8 ms·

Shadowy tech brokers that deliver your data to the NSA

194 points by morisy 11y ago

awongh 11y ago
They reference this article, which was also interesting: http://www.buzzfeed.com/reyhan/the-most-important-tech-company-youve-never-heard http://www.buzzfeed.com/reyhan/the-most-important-tech-compa...
mtgx 11y ago
I wish we pushed for a law that said you can only serve a warrant for a data request to the person whose data you want. I think from a human rights principle it makes the most sense. The only reason the government can take it from third parties that store our data for us is because it's "easier" for them to do that, and because there hasn't been enough pushback against it. Imagine if the government said "hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." Probably not the most accurate analogy, but I think you see where I'm going with this. Since the ruling that invalidated Safe Harbor, Microsoft has been pushing for laws and agreements between nations that say law enforcement shouldn't be coming to Microsoft (as a cloud service provider) with a warrant for data requests, but to their corporate customers. So for instance, if FastMail uses the Azure cloud service, they're saying that if the government wants access to a user's data, they shouldn't be going to Microsoft but to FastMail with the warrant. It's a small improvement, but Microsoft and all of the other companies should be pushing so this works for all of their customers, not just the corporate ones. It's exactly the same principle, but Microsoft just takes the easier way out here, because that still gets them off the hook, and it's really what they care most about. The corporations (even if they are "people") shouldn't be having more rights than actual people.
- Terr_ 11y ago
  Unfortunately there is a flip-side to that: How do you investigate or prosecute a company (for, say, fraudulent billing) when they insist that you need a million individual warrants to prove your case?
  - secondtimeuse 11y ago
    Thanks, most privacy activists conveniently forget this argument. In most cases, the absolute approach taken by most privacy activists ends up hurting Students/Patients/Customers etc. since Universities/Hospitals & Insurers/Companies cite privacy laws to escape from the burden of accountability. At the same time the entities are free to mine their own data under guise of "Performance enhancement". Essentially stringent privacy laws often have adverse effect where activities that might be of public benefit Research on Rare diseases/Teacher Accountability/Class action lawsuits are curtailed.
- jMyles 11y ago
  > I wish we pushed for a law that said you can only serve a warrant for a data request to the person whose data you want Among the potential problems with such a solution is that it gives the government the imperative to adjudicate the "ultimate owner" of data. It will not always be obvious, and when it's not, it can surely be decided in such a way that tramples, rather than bolsters, individual rights over data.
  - eximius 11y ago
    The have more stringent requirements for the warrant that doesn't need to determine the owner.
- justabystander 11y ago
  > Imagine if the government said "hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." That's exactly the logic used to justify civil asset forfeiture. There was a link on here two months ago showing that the assets seized were more than all burglaries in 2014: https://news.ycombinator.com/item?id=10591250 https://news.ycombinator.com/item?id=10591250 .
- secondtimeuse 11y ago
  "hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." >> You are clearly not familiar with how IRS functions. IRS can and often times does automatically freeze bank accounts if they suspect tax evasion.[1] The reality is that when it comes to user data the analogy is even weaker, since most user data is transactional in nature. Hence both parties can assert their rights. This is particularly of importance in medical data. Where there are no laws that assure patients of his ownership of his own data.[2] In reality when it comes to information/data the ownership argument is on a shaky legal grounds. And in some cases data ownership might be counterproductive. [1] https://news.ycombinator.com/item?id=8509500 https://news.ycombinator.com/item?id=8509500 [2] http://jolt.law.harvard.edu/articles/pdf/v25/25HarvJLTech69.pdf http://jolt.law.harvard.edu/articles/pdf/v25/25HarvJLTech69....
peter303 11y ago
I've always presumed that ALL of my online activities are visible to the government or other nosy parties. I do stupid things sometimes, but not really stupid.
- JustSomeNobody 11y ago
  This sounds like a form of "I don't have anything to hide so I don't care if they spy on me."
  - hodwik 11y ago
    No, it's more like "The internet is public, and I know I can't hide what I'm doing in public, so I don't do stupid things in public."
  - jkaunisv1 11y ago
    It sounds to me like an acknowledgement that defending yourself against all possible vectors a determined attacker could take to obtain your data is a lot more work than just being a bit careful about what you say and do online. I'm not saying that's a desirable situation.
  - gurkendoktor 11y ago
    No, worse! "I can't hide anything anyway, so I'll adjust my behaviour instead." There are things that I wouldn't ask Google while being logged in (or at all), and that sucks. These things are not "stupid" :(
  - hitekker 11y ago
    It is. I've always countered with "So, you'd be okay if a government agent was watching you have sex with your wife? Every time it happened? For the next 10 years?" You're doing nothing wrong, nothing bad will come of it, but that question always brings that awkward pause: that realization that "wait a second, privacy IS important even if I'm not doing anything wrong." As a side note, people hide things from other people all the time. That's what people do. None of us would like it if all of our insecurities, resentments, any negative thought were exposed to others. In my opinion, those who say they have nothing to hide, are either profoundly ignorant of their selves, or simply lying to themselves and others, i.e. my job depends on me believing and extolling this untruth.
purpled_haze 11y ago
Two things: (1) The NSA is there to protect us, in theory. (2) There will never, ever be guaranteed privacy or security as long as you continue to use other people's equipment and network. Using the internet expecting privacy is like continually saying, "I'm going to have sex with everyone and going to complain about the people that have STD's." You could try: https://en.wikipedia.org/wiki/Wireless_mesh_network https://en.wikipedia.org/wiki/Wireless_mesh_network Or: https://en.wikipedia.org/wiki/Sneakernet https://en.wikipedia.org/wiki/Sneakernet Those are a little safer.
- hammock 11y ago
  >Using the internet expecting privacy is like continually saying, "I'm going to have sex with everyone and going to complain about the people that have STD's" It's more like, no matter how careful you are to choose who you have sex with, there's no avoiding the STD risk when everybody has already been fucked by the NSA
- EasyTiger_ 11y ago
  > (1) The NSA is there to protect us, in theory. Do people actually believe this?
  - cglace 11y ago
    Of course, but not directly "us", they are there to protect our national interests.
  - hodwik 11y ago
    Yes, many of us do.
  - manigandham 11y ago
    What else do you think they are around for? They have bureaucracy and misguided projects and overreaching power but they do protect our national security. They aren't some evil corporation headed by a supervillain, they're full of people just like you and me.
deleted 11y ago
[deleted]
- jlangenauer 11y ago
  What?
  - hoh_helper 11y ago
    The only way I see out of it is open sourcing the entire humanity. The way I see humanity: Good community (99% of the world). Evil community (1% of the world). Scenario - open sourcing government for everyone: If we say the power of good community is "50" and the power of bad community is "5" then open sourcing the gov will have effect something like this: (power of good community increases exponentially) ^ 2 = 2500 (power of bad community increases exponentially) ^ 2 = 25 I mean the power of bad community also increased because they too have access to the source, but they are now in a greater overall disadvantage. That is my rough impression.
    - ddorian43 11y ago
      Come on dude you created an entire account just for that stupid joke
deleted 11y ago
[deleted]
welder 11y ago
Are there any examples of companies refusing to provide the requested data to the NSA other than lavabit?
- tptacek 11y ago
  Lavabit didn't refuse requests --- he had apparently been responsive to others --- until the Snowden incident, where his refusal cost all its users their privacy in a futile effort to preserve one user's privacy.
  - lindx 11y ago
    Not familiar with the lavabit story - how did his refusal cost users their privacy?
    - Tomte 11y ago
      He had to give up other peoples' privacy, as well. The alternative (that the FBI demanded until he started playing childish games) was actually only handing over Snowden's mails.
      - tptacek 11y ago
        Which, to be clear, would still have been a disaster for Lavabit! It's not my suggestion that he should have gone along with the FBI and then continued to run the service. But had he complied, as he was legally obligated to do, with the FBI, he could have immediately and gracefully shuttered the service without having given up the TLS keys that unlocked all communications to the site.
        nitrogen 11y ago
        I can't remember whether the Lavabit story was before or after the leaks. Would we still have the Snowden leaks if Lavabit had complied immediately?
joesmo 11y ago
It's an amazing racket, the art of making criminals out of ordinary citizens, a racket the US government has got down pat. I have to really hand it to them. When the country and the world no longer requires their existence, they keep coming up with faux reasons for continuing to exist, faux reasons for arresting, torturing, and murdering innocent people, faux reasons to continue to get funding and hurt more innocent people. You'd almost think that this country no longer has problems (at least none it wants to solve so poverty, justice, racism, education, healthcare, etc. are out), that government's new role is to create problems simply so it can solve them all while making money in the process and justifying its unconstitutional existence. Then you'd be right.
- laotzu 11y ago
  >"The mere existence of the "police state" anywhere is the sure sign of old arrangements being propped up by newer forms that have already rendered the older forms irrelevant." -Take Today: The Executive as Dropout, Marshall McLuhan

194 points by morisy 11y ago

They reference this article, which was also interesting: http://www.buzzfeed.com/reyhan/the-most-important-tech-company-youve-never-heard http://www.buzzfeed.com/reyhan/the-most-important-tech-compa...

mtgx 11y ago

I wish we pushed for a law that said you can only serve a warrant for a data request to the person whose data you want. I think from a human rights principle it makes the most sense. The only reason the government can take it from third parties that store our data for us is because it's "easier" for them to do that, and because there hasn't been enough pushback against it. Imagine if the government said "hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." Probably not the most accurate analogy, but I think you see where I'm going with this. Since the ruling that invalidated Safe Harbor, Microsoft has been pushing for laws and agreements between nations that say law enforcement shouldn't be coming to Microsoft (as a cloud service provider) with a warrant for data requests, but to their corporate customers. So for instance, if FastMail uses the Azure cloud service, they're saying that if the government wants access to a user's data, they shouldn't be going to Microsoft but to FastMail with the warrant. It's a small improvement, but Microsoft and all of the other companies should be pushing so this works for all of their customers, not just the corporate ones. It's exactly the same principle, but Microsoft just takes the easier way out here, because that still gets them off the hook, and it's really what they care most about. The corporations (even if they are "people") shouldn't be having more rights than actual people.

Terr_ 11y ago
Unfortunately there is a flip-side to that: How do you investigate or prosecute a company (for, say, fraudulent billing) when they insist that you need a million individual warrants to prove your case?
- secondtimeuse 11y ago
  Thanks, most privacy activists conveniently forget this argument. In most cases, the absolute approach taken by most privacy activists ends up hurting Students/Patients/Customers etc. since Universities/Hospitals & Insurers/Companies cite privacy laws to escape from the burden of accountability. At the same time the entities are free to mine their own data under guise of "Performance enhancement". Essentially stringent privacy laws often have adverse effect where activities that might be of public benefit Research on Rare diseases/Teacher Accountability/Class action lawsuits are curtailed.
jMyles 11y ago
> I wish we pushed for a law that said you can only serve a warrant for a data request to the person whose data you want Among the potential problems with such a solution is that it gives the government the imperative to adjudicate the "ultimate owner" of data. It will not always be obvious, and when it's not, it can surely be decided in such a way that tramples, rather than bolsters, individual rights over data.
- eximius 11y ago
  The have more stringent requirements for the warrant that doesn't need to determine the owner.
justabystander 11y ago
> Imagine if the government said "hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." That's exactly the logic used to justify civil asset forfeiture. There was a link on here two months ago showing that the assets seized were more than all burglaries in 2014: https://news.ycombinator.com/item?id=10591250 https://news.ycombinator.com/item?id=10591250 .
secondtimeuse 11y ago
"hey, that money in your bank account, we can just automatically take our taxes from it, because we're not really taking it from you, we're just taking it from the bank." >> You are clearly not familiar with how IRS functions. IRS can and often times does automatically freeze bank accounts if they suspect tax evasion.[1] The reality is that when it comes to user data the analogy is even weaker, since most user data is transactional in nature. Hence both parties can assert their rights. This is particularly of importance in medical data. Where there are no laws that assure patients of his ownership of his own data.[2] In reality when it comes to information/data the ownership argument is on a shaky legal grounds. And in some cases data ownership might be counterproductive. [1] https://news.ycombinator.com/item?id=8509500 https://news.ycombinator.com/item?id=8509500 [2] http://jolt.law.harvard.edu/articles/pdf/v25/25HarvJLTech69.pdf http://jolt.law.harvard.edu/articles/pdf/v25/25HarvJLTech69....

peter303 11y ago

I've always presumed that ALL of my online activities are visible to the government or other nosy parties. I do stupid things sometimes, but not really stupid.

JustSomeNobody 11y ago
This sounds like a form of "I don't have anything to hide so I don't care if they spy on me."
- hodwik 11y ago
  No, it's more like "The internet is public, and I know I can't hide what I'm doing in public, so I don't do stupid things in public."
- jkaunisv1 11y ago
  It sounds to me like an acknowledgement that defending yourself against all possible vectors a determined attacker could take to obtain your data is a lot more work than just being a bit careful about what you say and do online. I'm not saying that's a desirable situation.
- gurkendoktor 11y ago
  No, worse! "I can't hide anything anyway, so I'll adjust my behaviour instead." There are things that I wouldn't ask Google while being logged in (or at all), and that sucks. These things are not "stupid" :(
- hitekker 11y ago
  It is. I've always countered with "So, you'd be okay if a government agent was watching you have sex with your wife? Every time it happened? For the next 10 years?" You're doing nothing wrong, nothing bad will come of it, but that question always brings that awkward pause: that realization that "wait a second, privacy IS important even if I'm not doing anything wrong." As a side note, people hide things from other people all the time. That's what people do. None of us would like it if all of our insecurities, resentments, any negative thought were exposed to others. In my opinion, those who say they have nothing to hide, are either profoundly ignorant of their selves, or simply lying to themselves and others, i.e. my job depends on me believing and extolling this untruth.

purpled_haze 11y ago

Two things: (1) The NSA is there to protect us, in theory. (2) There will never, ever be guaranteed privacy or security as long as you continue to use other people's equipment and network. Using the internet expecting privacy is like continually saying, "I'm going to have sex with everyone and going to complain about the people that have STD's." You could try: https://en.wikipedia.org/wiki/Wireless_mesh_network https://en.wikipedia.org/wiki/Wireless_mesh_network Or: https://en.wikipedia.org/wiki/Sneakernet https://en.wikipedia.org/wiki/Sneakernet Those are a little safer.

hammock 11y ago
>Using the internet expecting privacy is like continually saying, "I'm going to have sex with everyone and going to complain about the people that have STD's" It's more like, no matter how careful you are to choose who you have sex with, there's no avoiding the STD risk when everybody has already been fucked by the NSA
EasyTiger_ 11y ago
> (1) The NSA is there to protect us, in theory. Do people actually believe this?
- cglace 11y ago
  Of course, but not directly "us", they are there to protect our national interests.
- hodwik 11y ago
  Yes, many of us do.
- manigandham 11y ago
  What else do you think they are around for? They have bureaucracy and misguided projects and overreaching power but they do protect our national security. They aren't some evil corporation headed by a supervillain, they're full of people just like you and me.

deleted 11y ago

[deleted]

jlangenauer 11y ago
What?
- hoh_helper 11y ago
  The only way I see out of it is open sourcing the entire humanity. The way I see humanity: Good community (99% of the world). Evil community (1% of the world). Scenario - open sourcing government for everyone: If we say the power of good community is "50" and the power of bad community is "5" then open sourcing the gov will have effect something like this: (power of good community increases exponentially) ^ 2 = 2500 (power of bad community increases exponentially) ^ 2 = 25 I mean the power of bad community also increased because they too have access to the source, but they are now in a greater overall disadvantage. That is my rough impression.
  - ddorian43 11y ago
    Come on dude you created an entire account just for that stupid joke

deleted 11y ago

[deleted]

welder 11y ago

Are there any examples of companies refusing to provide the requested data to the NSA other than lavabit?

tptacek 11y ago
Lavabit didn't refuse requests --- he had apparently been responsive to others --- until the Snowden incident, where his refusal cost all its users their privacy in a futile effort to preserve one user's privacy.
- lindx 11y ago
  Not familiar with the lavabit story - how did his refusal cost users their privacy?
  - Tomte 11y ago
    He had to give up other peoples' privacy, as well. The alternative (that the FBI demanded until he started playing childish games) was actually only handing over Snowden's mails.
    - tptacek 11y ago
      Which, to be clear, would still have been a disaster for Lavabit! It's not my suggestion that he should have gone along with the FBI and then continued to run the service. But had he complied, as he was legally obligated to do, with the FBI, he could have immediately and gracefully shuttered the service without having given up the TLS keys that unlocked all communications to the site.
      - nitrogen 11y ago
        I can't remember whether the Lavabit story was before or after the leaks. Would we still have the Snowden leaks if Lavabit had complied immediately?

joesmo 11y ago

It's an amazing racket, the art of making criminals out of ordinary citizens, a racket the US government has got down pat. I have to really hand it to them. When the country and the world no longer requires their existence, they keep coming up with faux reasons for continuing to exist, faux reasons for arresting, torturing, and murdering innocent people, faux reasons to continue to get funding and hurt more innocent people. You'd almost think that this country no longer has problems (at least none it wants to solve so poverty, justice, racism, education, healthcare, etc. are out), that government's new role is to create problems simply so it can solve them all while making money in the process and justifying its unconstitutional existence. Then you'd be right.

laotzu 11y ago
>"The mere existence of the "police state" anywhere is the sure sign of old arrangements being propped up by newer forms that have already rendered the older forms irrelevant." -Take Today: The Executive as Dropout, Marshall McLuhan