which is not the point.

For instance, will an insistence that execs of Uber only talk in air-gapped soundproof rooms be considered incriminating?

I'm not the one "fixated" on the mechanism of communication. I've consistently talked about the motivation for using a given mechanism, and, when specific mechanisms have been raised, whether those mechanisms satisfy those motivations. I even specifically said, "not which tool was used, but why."

Please don't drag the actual point down into the weeds like that — particularly while accusing me of being the one to do so.

Does that hold if it’s company policy to do all communication over an ephemeral chat system?

I’m struggling to understand this. It seems to suggest a company cannot discuss anything potentially problematic unless there’s a log.

From the article:

>companies have an obligation to preserve records that may be reasonably seen as relevant to litigation or that fall under data retention rules set by industry regulators.

So, is that saying watercooler chat is ok over Snapchat but nothing serious?

Edit: I think this is answered well here: https://news.ycombinator.com/item?id=15827511

Which statutory data retention obligations are being talked about with regards to uber? The original commented seems to believe it's obvious.

If they were using an ephemeral messaging app to talk about the theft of trade secrets — a thing that is "black-letter" illegal — then the laws against destroying evidence of criminal behavior might be relevant?

Data retention laws are well-established and every major company I've worked for required training on what communications we are legally required to retain, how it should be retain and for how long.

They seem to be talking about litigation hold, which must be triggered by some event that makes the company aware of the potential for litigation.

If they didn't use encryption, the NSA could recover everything from their data centers and then the FBI could do parallel construction?

Reply on news.ycombinator.com