8 ms·

In Silicon Valley, a new emphasis on barriers to government requests for data

88 points by ValG 10y ago

qq66 10y ago
The government has an easy answer to this, data retention laws, which are already common in many countries. The more companies start doing this, the quicker the laws will be passed, and the stricter they will be when they are. It's a temporary solution to a structural mismatch between government and startup incentives.
- smokeyj 10y ago
  The easy answer to this is decentralized protocols. For example SMTP. You can just delete evidence of criminal activity and then run for president.
  - qq66 10y ago
    You would have to have a direct link to your counterparty. Otherwise you'd have to account for why your upstream ISP had record of traffic that you cannot produce any records for.
Zyst 10y ago
A factor that I feel is more important but was sort of glossed over during the article is the fact that it is a competitive disadvantage NOT to do this. The average person is becoming increasingly security conscious, and so are small and medium sized businesses. I seem to remember that Azure was having a really hard time selling to an international audience because foreigners thought the data would be vulnerable in the hands of the US government. As someone who doesn't live in the US and works in consulting the few years post Snowden were quite curious, with clients who previously didn't mind using cloud solutions like Amazon S3 actively refusing any architecture choices which would lead to having their data stored in the US, even if it meant greater expense. I really do believe that not taking an approach similar to this where we use End to End encryption and companies minimise their access over their customers data as much as humanly possible can and does lead to lost business.
- stephengillie 10y ago
  This is one of the advantages to my employer's cloud product - you can architect your servers and networks entirely outside of the US. Choose only European datacenters, and your data stays in Europe. By the exact same token, if you have a requirement to keep your data in the USA, you can easily design your networks and services to comply.
bgentry 10y ago
The article's actual title is much more inflammatory: What’s driving Silicon Valley to become ‘radicalized’
bpchaps 10y ago
And yet, through all of this, it's still easier and takes less time for them to violate our privacy rights than it is for private citizens gather similar data about elected officials and information regarded as "public". I've been trying to get Chicago's mayor's office's phone records for a while now. 1.5 years, 4 FOIAs to two different city departments, state's attorney FOIA request for review, redactions left and right, a fight for AG anonymity, and a lawsuit later, I got a list of phone numbers and created [0]. The amount of pushback and bad interpretation of FOIA that prevented me, or anyone else, in getting that data was shameful. And after all of that, the judge didn't give me the FOIA suit payout since the city eventually "complied". It's no wonder nobody actually tries to make positive change - it's just so damn hard. [0] https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTRN8n876KL8aXYYu5it8Lg0g8/edit#gid=0 https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTR... edit: cleaned up a wee. Also, that link's for the whole office suite, not just the room the mayor calls his office. Please don't try to come to any direct conclusions.
- jordanb 10y ago
  Wow nice work. I'm glad you persevered. What they finally gave you is hilarious. The first design feature of the panopticon is that any inmate can be seen by the guards at any time without his knowledge. The second equally important design feature is that the inmate can never see the guard, can never see what he's up to or who he is looking at. Or even if he's around. In the present context this manifests itself in the above hilarious obstructionism against FOIA and open government, and more ominously in Obama's war against whistle blowers.
  - bpchaps 10y ago
    Thanks :). What's absurd is that they released (redacted) numbers for phones outside of government, but claimed that even redacted government phones were exempt from release. Because of privacy reasons, and because they'd be interrupted at home. So, they essentially gave themselves FOIA privacy while giving strangers information on strangers. The judge eventually just told them to just Google the phone numbers as a check if they're public numbers. They followed with other checks, and a longish list of numbers was the result. There was one government phone redacted, but we got the name of the person a bit later, with just a name, no number.
abecedarius 10y ago
Can we please stop calling these demands 'requests'? "n. the act of asking for something to be given or done, especially as a favor or courtesy; solicitation or petition". The connotation is really misleading. I've held my tongue about this through dozens of stories, and I won't harp on it again, but after the third time in this article I'm sort of snapping.
walrus01 10y ago
An effective barrier is making it IMPOSSIBLE for a government request for data to be fulfilled - such as end-to-end encryption where the intermediary never has the key, like Whatsapp has done. This is easiest if implemented into a new system from the beginning design of its architecture. It completely removes the need to waste person-hours attempting to fulfill a "wiretrap" request, whether from a warrant or FISA-court type thing, if the request is impossible due to lack of crypto keys. And at least at present completely legal unless the US passes laws outlawing crypto.
- rpgmaker 10y ago
  Essentially what Apple is going for with iOS. I honestly doubt they will allow them to do that for long. There's going to be a rematch eventually.
  - Razengan 10y ago
    What can be done? Building a new open-sourced layer on top of the current internet, from scratch, that's impervious to snooping and censorship by design? There are precedents for that kind of thing here and there already, in Bittorrent, Bitcoin, Ethereum, Freenet, TOR... and as [1] said, SMTP. [1] https://news.ycombinator.com/item?id=11766929 https://news.ycombinator.com/item?id=11766929
    - walrus01 10y ago
      TLS1.2 for SMTP end-to-end is obviously a good thing, but it has its own problems aside from all of the crap we've been piling on top of SMTP for 20+ years (SPF, DKIM, DMARC, TLS1.2, etc) for ISP mail server operational reasons. At some point that mail has to go into storage somewhere so it can be accessed by a user/client via IMAP, and that's where the subpoena/national security letter/warrant/FISA court request will go. To whatever location the disk storage resides at.
Zigurd 10y ago
FTA: The trade-offs can be significant: Heavy encryption risks slowing down your service. "Heavy" encryption? Srsly?
JumpCrisscross 10y ago
> Investigators say two such services, WhatsApp and Telegram, were used by terrorists in the Paris attacks last November I thought they communicated using burner phones and not encryption [1]. [1] http://arstechnica.com/tech-policy/2016/03/paris-terrorist-attacks-burner-phones-not-encryption/ http://arstechnica.com/tech-policy/2016/03/paris-terrorist-a...
- x0x0 10y ago
  It hardly matters. These liars are going to find some tenuous link between terrarism and the encryptions and scream about it at the top of their lungs. ps -- remember the san bernardino attacks? The attackers destroyed their personal cells and left a work cell behind. It's pretty obvious there never was anything on it. And had the fbi found anything germane, they would have trumpeted it.
- csandreasen 10y ago
  CNN and the Washington Post both reported that WhatsApp and Telegram were found on several of the Paris attackers' phones, but that the content wasn't able to be recovered. http://www.cnn.com/2015/12/17/politics/paris-attacks-terrorists-encryption/ http://www.cnn.com/2015/12/17/politics/paris-attacks-terrori... https://www.washingtonpost.com/world/europe/paris-attack-planners-used-encrypted-apps-investigators-believe/2015/12/17/e798d288-a4de-11e5-8318-bd8caed8c588_story.html https://www.washingtonpost.com/world/europe/paris-attack-pla...
ipsin 10y ago
Stewart Baker's quote from the article is so disingenuous: “This is a Silicon Valley delusion that the government wants to outlaw encryption,” If you replace "encryption" with "secure encryption", that's absolutely what's being proposed.
mankash666 10y ago
I hope the government realizes that their aggressive requests is leading to lost business overseas. Companies are merely doing what they need to, to be relevant outside the US
jackgavigan 10y ago
> “They are afraid of a phone call from someone high up saying that they are unpatriotic,” Baylor said. Looks like McCarthyism is alive and well in the United States.
- dev1n 10y ago
  Trump will bring a new level of fear to non-WASPs. A true authoritarian. I really hope he does not receive the presidency.
krylon 10y ago
When the German Verfassungsgericht (our equivalent of the US Supreme Court, I guess) struck down the data retention law on phone/Internet metadata, there was a sentence in the verdict that was just priceless - "Wo ein Trog ist, da kommen die Schweine" (Where there is a trough, the pigs will come).[1] If more services start to avoid storing data altogether (or at least only encrypted in a way that prevents them from accessing the data), there will be less food so to speak for the various creatures that might gravitate towards the trough. [1] NB that the choice of words is not mine - the irony of a supreme court judge calling law enforcement and intelligence agencies pigs is kind of nice, though. ;-)
- Joof 10y ago
  When it comes to data privacy and security, it's hard to find a more saavy people than the Germans. I wish we had a chaos computer club out in America.
  - asymmetric 10y ago
    Not necessarily the same thing, but NoiseBridge is a pretty nice hackerspace and it's in SF.
    - Joof 10y ago
      Some hackerspaces are nice. Their goals are different most of the time and unfortunately they aren't as well respected in government. Worst part is that I currently live in Texas, and not the cool parts :p
pacala 10y ago
Keeping governments out of private data is a great goal. I wish the same emphasis were placed on Silicon Valley's own practices of tracking every bit of our lives. At anywhere between 75-200 billion of revenue, the largest Silicon Valley behemoths have more economic power than any of the poorest 122 countries in the world, including places like Ethiopia, Croatia or Uruguay.
jeffmould 10y ago
There is a guy in Florida who is championing for more open government. The number of FOIA requests and lawsuits he has brought and won is pretty interesting. His work in general is very interesting and he is currently working on a pretty cool database idea for the state of Florida. His website is: http://fogwatch.org/ http://fogwatch.org/ His name is Joel Chandler and he lives in Lakeland, FL. You can Google him for more details on some of the requests he has made and lawsuits he has filed to get information.

88 points by ValG 10y ago

qq66 10y ago

The government has an easy answer to this, data retention laws, which are already common in many countries. The more companies start doing this, the quicker the laws will be passed, and the stricter they will be when they are. It's a temporary solution to a structural mismatch between government and startup incentives.

smokeyj 10y ago
The easy answer to this is decentralized protocols. For example SMTP. You can just delete evidence of criminal activity and then run for president.
- qq66 10y ago
  You would have to have a direct link to your counterparty. Otherwise you'd have to account for why your upstream ISP had record of traffic that you cannot produce any records for.

Zyst 10y ago

A factor that I feel is more important but was sort of glossed over during the article is the fact that it is a competitive disadvantage NOT to do this. The average person is becoming increasingly security conscious, and so are small and medium sized businesses. I seem to remember that Azure was having a really hard time selling to an international audience because foreigners thought the data would be vulnerable in the hands of the US government. As someone who doesn't live in the US and works in consulting the few years post Snowden were quite curious, with clients who previously didn't mind using cloud solutions like Amazon S3 actively refusing any architecture choices which would lead to having their data stored in the US, even if it meant greater expense. I really do believe that not taking an approach similar to this where we use End to End encryption and companies minimise their access over their customers data as much as humanly possible can and does lead to lost business.

stephengillie 10y ago
This is one of the advantages to my employer's cloud product - you can architect your servers and networks entirely outside of the US. Choose only European datacenters, and your data stays in Europe. By the exact same token, if you have a requirement to keep your data in the USA, you can easily design your networks and services to comply.

bgentry 10y ago

The article's actual title is much more inflammatory: What’s driving Silicon Valley to become ‘radicalized’

bpchaps 10y ago

And yet, through all of this, it's still easier and takes less time for them to violate our privacy rights than it is for private citizens gather similar data about elected officials and information regarded as "public". I've been trying to get Chicago's mayor's office's phone records for a while now. 1.5 years, 4 FOIAs to two different city departments, state's attorney FOIA request for review, redactions left and right, a fight for AG anonymity, and a lawsuit later, I got a list of phone numbers and created [0]. The amount of pushback and bad interpretation of FOIA that prevented me, or anyone else, in getting that data was shameful. And after all of that, the judge didn't give me the FOIA suit payout since the city eventually "complied". It's no wonder nobody actually tries to make positive change - it's just so damn hard. [0] https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTRN8n876KL8aXYYu5it8Lg0g8/edit#gid=0 https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTR... edit: cleaned up a wee. Also, that link's for the whole office suite, not just the room the mayor calls his office. Please don't try to come to any direct conclusions.

jordanb 10y ago
Wow nice work. I'm glad you persevered. What they finally gave you is hilarious. The first design feature of the panopticon is that any inmate can be seen by the guards at any time without his knowledge. The second equally important design feature is that the inmate can never see the guard, can never see what he's up to or who he is looking at. Or even if he's around. In the present context this manifests itself in the above hilarious obstructionism against FOIA and open government, and more ominously in Obama's war against whistle blowers.
- bpchaps 10y ago
  Thanks :). What's absurd is that they released (redacted) numbers for phones outside of government, but claimed that even redacted government phones were exempt from release. Because of privacy reasons, and because they'd be interrupted at home. So, they essentially gave themselves FOIA privacy while giving strangers information on strangers. The judge eventually just told them to just Google the phone numbers as a check if they're public numbers. They followed with other checks, and a longish list of numbers was the result. There was one government phone redacted, but we got the name of the person a bit later, with just a name, no number.

abecedarius 10y ago

Can we please stop calling these demands 'requests'? "n. the act of asking for something to be given or done, especially as a favor or courtesy; solicitation or petition". The connotation is really misleading. I've held my tongue about this through dozens of stories, and I won't harp on it again, but after the third time in this article I'm sort of snapping.

walrus01 10y ago

An effective barrier is making it IMPOSSIBLE for a government request for data to be fulfilled - such as end-to-end encryption where the intermediary never has the key, like Whatsapp has done. This is easiest if implemented into a new system from the beginning design of its architecture. It completely removes the need to waste person-hours attempting to fulfill a "wiretrap" request, whether from a warrant or FISA-court type thing, if the request is impossible due to lack of crypto keys. And at least at present completely legal unless the US passes laws outlawing crypto.

rpgmaker 10y ago
Essentially what Apple is going for with iOS. I honestly doubt they will allow them to do that for long. There's going to be a rematch eventually.
- Razengan 10y ago
  What can be done? Building a new open-sourced layer on top of the current internet, from scratch, that's impervious to snooping and censorship by design? There are precedents for that kind of thing here and there already, in Bittorrent, Bitcoin, Ethereum, Freenet, TOR... and as [1] said, SMTP. [1] https://news.ycombinator.com/item?id=11766929 https://news.ycombinator.com/item?id=11766929
  - walrus01 10y ago
    TLS1.2 for SMTP end-to-end is obviously a good thing, but it has its own problems aside from all of the crap we've been piling on top of SMTP for 20+ years (SPF, DKIM, DMARC, TLS1.2, etc) for ISP mail server operational reasons. At some point that mail has to go into storage somewhere so it can be accessed by a user/client via IMAP, and that's where the subpoena/national security letter/warrant/FISA court request will go. To whatever location the disk storage resides at.

Zigurd 10y ago

FTA: The trade-offs can be significant: Heavy encryption risks slowing down your service. "Heavy" encryption? Srsly?

JumpCrisscross 10y ago

> Investigators say two such services, WhatsApp and Telegram, were used by terrorists in the Paris attacks last November I thought they communicated using burner phones and not encryption [1]. [1] http://arstechnica.com/tech-policy/2016/03/paris-terrorist-attacks-burner-phones-not-encryption/ http://arstechnica.com/tech-policy/2016/03/paris-terrorist-a...

x0x0 10y ago
It hardly matters. These liars are going to find some tenuous link between terrarism and the encryptions and scream about it at the top of their lungs. ps -- remember the san bernardino attacks? The attackers destroyed their personal cells and left a work cell behind. It's pretty obvious there never was anything on it. And had the fbi found anything germane, they would have trumpeted it.
csandreasen 10y ago
CNN and the Washington Post both reported that WhatsApp and Telegram were found on several of the Paris attackers' phones, but that the content wasn't able to be recovered. http://www.cnn.com/2015/12/17/politics/paris-attacks-terrorists-encryption/ http://www.cnn.com/2015/12/17/politics/paris-attacks-terrori... https://www.washingtonpost.com/world/europe/paris-attack-planners-used-encrypted-apps-investigators-believe/2015/12/17/e798d288-a4de-11e5-8318-bd8caed8c588_story.html https://www.washingtonpost.com/world/europe/paris-attack-pla...

ipsin 10y ago

Stewart Baker's quote from the article is so disingenuous: “This is a Silicon Valley delusion that the government wants to outlaw encryption,” If you replace "encryption" with "secure encryption", that's absolutely what's being proposed.

mankash666 10y ago

I hope the government realizes that their aggressive requests is leading to lost business overseas. Companies are merely doing what they need to, to be relevant outside the US

jackgavigan 10y ago

> “They are afraid of a phone call from someone high up saying that they are unpatriotic,” Baylor said. Looks like McCarthyism is alive and well in the United States.

dev1n 10y ago
Trump will bring a new level of fear to non-WASPs. A true authoritarian. I really hope he does not receive the presidency.

krylon 10y ago

When the German Verfassungsgericht (our equivalent of the US Supreme Court, I guess) struck down the data retention law on phone/Internet metadata, there was a sentence in the verdict that was just priceless - "Wo ein Trog ist, da kommen die Schweine" (Where there is a trough, the pigs will come).[1] If more services start to avoid storing data altogether (or at least only encrypted in a way that prevents them from accessing the data), there will be less food so to speak for the various creatures that might gravitate towards the trough. [1] NB that the choice of words is not mine - the irony of a supreme court judge calling law enforcement and intelligence agencies pigs is kind of nice, though. ;-)

Joof 10y ago
When it comes to data privacy and security, it's hard to find a more saavy people than the Germans. I wish we had a chaos computer club out in America.
- asymmetric 10y ago
  Not necessarily the same thing, but NoiseBridge is a pretty nice hackerspace and it's in SF.
  - Joof 10y ago
    Some hackerspaces are nice. Their goals are different most of the time and unfortunately they aren't as well respected in government. Worst part is that I currently live in Texas, and not the cool parts :p

pacala 10y ago

Keeping governments out of private data is a great goal. I wish the same emphasis were placed on Silicon Valley's own practices of tracking every bit of our lives. At anywhere between 75-200 billion of revenue, the largest Silicon Valley behemoths have more economic power than any of the poorest 122 countries in the world, including places like Ethiopia, Croatia or Uruguay.

jeffmould 10y ago

There is a guy in Florida who is championing for more open government. The number of FOIA requests and lawsuits he has brought and won is pretty interesting. His work in general is very interesting and he is currently working on a pretty cool database idea for the state of Florida. His website is: http://fogwatch.org/ http://fogwatch.org/ His name is Joel Chandler and he lives in Lakeland, FL. You can Google him for more details on some of the requests he has made and lawsuits he has filed to get information.