Hacker News Reader

Comment by Spivak | Hacker News Reader

I honestly don't see a problem with this. If it weren't for the fact that it's a company this this site hates it would be hailed as a marvel innovation against states that are increasingly cavalier about disrespecting people's digital rights and privacy. If the police have all the proper warrants there's no reason they can't seize the locked servers and workstations and compel them to unlock them after the fact.

To me this just falls under the category of unauthorized access. If my threat model included people physically present using force to access my sysadmins' computers I would be implementing the same security with a company-wide lock-down triggered by a panic button on every machine.

View on HN

I hate to tell you this, but when a judge issues a warrant, denying (even through this method) is clearly obstruction of justice. That's right, if you work for Uber, and you help them do this, you can, and will go to jail - are you willing to go to jail just to protect Uber from potential legal problems?

Why? Locking computers that aren't in company possession is common practice. You have to prove it's obstruction of justice.

No, people served with court orders have to obey those orders. All people have to show is that the orders weren't complied with.

They also can probably get off if they show the warrant was defective. But that’s a risk you take. If the warrant was valid and you didn’t comply, you’re in trouble.

from the article: Uber built a whole system and gave it a swaggering name. It takes the procedure just one step further, but what a step.

Actively building a specific system to counter a warrant is probably going to go a long way to prove its obstruction. Uber's less than lawful reputation won't help here.

It's by definition. If you fail to comply with a court ordered search, you're in contempt of court. You go to jail.

I notice Uber have probably-intentionally crossed jurisdictions here.

Some guy in Canada pages a number - as the company training teaches - hen cops show up. That's plausibly not an attempt to fail to comply with a court order. Pretty sure telling your boss your office is being raided isn't an easy thing to prove contempt for, especially if it's company policy in subpoena-able training manuals.

Then some anonymous team initiates a nuke-it-from-orbit sitewide computer lockdown remotely from the US. Where they're quite likely fairly well shielded from Canadian contempt-of-court rulings.

Sneaky.

So, here's where your theory is flawed:

Many people equate standards in criminal law to "beyond any doubt", when the reality is "beyond reasonable doubt".

When you write a program like this, and you can be shown to have executed it at a police raid, _followed by_ a call to your company's general counsel (or in this case to a "special team", "specially trained" to run a program called "Ripley", with the purpose of "nuking a site from orbit") to advise them, the claim that "this is common practice" goes out the window and "we're specifically obstructing a warrant until counsel/whatever other process happens takes place" becomes entirely "reasonable" as a depiction of what you are doing.

Not all government officials and police officers are the same. For example Magnitskiy scandal in Russia.

https://en.wikipedia.org/wiki/Sergei_Magnitsky#Exposing_the_...

TL/DR: police had given the materials taken during the police raids to organized criminals, who used them to fraudulently reclaim $230m of the taxes previously paid by the company.

Did you read the article? Please explain why you think it’s unauthorized access.

>> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.

I think the parent's point is that if there is a warrant to collect information, the machines can be seized and the company compelled to comply. This move prevents overreach in the moment.

This doesn't just prevent overreach, it prevents any collection. Also known as "obstruction" (and possibly "destruction").

So you want the police to start physically impounding property, instead of just getting the data it had a warrant to collect? How is that preventing overarch? It seems to be demanding it!

(If it were me) Yes! It's annoying as hell to have them haul off my workstations but I would much rather them seize the locked and encrypted data while legal has time to do the due-diligence on the warrant and come up with a plan for compliance.

I keep my head above water so I really don't really care if the police can access the data. I do have a problem with the raid giving them access to data well beyond the scope of their warrant and relying on the courts to pare it down after the fact.

Determining authorized access is a process. Processes take time.

Just because some people in uniforms show up at your door and demand access, doesn't mean that's the entire process. Even if they have a nice piece of paper from a court, it's just the start of the process.

What if its just a ruse and they aren't really cops? What if they are cops, but the government is corrupt? What if the warrant was obtained in a faulty manner?

This sort of measure allows the company to engage with the process in a less disadvantaged way.

> What if its just a ruse and they aren't really cops?

Making a mistake in this regard gets you a obstruction of justice charge. Call a lawyers, but don't expect a judge not to take this badly when they have issued a warrant.

> What if they are cops, but the government is corrupt? What if the warrant was obtained in a faulty manner?

That's for the lawyers to deal with in court. Once again, obstruction of justice on a legally issued warrant is going to be bad news for you.

Uber is still operational in those countries and Uber execs dont have international arrest warrants of them. Based on that, it looks like Uber was correct in blocking access.

It also conveniently gives Uber more time to cover up whatever illegal activities they may have been up to.

This is the whole point of why police conduct raids:

...to use the element of surprise to arrest targets that they believe may hide contraband or other evidence, resist arrest, be politically sensitive, or simply be elsewhere during the day.

https://en.m.wikipedia.org/wiki/Police_raid

Apparently Ripley doesn't wipe data from the computers. It just locks them. If the authorities have the legal right to seize them and compel Uber to give them access then all it bought Uber was some time to pursue legal remedies.

How does it give them more time? Shouldn't the goal of seizure is to remove access to something to someone and remove him the capacity to alter evidence?

If he refuses to comply or try to alter the evidence while complying, sure, they are guilty and I'm pretty sure there's a legal process for this situation, but at this point right now if they seized the data, they can no longer alter it.

You also see see similar protection mechanism with some of the more security minded individuals. It's a bit like shutting down the PC (to enable the encryption) if you notice a police raid on time, at your home. Or something like USBKill, an USB kill switch (https://www.theregister.co.uk/2015/05/05/usbkills_laptops_to...).

I'm certainly no Uber defender, but I don't see a problem with this. Uber operates in some pretty lousy jurisdictions.

However, the problem is that this represents a nuclear escalation that I'm not sure tech companies really want to have.

These warrants will probably now move directly to "comply or shut down."

I suspect that the next time this occurs, the police will decide that intimidation is the better part of valor, seize EVERYTHING, arrest EVERYBODY, and tell Uber to come sort it out.

They may not be able to get Uber, but I suspect that they will grind enough employees through the police and legal system with enough force that everybody will think twice about calling a shutdown number ever again.

> Uber operates in some pretty lousy jurisdictions.

Since when was Canada considered a lousy jurisdiction? Last I checked, most of the jurisdictions they operate in are no worse than the US. Unless you’re saying that all first world countries are lousy jurisdictions, I think you are being rather hyperbolic.

Kazakhstan, Belarus, Russia and Ukraine fall below the middle of the corruption perceptions list. China and Morocco fall about the center of that list.

I can easily see this tool having been built for operating in those kinds of countries.

What's upsetting people is that this got used in a country which is nominally not corrupt in order to hide from "proper" law enforcement.

If this was being used to hide from a raid in Russia, people would be cheering instead.

> If this was being used to hide from a raid in Russia, people would be cheering instead.

Personally, I wouldn’t be cheering. I’m of the mind that if you’re going to do business in a country, you can’t choose to ignore the local laws and expect zero repercussions.

That said, do I care that Uber built this system, nope! But I would laugh if it backfired on them and got them into more legal trouble.

Montreal struggles with far more corruption than your average Canadian city. That Uber manages to operate in that mob town is a miracle.

Long time ago, in a galaxy far far away I was on a receiving end of this because of one of the customers that we had. We went through an extensive training, including direct meetings with people from USAO. The bottom line of those instructions was :

* there are too many entities that may think they can get this information

* you are to ignore them all, execute a physical intrusion protocol (lock every and make everything inaccessible ) and notify your contact at USAO.

* our legal signed off on it.

We have executed intrusion protocol four times during my time there. In one case it involved a dick waving contest between state police and state court and USAO, USMS and federal court.

The bottom line, learned in trenches, is that if you are a reasonably big fish, you classify all search warrants as intrusions and deal with them as you deal with other physical intrusions. Documents/data will be turned over in an orderly fashion by your legal.

Uber does lots of really screwed up stuff but I would not consider this particular event to be one of them.

I wouldn’t do that if the practice was taking place in my jurisdiction. Interference with a search warrant is not good for an individual.

Oh come off it. This is a company, not a person. Uber has an official and public business model that relies on breaking the law. Laws that constrain anti-citizen business practices like tax evasion and labor violations should be highly enforceable, and the system described in the article is expressly designed to impede that enforcement. This is bad for everyone -- not a freedom issue.

How is this different than shutting down your phone at the border crossing?

It is dramatically different -- so different, in fact, that I suspect you haven't even attempted to think about it. Maybe willfully so.

You are a person entitled to rights. A company is not a person. Border searches are warrantless, arbitrary, and lack any oversight whatsoever. The company was searched by a court order signed by a judge for suspicion of a specific crime. In every way possible, these situations are entirely different.

Reply on news.ycombinator.com