Hacker News Reader

The parent post says companies "believe they have to respond to subpoenas or face public obstruction or co-conspiracy charges." This is simply not true. Google fought a DOJ subpoena for search terms in court (while Yahoo, AOL, and Microsoft did not): http://news.cnet.com/FAQ-What-does-the-Google-subpoena-mean/...

Twitter successfully fought for the ability to notify the Wikileaks crew of a DOJ (d) order it received, who then fought it in court with the help of EFF and ACLU: http://news.cnet.com/8301-31921_3-20027893-281.html

Facebook fought a subpoena from the state of Virginia: http://news.cnet.com/8301-13578_3-10352587-38.html

Amazon.com fought the DOJ in court in Wisconsin and fought the North Carolina tax collectors in court in Seattle: http://news.cnet.com/8301-13578_3-9824977-38.html http://news.cnet.com/8301-31921_3-20020680-281.html

And, perhaps most importantly, Google is currently challenging a secret NSL it received from the FBI in federal court in San Francisco, making it the first large Internet company to do so.

In other words, the thesis of the parent's post -- that "contempt of court" is likely -- has been disproven by recent history. That said, I think it's fair to say that AT&T, Verizon, and the other telcos have a much closer relationship with law enforcement and are less likely to take privacy-protective steps via litigation. Look at AT&T's warrantless wiretapping for the NSA. And in the case of the recently-publicized DOJ subpoena to Verizon for the AP's phone records, Verizon could have notified the affected journalists, but chose not to do so.

> Most large public services you use (Skype, Exchange, likely Gmail, etc) have backdoors.

Google gave up Paula Broadwell's joint Gmail account with David Petraeus to the FBI after receiving a subpoena. Gmail isn't secure unless you log in through Tor, compose your message on a separate editor (to avoid autosaving of plaintext) and then copy and paste a PGP encrypted message before you send it.

Now, you might think that this is a ridiculous and impractical thing to do, especially if you are not guilty of any crimes. But Paula Broadwell wasn't guilty of any crimes (or at least wasn't charged with any crimes) before Google happily violated her privacy by giving away her information without a warrant.

It would have been a search warrant from the FBI, not a subpoena. The FBI was notified about the Broadwell "harassment" in mid-2012, and by then Google had nationalized Warshak and was requiring a search warrant for the contents of email communications.

You're right. The FBI did have a warrant to monitor her email accounts [ǣ] (it's too late to edit my previous comment). The troubling thing about the Broadwell story was the FBI's preferential treatment of Kelley because she knew members of the agency. It shows how easy it is to get the FBI to investigate your enemies if you have connections; otherwise it is difficult to get the FBI to care about your case, especially if no one was physically hurt and no monetary damage was caused.

[ǣ] http://online.wsj.com/article/SB1000142412788732407350457811...

(I'm one of the guys that was talking with you in that link)

To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. Once they have the capability, the government can then capable of compelling them to comply. I don't think the government is compelling them to build the capability in the first place.

To use a concrete example, Bitlocker is presumably not backdoored by Microsoft and I don't believe that the government has any (public) laws that would allow them to compel Microsoft to modify Bitlocker in such a way. Microsoft's refusal to backdoor Bitlocker could not get them into any sort of official trouble. If Microsoft had Bitlocker backdoored already for whatever reason (say, customer service data recovery), then the government could compel them to comply them to unlock drives.

I don't think we really disagree on anything substantial.

To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers.

I disagree. Most are "backdoorable" because it is easier to build a service that way.

For instance consider gmail. The hard requirement is that a person armed with a user name and password can login from a browser and get access to that email. The common requirement is that a person armed with the right cookie can get that email. Now in theory you could encrypt all of the emails on the server, but now your operations costs went through the roof. However if you store them in plain text then you can use smart indexing, and your operations costs are much more manageable.

However once you've decided to have plain text files on your server, EVEN IF you aren't doing anything with them other than storing/sending them to the user, you're now able to backdoor those files, and hence can be compared to by a court.

There have been many email systems out there. Open source (qmail, sendmail, etc), proprietary (Exchange, Dovecot, etc), hosted in the cloud (Hotmail, Gmail, etc), hosted at your company (Exim, Oracle Communications Messaging Server, etc), built on top of platforms not meant to do email (Lotus Notes being a prime example) and so on.

Every single one of the ones I named and many, many, more stored data in plain text and legal discovery could be compelled on them. Simply because that was the easiest way to build them. There are exceptions, but they are exceptions because they were meant to be. Hushmail comes to mind. However even there, even when it was designed to store data in encrypted format, if the government can find a way to force you to extract data, they will push you to do so. (See http://en.wikipedia.org/wiki/Hushmail for a description of the way in which the government got Hushmail to capture plain text, even though the data was stored in plain text.)

The moral? Often the government has access not because evil profit-mongering corporations did wrong, but simply because obvious technical decisions leave them able to do so. And this can be true even when those corporations made a good faith effort to make that impossible.

> Most are "backdoorable" because it is easier to build a service that way.

Okay sure, I can go with that. My point is that the reason is not "because the government makes them do it that way." I agree with all of what you are saying.

Tying into the original conversation, my beef with skype isn't so much that they were backdoorable but that they were backdoorable when they have been claiming for years that they are not.

This is well said. The thing is, though, that it was the non-Java version of Hushmail that was exploited by the Feds. The fact that it could be exploited shouldn't cast the end-to-end secure version in a negative light.

So who at Google is going to code an encrypted Gmail in their 20% time? Paid, of course, because the server won't know what ads to show. (You could put that intelligence in the client, but it seems a privacy-sensitive clientele wouldn't like even that info to leak.)

I'm sure Google already has an encrypted version of their Gmail service, but why would they shoot themselves in the foot and loose all that Ad revenue?

You could put that intelligence in the client, but there is only so much analysis you do do using JavaScript, I'm sure the computing power they have available on their servers is phenomenal, and add to that a huge databank of information they have available to be able to better match those ads to you. And you've already mentioned the privacy issue...

Google would choose to lose "all that ad revenue" if they could replace it with sufficient, and probably more lucrative, non-ad revenue through paying customers.

Yep, there is no public or secret law that would require Microsoft to backdoor Bitlocker.

What's worth remembering, though, is that such a proposal came reasonably close to becoming federal law in the 1990s. It was backed by the FBI and was approved by a House of Representatives committee, which I mention here: http://news.cnet.com/8301-13578_3-10024163-38.html

An excerpt from that article: "In the 1990s, [now-VP Joe] Biden was chairman of the Judiciary Committee and introduced a bill called the Comprehensive Counter-Terrorism Act, which the EFF says he was "persuaded" to do by the FBI. A second Biden bill was called the Violent Crime Control Act. Both were staunchly anti-encryption, with this identical language: It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law...

While neither of Biden's pair of bills became law, they did foreshadow the FBI's pro-wiretapping, anti-encryption legislative strategy that followed -- and demonstrated that the Delaware senator was willing to be a reliable ally of law enforcement on the topic. (They also previewed the FBI's legislative proposal later that decade for banning encryption products such as SSH or PGP without government backdoors, which was approved by one House of Representatives committee but never came to a vote in the Senate.)"

I agree!

And I hope it's clear I like and respect your questions -- people like you are the key reasons I keep coming back here.

About bitlocker, I agree with you that there likely isn't a backdoor built into the service beyond breaking crypto (likely still hard, though crypto export laws still apply and influence overall strength). What I would point out is that the data recovery 'backdoor' (where private keys get stored in central servers, either in AD or your Microsoft Account) is turned on by default. It's most likely for user convenience, but I imagine those that want ediscovery would be happy.

http://windows.microsoft.com/en-us/windows-8/bitlocker-recov...

> The govt comes by with a subpoena (secret, classified, or public) and requires Microsoft or the customer company to produce communication records that exist in a form that may be used as evidence. Failure to do so is best contempt of court and worst obstruction of justice.

This assertion seems dubious - IIRC the law (court order or subpoena or whatever) cannot compel a company to disclose information which they do not have in their possession. What are your sources (and/or credentials) supporting this opinion?

[EDIT] While we're at it, could you please also substantiate the following claim of yours? It doesn't look right either - if this were so, then emails would be retained indefinitely whereas we know for a fact that they are routinely and aggressively purged, except when explicitly held for discovery.

>There is a prevailing theory that companies are responsible for employee actions, and failing to log is seen as unacceptable.

I recall some court rulings here in the US that a company could be required to install new software to write log data to disk, once the court found out that it was available in memory. This is only a special case of "information which they [do] have in their possession", but shows that that rule goes further than one might think.

I am concerned about another scenario. I'm working on a site where people can exchange messages they've encrypted at the endpoints, such that the participants alone have the decryption ability and the server does not (assuming drawkbox is mistaken in some of his claims). Will it be illegal to launch this in the US if the requested law is passed first?

Sometimes in tax law, courts have held that because Congress was considering a bill, the taxpayer was on notice that something was going to be illegal, and then the taxpayer was unable to rely on it, even though it was legal when he did it. Besides, USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded.

I think it's best to look for a lawyer to get specific advice.

Black-and-white statements like "USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded" only serve to cloud your judgement and blind you to the intricacies of the situation and your available options. You know it's not true.

> There is not yet a way to build a messaging service that has both features [content-aware features like URL detection, spell-checkers, web browsing for dumb clients, targeted ads to fund free services, etc] AND [pure] privacy [in the US].

If you did it on the client, and not on the server, you could provide those features without reading messages, or breaking end-to-end encryption.