18 ms·
Uber's use of encrypted messaging may set legal precedents
- kinkrtyavimoodh 9y agoEdit: For people bringing up Sarbanes-Oxley, I will paste a comment made by a user in this thread (https://news.ycombinator.com/item?id=15827298 https://news.ycombinator.com/item?id=15827298) > "This is not even a little bit true. What you're implying is that businesses are required by law to keep all internal communications in case someday there's litigation, and that is just flatly false. Deleting data once litigation has been initiated is tampering/obstruction. Deleting data when not under litigation is the company's choice, with very few exceptions. Many companies explicitly require all communication be ephemeral - email, messaging, etc. it explicitly only preserved for X days and then deleted entirely from all systems." "That they were so concerned about covering things up meant that they could have known what they were doing was a crime" When the government says "Only criminals want privacy. Why do you care about privacy if you're doing nothing wrong", every one is up in arms (and rightly). What happened now? "However, companies have an obligation to preserve records that may be reasonably seen as relevant to litigation. Chat logs that could help get to the bottom of the trade secrets case are now inaccessible" Why does someone automatically have a right to know what communication took place just because that knowledge would help incriminate the communicator? There seems to be a double standard in the community here when it comes to privacy. Usually, everyone's all gung-ho about privacy and encrypted communication and VPNs that don't keep logs. At that time, no one seems to be concerned about who is using that encrypted channel and for what purpose. But now suddenly Uber did it and it's bad?
- throwaway613834 9y agoI don't know if this is the reasoning, but I don't see any immediate contradictions in having different standards for individuals and corporations.
- kinkrtyavimoodh 9y agoSo if an organization says that its employees should always use an ephemeral messaging service for communication, it's inherently in the cloud of suspicion? Because that seems tantamount to saying that literally any communication between employees of the company (even verbal) must be recorded? What if all this communication had happened between them in those 'long walks' they took in San Francisco?
- rosser 9y agoIf that company is subject to data retention laws, yes.
- Analemma_ 9y agoYes. Sarbanes-Oxley requires business records to be kept for a reasonable length of time, and with ephemeral messaging that is impossible. So it would seem that these applications are illegal for business use by default.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- jacquesm 9y agoIf you want to operate a business you need to play by the rules for businesses. Private individuals have different expectations and laws governing their privacy. One major difference between individuals and corporations is that you can not really jail a corporation (though you can jail execs, but this rarely happens) and running a company is a privilege, not an innate right. So it stands to reason that if the law says you need to preserve your records that you do so in order to be able to hold the company accountable for its actions. Similar laws apply to your financial recordkeeping. Willfully destroying evidence, whether you are a private individual or a corporation is going to be frowned upon by a judge anyway, the best way to avoid all of this is to simply not commit any deeds that could be labeled crimes.
- pfarnsworth 9y agoIn the broader picture, this seems pretty unreasonable. What if you used iMessage in the context of your business, or if you communicated entirely over the phone verbally? Is it fair to assume if there is no evidence of problems that it was simply deleted, as the judge said? That's like trying to prove a negative, is that really legal?
- Analemma_ 9y agoFor iMessage specifically (which is not ephemeral), the judge would just order you to unlock your phone and show the messages, or provide your iCloud password, and jail you for contempt if you refused. Sarbanes-Oxley requires corporate record-keeping and outlaws interference with investigations. While it doesn't specifically mention ephemeral messaging, it would seem to preclude its use in anything business-related. So it's not "trying to prove a negative" so much as it seems to be saying these applications are illegitimate for business use period.
- rosser 9y ago> the judge would just order you to unlock your phone... Depending on which Federal circuit applies, and how you authenticate to your device, only if they already had proof that your messages were material to the case. Unlocking your device (with a passcode or password, as distinct from biometrics) has been ruled to be "testimonial", so the State must have specific knowledge that your iMessage has inculpatory evidence in order to compel you to unlock it and hand those messages over. (IANAL.)
- icebraining 9y agoYou can, but pleading the Fifth on a civil case can be held against you (adverse inference). IANAL as well.
- 1_2__4 9y agoThis is not even a little bit true. What you're implying is that businesses are required by law to keep all internal communications in case someday there's litigation, and that is just flatly false. Deleting data once litigation has been initiated is tampering/obstruction. Deleting data when not under litigation is the company's choice, with very few exceptions. Many companies explicitly require all communication be ephemeral - email, messaging, etc. it explicitly only preserved for X days and then deleted entirely from all systems.
- paxy 9y agoIt isn't really about encryption, as the title implies, but about deleting communication records (whether encrypted or not). > However, companies have an obligation to preserve records that may be reasonably seen as relevant to litigation or that fall under data retention rules set by industry regulators Seems pretty clear that Uber violated this.
- kinkrtyavimoodh 9y agoThe concept of spoliation of evidence is usually well-established. Is that the charge against Uber here? Or is the charge that they in general did their communication on Wickr? What happens if the service I am using has an inherent 24-hour window after which all data is erased? What if that window is 0 hour now? No data storage. If FB deleted all data about a druglord (who used FB for some nefarious purposes) after she deleted his profile, will FB be considered guilty of deleting evidence that could have been used to incriminate her?
- paxy 9y agoThe problem isn't how they communicated, and the article acknowledges this. Wickr and other "secret" apps are perfectly fine. But at the end of the day if the court asks you for records relevant to a case, you are obligated to hand them over. "Oops the app deleted them" might not work for a judge.
- kinkrtyavimoodh 9y agoBut what if those logs didn't exist to begin with? Surely you are not suggesting that literally every communication that takes place in a company (verbal, written, or via gestures) be recorded and retained?
- deleted 9y ago[deleted]
- rosser 9y agoIt's not whether the logs exist, but whether the conversation was deliberately had using an ephemeral messaging service, in order to evade statutory data retention obligations. That's the criminality — the evasion, itself; not which tool was used, but why.
- trhway 9y agoas companies are apparently persons, do they have the right against self-incrimination and the right to remain silent?
- rosser 9y agoYou, as an individual, have a right against self-incrimination, but you're simultaneously subject to laws against tampering with or destroying evidence. You don't have to hand over the incriminating evidence, or even tell the cops that you have it. But if they find out you did have it, and knowingly destroyed it to hide your illegal behavior, that is a legitimate additional charge.
- rayiner 9y agoThe Supreme Court has held that corporations don't have fifth amendment rights. They have done so precisely because they've never categorically held that "companies are ... persons," but rather have in various cases stamped out attempts to infringe on personal rights just because those people happen to act through a corporation.
- free2rhyme214 9y agoSnapchat offers E2E?
- jayd16 9y agoIf you think Snapchat is secure or unrecorded, I've got news for you.
- Cshelton 9y agoThis keeps going around but it's simply not true... For snaps that are not saved, those are not retained on any server after their expiration. Why would snap spend the money and/or hold the liability of keeping expired snaps stored... They know if it was all leaked they'd be done. And with the number of daily snaps, that would add up storage costs real fast or no reason.
- kodablah 9y ago> This keeps going around but it's simply not true How do you know? > Why would [...] Because you can't think of a reason it must not be true? Or are you claiming internal knowledge or taking the company's word for it? I don't know for sure what's retained, and therefore I won't go around saying I know.
- Analemma_ 9y agoI'm half-joking here, but one reason we might know it isn't true is the "argument from cash flow": Snap is still hemorrhaging money, to the consternation of investors, mainly because they're paying astronomical sums to Google for GCE hosting. Given the amount of data that passes through Snapchat every day and the cost to host it, I can make a decent guess that they're not hanging on to it, or else their infrastructure costs would be even greater.
- user5994461 9y agoTheir costs is already in the hundreds of million of dollars. They could hang on to all videos with no issue whatsoever. That's financially easily doable within their budget, and that's technically easily doable because google storage will take any amount of TB thrown at it. The only fair assumption is that they store all videos. Remember that they are an ad business. If it's too annoying, the wise decision would be to cut storage to only 1 month, or store only 1% of randomly selected videos. It will never be to stop storing videos.
- JumpCrisscross 9y ago> Richard Jacobs, a security analyst whom Uber fired in April and now consults for the company, testified Tuesday that up to dozens of employees were trained to used ephemeral messaging systems, including Wickr, to communicate so that their conversations would be clandestine and could not surface in any “anticipated litigation.” Given two identical actions, the law can find one illegal and the other permissible based solely on intent.
- AckSyn 9y agoIntent is such a petty way of regulating or enforcing law
- solidsnack9000 9y agoCrimes generally involve a mens rea and actus reus — a guilty mind and a guilty act. For example, battery is the intentional touching of a person, either against their will or to cause them harm. If it weren’t like that, then every time one person bumped another in the street it would be a crime.
- bkovacev 9y agoI'll probably get downvoted but is there a specific reason that any uber related story is always in top 10? Can there be a day when there aren't any?
- adjkant 9y agoYou'll see that when notable stories stop hitting the news so frequently. I think this complaint should be forwarded to Uber. Perhaps directly to the CEO since you might get a big payday out of that.
- bkovacev 9y agoI dislike them quite a bit honestly due to the way things have been developing for a while, but it's getting tedious that every time I open HN all I see is Uber.
- adjkant 9y agoThat's fair, but it doesn't mean it shouldn't be there. I think people feel that way about a lot of things right now, like Trump on the news daily, regardless of where you stand.
- ggg9990 9y agoIt's because Uber is a massive company which had a massive impact on transportation and employment while simultaneously being a complete inferno of unethical and illegal behavior internally and externally. It is simply a lot of news.
- josh2600 9y agoOk so what if, by policy, the company uses an ephemeral messaging app with a 30 day log rotation? Can a court hold them in contempt for using that product or is it fine because it's a policy to have log rotation?
- dqv 9y agoI don't think they'd hold them in contempt. I think the encrypted messages being deleted is about adverse inference - where it can be assumed that the destroyed evidence negatively affects Uber. Also, if anyone is interested in reading about it, I found this enjoyable article [1] about the topic. [1]: http://fordhamlawreview.org/wp-content/uploads/assets/pdfs/Vol_83/No_3/Scheindlin_Orr_December.pdf http://fordhamlawreview.org/wp-content/uploads/assets/pdfs/V...
- deleted 9y ago[deleted]
- paxy 9y agoProbably not, but again depends on the circumstances. If, say, the company normally used Slack but for a single project all communication was strictly off-the-record on something like Wickr. And that project just happened to be involved in an espionage lawsuit. And someone testified that they used the secret app specifically to avoid future litigation...
- mywittyname 9y agoIf the policy is against the law, then yes. Business records are legally required to be retained for a period of time (which varies depending on its content). Failure to do so is a violation of the law, and is evidence against you in the event of a lawsuit.
- reaperducer 9y agoKind of an IT-specific viewpoint. I used to work in an industry where everyone from the local police all the way up tot he F.B.I. would routinely send us subpoenas. The corporate (big company - 30k employees around the world) policy was that we would delete all paper notes every seven days, and destroy anything recorded (especially videotapes) every 14 days. We were told this was specifically so we could dodge subpoenas, otherwise we'd drown in them.
- cmansley 9y agoHow is this any different than in-person conversations that are not recorded? Should companies be required to record all conversations that happen face to face?
- QAPereo 9y agoIn many cases they are, although not “all” it’s true.
- Psilidae 9y agoWhat do you mean by "they are"? I, too, don't understand how this is a legal issue given that people can talk face-to-face, or over non-recorded voice services. If it's written communication, what if you're writing things on whiteboards? How would this not set a legal precedent that essentially requires all communication be through Slack/etc?
- QAPereo 9y agoDepending on the content of your communication, you might be legally required to commit it to writing, be in the presence of someone transcribing it, etc. This is not exactly unheard of, especially wherever lawyers tread, such as the world of business.
- cmansley 9y agoI feel that many of these legal arguments have not caught up with modern technology. If we had had the capabilities we have today 100 years ago, I am sure the lawyers would have pushed for maximum recording of all things. But face to face discussions are some how grandfathered in.
- deleted 9y ago[deleted]
- puppetmaster40 9y agoI recall a case where after a subpoena for records hard drives were wiped clean and mobile phones where smashed with a hammer. So what is it, OK to destroy or not as a legal precedent?
- amiga-workbench 9y agoOh, that was just extreme carelessness ;^)
- puppetmaster40 9y agolol.
- saulrh 9y agoI'm surprised that this isn't turning into a conspiracy charge. That's basically what it amounts to, right? An agreement to commit illegal acts and actions taken to further the commission of those illegal acts? Honestly, this seems like exactly the kind of thing that the conspiracy laws were meant to deal with - you know that one of them did something illegal, but you can't tell who because they covered the details up well enough to prevent identification.
- AnimalMuppet 9y agoGive it time. The courts don't move fast, but they do move. Recall that this stuff came out because the judge in the Waymo case referred the situation to federal prosecutors.
- matt_wulfeck 9y ago>“It’s a knotty question for courts and lawyers on when the obligation arises” to preserve records, said Julia Brickell, general counsel at the legal discovery firm H5. Is it really knotty though? Even I know that communication related to running a business must follow data preservation rules. It may not be massively illegal, but at its base using encrypted messaging in this manner is contempt, especially since they knew it could be used in litigation.
- Steeeve 9y agoUber is not in a regulated industry. Taxi companies do not have any obligation to store email or any other communication for x number of years. You can destroy whatever you want pre-lawsuit. Once the suit is filed, you are not allowed to destroy anything that is evidence, and most lawyers will caution you away from destroying anything at all at that point, since the most mundane things could be perceived as evidence under argument. This is being painted as "Uber is being super slimy". Anyone who has sat through a trial having anything to do with electronic communications knows that it's a benefit to everybody if as little logging is done as possible. > On December 18th, you responded "OK", but on December 19th you responded "Will Do" to the same request from another co-worker. Why was the second co-worker more deserving of a positive response? Trials are littered with this kind of mundane exchange. It's why Clinton, Bush, and I'm sure Obama and Trump all used alternative communications systems - because when every thought that is laid down will come under scrutiny, you lose productivity. How are we going to hold companies to standards that we don't expect our nations leaders to follow?
- dragonwriter 9y ago> You can destroy whatever you want pre-lawsuit. That's at best imprecise; the duty to preserve evidence is triggered when a lawsuit is threatened, filed, or reasonably anticipated. > This is being painted as "Uber is being super slimy". Anyone who has sat through a trial having anything to do with electronic communications knows that it's a benefit to everybody if as little logging is done as possible. That is entirely untrue. While records can be inconvenient, they can also be critical to the case of the party retaining them.
- saulrh 9y ago> reasonably anticipated Does "We're going to be doing illegal stuff, so don't talk about it where the courts might hear" qualify as "Reasonably anticipated legal action"?
- dqv 9y ago"We're going to be doing illegal stuff, so don't talk about it where the courts might hear" Sounds like the underlying implication of an ethics class. I think reasonable anticipation would be at the point that Uber knew or should have known they were deriving development from stolen material.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- DannyBee 9y agoPretty much everyone here is missing the point, so i guess i'll try to make it more clearly. Once you have reasonable anticipation of future litigation, you are required to preserve evidence. This why most litigation holds companies place do not let you delete emails, for example. The purpose of discovery is to get all relevant evidence out in the open in order to help resolve the case. These two things are true regardless of medium. IE If i am making phone calls that are relevant to litigation, and you otherwise would keep records or recordings of them, you must preserve them. I can be called to testify to them. Use of mediums like this is a grey area, but that's irrelevant. You can argue till you are blue in the face that you have legitimate reasons to use self-destructing/encrypting mediums. "Once a party has notice that litigation has been filed, courts uniformly impose a duty to preserve potentially relevant evidence on parties to the lawsuit. The duty “includes an obligation to identify, locate, and maintain, information that is relevant to specific, predictable, and identifiable litigation.” The duty applies only to relevant data, documents and things." Remember that at one point, email preservation and other things did not exist. Courts forced companies to preserve that data: "To be sure, as part of a litigation hold, a company may be required to cease deleting e-mails, and to disrupt its normal document destruction protocol." So let's turn to here. First, regardless of anything else, the use of anything with a specific goal of avoiding the duty to preserve evidence is going to be held against you. Full stop. It does not matter what that is. So regardless of the medium in use here, that's problem #1. How far does anticipation of a lawsuit go? In the oft-cited Zubalake decision, the court found that a company employer had a duty to preserve electronic records destroyed before an employee filed the charge of discrimination that triggered a government investigation because almost everyone with whom that employee worked anticipated she might bring a lawsuit. That is, the court held that duty to preserve attached at the time that litigation was “reasonably anticipated,” and that key company employees anticipated litigation months before the employee filed a charge of discrimination. Boom. This case is pretty much already lost in those jurisdictions. Problem #2 is what if the medium normally keeps no records. Again, if you did it deliberately to avoid discoverability, you are already going to lose. It's true that there is no general duty to preserve, but once that duty kicks in, the fact that the medium is ephemeral is irrelevant. There is literally nothing that prevents preservation of evidence here other than desire. They could make records of conversations (screen grabs, what have you), they could record the ephemeral keys and data (they have physical access), and they could also tell people who they anticipate (above) to be involved in litigation to not use such mediums, and in fact, pretty easily force compliance. I'm aware of zero cases that have said "yeah, it sucks that you lost those ephemeral messages", and plenty that have sanctioned as a result of failure to save. See all the linked cases in https://www.lexology.com/library/detail.aspx?g=f47f71d2-281b-49c1-8bbc-f0a23a123c8a https://www.lexology.com/library/detail.aspx?g=f47f71d2-281b... You should also realize that if these forms of communication become incredibly common, the discovery rules will adapt. They have adapted as texting and instant messaging became more common, they will adapt as self-destructing messages become more common. That adaptation is not going to be "self-destructing messages get a free pass", it's going to be "you may be required to preserve keys"
- tonyztan 9y ago> "Richard Jacobs, a security analyst whom Uber fired in April and now consults for the company" Why did Uber fire Jacobs and then hire him again, as a consultant?
- dimpadumpa 9y agoWhats the point of crypting when workers read them anyway ?? Cmon, is this a hoax or what ??