5 ms·

Germany's biggest Bitcoin exchange surrenders user data to the police

98 points by MatthiasP 9y ago

yAnonymous 9y ago
I get user data protection and all that, but when you know that the charges are drug-related and they'd get a warrant anyway, why not cooperate and make it easier for everyone? Would you risk having your servers seized for someone you know committed a crime? If you do, you make it very easy for competitors to shut you down. edit: I'm assuming they don't blindly trust the police, but can verify the transactions to the drug site themselves. If that's not the case, making the police get a warrant would be the right thing to do.
- piker 9y ago
  In the US: make them get the warrant. It's not the service provider's job to determine if probable cause exists, and the service provider is probably very bad at it. Police always go for the consent search first precisely because the standard for a warrant is so high.
- DarkKomunalec 9y ago
  But should we allow the police to threaten people with overbroad warrants? "Gives us the data on these 8 people, or we'll get a warrant for it." vs. "Gives us the data on these 8 people, or we'll get a warrant to confiscate all your servers, computers, laptops, and phones." And getting a warrant is not as large a barrier as people like to believe: https://www.popehat.com/2014/07/15/warrants-bulwark-of-liberty-or-paper-shield/ https://www.popehat.com/2014/07/15/warrants-bulwark-of-liber...
  - skrause 9y ago
    In Germany the police can threaten all they want, getting a warrant for user data is the prosecutor's job. That's also why don't give out the data directly the police. If the prosecutor is asking that's a totally different level than the police.
  - FRex 9y ago
    It might also be an indication that the police doesn't risk wasting the judge's time and get shitted on if they don't have rock solid reasons for suspecting someone. Is a bit over 20k drug related warrants over 10 years really that much for the country the size of USA with such a drug problem and such an axe to grind with drugs users (war on drugs, private prisons, blacks with crack and teens with weed being juicy targets to boost statistics, etc.)? Or 1300 warrants and 600 extensions in one fiscal year for a 'black bag job search' across all circuits?
- skrause 9y ago
  Because if you make it too easy for the police they'll just ask for too much all the time, even for things where they wouldn't get a warrant. This is happening in Germany all the time when a provider wants to be nice to the police. If they say "we'll get a warrant anyway", just response "okay, so get the warrant and come back and I'll give you the data". Then at least it's up to a judge to decide where giving out data is warranted, and not up to an oridinary policeman and sysadmin.
  - teamhappy 9y ago
    > This is happening in Germany all the time when a provider wants to be nice to the police. All the time? Really?
    - skrause 9y ago
      Not literally. But if you make the police work much easier by voluntarily giving out data that you don't need to give them of course they are happy to take your offer to make their job easier whenever they can.
  - yAnonymous 9y ago
    See my edit. I'm assuming they can verify the allegations, due to the nature of BTC transactions. A warrant possibly means that they go out of business, because the servers are physically seized. If you tell me you'd risk that for a stranger who you can tell probably committed a crime, I don't believe you.
    - Joe-Z 9y ago
      >A warrant possibly means that they go out of business, because the servers are physically seized Why would the police be interested in destroying a legitimate business just because they want data for 8 users? They can just as well get the warrant and then get the data the same way they did now.
      - cr1895 9y ago
- jarman 9y ago
  >but can verify the transactions to the drug site themselves Once you start selectively give out user data, you are basically giving out warrants yourself and acting as a judge.
  - yorwba 9y ago
    And if you are allowed to do that and want to do it, why not? The purpose of a warrant is to verify that a judge has done due diligence and found the search to be justified, but if you check for yourself and come to the same conclusion, the warrant isn't really necessary.
    - jarman 9y ago
      Because search warrant is removal of privacy rights, which is something only court should be allowed do.
    - EpicEng 9y ago
      Because you're almost certainly not qualified to make that determination.
    - rad_gruchalski 9y ago
      But if you check yourself what. By looking at their data? How would that be okay? I'm not putting words in your mouth, just looking for a logical conclusion.
      - yorwba 9y ago
        If you look at their transaction history with your service, it's not just their data, it's also yours and you have every right to look at it. Now what's morally ambiguous is then deciding to reveal that data to others, and if you did it indiscriminately for all customers I'd be against it. But on a small scale, I don't think it's so wrong.
- naasking 9y ago
  > but when you know that the charges are drug-related and they'd get a warrant anyway Do you actually know though? Or is it really just an educated guess? > why not cooperate and make it easier for everyone? Because violating privacy isn't supposed to be easy. Those laws exist for a reason.
- pavel_lishin 9y ago
  > when you know that the charges are drug-related and they'd get a warrant anyway If it's that easy to get a warrant, why didn't they just go ahead and get the warrant?
- lightedman 9y ago
  "why not cooperate and make it easier for everyone?" Because the law in Germany EXPLICTLY forbids this - Bundesdatenschutzgesetz is the name of the law. Which means bitcoin.de doesn't care about following the law in the first place. Not a surprise for a company trying to make money off of a pyramid scheme currency.
saimiam 9y ago
I want to understand this a bit better from an operational perspective.. Say my DigitalOcean VPS hosted in Germany provides a service X which can be subverted for illegal purposes. Will the police have to me to ask for data or can they go to DO and demand access to the data without my knowledge?
- ilovefood 9y ago
  They can go and ask/seize since it's on German territory. Encrypt the shit out of it. My servers are in Amsterdam/Paris.
  - yorwba 9y ago
    > Encrypt the shit out of it. My servers are in Amsterdam/Paris. Is this meant to imply that the legal situation is very different in the Netherlands/France, or that you encrypt everything because it's the same as in Germany?
    - r1ch 9y ago
      Regardless of the risk of seizure from law enforcement, I feel you should fully encrypt any remotely hosted servers. There are plenty of examples of datacenter techs being socially engineered to install backdoors, affecting both colo and dedicated. Had it happen to myself with an old server - they called up with some excuse and were able to completely bypass the 2FA in the control panel I thought I was secure with and have the techs disable pubkey authentication and reset the root password.
    - rurban 9y ago
      Yes, the situation is very different. Germany has the strongest privacy laws, Netherlands is practically a police state like the UK, and the French are at war like the US, with special police powers.
- teamhappy 9y ago
  Im not a lawyer, but I assume the laws behind this look pretty much the same in every western country. I assume that if you want to search/seize somebodies property then you have get a warrant made out the the legal owner of the property. (Obviously you don't have to get a warrant if the owner voluntarily hands out the data...) In your example DO is the legal owner of the server your VPS runs on. I can't see why DO would be required to tell you about it. I don't know how the owners of data centers play into this. I guess if you have somebody else's property in your possession and the cops have a warrant then you have to hand it to them. Keep in mind that the actual data on the VPS may be protected by all sorts of privacy laws if, e.g., you run a mail server on it. Edit: I forgot to mention that the location of the server and the jurisdiction the legal owner is under also play a large role. Also don't forget which jurisdiction you're under. Nobody cares that you've rented a server from a russian company located on the dark side of the moon. In this case they'll probably make the warrant out to you rather than the legal owner. And you'll have to comply.
xya 9y ago
Ironically, bitcoinblog.de, (which is the blog of bitcoin.de) published an article in November 2016, citing the lack of anonymity in bitcoin transactions, that would drive around 1/5 of bitcoin users to not using bitcoin anymore. the article I am referring to: https://bitcoinblog.de/2016/11/09/ein-fuenftel-der-bitcoin-nutzer-erwaegt-bitcoin-wegen-mangelnder-anonymitaet-nicht-mehr-zu-benutzen/ https://bitcoinblog.de/2016/11/09/ein-fuenftel-der-bitcoin-n...
benedictp 9y ago
They released on Facebook a statement to this article: https://www.facebook.com/bitcoin.de/posts/1621138617927372 https://www.facebook.com/bitcoin.de/posts/1621138617927372 > The protection of our unscrupulous customers and their bitcoins is more important to us than the protection of the data of offenders. Another interesseting thing: > We only issue data from customers to investigating authorities if they can inquire in writing in specific cases and can demonstrate a legitimate interest in specific criminal offenses. This has always been the case from our point of view. Big question here: So they've done it several times?
- d0lph 9y ago
  Not necessarily, might just have been their policy.
INTPenis 9y ago
I'd think most of them would cooperate with the police. We've already seen local cops in Sweden and Denmark track drug dealers through bitcoin. They must have had the cooperation of exchanges and banks to make that happen. So I expect exchanges to cooperate on the same level that banks cooperate with police.

98 points by MatthiasP 9y ago

I get user data protection and all that, but when you know that the charges are drug-related and they'd get a warrant anyway, why not cooperate and make it easier for everyone? Would you risk having your servers seized for someone you know committed a crime? If you do, you make it very easy for competitors to shut you down. edit: I'm assuming they don't blindly trust the police, but can verify the transactions to the drug site themselves. If that's not the case, making the police get a warrant would be the right thing to do.

piker 9y ago
In the US: make them get the warrant. It's not the service provider's job to determine if probable cause exists, and the service provider is probably very bad at it. Police always go for the consent search first precisely because the standard for a warrant is so high.
DarkKomunalec 9y ago
But should we allow the police to threaten people with overbroad warrants? "Gives us the data on these 8 people, or we'll get a warrant for it." vs. "Gives us the data on these 8 people, or we'll get a warrant to confiscate all your servers, computers, laptops, and phones." And getting a warrant is not as large a barrier as people like to believe: https://www.popehat.com/2014/07/15/warrants-bulwark-of-liberty-or-paper-shield/ https://www.popehat.com/2014/07/15/warrants-bulwark-of-liber...
- skrause 9y ago
  In Germany the police can threaten all they want, getting a warrant for user data is the prosecutor's job. That's also why don't give out the data directly the police. If the prosecutor is asking that's a totally different level than the police.
- FRex 9y ago
  It might also be an indication that the police doesn't risk wasting the judge's time and get shitted on if they don't have rock solid reasons for suspecting someone. Is a bit over 20k drug related warrants over 10 years really that much for the country the size of USA with such a drug problem and such an axe to grind with drugs users (war on drugs, private prisons, blacks with crack and teens with weed being juicy targets to boost statistics, etc.)? Or 1300 warrants and 600 extensions in one fiscal year for a 'black bag job search' across all circuits?
skrause 9y ago
Because if you make it too easy for the police they'll just ask for too much all the time, even for things where they wouldn't get a warrant. This is happening in Germany all the time when a provider wants to be nice to the police. If they say "we'll get a warrant anyway", just response "okay, so get the warrant and come back and I'll give you the data". Then at least it's up to a judge to decide where giving out data is warranted, and not up to an oridinary policeman and sysadmin.
- teamhappy 9y ago
  > This is happening in Germany all the time when a provider wants to be nice to the police. All the time? Really?
  - skrause 9y ago
    Not literally. But if you make the police work much easier by voluntarily giving out data that you don't need to give them of course they are happy to take your offer to make their job easier whenever they can.
- yAnonymous 9y ago
  See my edit. I'm assuming they can verify the allegations, due to the nature of BTC transactions. A warrant possibly means that they go out of business, because the servers are physically seized. If you tell me you'd risk that for a stranger who you can tell probably committed a crime, I don't believe you.
  - Joe-Z 9y ago
    >A warrant possibly means that they go out of business, because the servers are physically seized Why would the police be interested in destroying a legitimate business just because they want data for 8 users? They can just as well get the warrant and then get the data the same way they did now.
    - cr1895 9y ago
jarman 9y ago
>but can verify the transactions to the drug site themselves Once you start selectively give out user data, you are basically giving out warrants yourself and acting as a judge.
- yorwba 9y ago
  And if you are allowed to do that and want to do it, why not? The purpose of a warrant is to verify that a judge has done due diligence and found the search to be justified, but if you check for yourself and come to the same conclusion, the warrant isn't really necessary.
  - jarman 9y ago
    Because search warrant is removal of privacy rights, which is something only court should be allowed do.
  - EpicEng 9y ago
    Because you're almost certainly not qualified to make that determination.
  - rad_gruchalski 9y ago
    But if you check yourself what. By looking at their data? How would that be okay? I'm not putting words in your mouth, just looking for a logical conclusion.
    - yorwba 9y ago
      If you look at their transaction history with your service, it's not just their data, it's also yours and you have every right to look at it. Now what's morally ambiguous is then deciding to reveal that data to others, and if you did it indiscriminately for all customers I'd be against it. But on a small scale, I don't think it's so wrong.
naasking 9y ago
> but when you know that the charges are drug-related and they'd get a warrant anyway Do you actually know though? Or is it really just an educated guess? > why not cooperate and make it easier for everyone? Because violating privacy isn't supposed to be easy. Those laws exist for a reason.
pavel_lishin 9y ago
> when you know that the charges are drug-related and they'd get a warrant anyway If it's that easy to get a warrant, why didn't they just go ahead and get the warrant?
lightedman 9y ago
"why not cooperate and make it easier for everyone?" Because the law in Germany EXPLICTLY forbids this - Bundesdatenschutzgesetz is the name of the law. Which means bitcoin.de doesn't care about following the law in the first place. Not a surprise for a company trying to make money off of a pyramid scheme currency.

saimiam 9y ago

I want to understand this a bit better from an operational perspective.. Say my DigitalOcean VPS hosted in Germany provides a service X which can be subverted for illegal purposes. Will the police have to me to ask for data or can they go to DO and demand access to the data without my knowledge?

ilovefood 9y ago
They can go and ask/seize since it's on German territory. Encrypt the shit out of it. My servers are in Amsterdam/Paris.
- yorwba 9y ago
  > Encrypt the shit out of it. My servers are in Amsterdam/Paris. Is this meant to imply that the legal situation is very different in the Netherlands/France, or that you encrypt everything because it's the same as in Germany?
  - r1ch 9y ago
    Regardless of the risk of seizure from law enforcement, I feel you should fully encrypt any remotely hosted servers. There are plenty of examples of datacenter techs being socially engineered to install backdoors, affecting both colo and dedicated. Had it happen to myself with an old server - they called up with some excuse and were able to completely bypass the 2FA in the control panel I thought I was secure with and have the techs disable pubkey authentication and reset the root password.
  - rurban 9y ago
    Yes, the situation is very different. Germany has the strongest privacy laws, Netherlands is practically a police state like the UK, and the French are at war like the US, with special police powers.
teamhappy 9y ago
Im not a lawyer, but I assume the laws behind this look pretty much the same in every western country. I assume that if you want to search/seize somebodies property then you have get a warrant made out the the legal owner of the property. (Obviously you don't have to get a warrant if the owner voluntarily hands out the data...) In your example DO is the legal owner of the server your VPS runs on. I can't see why DO would be required to tell you about it. I don't know how the owners of data centers play into this. I guess if you have somebody else's property in your possession and the cops have a warrant then you have to hand it to them. Keep in mind that the actual data on the VPS may be protected by all sorts of privacy laws if, e.g., you run a mail server on it. Edit: I forgot to mention that the location of the server and the jurisdiction the legal owner is under also play a large role. Also don't forget which jurisdiction you're under. Nobody cares that you've rented a server from a russian company located on the dark side of the moon. In this case they'll probably make the warrant out to you rather than the legal owner. And you'll have to comply.

xya 9y ago

Ironically, bitcoinblog.de, (which is the blog of bitcoin.de) published an article in November 2016, citing the lack of anonymity in bitcoin transactions, that would drive around 1/5 of bitcoin users to not using bitcoin anymore. the article I am referring to: https://bitcoinblog.de/2016/11/09/ein-fuenftel-der-bitcoin-nutzer-erwaegt-bitcoin-wegen-mangelnder-anonymitaet-nicht-mehr-zu-benutzen/ https://bitcoinblog.de/2016/11/09/ein-fuenftel-der-bitcoin-n...

benedictp 9y ago

They released on Facebook a statement to this article: https://www.facebook.com/bitcoin.de/posts/1621138617927372 https://www.facebook.com/bitcoin.de/posts/1621138617927372 > The protection of our unscrupulous customers and their bitcoins is more important to us than the protection of the data of offenders. Another interesseting thing: > We only issue data from customers to investigating authorities if they can inquire in writing in specific cases and can demonstrate a legitimate interest in specific criminal offenses. This has always been the case from our point of view. Big question here: So they've done it several times?

d0lph 9y ago
Not necessarily, might just have been their policy.

INTPenis 9y ago

I'd think most of them would cooperate with the police. We've already seen local cops in Sweden and Denmark track drug dealers through bitcoin. They must have had the cooperation of exchanges and banks to make that happen. So I expect exchanges to cooperate on the same level that banks cooperate with police.