8 ms·

Justice Department goes nuclear on Google in search warrant fight

112 points by daenney 9y ago

quuquuquu 9y ago
In this article, the government directly accuses Google of deliberately storing data overseas, so that they don't have to comply with certain court orders. How is it a crime to store data internationally? Am I a criminal for storing my photos on a Russian VPS? Does this enrage you? Also absolutely insane that one ruling in one Fed District Court is non-binding to the other Courts.
- uiri 9y ago
  Also absolutely insane that one ruling in one Fed District Court is non-binding to the other Courts. What is the point of having the Supreme Court if courts which are nominally peers of one another are bound by each other's decisions? By having multiple cases with slight variations of the facts involved, the Supreme Court gets multiple data points upon which to base their decision which is then binding for the whole country.
  - bonesss 9y ago
    From the article, and I'm no expert: they referred to that other court as a "sister court". My take on that was that those courts reside on the same legal 'tier' so neither one really dictates for the other, SCOTUS is the point of final arbitration.
- dataminded 9y ago
  You aren't a criminal for storing photos on a Russian VPS but you might be a criminal if you store data related to your money laundering activities on that same server. If the government can meet a reasonable standard for a warrant and prove that there is likely evidence on that server, should they be unable to secure access? What if that data were related to an imminent attack? I'm in favor of protecting data privacy and hope that the courts side with Google/Microsoft but I don't think that the arguments are as crazy as you describe them. From the government's standpoint, tech companies are enabling criminal's efforts to circumvent the law and endanger citizens. Offline laws are struggling to keep pace with the internets, nothing new.
  - pjc50 9y ago
    If I understand the 5th amendment correctly, and its caselaw, you would be OK storing evidence of your own crimes overseas, but evidence relating to other people you could be compelled to turn over.
  - exergy 9y ago
    The "reasonable standard" I agree with, and they should be discussed not in secret courts.
  - Spivak 9y ago
    > If the government ... access? What if that data were related to an imminent attack? We can always play the game of upping the consequences but it's always the case that people are willing to throw out the rule of law when there's enough danger and I think that's the standard we should hold. If there's an imminent attack I think the argument should be that the danger is so great that the police/military must be given an exception to the law, not constantly expanding their power just in case.
    - oldandtired 9y ago
      When "the rule of law" can be changed at whim by one side to the detriment of the citizens, without recourse by the citizens to fix those changes, then "the rule of law" is a farce and has already been thrown out. Too often, the group who is currently in charge of a government gets a free pass to play havoc with both constitutional interpretations and general reasonableness of the societal rules and laws simply because they are the government. They are not held to any standard of responsibility for the changes they force upon the citizens. How often do we find that governments create more and more law and regulation solely for the benefit of that government and its "backers"? These laws and regulations end up being to the detriment of the citizens, those for whom, ostensibly, that regulation and law is supposed to protect and benefit. I should make note that irrespective of any imminent threat, law enforcement and military should always be held to the highest possible standard and never given any exception in following the law, that is the path to them never following the law and becoming a "law" unto themselves.
tyfon 9y ago
Today, the first thing we have to check when sourcing some saas solution is where the data is stored and weather the company has a US department (I work in a Norwegian bank). So far, if the data is stored physically in the EU and we get a list of names with access to said data, we have been able to use the service, however if the DoJ wins this case we can never use a US based saas type company again regardless of where the data is stored. Is this on the agenda at all? I think a ruling like that would be most harmful for the US IT industry.
- wavefunction 9y ago
  We have many factions in the US, some more short-sighted or zealous than others. There certainly are citizens of the US who feel that unquestioning compliance with authority is paramount above all other concerns, including long-term economic effects.
  - tyfon 9y ago
    They must be very short-sighted, even a dotard should be able to understand what happens if you remove large sections of a companies market overnight. I mean, we would have to pull out of azure completely. Today we spend millions of kroner there every year. It would also leave a very sour taste for going back to US based companies if this is rectified at a later stage of fear of a similar event.
    - craftyguy 9y ago
      Our El Dotart, and his old fat friends, probably won't be alive long enough to realize any long term economic damage due to these types of decisions. What motivation do the self-centered have to think beyond their lifetimes?
      - andrew-lucker 9y ago
        This isn't climate science, we could see the economic effect immediately. That is simple enough for most people to draw a connection. I think the problem is more that some people want to hurt the US IT industry for political gain.
Crontab 9y ago
The government's arguments are awful. And I would like to point out that their efforts started when Obama was in office, so the awfulness cuts across party lines.
- B1FF_PSUVM 9y ago
  > across party lines The two wings of the U.S. owners party, as the late Gore Vidal used to put it rather accurately.
  - basicplus2 9y ago
    "There is only one party in the United States, the Property Party … and it has two right wings: Republican and Democrat"
boznz 9y ago
Just wondering, is it possible to design software where the data is visible to the software but not to a human (the programmer). I could see a system where the private key is generated and stored in RAM and all the data is encrypted but the first update or power event would destroy the data. Just a thought experiment.
- pjc50 9y ago
  Two approaches: "trustzone"-style systems where the data is inaccessible to everything but the secure processor, or homomorphic encryption. But on the first, software updates present a problem. You can make the system only accept signed updates, but then the programmer can just replace the program with "please print all your secure data". Variants of this technique have been used to break all sorts of things, from arcade machines to payment cards. So if you want the data not to be visible to the programmer, you can never update the software. Homomorphic encryption theoretically hides the data from the program, but is extremely inefficient and I'm not aware of any widely deployed use.
  - kobeya 9y ago
    Homomorphic encryption is behind some crypto currency stuff like zcash, but that’s about it. It is many orders of magnitude slower.
- kelnos 9y ago
  There was mention of the idea of data being (or not being) accessible to someone while in the US. It seems like it would be possible to design the system so no one in the US has "admin access" to the data in question. VPNs and firewalls restrict access to the data such that only someone physically in the EU can access it. An end-user with the account password could access their email or whatever through normal means from anywhere, but that would be it. Not sure if this is possible, considering you can always make the argument that the employees in the EU with access are subordinate at least to the US-residing CEO, who could order them to fetch and send the data.
- user5994461 9y ago
  No, there is always a programmer, a sysadmin or an operator who is in control of a program. Software cannot deploy and maintain themselves. It's possible to completely cut access to a system, for example you lose the only SSH key. It would continue to run and service users, but it is inoperable on an operational point of view.
singularity2001 9y ago
Nice attempt of a PR stunt. "Google resists to hand hover 22 mail accounts" when in truth they hand over ALL of your email and surf data to the NSA, for later abuse. (willingly or not)
- zeep 9y ago
  Yeah, I don't really understand why DoJ doesn't ask the NSA/PRISM for the data, and lie about its origin (parallel construction).
1024core 9y ago
> The government, meanwhile, accused Google of fashioning a system that kept consumer data stored on various servers across the globe—just so it could defy court orders. GGG? (Good Guy Google) ? For all the hate that Google gets on HN, it should also get some kudos for trying to protect the users' data.
- usjehshksish 9y ago
  Seems like this filing from the government is reason enough to hope that Google does implement such systems.
- harsharama 9y ago
  Engineering-wise, data dup and replication is worldwide for guaranteed access times, availability and DR. This particular legal advantage is a bonus of good design :)
  - bonesss 9y ago
    Point of order: the accusation is not that Google duplicated and replicated data, some of which is outside the country. Google is being accused of intentionally obfuscating their control of the data explicitly to avoid court-orders (and not technical reasons and common engineering approaches). ... what you're talking about should result in a logical amalgamation: data here AND data there. Google is being accused of going out of their way to create an artificial barriers to the legal system by only having data "NOT here".
- bonesss 9y ago
  Two things can be true simultaneously... Google, good or evil, has a massive long-running interest in not allowing nations to subvert each others laws. Taken cynically: protecting user data may be entirely incidental to securing megabillions in hosting and services over the next few decades in privacy aware countries and with authoritarian regimes. Still: doing the right thing for the wrong reason ain't the worst ;)
jacquesm 9y ago
I hope DOJ realizes that if they win this Google, Microsoft and Amazon will lose a very large chunk of their clients.
throw2016 9y ago
There was a desire for globalization, people to people connection and one world fantasy that a whole generation was brought up on that early tech companies leveraged. But a lot of this is coming from the post 60-70 generation and events have completely discredited the idea of globalism. Nation states, politics and parochialism is as alive and kicking and far from uniting people our companies are just a way to exercise unilateral power and further national interests. No county can afford to be dependent on others for food, it's always used against them. It's the same for technology, both software and hardware and this will lead to a more divided splintered world and limit US opportunities but also increase local opportunities. Until globalism is a social and political reality based on mutual respect and humanity and not exploitation and capitalism this can't change.
jokoon 9y ago
Why can't anybody work on some kind of blockchained database software? I wonder if it would be doable... The Silicon Valley TV show had this. I've also thought about it, but I'm not sure it would be fast enough and redundancy could be tweaked... so only for backing up data... I don't know but storing data in a cloud which resides in user computers sound like the perfect solution to those kinds of legal issues. The whole feature is having data that cannot be suppressed or accessed by a private party.

112 points by daenney 9y ago

In this article, the government directly accuses Google of deliberately storing data overseas, so that they don't have to comply with certain court orders. How is it a crime to store data internationally? Am I a criminal for storing my photos on a Russian VPS? Does this enrage you? Also absolutely insane that one ruling in one Fed District Court is non-binding to the other Courts.

uiri 9y ago
Also absolutely insane that one ruling in one Fed District Court is non-binding to the other Courts. What is the point of having the Supreme Court if courts which are nominally peers of one another are bound by each other's decisions? By having multiple cases with slight variations of the facts involved, the Supreme Court gets multiple data points upon which to base their decision which is then binding for the whole country.
- bonesss 9y ago
  From the article, and I'm no expert: they referred to that other court as a "sister court". My take on that was that those courts reside on the same legal 'tier' so neither one really dictates for the other, SCOTUS is the point of final arbitration.
dataminded 9y ago
You aren't a criminal for storing photos on a Russian VPS but you might be a criminal if you store data related to your money laundering activities on that same server. If the government can meet a reasonable standard for a warrant and prove that there is likely evidence on that server, should they be unable to secure access? What if that data were related to an imminent attack? I'm in favor of protecting data privacy and hope that the courts side with Google/Microsoft but I don't think that the arguments are as crazy as you describe them. From the government's standpoint, tech companies are enabling criminal's efforts to circumvent the law and endanger citizens. Offline laws are struggling to keep pace with the internets, nothing new.
- pjc50 9y ago
  If I understand the 5th amendment correctly, and its caselaw, you would be OK storing evidence of your own crimes overseas, but evidence relating to other people you could be compelled to turn over.
- exergy 9y ago
  The "reasonable standard" I agree with, and they should be discussed not in secret courts.
- Spivak 9y ago
  > If the government ... access? What if that data were related to an imminent attack? We can always play the game of upping the consequences but it's always the case that people are willing to throw out the rule of law when there's enough danger and I think that's the standard we should hold. If there's an imminent attack I think the argument should be that the danger is so great that the police/military must be given an exception to the law, not constantly expanding their power just in case.
  - oldandtired 9y ago
    When "the rule of law" can be changed at whim by one side to the detriment of the citizens, without recourse by the citizens to fix those changes, then "the rule of law" is a farce and has already been thrown out. Too often, the group who is currently in charge of a government gets a free pass to play havoc with both constitutional interpretations and general reasonableness of the societal rules and laws simply because they are the government. They are not held to any standard of responsibility for the changes they force upon the citizens. How often do we find that governments create more and more law and regulation solely for the benefit of that government and its "backers"? These laws and regulations end up being to the detriment of the citizens, those for whom, ostensibly, that regulation and law is supposed to protect and benefit. I should make note that irrespective of any imminent threat, law enforcement and military should always be held to the highest possible standard and never given any exception in following the law, that is the path to them never following the law and becoming a "law" unto themselves.

tyfon 9y ago

Today, the first thing we have to check when sourcing some saas solution is where the data is stored and weather the company has a US department (I work in a Norwegian bank). So far, if the data is stored physically in the EU and we get a list of names with access to said data, we have been able to use the service, however if the DoJ wins this case we can never use a US based saas type company again regardless of where the data is stored. Is this on the agenda at all? I think a ruling like that would be most harmful for the US IT industry.

wavefunction 9y ago
We have many factions in the US, some more short-sighted or zealous than others. There certainly are citizens of the US who feel that unquestioning compliance with authority is paramount above all other concerns, including long-term economic effects.
- tyfon 9y ago
  They must be very short-sighted, even a dotard should be able to understand what happens if you remove large sections of a companies market overnight. I mean, we would have to pull out of azure completely. Today we spend millions of kroner there every year. It would also leave a very sour taste for going back to US based companies if this is rectified at a later stage of fear of a similar event.
  - craftyguy 9y ago
    Our El Dotart, and his old fat friends, probably won't be alive long enough to realize any long term economic damage due to these types of decisions. What motivation do the self-centered have to think beyond their lifetimes?
    - andrew-lucker 9y ago
      This isn't climate science, we could see the economic effect immediately. That is simple enough for most people to draw a connection. I think the problem is more that some people want to hurt the US IT industry for political gain.

Crontab 9y ago

The government's arguments are awful. And I would like to point out that their efforts started when Obama was in office, so the awfulness cuts across party lines.

B1FF_PSUVM 9y ago
> across party lines The two wings of the U.S. owners party, as the late Gore Vidal used to put it rather accurately.
- basicplus2 9y ago
  "There is only one party in the United States, the Property Party … and it has two right wings: Republican and Democrat"

boznz 9y ago

Just wondering, is it possible to design software where the data is visible to the software but not to a human (the programmer). I could see a system where the private key is generated and stored in RAM and all the data is encrypted but the first update or power event would destroy the data. Just a thought experiment.

pjc50 9y ago
Two approaches: "trustzone"-style systems where the data is inaccessible to everything but the secure processor, or homomorphic encryption. But on the first, software updates present a problem. You can make the system only accept signed updates, but then the programmer can just replace the program with "please print all your secure data". Variants of this technique have been used to break all sorts of things, from arcade machines to payment cards. So if you want the data not to be visible to the programmer, you can never update the software. Homomorphic encryption theoretically hides the data from the program, but is extremely inefficient and I'm not aware of any widely deployed use.
- kobeya 9y ago
  Homomorphic encryption is behind some crypto currency stuff like zcash, but that’s about it. It is many orders of magnitude slower.
kelnos 9y ago
There was mention of the idea of data being (or not being) accessible to someone while in the US. It seems like it would be possible to design the system so no one in the US has "admin access" to the data in question. VPNs and firewalls restrict access to the data such that only someone physically in the EU can access it. An end-user with the account password could access their email or whatever through normal means from anywhere, but that would be it. Not sure if this is possible, considering you can always make the argument that the employees in the EU with access are subordinate at least to the US-residing CEO, who could order them to fetch and send the data.
user5994461 9y ago
No, there is always a programmer, a sysadmin or an operator who is in control of a program. Software cannot deploy and maintain themselves. It's possible to completely cut access to a system, for example you lose the only SSH key. It would continue to run and service users, but it is inoperable on an operational point of view.

singularity2001 9y ago

Nice attempt of a PR stunt. "Google resists to hand hover 22 mail accounts" when in truth they hand over ALL of your email and surf data to the NSA, for later abuse. (willingly or not)

zeep 9y ago
Yeah, I don't really understand why DoJ doesn't ask the NSA/PRISM for the data, and lie about its origin (parallel construction).

1024core 9y ago

> The government, meanwhile, accused Google of fashioning a system that kept consumer data stored on various servers across the globe—just so it could defy court orders. GGG? (Good Guy Google) ? For all the hate that Google gets on HN, it should also get some kudos for trying to protect the users' data.

usjehshksish 9y ago
Seems like this filing from the government is reason enough to hope that Google does implement such systems.
harsharama 9y ago
Engineering-wise, data dup and replication is worldwide for guaranteed access times, availability and DR. This particular legal advantage is a bonus of good design :)
- bonesss 9y ago
  Point of order: the accusation is not that Google duplicated and replicated data, some of which is outside the country. Google is being accused of intentionally obfuscating their control of the data explicitly to avoid court-orders (and not technical reasons and common engineering approaches). ... what you're talking about should result in a logical amalgamation: data here AND data there. Google is being accused of going out of their way to create an artificial barriers to the legal system by only having data "NOT here".
bonesss 9y ago
Two things can be true simultaneously... Google, good or evil, has a massive long-running interest in not allowing nations to subvert each others laws. Taken cynically: protecting user data may be entirely incidental to securing megabillions in hosting and services over the next few decades in privacy aware countries and with authoritarian regimes. Still: doing the right thing for the wrong reason ain't the worst ;)

jacquesm 9y ago

I hope DOJ realizes that if they win this Google, Microsoft and Amazon will lose a very large chunk of their clients.

throw2016 9y ago

There was a desire for globalization, people to people connection and one world fantasy that a whole generation was brought up on that early tech companies leveraged. But a lot of this is coming from the post 60-70 generation and events have completely discredited the idea of globalism. Nation states, politics and parochialism is as alive and kicking and far from uniting people our companies are just a way to exercise unilateral power and further national interests. No county can afford to be dependent on others for food, it's always used against them. It's the same for technology, both software and hardware and this will lead to a more divided splintered world and limit US opportunities but also increase local opportunities. Until globalism is a social and political reality based on mutual respect and humanity and not exploitation and capitalism this can't change.

jokoon 9y ago

Why can't anybody work on some kind of blockchained database software? I wonder if it would be doable... The Silicon Valley TV show had this. I've also thought about it, but I'm not sure it would be fast enough and redundancy could be tweaked... so only for backing up data... I don't know but storing data in a cloud which resides in user computers sound like the perfect solution to those kinds of legal issues. The whole feature is having data that cannot be suppressed or accessed by a private party.