Hacker News Reader

Comment by AlienRobot | Hacker News Reader

This seems like such a weird problem to me. If they're criminals, just send the cops? If you can't send the cops, then they aren't criminals?

How do you end up in this limbo where you need critical infrastructure to play judge?

View on HN

The internet is a global system that spans ~all jurisdictions, and most internet criminals live in jurisdictions that don't prosecute internet crimes as long as the bad actors leave citizens of their own country alone.

So they're criminals as far as the US and allies are concerned, but de facto not criminals where they live. If they're going to be locked out of the system, it has to be by the infrastructure, because their government has no interest in stopping them.

I see. Perhaps there should be a legal framework to get the government to demand companies like cloudflare stop serving these international criminals, then. That way it wouldn't depend on a private entity making the judgement.

Do you ever think it's weird that we have gone through web 1.0, web 2.0, semantic web, intertubes clogged with spam bots, web 3.0: crypto edition, and the dawn of AI scraping, and we still haven't figured out these issues?

Which government do you mean when you say "the government"? Any national government? Only the US government? Only governments in which the US is friendly and/or has agreements with?

Would you want authoritarian governments to be able to demand Cloudflare stop serving those they consider criminals that are outside their borders?

International law is messy.

The rule of thumb is governments where Cloudflare has equipment, personel, or banking.

There is a procedure to get a foreign case recognized in the US, too, but it has to be serious, and it's not an easy process.

CloudFlare has equipment in 120+ countries, including China: https://www.cloudflare.com/network/

I again ask: is it desirable for any of those countries to be able to unilaterally force a company to enforce its laws regardless of where the individual in question is?

If the equipment is in country X, it seems reasonable to enforce the rules of country X. Plenty of companies refuse to operate in specific countries, including China, because they don't want to follow rules of that country.

If CloudFlare chooses to do business in China, that's a choice they're making and it comes with consequences.

Maybe they can offer service where customers will only be served from equipment outside of China, maybe that's not something they choose.

For starters, Cloudflare is a USA company so it has to do whatever the USA government tells it. See National Security Letters.

They can easily order it to reveal the origin server of a website, or the sign-up IP address of the account, or to stop providing services to one.

Are you American? Because that sounds like such an American idea of how the world works.

To answer your question: most malware actors can be traced back to Russia, what exactly do you think "sending the cops" after them will accomplish and if the answer is "nothing", then does that mean you don't think they can be called criminals?

It doesn't need to be physical cops. What I mean is that if crimes are being committed, the legal system should initiate a process that either puts them in jail (which as you say may not be possible) or ends up with cloudflare banning and other internet companies blacklisting them. That way, the burden of judging criminality isn't on random companies but on the appropriate authorities.

Legal systems. And getting the Russian and American legal systems to cooperate is about as hard as getting Russia and America to cooperate.

Who you going to send to an online pharmacy hosted say in Egypt?

Why do you need to take down Egyptian pharmacy in the first place?

Because they send controlled substances to the US and falsely label them as "supplements"

I know, because I bought RX stuff from India and it did not get labelled as medication

Someone bought roids from India and didn't get busted by DEA in the process?! The horror!

Cloudflare shields criminals from cops. They do so because of "free speech" or whatever. There was recently a story about a swatting victim, who tried to get the forum the swatters use to shut down. Cloud flare refused to give the identity of the criminals, the case even went to court and the victim lost and now apparently has to pay court costs.

Our legal system is unfortunately not perfect, which is why it matters what infrastructure providers do.

Do they enable criminals by shielding them from the police? Or do they have policies in place that prevent abuse of their service?

With Cloudflare, I'm pretty sure they lean towards the former.

I'm reasonably sure cloudflare would comply with any subpoenas / warrants sent their way.

Which is a catch-22, because subpoenas / warrants for collection of digital information have to name a specific intended target (a real legal identity under suspicion, not some pseudonym) — and "the real legal identity of the suspect" is exactly the thing that Cloudflare's proxy-shielding prevents you from learning. Courts won't act until they have some specific individual to act toward.

(This is also why, whenever you hear about e.g. police stings on Tor forums, they never mention requesting courts to issue warrants to ISPs for collection of e.g. traffic-analysis-correlation info about locations of servers hosting illegal content. Instead, this de-anonymization step is something they always have to achieve extra-judicially, usually by contracting a private network threat intelligence firm.)

Or you don't hear about the methods they are using for deanonymizing because they would get the cases thrown out of a court. Warrantless wiretapping and the like... And the private firm is just lying for them so law enforcement can do parallel construction.

Obviously with no context but what I hear

Is the website illegal? Or maybe the police need to deal with spam calls more sensibly. Presumably they can trace where the calls are coming from in real life

wait, are you mad cloudflare decided not to be an active participant in a doxxing campaign? Swatting is awful but I'm inclined to side with cloudflare here.

I'm mad that they offer anonymity to criminals. If you offer a service that lets people hide their identity, you ought to perform a bit of due diligence.

Reply on news.ycombinator.com