Comment by apsec112 | Hacker News Reader

Comment by apsec112 | Hacker News Reader

Parent Full thread

Shame on the EFF, which I normally support, for jumping on this bandwagon of terrible journalism.

The EFF insinuates, without saying outright (since they must know it is false), that this is a law enforcement policy like the Computer Fraud and Abuse Act. A law enforcement policy is one where, if you're sitting at your desk, and the government thinks you've hacked into someone's computer, the government throws you in jail.

This executive order has nothing to do with domestic law enforcement, like Aaron Swartz or Kevin Mitnick or Dread Pirate Roberts or whatever. It is a foreign policy decision. The US maintains a public list, called the SDN list, of foreign entities that American citizens and companies aren't allowed to do business with. These are normally agents of governments the US doesn't like, eg. Iran and North Korea. This order adds hacking to the list of reasons why the President can put an entity on the SDN list. If, say, a Chinese defense contractor started hacking into American computers, the President can now prohibit American businesses from trading with them.

Under this order, the only way you can go to jail (that you couldn't go to jail for before) is if a) the President suspects some foreign person or company (say, a Chinese defense contractor) of hacking; b) the President decides to put that company on the SDN list; c) you know that company is now on the SDN list; and d) you buy things from, sell things to, or otherwise do commercial business with that company.

I think it's a bad idea for the executive to have the power to add people to the SDN list without judicial oversight. But they already had that power; this isn't really anything new. Claiming it is just confuses everybody.

Not a lawyer, but sounds to me like Dread Pirate Roberts could still find himself on the wrong side of this sort of this EO:

"Sec. 5. (a) Any transaction that evades or avoids, has the purpose of evading or avoiding, causes a violation of, or attempts to violate any of the prohibitions set forth in this order is prohibited"

Broadly interpreted, wouldn't that be used against crypto-currency developers or secure communication tools developers that work on such tools with the knowledge that they can be used by sanctioned individuals or organizations? How about developers who write secure communication or security testing tools and sell them online without the ability or interest to verify who the purchaser is?

The Patriot Act was also supposed to be about targeting only a few hostile foreign organizations, and yet it had massive implications for everyone living in the U.S. and abroad. Now, I get that an EO and a law are different things, but still, I can see potential implications of the general trend of the U.S. government seeing cybersecurity as something you throw sanctions and laws and deterrence at until it stops being an issue, without considering the potential collateral damage or overreach.

Ross Ulbricht isn't a foreign national, and there is no foreign power within the scope of this EO for whom any of Ross Ulbricht's assets hold any beneficial interest, so, no, this doesn't have anything to do with DPR.

Given he tried to have several people killed I imagine he finds himself on the wrong side of multiple executive orders, laws and moral frameworks alike...

As for your second paragraph I would imagine you'd have to prove some form of intent in order to throw someone in jail?

Do we know if he really did ? I thought this was all speculation from the prosecutor to shine a bad light on the character. He never was convicted of it for sure.

> Given he tried to have several people killed I imagine he finds himself on the wrong side of multiple executive orders, laws and moral frameworks alike...

Sure, not saying he is a moral person, or not a criminal, or that he is likely to be even in the smallest measure a good person. But he clearly is not a hostile foreign power in and of himself, though I am sure he would love to be considered one ;)

My only argument regarding DPR is that this sort of EO might end up applying to targets other than agents of hostile governments or terrorists or whatever the current boogieman is.

> As for your second paragraph I would imagine you'd have to prove some form of intent in order to throw someone in jail?

I would hope so, and that things like "intent to sell/export tools to find and exploit security vulnerabilities" would not be enough, even when interpreted by non-expert police, prosecutors, juries and judges.

Actually, no. The same federal agents that stole large sums of Bitcoin from Silk Road also seem to have tried to frame DPR for murder. http://www.forbes.com/sites/sarahjeong/2015/03/31/force-and-...

"This executive order has nothing to do with domestic law enforcement"

This is just not true.

As the article points out, Section 1(ii)(B) has absolutely no provision requiring activity to be outside of the United States. Read it through:

Section 1. (a) All property and interests in property that are in the United States, that hereafter come within the United States, or that are or hereafter come within the possession or control of any United States person of the following persons are blocked and may not be transferred, paid, exported, withdrawn, or otherwise dealt in:

(ii) any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State:

(B) to have materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of, any activity described in subsections (a)(i) or (a)(ii)(A) of this section or any person whose property and interests in property are blocked pursuant to this order;

Look closely at this part of (B):

to have materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of, any activity described in subsections (a)(i) or (a)(ii)(A) of this section

The requirement is only to assist, sponsor, or provide support to someone described in (a)(i) or (a)(ii)(A), which describe people who are "in whole or in substantial part, outside the United States."

What it does NOT say is that the person providing that support must also be outside of the United States. That's what the EFF article is talking about.

It doesn't matter what the executive order says. It has to invoke laws passed by Congress that provide the President with the authority to do anything. In this case, that law is the IEEPA. Read 50 U.S.C. 1702. He is limited to foreign transactions.

Executive orders are part of the federal rulemaking process. Rulemaking fills in the blanks left deliberately by Congress. Whether or not the President can use a national emergency to interfere with domestic financial transactions is not a blank Congress appears to have left in the IEEPA.

It does invoke laws passed by Congress, one which specifically grants powers to the President:

50 U.S. Code § 1702 - Presidential Authorities [0]:

(1) At the times and to the extent specified in section 1701 of this title, the President may, under such regulations as he may prescribe, by means of instructions, licenses, or otherwise—

(B) investigate, block during the pendency of an investigation, regulate, direct and compel, nullify, void, prevent or prohibit, any acquisition, holding, withholding, use, transfer, withdrawal, transportation, importation or exportation of, or dealing in, or exercising any right, power, or privilege with respect to, or transactions involving, any property in which any foreign country or a national thereof has any interest by any person, or with respect to any property, subject to the jurisdiction of the United States;

[0] https://www.law.cornell.edu/uscode/text/50/1702

Yes, and 50 USC 1702 is limited to foreign transactions and actors. You can't have your assets frozen under IEEPA merely for publishing POODLE. You have to write POODLE on behalf of China for this to matter to you.

Citation? Because that's not what the EO says:

to have materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of, any activity described in subsections (a)(i) or (a)(ii)(A)

According to the EO, you only need to "provide technological support." And what does that entail? Whatever the Secretary of Treasury and AG decide it does.

Once again: the EO can only do what the IEEPA allows it to do. It does not matter what the EO says: if it conflicts with (or, in this case, is simply vague about) something in the IEEPA, it's the IEEPA that controls. Look at your own citation (50 USC 1702 is part of IEEPA); it's right there in the text.

This has come up before in US law --- executive orders w/r/t IEEPA --- before, by the way.

(I didn't downvote you and don't think anything you wrote deserves a downvote, for what it's worth).

That sounds very good, except for four ominous words in the article: "declares a national emergency". If I understand correctly (and I could well be wrong), in a national emergency, the president can (temporarily, theoretically) assume powers that neither Congress nor the Constitution gives him. Lincoln did this, briefly, during the Civil War.

The article doesn't give any more detail on the "national emergency". But I worry that it could be a "get out of jail free" card for the president to do more than Congress authorized in the IEEPA.

Does anyone know enough to shed some light here?

The whole concept of the IEEPA is to define the scope of powers the President has when he declares a national emergency.

The history of the IEEPA was that before it was passed in the 1970s, Congress felt like there were not enough controls on the President's emergency powers. So we're discussing a delegation of power designed for exactly the circumstance you're talking about.

The concern that the President could claim extralegal powers in an "emergency" is legitimate, but you can't reasonably point to a case where he's working within the narrow guidelines established by Congress specifically to avoid that outcome as evidence that that's happening.

Got it, thanks.

We've been in a national emergency since September 14, 2001. http://www.msnbc.com/all/obama-quietly-extends-post-911-stat...

I'm not sure if that was extended in 2014 but after some googling I also found that we have multiple ongoing national emergencies http://www.usatoday.com/story/news/politics/2014/10/22/presi...

The NEA means national emergencies aren't a simple binary state. Instead, the President invokes "emergencies" on an as-needed basis to access specific powers delegated to him by Congress, which can shut him down with a vote (and, of course, can repeal the grants of power altogether).

So it's not as if the President can say "oh noez hackers national emergency!", suspend habeas, and imprison Michal Zalewski†. Instead: Congress gave the President the authority to recognize arbitrary foreign powers as "threats" and, pursuant to the declaration of a "national emergency", to interfere with their financial transactions. That's what Obama has done here, presumably with China as the subtext.

In the wake of KindHearts, if these powers are executed against American citizens or organizations, they can be challenged and overturned on 4th Amendment grounds. (Note the powers we're talking about are, again, only meaningful in the context of foreign transactions, or assets whose beneficiaries are foreign threat actors).

† I'm not saying you said this.

Cryptocurrency. Reading that section reads like a playbook on threatening cryptocurrency networks.

If you are a part of a cryptocurrency network, you are materially assisting and providing technological support for services potentially in use by foreign entities that are potentially targeted by United States enforcement of this EO.

>This executive order has nothing to do with domestic law enforcement

Of course it doesnt, just like kidnapping people, or murdering with drones doesnt. Its just something your president does on the side, for fun.

Reply on news.ycombinator.com