FBI Has Gained Access to Sci-Hub Founder's Apple Account, Email Claims | Hacker News Reader

FBI Has Gained Access to Sci-Hub Founder's Apple Account, Email Claims

torrentfreak.com

555 pointsmrzool297 comments

Oh boy, that ever useful boogeyman

>“In December 2019, the Washington Post reported that Elbakyan was being investigated by the US Justice Department on suspicion that she “may” be working with Russian intelligence to “steal U.S. military secrets...”

When you start trotting that out, you know it’s a witch-hunt because if they had real reasons they’d have stated them, since they don’t they offer vague insinuations couched with ten ton weasel words like may and suspicion...

But now they “have cause” and that’s all they need to go to town on her.

And whatever happened to Apple who refused to work with FBI on the San Bernardino shooter but here is only happy to comply in a much less interesting case?

> And whatever happened to Apple who refused to work with FBI on the San Bernardino shooter but here is only happy to comply in a much less interesting case?

Nothing. It's just a matter of technical means. They had no means of unlocking that phone without potentially compromising all the rest of the phones they've made before that point. But Apple account / emails are "in the cloud", so Apple has full access to it.

Apple has always bragged about iMessage content being end-to-end encrypted, and thus inaccessible even to Apple. Why aren't they doing the same with email and other files, like other providers? (ProtonMail, to name one example)

It is technically impossible to end-to-end encrypt email.

Not technically. You'd just have to apply encryption at a higher level

Send email bodies encrypted to base64 along with a public key fingerprint, then receiver's client would decrypt if it had the private key for that fingerprint

But this isn't compelling enough to get a network effect to topple in-browser gmail

This could work on top of GMail, with the help of a browser plugin.

https://mailvelope.com/en

Common misconception. The three letter agencies do not really need to know the contents of your email body. They're much more interested in to/from, timestamps, and subject. Establishing that you communicate with a person and then getting their emails is much easier than playing with your encrypted email body.

Exactly right. The American government considers associations inferred from this "metadata" to be sufficient evidence to execute people via drone.

Only foreigners and Americans on foreign soil

I think this is a common misconception of its own. The three letter agencies would love to be able to see the content of messages. But the code makers have run so far ahead of the code breakers that this is effectively impossible. So they settle for only meta information and tell the people that are funding them that this is now sufficient for them to continue to do their job.

What is this based on? How do you know their capabilities?

Per published reports, they (and others) have exploits for many things, including many cryptography implementations.

This is just such an obviously ridiculous statement.

Feel free to elaborate. This is fairly common knowledge if you Google parts of what makes ProtonMail (and others) susceptible to state actors.

You have a misconception yourself, and it shows. It depends on what they're after. If they want to see an individual's email then obviously they need to decrypt the body.

Base64 is an encoding, not encryption. But yes PGP or S/MIME encrypted email would work.

Charitably, they mean take the whole message with headers, encrypt it, and base64 it so you can stick it in a body. Probably still a bad idea.

PGP begs to differ.

Anyone who's worked on the PGP project would be the first to tell you that PGP does not and cannot encrypt the email's metadata (to/from, subject, timestamps, etc).

All PGP does is encrypt the inner message body. All of the metadata that TLAs love to analyze is sent in the clear (at best inside a TLS connection, although the SMTP protocol unfortunately makes it incredibly easy for well-positioned network attackers to downgrade these connections to in the clear)

While not a silver bullet, anonymous remailers can strip out a lot of metadata. Mixmaster remailers can also help against traffic analysis.

While not as popular as they once were networks of remailers are fairly easy to spin up.

None of this has anything to do with the incorrectness of the assertion that PGP would “beg to differ” that end-to-end encryption of email is impossible. Playing 3-card monty with your message is something else entirely.

People routinely do end to end encryption with email every day using either OpenPGP or S/MIME. Heck, email encryption is where the term "end to end encryption" came from. When someone claims E2EE for some other sort of messaging system they have to at least be as good at it as the email case to be taken seriously.

> People routinely do end to end encryption with email every day using either OpenPGP or S/MIME.

Those solutions encrypt only the content and not the headers, which are just as important. Also, encrypting the content prevents some webmail services from functioning, such as search.

Email can't really be made secure.

The headers are mostly protected with the TLS used for the connections between the server and the clients and other servers. Email is no worse than most things these days and better than many.

* https://articles.59.ca/doku.php?id=em:anonemail

(see my response to the other comment, above; thanks)

> Those solutions encrypt only the content and not the headers, which are just as important.

There are implementations which encrypt the headers, for example Delta Chat, which says[0] in its FAQ:

'Many other e-mail headers, in particular the “Subject” header, are end-to-end-encryption protected, see also this upcoming IETF RFC.'

If you mean that the sender's server and the recipient's server can see the recipient's and sender's (respectively) addresses, then I would say that this is equivalent to most other "end to end encrypted" messaging apps, which usually rely on a trusted third party to connect the two ends.

In fact, I would argue that the situation with email is better, because although Alice and Bob's providers might know that they are communicating with each other, Carol's provider will have no record of this at all (and Alice and Bob may not know that Carol or her provider exists).

The situation with email could be made even better than that, though, since email servers could provide a dedicated "switchboard" address, such that Alice sends her email for Bob as an encrypted inner-message of an email sent to Bob's server's switchboard address. That way Alice's server wouldn't know who the intended recipient was, only their server address. Similarly Alice's server could rewrite the headers of her outer-message so that Bob's server doesn't know that Alice was the original sender. This would effectively implement a type of anonymous remailer.[1]

> encrypting the content prevents some webmail services from functioning, such as search.

You've shifted the goalposts here from "email can't be secure" to "webmail can't be secure". In any case, I disagree. It is possible to implement a client-side full text search[2], even if it means decrypting the index for every search, and re-encrypting the index whenever a new email is added to it.

[0] https://delta.chat/pt/help#how-does-delta-chat-protect-my-me...

[1] https://en.wikipedia.org/wiki/Anonymous_remailer

[2] https://lucaongaro.eu/blog/2019/01/30/minisearch-client-side...

This is bad advice, which could be dangerous for some. Look around for what actual security experts recommend: It's not email, and it's specifically to not use email. It's not a debate; it's universal afaik.

Hmmm!? Most people use emails via cloud services. I don’t think Eudora is still a thing.

But Thunderbird and Claws and Sylpheed and K-9 and Fairmail are things. There is Mailvelope for webmail.

If you do end to end encryption, you can't persist the mails. So when you logout or clear cache or change browser or email client your past mails will be lost, which drastically reduces the purpose of mail as a long term thing.

You can persist end to end encrypted mails on the server just fine. The important thing is that the keys for encrypting/decrypting the mails are not stored on the server too.

modeless wrote here in Feb, 2021 (https://news.ycombinator.com/item?id=25778758) :

> It's also important to realize that the backup includes your encrypted iMessage messages, and the key required to decrypt them. Meaning that if you have backups enabled, all the "end-to-end" encryption in iMessage is defeated. Apple and by extension the FBI can read your messages. This is documented by Apple here: https://support.apple.com/en-us/HT202303

> Even if you disable backups, whenever you correspond with someone that has backups enabled those messages are still accessible to Apple.

I have long since switched to only doing local encrypted backups, but for some reason it never clicked that of course all of my messages are included in other people's backups. Frustrating that its E2E with a bunch of caveats.

E2EE only applies to data in transit, not data at rest. Talking via E2EE chat client means only that third parties in between cannot read what you write. It doesn't imply the messages cannot be recovered from your device, or your conversation partner's device, and it definitely does not imply said partner can't just leak them, whether accidentally or on purpose.

I'm not sure how E2EE came to be interpreted as to mean "totally secure against everything".

I think it's the colloquial meaning of "end", as in "be all end all". I'd think something like "full in-transit encryption" or even "phone to phone" would be clearer.

It's also how data collection still works if you personally 'block' it but communicate with others who don't.

Your messages, phone book, pictures you share with others etc. are still 'readable' on the remote end and thus still get collected. And if you connect the dots when you have a large collections your personal data can be reconstructed from that.

If you have persons A, B, C and D in your phone book, but your phone book is 'secret', it doesn't prevent someone from knowing that you know A to D if those still have you listed.

[EDIT: I misread]

> Even if you disable backups, whenever you correspond with someone that has backups enabled those messages are still accessible to Apple.

That last bit is not true. From Apple’s security PDF:

> When Messages in iCloud is enabled, iMessage, Business Chat, text (SMS), and MMS messages are removed from the user’s existing iCloud Backup and are instead stored in an end-to-end encrypted CloudKit container for Messages. The user’s iCloud Backup retains a key to that container. If the user later disables iCloud Backup, that container’s key is rolled, the new key is stored only in iCloud Keychain (inaccessible to Apple and any third parties), and new data written to the container can’t be decrypted with the old container key.

https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

The quoted parent says that if Adam sends a message to Bob, and Adam has backups off, but Bob has backups on, that Bob's copy of the message Adam sent is accessible to authorities.

Bob is one end of end-to-end.

I see! I misread

It’s worth noting that if you use iMessage for MacOS, all of your messages are stored unencrypted, in plain text, on your computer HD.

I'd guess most macos systems (laptops) have encrypted hard drives.

Yes, however if you use a company computer, those are typically logged by monitoring software and archived elsewhere.

That protects you in the case of physical theft but not from any other program you run exfiltrating the data.

> Apple has always bragged about iMessage content being end-to-end encrypted, and thus inaccessible even to Apple.

Majority of iPhone users have backup enabled so Apple can certainly access most iMessages.

And most people using iMessage is using it on iOS with basically zero control over the software it's running.

If Apple wanted to they could make your phone send them whatever they want.

It's end-to-end encryption* with an asteriks as Apple controls both ends.

> But Apple account / emails are "in the cloud", so Apple has full access to it.

PSA: So are your iCloud backed-up "e2e encrypted iMessages".

If the FBI can use the Russia thing on a presidential candidate, they can use it on anybody.

The sad thing about this is I understand many people disliked Trump and were pleased by this, but, unfortunately that sword is double edged and all candidates have to dance to their tune, meaning they have to let them go beyond their purview or mission and maintain inertial agendas —which should not be the case. They are supposed to look at interstate crime among some other things.

Yes, remember that presidential candidate Bernie Sanders also got smeared with Russian interference, so it is not something only used on Trump or Trump supporters. In my country, Sweden, alleging connections to Russia or Putin is often used in the political discourse to silence individuals or groups, without any sort of proof. It has happened both on the right and the left.

We have to remember that many journalists in the west are funded by the security apparatus or any of it subsidiaries.

Did FBI investigate Bernie Sanders and his associates?

Not officially to my knowledge, so it is not exactly the same, but he was briefed by the "intelligence community" about it and that was used to smear his campaign.

The accusation stuck enough that nothing further had to be put forth.

Na, cause Bernies team did not speak with the russians unlike trumps team whom spoke with, meet with, and gave information to the russians.

What information to whom?

Treasury: Manafort associate passed 'sensitive' campaign data to Russian intelligence [1]

The government finally connects the line from Trump’s campaign to Russian intelligence [2]

[1] https://thehill.com/policy/national-security/548447-treasury...

[2] https://www.washingtonpost.com/politics/2021/04/15/governmen...

Thanks. Manafort seems to be a dirty player and I wouldn't be surprised if he was involved in some shady businesses with people you shouldn't associate with, however that report is based on one line taken from a press release from the Treasure Department providing zero evidence for that claim. I will keep my skepticism on until more evidence is shown.

Aaron Maté and Glenn Greenwald discusses this on the Grayzone

https://www.youtube.com/watch?v=6AXcjwX-JGA&t=853s

Interesting that you comment on the part from the Treasury Department, and not the WP piece. The latter references the Senate committee, stating that Kilimnik received highly sensitive campaign data and designated him as a Russian agent. If anything needs skepticism its people like Mate and Greenwald.

What type of information was shared from the Trump campaign? Polling data and strategy to beat Hillary Clinton. Gates has testified that the polling data was non-sensitive and also dated. I think the only real significant claim the Senate report does is when says the DNC leaks of 2016 was done by GRU and then sent to WikiLeaks and report says "Kilimnik may have been connected to the GRU's hack and leak operation targeting the 2016 U.S. election", but that proof builds on speculation based redacted material in the Senate report.

> I think

What you think is irrelevant, US intelligence classifies the data as sensitive. The fact is that Manafort lied about sharing the data with Kilimnik, that Barr tried to keep it a secret.

But lets see what the Senate report actually says:

"It is our conclusion, based on the facts detailed in the Committee's Report, that the Russian intelligence services' assault on the integrity of the 2016 U.S. electoral process[,] and Trump and his associates' participation in and enabling of this Russian activity, represents one of the single most grave counterintelligence threats to American national security in the modem era."

Trump and his associates' participation in and enabling of this Russian activity

> US intelligence classifies the data as sensitive.

Where can I read about that classification for this polling data?

That part of the report your are quoting is from the addendum of the senators Heinrich, Feinstein, Wyden, Harris and Bennet, all five are members of the Democratic party, so it is not what the report concludes, it just their viewpoints. Nice try.

What the report does concludes is

"The Committee found that Manafort's presence on the Campaign and proximity to Trump created opportunities for the Russian intelligence services to exert influence over, and acquire confidential information on, the Trump Campaign. The Committee assesses that Kilimnik likely served as a channel to Manafort for Russian intelligence services, and that those services likely sought to exploit Manafort's access to gain insight info the Campaign. Taken as a whole, Manafort's high-level access and willingness to share information with individuals closely affiliated with the Russian intelligence services, particularly Kilimnik, represented a grave counterintelligence threat."

Likely is something you use when you don't have hard evidence.

> Where can I read about that classification for this polling data?

I see that you get your talking points from Mate. But the fact that he or you don't have access to classified info doesn't mean you get to decide that the data is not sensitive. Manafort lied about it and both he and Kilimnik tried to tamper witnesses, that's not something one does over top-level polling data.

That fact that Mueller didn't get enough hard evidence to secure a conviction doesn't mean that there is no evidence. Clinging to 'Russia hoax' doesn't do justice to the amount of circumstantial evidence there is. Lawfare [1] did a much more honest attempt at discussing the report then Mate/Greenwald will ever do.

[1] https://www.lawfareblog.com/collusion-reading-diary-what-did...

As you said it is circumstantial, it could be that that there were more exchanges of (truly) sensitive information between Manafort and Kilimnik (they used encrypted communication) and that Kilimnik does in fact have GRU access (or is GRU himself), or everything could have been orchestrated by Putin himself to put Trump into power, I don't know that, but that needs to proven.

But doesn't X amount circumstantial evidence together prove collusion? Not necessarily, you still need to weigh each circumstantial evidence.

Lets take the WikiLeaks example, assume that it is 100% true that it was the GRU that was feeding WikiLeaks with the stolen documents. Trump campaign benefited from those leaks and Trump encouraged WikiLeaks to do more, does this prove Russian collusion? No. There is no proven coordination between the Trump Campaign and GRU via WikiLeaks. GRU could have played on these events during the 2016 election and used that to benefit the candidate they would prefer, assuming Trump. Putin is on the record for criticizing the US interventionist policies, policies that Clinton represents, and they could have used this opportunity to help the Trump campaign and the Trump campaign gladly accepted this opportunity to get an advantage, but I would say that should be viewed as interference from GRU, not collusion with the campaign.

That is why the claim from the Senate report that "Kilimnik may have been connected the GRU's hack" is interesting, but the report doesn't provide any evidence only speculation on redacted material. That is of course impossible to asses the truthiness of.

If the information was old and of no use then why give it to russian agents?

That smear against Bernie was pretty easy when there are like a dozen videos of Bernie praising communism, being sad that Reagan was so popular in Russia in the 80's, thinking Castro was a really great guy, or generally publicly sucking up to the USSR or USSR clients.

Union of Soviet Socialist Republics is not the same entity as the Russian Federation, two totally different political entities with not that much in common (except maybe KGB/FSB).

Usually socialist in the west, that supported the USSR, are anti-Russia today because the perceive Russia as nationalistic and conservative. It is okay to criticize Sanders past political praise of USSR, but mixing that up with Russia today is just nonsense.

USSR was a Communist expansionist, militaristic authoritarian tyranny. Russian Federation is a oligopoly market-based, expansionist, militaristic authoritarian tyranny composed of largely the same people.

The current President of Russia (and now dictator for life) dislikes communism because it was an economic failure that didn't sustain his dictatorship.

Soviet republics are gone, they are independent from the Soviet empire. Warsaw Pact does not exist, most of the old membership countries are part of EU now. All that military power is mostly gone.

Soviet was expansionist to spread communism around the world.

Russia interfere in countries that has a large Russian minority, like Crimea or Georgia. Not really the same as how the Soviet Union worked.

Russians can now travel freely. Orthodox Church is no longer forbidden.

Fox News and conservatives supporting sources smeared sanders that way. Part of it was likely to muddy the waters since Trump had an actual Russia thing, and part was to play up the gops age old boogie man, socialism.

What Russia thing would that be?

A benefit of having committed innumerable crimes is that talking heads, politicians and anonymous accounts everywhere can defend you by simply picking one and fighting about it endlessly, as if in a vacuum, and keep moving the goalposts while they do.

Let’s be real. There was a trump Russia thing. It’s beyond sketchy to have your campaign manager and his aid literally provide internal polling data to Russian intelligence. And Russia was undeniably trying to help trump win, and trump was undeniably pleased that was happening. I don’t get why people deny this happened.

Can you provide a source on that claim of polling data to Russian intelligence?

I googled "polling data to Russian intelligence"

https://apnews.com/article/donald-trump-paul-manafort-russia...

Thanks. Answered this here https://news.ycombinator.com/item?id=27156995

His own lawyers admitted to it in documents they tried (and failed) to redact:

https://www.nbcnews.com/politics/justice-department/manafort...

Because apparently we're going to pretend that NBCnews is somehow not a reputable news source, the link to the actual document so we can stop trying to change the subject:

https://assets.documentcloud.org/documents/5677512/Manafort-...

Page 6, copy and paste the blacked out text:

>The same is true with regard to the Government’s allegation that Mr. Manafort lied about sharing polling data with Mr. Kilimnik related to the 2016 presidential campaign. (See Doc. 460 at 6). The simple fact that Mr. Manafort could not recall, or incorrectly recalled, specific events from his past dealings with Mr. Kilimnik – but often (after being shown or told about relevant documents or other evidence) corrected himself or clarified his responses – does not support a determination that he intentionally lied.

This page is loaded with repeated headline statements but no substance. A collaborator to many of the NBC stories on the page you’ve provided is Ken Dilanian, a reported fired from the LA Times for his “collaborative relationship with the CIA.” I surmise this is consistent with the rest of the entire episode from LeavesTea onward.

I'm not sure I follow your point, nothing you've stated contradicts the fact that his own lawyers admitted to him supplying Russians with polling data. You can't refute the facts so refute the site to try to distract the discussion? It is LITERALLY in the redacted court documents:

https://assets.documentcloud.org/documents/5677512/Manafort-...

If you have an issue with that site you can go to literally dozens of others, how about the BBC?

https://www.bbc.com/news/world-us-canada-46804127

What do you think the punishment should be for giving mostly outdated, partially public and top line polling data (Trump 50% vs Clinton 48%) to Russians (as in citizens)?

I would need you to go back and edit your posts insinuating there was no proof before I have any interest in continuing the conversation. I get the impression you're more interested in trolling than having a conversation based in facts.

Please point me to when I said there was no proof for Manafort giving Kilimnik polling data. (I didn't, what I was skeptic about was that Manafort gave Russian Intelligence sensitive campaign data and that there was connection from the Trump campaign to Russian Intelligence).

Now, please answer my question.

My point is exactly this: this has been puffed to sound nefarious. It is a zero.

Fuzzy thinking around it was and is being used to excuse extraordinary abuse of the law and legal system.

To be illegal, information sharing has to violate some law. This does not. It is simply not illegal to share information with Russia citizens, the Russian government, or anyone affiliated with Russia.

Not even "secret" information, unless that information is governed under very specific laws. All this media puffery is absolute manipulation, and your distributing it shows that you either don't understand the law or don't wish to.

>To be illegal, information sharing has to violate some law. This does not. It is simply not illegal to share information with Russia citizens, the Russian government, or anyone affiliated with Russia.

I can't tell if you're intentionally stating falsehoods with the hope nobody will fact check you, or if you're just completely ignorant of the law. He was accused and convicted of acting as an unregistered foreign agent. Is it absolutely, unquestionably illegal to be a political operative for a foreign government and not register. For good reason. He broke the law, he went to prison. It was entirely illegal.

And NONE of that has anything to do with the original question or answer. Which is: what proof is there that he gave polling data to the Russians. Which I provided, and you still haven't refuted.

This is a non-argument. I do not dispute that he did or not.

I assert strongly that no one on earth should care in the slightest.

There were no charges related to information, sharing, or Russians.

Sharing non-classified information is completely legal. Working for a foreign business is legal. Getting paid is legal. Almost everything is legal.

Acting as an foreign agent without disclosure is illegal, in limited scope. The FARA violation related to Ukraine.

There was a lot of Russian collusion going into 2016, just not from the people you expect it.

For example, Fusion GPS paying Veselnitskaya, using her to lobby _against_ the magnitsky act, and also supplying the infamous "dossier" which was paid for by the DNC.

The whole thing is a cobweb or power players who use connections and ignorant US media to parrot back narratives, divide events into political tribes, and isolate people from the truth. It's a dumpster fire where people end up believing things that are untrue and they don't even know why.

https://www.washingtonexaminer.com/news/analysis-mueller-and...

If you look at source documents, the “provided material” was polling data of the kind one could find on the news.

Thus, this is the thinnest conceivable gruel for spying on a campaign with FISA warrants, framing an incoming national security advisor, multiple impeachment efforts, four years of media hysteria deeply interned with leaks and special council, and countless lives ruined. In the course of history, there are simply no excuses for this kind of casual slander, excepting smack dab in the middle of an outrageously powerful police-bureaucratic state.

This is a very weasely statement. The FBI and multiple other agencies investigated a very real campaign of election influence that swirled around a particular candidate. No one ever made an accusation that wasn't supported by facts. There was no concerted effort to punish a candidate. Proxies to the candidate were tried and convicted for their very real crimes.

Your statement is simply false. There were four years of allegations and strong innuendo floated in congress and the press, as well as extraordinary use of carefully worded statements to sustain extralegal focus with zero evidence of behavior that would violate an actual law. No one was charged with or found guilty of anything other than conjured process crimes. History will not forgive, and it will not forget.

"Process crimes" is the refrain of the denier. The process crimes in question involved obstructing the investigation that could have uncovered more evidence. That is tantamount to full guilt. We know for a fact that Roger Stone worked with the campaign and Guccifer 2.0 and WikiLeaks. He refused to cooperate and waited for his pardon. Manafort was reporting to his Russian handler while he was campaign manager. Trump Jr met with Russian agents about emails at Trump Tower.

There was plenty of legitimate crime going on but the standard for a president shouldn't be conviction beyond a reasonable doubt. His open encouragement of Russian hacking even under the guise of "sarcasm" was grotesquely inappropriate. His refusal to confront Russia was shameful. His continued conspiring with his agents in Ukraine were plain as day and showed his willingness to break any rules he could to meet his ends.

Trump, who won his campaign on ludicrous conspiracy theories spent his final days in office fomenting insurrection and suing relentlessly to overturn the election based on lies. His crimes done in broad daylight are 1000x worse than the ones we can't thoroughly prove.

"No one ever made an accusation that wasn't supported by facts. " Wow.

I meant no one in an official capacity. No one at DOJ or elsewhere accused anything unsupported by facts.

I am only surprised child porn has not been found on her computer yet. And there is no report from some hotel room cleaner that he or she was raped by Elbakyan.

Those "stolen" military secrets published in journals anyone can purchase for a few bucks does not even sounds scary.

Apparently FBI got lazy these days, maybe because of all that Covid mess.

> Apparently FBI got lazy these days, maybe because of all that Covid mess.

The FBI has always been lazy. They sent notes to MLK stating he should commit suicide, after all.

Seems more malicious than lazy.

Of course it’s malicious. In context they were making a tongue-in-cheek joke intended to expose those that never heard about the MLK letter(s) to their existence.

In other news, I only learned about the assassination of Fred Hampton quite recently. That’s a fun one.

To save anyone a Google search:

https://en.wikipedia.org/wiki/Fred_Hampton

I am skeptical about FBI but 1969 was over 50 years ago and that was under Hoover. Different FBI now. They have jurisdiction over copyright issues so no need for any international intrigue. Maybe there actually is one here.

You can be lazy with your malice, I think.

Malazeice?

Perhaps “lazeh”

Also rhymes with Blasé !

If the FBI wanted to catch spies, I bet they could find a few at Los Alamos labs. I’m sure there are. Besides, military contractors are constantly “inadvertently” sending classified materials to questionable third parties and get fined at most and no one gets prosecuted and sent to the penn.

"I bet they could find a few at Los Alamos labs".

They have, but unfortunately they get innocent people and lock them in solitary confinement for months eventually resulting in $1.6 million dollar pay outs and presidential apologies to the accused.[1]

[1]https://en.wikipedia.org/wiki/Wen_Ho_Lee

I can't find anything in your link about presidential apologies. The judge in his case apologised:

Lee pleaded guilty to one felony count of illegal "retention" of "national defense information." In return, the government released him from jail and dropped the other 58 counts against him. Judge Parker apologized to Dr. Lee for the unfair manner in which he was treated. The judge also regretted being misled by the executive branch into ordering Dr. Lee's detention, stating that he was led astray by the Department of Justice, by its FBI, and by its United States attorney. He formally denounced the government for abuse of power in its prosecution of the case.[20][21][22] Later, President Bill Clinton remarked that he had been "troubled" by the way Dr. Lee was treated.[23][24][25][26]

Wikipedia is not a great source for truth of specific facts, but in the "Government investigation" section there is the line "President Bill Clinton issued a public apology to Lee over his treatment by the federal government during the investigation.[5] "

Which references a CNN article that states: "Then-President Clinton issued a public apology to Lee over his treatment."

[5] http://www.cnn.com/2006/LAW/05/22/scotus.wenholee/

It would be nice to find a full quote or video of the apology to be more certain that it happened and it was not a sorry, not really sorry, apology.

OK, thanks- I missed that.

I think it's equally naive to think that Russia doesn't have their mitts into a lot of shady business. You have a right to be skeptical but this could easily be true.

>weasel words like may and suspicion

On the other hand, do we want law enforcement to NOT use words like this, as though everyone they suspect of committing a crime is definitely guilty? I personally think it's preferable that they keep those "weasel words" in there until the whole "due process" thing has run it's course.

And whatever happened to Apple who refused to work with FBI on the San Bernardino shooter but here is only happy to comply in a much less interesting case?

The unfortunate implication here is that Apple is more strongly against theft of Imaginary Property than it is against physical violence.

Honestly, I know of someone who was involved with the San Bernardino shooting. And the shooter was not the Muslim man that was a co-worker of my friend who was there during the attack. The guy who did it was light skinned (not dark), looked of Caucasian background based on skin, and was more than 1 foot taller than the accused assailant. The media explained a different story.

> And whatever happened to Apple who refused to work with FBI on the San Bernardino shooter but here is only happy to comply in a much less interesting case?

For a bunch of years Apple was slowly moving in a direction where they couldn't offer encryption keys to law enforcement because only customers had access to encryption keys. I'm not sure if it was publicly announced or just internally planned, but they were planning to do it for iCloud backups, too, but never went through with it. Reporting says it was in cooperation with the FBI.

https://www.cnbc.com/2020/01/21/apple-dropped-plan-for-encry...

I was skeptical that apple was doing it for positive privacy publicity in the SB case and it continues to be the case. Many well meaning people think they have their back as a result. The illusion of security is worse than no security, etc etc

I really hope for the best for Elbakyan.

Sorta related, the Darknet Diaries podcast just did an ep on the Pirate Bay. The ways in which US capital flexes it’s interests on sovereign nations makes me deeply uncomfortable.

https://darknetdiaries.com/episode/92/

Off topic, but that podcast is amazing. Stories, guests, production quality, narration, music, everything. It's one of the only worth listening to at 1x speed. I highly recommend it.

waaaaay too slow talking to be at 1x speed. I don't listen to podcasts that fast, but darknet diaries definitely needs a speed bump.

I like the episodes I've listened to though (so far only 5-10 of them)

All of you people really listen to podcasts and youtube videos and lectures at more than 1x speed? What about just enjoying the emotional journey, the pregnant pauses, having time to consider possibilities and implications between narrative sections?

I only ever met one person who basically always sped up any media they consumed, but I wonder if it's more common and if so what you think about your habit. Seems useful only in rare occasions where it's an information based media and the person is exceptionally slow.

I speed up most. It allows me to fit them into a commute.

Why not slim down the number of podcasts?

Why not learn less? Why would I do that?

Unless you are some anomaly with super memory abilities, speeding through 10 different podcasts won't make the day any shorter (or longer).

I had a biochem professor in college who talked extremely slowly, like we are talking 2x speed just to approach normal talking (and her lectures were all online). I usually listen to stuff at 2x or greater depending on the content.

personally, i listen to mostly informational podcasts (darknet diaries, select episodes of freakonomics, selfhosted, etc) - even if there's a story setup to it, it's not really what i'm there for - i'm not a genius or anything but usually don't need an artificial pause and consideration time - if i really need it i'll pause it myself or rewind briefly to listen to something again. I tend to listen to podcasts when i can't be doing anything else (waiting rooms, airplanes, maybe commuting, etc)

However, i'm not a 2x'er - i'll do 1.2-1.5 depending on who's talking - some others (in my weaker languages) i'll do at 0.8x

Personally not a fan of music between sections or artificial reflective moments ("did you get that?! wow...") or trying to make things grandiose. Though i guess i wouldn't like a monotonous drone either.

It's interesting you view those as informational because I see them as narrative stories. Also you might think you don't need the time to ponder but you don't know what you've missed by not taking the time the show makers decided to put in there for pause. Also changing the speed changes their voice and therefore some subte things about the delivery. Pure information media is like Strangs Linear Algebra course or some similar MIT OCW mathy course. Would you also consider radiolab something informational that you might speed up?

haven't listened to radiolab in a while so can't remember off the top of my head what speed i'd put it at - but i think the difficulty there with speeding it up is how much they intersperse and cut things in to each other.

I mean, yeah, these are narratives - sometimes i like that and sometimes i just want the juice. If i can't keep up with it i obviously slow it down. If i find my mind has wandered i'll pause/rewind - if that keeps happening i'll stop and come back to it another time cos i'm obviously not giving it enough attention.

I'm not pretending to be a genius but English is native to me and I have tangential knowledge of what they're talking about already often enough so it's rare I have to hang on every word and ponder every implication.

I tend to adjust speed depending on 1) what i'm doing and 2) how noisy it is around me/how well i can focus/hear what they're saying. If i'm not keeping up or it's way too much effort, i slow down. That said, I'm never past 1.5x cos i just don't enjoy straining.

They’re not really sovereign then, are they?

I hope she will be OK, Kazakhstan isn't safe to hide from the US and made deals to resettle[1][2] former gitmo inmates now under surveillance 24/7 (payrolled by the US). If the charges are spun as working with Russian intelligence to “steal U.S. military secrets...” she will remain vulnerable.

[1] https://en.wikipedia.org/wiki/Lotfi_Bin_Ali#Transfer_to_Kaza...

[2] https://www.youtube.com/results?search_query=Lotfi+Bin+Ali+k...

I think she moved to Russia since then?

I hope so too. Not sure we have to worry though, the email is referring to a data request that happened in February 2019. If they would have found something they could act on, it's likely they would have already.

This case is just the "Apple Privacy & Law Enforcement Compliance" team being extremely slow at sending out notifications.

I assume that when the FBI sends a request to a tech company about a user, they probably also contact lots of other tech companies too about the same user...

Which raises the question: Where is the Google notification about the FBI request... How about the Facebook notification? The VK or OK notification? How about the Twitter notification?

Did these tech companies hand over data without notice, even though the orders presumably had the same gagging timeout?

> I assume that when the FBI sends a request to a tech company about a user, they probably also contact lots of other tech companies too about the same user...

You assume a lot. I know it’s fun to pontificate about dragnet surveillance, but in general when issuing / granting a warrant there has to be some kind of specific target and scope. In this case it’s likely the FBI knew the Sci-Hub founder was using iCloud email and so they could get a warrant for that specific account for a specific time range.

Would they take a chance and miss a juicy account at Google/Facebook etc? I don’t think so.

Therefore it’s likely they issued requests but Google/Facebook etc were less “inclined” to talk about these things.

This is the correct take. When have they ever?

No, it's absolutely false.

https://www.latimes.com/business/technology/story/2021-03-24...

> In Google’s case, the company typically lets users know which agency is seeking their information.

I'm not sure that's true for non-US citizens.

Two things:

1.) The US Constitution only applies to American citizens.

2.) It’s hilarious when someone starts a reply with egotistical language (like “you assume a lot”) and then miss the most important fact in a scenario.

Regarding: The US Constitution only applies to American citizens.

False.

In U.S. v. Wong Kim Ark, an 1898 decision, the Supreme Court ruled that the term “person” under the Fifth Amendment applied to aliens living in the U.S. In Fong Yue Ting v. U.S.,the court held that Chinese laborers, “like all other aliens residing in the United States,” are entitled to protection of the laws.

"There's no dispute at the absolute core," said Andrew Kent, a constitutional scholar at Fordham Law. "If somebody is picked up by police they the have same Miranda and due process rights in all contexts except immigration law."

https://www.forbes.com/sites/danielfisher/2017/01/30/does-th...

Ok, then: the US constitution only applies on US soil.

Also false.

https://constitutioncenter.org/blog/constitution-check-do-in...

(Please try ... at least a little harder, people.)

You're being misleadingly pedantic.

This article is about people who are US citizens abroad, or foreigners who came to USA or who are under the jurisdiction (imprisonment) of territory controlled by the USA government.

Non-resident non-citizen non-present people violating US national security (rightly or wrongly, that's per the government's judgment) don't have Constitutional rights.

Statutory or case law citation requested.

But first, please, citation on how this "statutory or case law" could apply in the first place. It has no more jurisdiction over the kind of people described than the constitution. (Neither, of course, does the original claim that they violated US law.)

This American habit of claiming global hegemony for American law is, on the whole, about equally fucking annoying whichever side it comes from: Yank law enforcement blithely assuming a right to arrest someone who's never set foot in America isn't really all that much worse than Yank liberals who leap to the conclusion that the only defense such victims have is the Holy Constitution.

Does this case establish precedent that the fifth amendment applies to people in Kazakhstan?

Onus of precedent would have to be that it does not.

If you're able to find any such, I might have further interest in this line of questioning. Though I doubt even that.

You think the US Constitution of the United States* of America restricts what the US can do to non-citizens who aren't in the US at all?

What possible reason could you have for that thought?

Precedent is that protections like that are created by treaties like the Geneva Convention.

https://news.ycombinator.com/item?id=27155570

The question isn’t about whether the constitution restricts non-citizens, but about whether it protects them by preserving their rights.

In fact I’m not sure the constitution restricts any entity other than the government. It’s laws that restrict people. And laws apply to everyone, assuming jurisdiction can be established, or extradition will be enforced. I can’t murder someone in Japan just because I’m a non-citizen there. But I could break US law by doing something not-illegal in Russia, and they probably wouldn’t extradite me.

United States v. Verdugo-Urquidez, 494 U.S. 259 (1990), was a United States Supreme Court decision that determined that Fourth Amendment protections do not apply to searches and seizures by United States agents of property owned by a nonresident alien in a foreign country.

Points for a case in which a protection was held not to apply ... on a 5/4 decision. (Hand grenades, horse shoes, H-bombs, ... and SCOTUS decisions.)

Which still doesn't establish that no Constitutional rights (that is, limitations on government action) apply to extraterritorial noncitizens.

But props all the same for a relevant citation rather than more smoke-blowing as others have been.

If a country's constitution has the possibility of being interpreted in such a way that non-citizens outside its borders are entitled to zero protections, then that option should be rejected under a generalised version of what has been called "the Auschwitz rule of interpretation":

"in case there are two plausible interpretations of the text of a human rights treaty, one should favour that interpretation under which Auschwitz would be considered a human rights violation."

https://www.ejiltalk.org/foreign-surveillance-and-human-righ...

I disagree with using "the Auschwitz rule of interpretation". The first reason is that it's the rhetorical equivalent of comparing someone to a Nazi. It immediately escalates the discussion to a comparison with one of the worst things humanity has done.

The second is that it is either pointless, or creates a mess of international affairs. It disregards national sovereignty, so either we're going to do something about it every time another nation encroaches on what we consider natural rights (probably meaning war), or we're not going to do anything about it in which case it was a pointless exercise.

Your text actually says "treaty" though, which implies an international context. It makes more sense in that context because national sovereignty still exists.

Legal requests need at least one unique identifier to make a request. First and last name is rarely enough; there are too many people with the same name and the proper response to that kind of request is "we can't identify a unique subscriber with that information". Email addresses, user IDs, phone numbers, profile urls, screen names, etc. are the kinds of unique identifiers for specific service providers. Not every online service records phone number or email address though, so identifiers are generally chosen specifically for each service when making a legal request.

https://www.apple.com/legal/transparency/ if you pick the drop-down for Account shows about a 60% success rate; in the other 40% of cases there's nothing to alert a user about because no data was produced, for a few possible reasons. The legal team comes up with a review process for requests and how to respond to each kind under different circumstances. Presumably Google and Facebook have similar transparency reports.

The FBI has shown that it will doctor emails in order to get FISA warrants. This fact is subverted by the narrative that one person was caught doing it, as if to imply that he woke up one morning and chose to do it all on his own.

source?

The IG Horowitz report from December 2019. FBI lawyer Kevin Clinesmith doctored a email from the cia which originally said Carter page was a CIA source and he changed it to he was not a source which made a huge difference because if courts had known Carter Page was a cia source, then the FISA warrants and 3 renewals on him would have not ever been issued. Carter Page was helping his own country and working for the CIA. But Kevin Clinesmith turned it the opposite. And as expected Clinesmith got no jail time.

> In Nov. 2019, the Department of Justice (DOJ) Inspector General (IG) Michael Horowitz issued a criminal referral for Clinesmith’s role in the FBI’s surveillance of Carter Page. According to Horowitz’s final report on FISA abuse, Clinesmith–identified as “Office of General Counsel attorney“–altered an email used in a surveillance renewal application.

> According to Horowitz, an FBI “Supervisory Special Agent 2” had requested “a definitive answer to whether Page had ever been a source for another U.S. government agency before he signed the final renewal application” of the third FISA warrant application seeking to maintain the wiretap on the former Trump 2016 campaign advisor.

> A Central Intelligence Agency (CIA) liaison told Clinesmith that Page “did, in fact, have a prior relationship with that other agency,” the IG report continued. Clinesmith, however, “altered the liaison’s email by inserting the words ‘not a source’ into it, thus making it appear that the liaison had said that Page was ‘not a source’ for the other agency” and passed it along to the FBI’s supervisory agent.

> “Relying upon this altered email, [Clinesmith] signed the third renewal application that again failed to disclose Page’s past relationship with the other agency,” Horowitz concluded.

> Horowitz’s report also showed that although the CIA told the FBI in August 2016 about Page’s relationship with the CIA, the FBI left that out in the initial FISA application, filed in September 2016.

> The report said the first FISA application left out that Page had been approved as an “operational contact” for the CIA from 2008 to 2013 and that he had had “provided information to the other agency concerning his prior contacts with certain Russian intelligence officers.”

> That information “overlapped with facts asserted in the FISA application,” according to Horowitz’s report. The FISA warrant application on Page also left out that the CIA had given Page a “positive assessment,” the report said.

https://oig.justice.gov/sites/default/files/reports/120919-e...

https://www.msn.com/en-us/news/politics/former-fbi-lawyer-ke...

Doesn’t the FBI have better things to do? Seriously Sci-Hub is more of a public good than a serious threat to the US.

You must be new here. The flight logs of Jeffrey Epstein's jet were obtained via subpoena and published in the press and not a single indictment was brought forth from it.

Every time there's a mass shooting we hear the shooter was "known to the FBI".

The FBI has better things to do than harass Elbakyan, but it won't do them.

The FBI is a political organization and domestic spying machine. The US is a police state.

The same US that wouldn't even enforce their mask mandates is a police state?

This is like running around and calling anything slightly bad a country does Nazi Germany.

Nuance matters, think about the world a little more complexly.

Selective enforcement of laws to political ends is a hallmark of a police state.

Also the US has the highest prison population per capita.

If it quacks like a duck...

And was there some great selective enforcement of the mask mandate to target a political group and lock them up?

No.

It wasn't enforced by the state at all.

And yet they have no hesitation to use the entire national security apparatus to chase a foreign national around the world for publishing some scientific papers.

An American law enforcement agency requesting data from an American company is a far cry from "chasing a foreign national around the world".

I think it's a waste of time as much as anyone else but Sci-hub is clearly against US law. Just because you disagree with the value of a law enforcement action doesn't mean you are living in a "police state"

> Sci-hub is clearly against US law.

Sci-hub has nothing to do with US law.

> Just because you disagree with the value of a law enforcement action doesn't mean you are living in a "police state"

Uncritically buying one's national government's claim to global jurisdiction, justifying "law enforcement actions" against foreign citizens in foreign lands in the frigging first place, on the other hand...

That seems to indicate some kind of successful indoctrination into a pro-police-state mindset.

> the highest prison population per capita

That's true, but the more horrifying fact is that it has the highest prison population in absolute numbers: http://news.bbc.co.uk/1/shared/spl/hi/uk/06/prisons/html/nn2...

https://en.wikipedia.org/wiki/List_of_countries_by_incarcera...

Considering the FBI's history of stopping terror attacks that they manufactured[1], I suspect many of those 'known to the FBI' shooters were actually working with the FBI in some capacity or another.

[1] https://theintercept.com/2015/02/26/fbi-manufacture-plots-te...

Google security in the face of a LE request: We'll need you to get a warrant, but here's a list of friendly judges with extremely efficient rubber stamps. We're here to serve you!!

Apple security in the face of a LE request: We'll need you to get a warrant.

The security we actually need and LE actually deserves: We'll need you to get a warrant, and then you can have access to that specific customer's E2E encrypted shitblob. Good luck.

Maybe that sort of security wouldn't be needed or deserved if our government was well intentioned and we had good laws and a functioning judicial system. But no...we have the world's top security agency that would rather hoard zero days than protect its citizens, law enforcement that will never respect constitutionally-protected rights, and judges that play along for political points and appointment nominations.

> The email’s authenticity (or otherwise) has indeed been considered by Elbakyan who says that after examining the metadata, has concluded that “it is too complicated and useless to be a spoof.” Indeed, the Sci-Hub founder also posted the email’s headers which at first blush do suggest that the email is genuine.

Has the founder confirmed whether or not Gmail reports DKIM and SPF passed?

That would confirm that it was sent from an Apple controlled email server. Then you would have to confirm that Apple does not allow a sender to spoof the "From:" address to "noreply@apple.com" somehow.

Stuff like this should just be sent with a regular email signature...

Seems like both DKIM and SPF checks have passed:

https://twitter.com/ringo_ring/status/1391415257881530376/ph...

Who have vested interests in stopping something like sci-hub?

this company: https://www.linkedin.com/company/elsevier

And the American Chemical Society that has never liked open science unless they can make money out of it.

Let me rephrase, who is trying to take this down and has sufficient leverage to have the FBI focused on this instead of the multitude of other important things they could be doing.

During the Obama Admin years Hollywood called in Joe Biden [1] to use the US Government's resources to pursue Kim Dotcom in New Zealand, to destroy Megaupload.

One can probably safely assume Elsevier has powerful friends in DC doing their bidding, trading favors.

[1] https://twitter.com/kimdotcom/status/1288926291949838336

> and has sufficient leverage to have the FBI focused

RELX is certainly big enough to do this:

https://en.wikipedia.org/wiki/RELX#Controversy

I'm fairly certain that it's not the authors of the papers. Hiding away research behind paywalls and subscriptions is extremely weird and counter productive to free and open research.

If you know that a paper exists, you can just email the authors and ask if they'll send you a pdf. My guess is that most will just send it to you, along with instructions on how to correctly cite them.

Years ago I had a Danish university lawyer look at me weird and ask if I was serious, when I asked what right a public funded university had to sell a patent to a US company. My logic was, and still is, that Danish companies already paid for the research and the patent via their taxes, so they should be legally allowed to use it for free. Apparently it's crazy talk to assume that something paid for by the tax payers should actually belong to those tax payers.

So far I have not met a researcher who held the opinion that sci-hub is a bad thing.

Actually the way I learnt about sci-hub a few years ago was when I asked an acquaintance of mine whether he'd share a copy of a paper he co-wrote with me, what I got from him was a sci-hub link.

I dream of a golden age where scientific knowledge is freely available to everyone. Unfortunately, the "people in charge" seem hellbent on a different path...

Related thread from 6 days ago: https://news.ycombinator.com/item?id=27086290.

I am disappointed Apple didn't attach a copy of the data sent to the FBI to the email.

Since it's all Elbakyan's data, there shouldn't be any privacy reason not to attach it.

Research funded by the public should always be public domain, change my mind!

Why would you use Apple software/services for anything like this? You know it's backdoored.

What are you going to switch to? Android?

You don't have to do everything on a phone.

You don't have to do anything on a phone!

Even if you use pen and paper it can still be subpoenaed.

Harder if you don't know that the paper exists and it is not in US controlled territories.

GNU/Linux phones?

Sure, because at least then I can have a top-down view of my security, instead of having it abstracted away into corners where I have to trust Apple to do the right thing (see article above as for why we don't do that).

Good luck finding something that isn't

It's a spectrum, not a black or white issue.

Nobody said she did. Likely there's nothing useful on there, it's just a way to intimidate her

> Why would you use Apple software/services for anything like this? You know it's backdoored.

Why would anyone use closed proprietary software/hardware/services for anything like this? You know it's backdoored, or soon will be, since putting backdoors in software is both a profitable business for corporations, and a convenient cheap way to find unwanted people for governments.

The same reason she plasters her face all over Sci-Hub waving. The same reason she's on Twitter and giving media interviews. And now she's got American FBI and Indian courts after along with the publishers.

It sounds like she hasn't actually used it in a long time, and probably forgot about it.

> According to the Sci-Hub founder, the Gmail account associated with her Apple account (and from where she received the email) was registered by her a “long time ago” when she “was at school perhaps.” However, a cursory Google search reveals that the address is public knowledge and has been associated with Elbakyan for many years, so it’s not beyond the realm of possibility that someone is having ‘fun’ at her expense.

She's doing good for the world; leave her alone.

Unless US citizens regain oversight of their government, the only people who have any say in the matter are those throwing dollars. It's quite barbaric, excepting vague thrusts at plausible deniability.

Is Apple's domicile what makes this possible? or can any country demand to see your data?

It makes me wonder about the state of the art on small countries becoming data havens, it seems like a natural thing to construct.

Apple's imports could be threatened so there's leverage.

Really you shouldn't depend on the good nature of some large organization to protect your data. That means not using iOS though since it's pretty much unusable without Apple services (even push notifications go through them.)

Why would anyone concerned with privacy have an apple account?

I would like to believe ElBakyan is wise enough not to have anything significant/private on such an account.

Why does she plaster her face all over Sci-Hub waving?

Is anyone downloading those articles and such for archival purposes in case it actually shuts down?

Seriously: why would a public figure, who knows she will be the target of the FBI, use her own name to make an Apple ID? Or didn't she and did the agency use her phone number and SIM card and IMEI to track her to whatever device she happend to be using?

Can anyone look up that case number?

Your tax dollar at work

How timely. Just finished watching 'startup' on netflix. Wouldn't be ironic if 'some company' started a darknet for their apps.

I'm surprised she has anything valuable on Apple (or Google) services. She clearly has the technical expertise to operate her own.

Did sci-hub do something different in 2019 or something? I thought they just had user submitted scientific papers

Why is fbi interested? Can anyone explain

Likely private interests. With college-running mafiosos breathing down their neck, I'm sure the US government has no trouble justifying the seizure of someone's personal information.

Because the main purpose of law enforcement is to enforce the property rights of the wealthy and well-connected. Things like catching murderers and rapists is a secondary concern that occasionally happens by accident.

The FBI's job is basically to quietly enforce the status quo and the interests of established powers. Look up cointelpro and it will make more sense.

They did this to Rudy Guilliani too. FBI was going into his iCloud for over a year. What makes it more egregious was that Guilliani was Trump's lawyer during the impeachment. So the government was both prosecuting him, and spying on his defence's lawyers private emails with his client. If they can do it to a presidents lawyer with no consequences. They can do it to anyone.

Are we sure this actually happened? The only source I'm finding on this is Giuliani himself.

The government disclosed that they did this to Rudy's lawyer after the fact.

https://ca.finance.yahoo.com/news/lawyer-feds-got-rudy-iclou...

Rudy made a video detailing the FBI breach of his iCloud account. [Starts at the 18:30 minute mark] https://www.youtube.com/watch?v=PcjaaBcmUVg

The "government" didn't make any such statement. A lawyer who was a longtime friend of Rudy came out and made a claim that was never corroborated or even acknowledged by the government, by the looks of it.

Remember, it'll be fine in the end. The RNC's push to eliminate domestic encryption ensures a future where everyone has access to Giuliani's iCloud!

I did not claim "government: made a statement". The government need not make statements when they disclose information to counsel, typically they don't. As per article, the government declined comment.

If Rudy is friends with is own Lawyer is irrelevant.

> If Rudy is friends with is own Lawyer is irrelevant.

Cool! By that logic, we'll stack the jury with people who hate him, since obviously personal relationships don't matter in the legal system. How do you think that case will turn out, Atticus Finch?

> They can do it to anyone.

Play stupid games, win stupid prizes.

I fully expect that any American, involved in half the shit that drunk found his way into, would also be under double top secret surveillance.

That's reality Jack.

That's a very low standard you are setting for your democratic government. Political prosecutions and spying on counsel is something that the Communists and Nazis did. But even they tried to follow their own laws.

If Rudy Guilliani is defending the democratically elected president of the United States, he should be beholden to the interests of the people. If our government has the legal ability to attain this data, this is a textbook example of how and why to use it.

This is mostly nonsense. The only legal duty of lawyer is to defend his client. No lawyer has the burden to be "beholden to the interests of the people" whatever double speak that means.

Well it's a good thing this has already been settled in a court of law then. No sense in arguing it online if our wonderful nation has already made an official ruling.

Yes, it went to full trial in the senate. Where he was ultimately not found guilty. The legal process played out.

But not before the prosecuting team was found to have been doctoring evidence against him. By adding a blue checkmark to tweets, they were then using to try and convict him. Its what happens when people try to use the ends justifies the means thinking.

Not really sure what you're prattling on about, I haven't used Twitter in the better half of a decade. Either way, Giuliani is the dude who tried jerking off in the Borat movie. You're going to have a hard time convincing America that he's some sort of bastion of innocence, and that we should really care about how poorly the system is treating an old white man defending another old white man. There are bigger metaphorical fish to fry here.

I posted to corroborate that FBI is able to access iCloud accounts, with what appears to me, minimal legal oversight. Not really trying to convince anyone. But even the best arguments only fall on reasonable people's ears.

That would be a heavy burden to try convince someone that gets their world view from Borat, based on a staged scene in a fictional movie. You are right.

On a side note, tricking people to laugh at them, and to make money from their moment of ambush, and racial stereotypes is gross on many levels.

Instead of viewing people as only representatives of some ethnic group like "white man". Try treating them as individuals. People very more inside an ethnic group anyway. Perhaps your scorn should be directed towards tall people, or short people, the intersectional list is endless.

Buddy, you're the person who's comment history is full of begging people to investigate hallucinative realities and conspiracy theories. Maybe you'd be better received on Facebook, or perhaps a place like Tik-Tok where they respect hysteria.

The Universe being a holographic projection is a legit theory! Do you throw in the kitchen sink into every argument? To actually go through my comment history to find something to "win" is kind of a low move. So I'm done.

Excuse me for being curious, I simply had to see what other words of wisdom you were sharing around here.

If the email is genuine, then we are officially lost. Apple has gone from the company that refused to break into the San Bernadino shooter's phone (Anyone remember the feature by Last Week Tonight and Tim Cook talking about writing "the software equivalent of cancer"?) to the company that dutifully does what the authorities demand when they bring down the hammer over copyright claims.

This comment shows a gross misunderstanding of the technical differences between 1) basically breaking encryption for all iPhones on the market simultaneously, and 2) copying a file.

Only if the file contents are accessible. Why isn't end-to-end encryption utilized for storage of email on Apple's servers, the same way they do for iMessaging?

Because 99.9999999% of emails are not encrypted before being sent.

True. But I’m not talking about end-to-end between sender and receiver. I’m just talking about using public key encryption to encrypt received contents with one key and decrypt with another. There are a lot of technical challenges - particularly with maintaining compatibility with email clients - but it can be done.

The inability of MTAs to negotiate and utilize any kind of SSL-style encryption when relaying messages is also a gross travesty in the year 2021.

According to Google, 82% of outbound email to other providers, and 93% of inbound from other providers, is encrypted in transit.

https://transparencyreport.google.com/safer-email/overview

I read somewhere that Apple were going to encrypt backups but that would mean if a user lost their key the data would be lost and as such decided that for usability they would keep back ups as is.

And apparently the request to Apple happened in Feb 2019.

So, not a recent change?

No, not a recent change, except now she decided to post this letter on Twitter.

Apple has always been subject to US law, and as such, was always required to provide information that they do have access to. If it's in iCloud, most of it can be extracted by the law enforcement with court order.

Nothing changed between now and the San Bernardino case. The difference was that FBI wanted Apple to compromise device encryption, which capability does _not_ exist now.

So why hasn't end-to-end encryption been utilized for years with the storage of email and other files, like they do with iMessage content?

You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS).

How Apple CloudKit security works is documented [0] and what Apple can provide to the law enforcement is pretty easily googleable [1], and has been subject to much media coverage over the years. All I was saying is that this is not some recent change.

[0]: https://support.apple.com/en-gb/guide/security/sec3cac31735/...

[1]: https://www.apple.com/legal/privacy/law-enforcement-guidelin...

> You can certainly use E2E encryption (ie, S/MIME) for your email, whether it's using Apple Mail or not. I'm not sure what you suggest Apple can do about it if you don't use PGP/GPG on your side though (and yes, you can use S/MIME for email both with iOS and macOS).

What Apple could do seems fairly obvious: Build it into their mail client and enable it by default, no?

> Build it into their mail client and enable it by default, no?

Support for S/MIME _is_ built into the client. The user has to configure their certificate keypairs, that part is not under the OS’s control (unless I’m missing something)

So, enable it by default and make setting up keys part of the mail client setup?

The hardest thing about a service trying to end-to-end encrypt an email, is that any given email service provider only controls one end.

You only need regular client side encryption to protect things in the cloud. Just generate a key on the phone and keep it there. Probably the reason they don't do that is that it would make it so that a lost phone would result in the loss of cloud stored data. People store things in the cloud to prevent that sort of loss.

Email when encrypted end to end in the traditional ways is safe on the IMAP server but also has a requirement to back up a key off the device to prevent loss of old emails on loss of device.

Email can't be secured for many reasons; use a modern, secure messaging app for that, such as Signal. Regarding encryption in particular:

Encrypting email metadata prevents emails from being delivered and processed. Metadata is as valuable as the content of the email.

Encrypting emails at rest prevents server-side services from operating, such as webmail.

Reply on news.ycombinator.com