8 ms·

It isn't really about encryption, as the title implies, but about deleting communication records (whether encrypted or not). > However, companies have an oblig

by paxy 9y ago

It isn't really about encryption, as the title implies, but about deleting communication records (whether encrypted or not). > However, companies have an obligation to preserve records that may be reasonably seen as relevant to litigation or that fall under data retention rules set by industry regulators Seems pretty clear that Uber violated this.

kinkrtyavimoodh 9y ago
The concept of spoliation of evidence is usually well-established. Is that the charge against Uber here? Or is the charge that they in general did their communication on Wickr? What happens if the service I am using has an inherent 24-hour window after which all data is erased? What if that window is 0 hour now? No data storage. If FB deleted all data about a druglord (who used FB for some nefarious purposes) after she deleted his profile, will FB be considered guilty of deleting evidence that could have been used to incriminate her?
- paxy 9y ago
  The problem isn't how they communicated, and the article acknowledges this. Wickr and other "secret" apps are perfectly fine. But at the end of the day if the court asks you for records relevant to a case, you are obligated to hand them over. "Oops the app deleted them" might not work for a judge.
  - kinkrtyavimoodh 9y ago
    But what if those logs didn't exist to begin with? Surely you are not suggesting that literally every communication that takes place in a company (verbal, written, or via gestures) be recorded and retained?
    - deleted 9y ago
      [deleted]
    - rosser 9y ago
      It's not whether the logs exist, but whether the conversation was deliberately had using an ephemeral messaging service, in order to evade statutory data retention obligations. That's the criminality — the evasion, itself; not which tool was used, but why.
      - bonzini 9y ago
        People use phones instead of email sometimes for sensitive conversations. Do phones count as ephemeral messaging services? What about voice mail?
        rosser 9y ago
        Phones have a record of the call having been made, and are subject to wiretapping. Ephemeral messaging services have neither.
        kinkrtyavimoodh 9y ago
        You seem to be fixating over the specifics of individual communication mechanisms, which is not the point. For instance, will an insistence that execs of Uber only talk in air-gapped soundproof rooms be considered incriminating?
        rosser 9y ago
        I'm not the one "fixated" on the mechanism of communication. I've consistently talked about the motivation for using a given mechanism, and, when specific mechanisms have been raised, whether those mechanisms satisfy those motivations. I even specifically said, "not which tool was used, but why." Please don't drag the actual point down into the weeds like that — particularly while accusing me of being the one to do so.
        deleted 9y ago
        [deleted]
        ggg9990 9y ago
    - mywittyname 9y ago
      Data retention laws are well-established and every major company I've worked for required training on what communications we are legally required to retain, how it should be retain and for how long.
- chrisfosterelli 9y ago
  I think the big problem, in my opinion, is not that they had disappearing messages so much as it is that they started requiring disappearing messages specifically so they could avoid being caught for anything illegal. In your example, I don't think FB would be at fault here any more than Wickr is at fault. The problem is with Uber (or the druglord), not the tool that happened to do the deleting.
  - kinkrtyavimoodh 9y ago
    "... started requiring disappearing messages _specifically_ ..." But that's an insinuation. Just like the govt can insinuate that people using encrypted communication are doing so to hide illegal activities. Is there specific evidence that Uber asked employees to use Wickr in order to hide talks of illegal activities?
    - paxy 9y ago
      > Richard Jacobs, a security analyst whom Uber fired in April and now consults for the company, testified Tuesday that up to dozens of employees were trained to used ephemeral messaging systems, including Wickr, to communicate so that their conversations would be clandestine and could not surface in any “anticipated litigation.” Literally from the article.
      - weddpros 9y ago
        Maybe he provided proof of that... maybe it was just his understanding? Legal departments know it's impossible to be 100.00% legal (who has never trespassed a single law?), and they're tasked with avoiding any legal risk. To them, it's probably just risk mitigation to ask employees to avoid leaving unnecessary evidence.
        Spooky23 9y ago
        There’s a line between managing risk and abetting. Uber likes to push or cross boundaries in many other areas, so it stands to reason that perhaps they did that here.
- bluGill 9y ago
  When you are told you are under investigation you have an obligation to not delete anything, even if the automatic window expires. My company has a policy that outlook will expire all messages in my inbox after 30 days (saved messages folders have a different policy). However when we get legal notice IT quickly changes a setting and now it is not possible for that person to delete any existing email. (eventually legal will review every email you have saved, they will then let you delete the ones that are not affected, but they err on the side of keeping anything) Even if you hit delete, the system will not let you delete the message. Our IM system makes it hard to save conversations, in part of make it hard for investigators to get access to conversations. As for Facebook, that is complex, depending on which situation. If the "evil person" deleted his account with no knowledge that he was under investigation than Facebook is safe. However the evil person could be in trouble if he knew he was under investigation. If Facebook knew about the investigation they could not legally delete all his data, I presume they have something in place for this situation. Of course in most cases evil people don't know they are under investigation. This mostly is a factor when a company is sued.
  - grok2 9y ago
    I wonder why should email be different (why should you change the expiration policy?) Is it explicitly called out in some law that it has to be treated differently? What about if you always use a service that auto-deletes communication every few hours (and it is well-known that this is what the service does and you have no control over it), will that be treated like you are using the phone service for communication?
    - ryandrake 9y ago
      I think the right question is, "Why should a phone call be different?" What intrinsic quality of a phone call makes it not subject to data retention, whereas an E-mail or a text message would be?
      - kazinator 9y ago
        And the answer boils down to: in a phone call you can blurt out shit such that, if it were written down in an edit window, you wouldn't click "Send". Also: a phone call can capture surrounding audio not intended to be part of the phone call. That audio can either leak information itself, or reveal the originator's location.
dqv 9y ago
They seem to be talking about litigation hold, which must be triggered by some event that makes the company aware of the potential for litigation.
conradev 9y ago
If they switched to using phone calls to discuss sensitive information and didn't record them, would they still be violating the rules?
- btian 9y ago
  no. that's why most corporate lawyers prefer you call them instead of email
  - deleted 9y ago
    [deleted]
  - ryandrake 9y ago
    What is a phone call, if not "a conversation that self-destructs after it's done"? Not commenting on how the law (which was written before "apps" existed) treats it, but on the true nature of a phone call vs. a messaging app.
    - spayu61 9y ago
      I believe the difference is intent--a phone call self destructs by default. They are not meant to be recorded (we even have laws here that prohibit it without consent of both parts). Messaging apps have, traditionally, kept logs, in both ends and in the server.
      - ISL 9y ago
        Entirely agreed, though it is true that intentionally-private messaging apps have, traditionally, not kept logs. That's a tradition worth keeping!
    - DannyBee 9y ago
      There are many many records of phone calls. I can ask your phone provider for them. I can subpoena you and make you testify to their content, etc.
zeep 9y ago
If they didn't use encryption, the NSA could recover everything from their data centers and then the FBI could do parallel construction?

by paxy 9y ago

kinkrtyavimoodh 9y ago

The concept of spoliation of evidence is usually well-established. Is that the charge against Uber here? Or is the charge that they in general did their communication on Wickr? What happens if the service I am using has an inherent 24-hour window after which all data is erased? What if that window is 0 hour now? No data storage. If FB deleted all data about a druglord (who used FB for some nefarious purposes) after she deleted his profile, will FB be considered guilty of deleting evidence that could have been used to incriminate her?

paxy 9y ago
The problem isn't how they communicated, and the article acknowledges this. Wickr and other "secret" apps are perfectly fine. But at the end of the day if the court asks you for records relevant to a case, you are obligated to hand them over. "Oops the app deleted them" might not work for a judge.
- kinkrtyavimoodh 9y ago
  But what if those logs didn't exist to begin with? Surely you are not suggesting that literally every communication that takes place in a company (verbal, written, or via gestures) be recorded and retained?
  - deleted 9y ago
    [deleted]
  - rosser 9y ago
    It's not whether the logs exist, but whether the conversation was deliberately had using an ephemeral messaging service, in order to evade statutory data retention obligations. That's the criminality — the evasion, itself; not which tool was used, but why.
    - bonzini 9y ago
      People use phones instead of email sometimes for sensitive conversations. Do phones count as ephemeral messaging services? What about voice mail?
      - rosser 9y ago
        Phones have a record of the call having been made, and are subject to wiretapping. Ephemeral messaging services have neither.
        kinkrtyavimoodh 9y ago
        You seem to be fixating over the specifics of individual communication mechanisms, which is not the point. For instance, will an insistence that execs of Uber only talk in air-gapped soundproof rooms be considered incriminating?
        rosser 9y ago
        I'm not the one "fixated" on the mechanism of communication. I've consistently talked about the motivation for using a given mechanism, and, when specific mechanisms have been raised, whether those mechanisms satisfy those motivations. I even specifically said, "not which tool was used, but why." Please don't drag the actual point down into the weeds like that — particularly while accusing me of being the one to do so.
      - deleted 9y ago
        [deleted]
      - ggg9990 9y ago
  - mywittyname 9y ago
    Data retention laws are well-established and every major company I've worked for required training on what communications we are legally required to retain, how it should be retain and for how long.
chrisfosterelli 9y ago
I think the big problem, in my opinion, is not that they had disappearing messages so much as it is that they started requiring disappearing messages specifically so they could avoid being caught for anything illegal. In your example, I don't think FB would be at fault here any more than Wickr is at fault. The problem is with Uber (or the druglord), not the tool that happened to do the deleting.
- kinkrtyavimoodh 9y ago
  "... started requiring disappearing messages _specifically_ ..." But that's an insinuation. Just like the govt can insinuate that people using encrypted communication are doing so to hide illegal activities. Is there specific evidence that Uber asked employees to use Wickr in order to hide talks of illegal activities?
  - paxy 9y ago
    > Richard Jacobs, a security analyst whom Uber fired in April and now consults for the company, testified Tuesday that up to dozens of employees were trained to used ephemeral messaging systems, including Wickr, to communicate so that their conversations would be clandestine and could not surface in any “anticipated litigation.” Literally from the article.
    - weddpros 9y ago
      Maybe he provided proof of that... maybe it was just his understanding? Legal departments know it's impossible to be 100.00% legal (who has never trespassed a single law?), and they're tasked with avoiding any legal risk. To them, it's probably just risk mitigation to ask employees to avoid leaving unnecessary evidence.
      - Spooky23 9y ago
        There’s a line between managing risk and abetting. Uber likes to push or cross boundaries in many other areas, so it stands to reason that perhaps they did that here.
bluGill 9y ago
When you are told you are under investigation you have an obligation to not delete anything, even if the automatic window expires. My company has a policy that outlook will expire all messages in my inbox after 30 days (saved messages folders have a different policy). However when we get legal notice IT quickly changes a setting and now it is not possible for that person to delete any existing email. (eventually legal will review every email you have saved, they will then let you delete the ones that are not affected, but they err on the side of keeping anything) Even if you hit delete, the system will not let you delete the message. Our IM system makes it hard to save conversations, in part of make it hard for investigators to get access to conversations. As for Facebook, that is complex, depending on which situation. If the "evil person" deleted his account with no knowledge that he was under investigation than Facebook is safe. However the evil person could be in trouble if he knew he was under investigation. If Facebook knew about the investigation they could not legally delete all his data, I presume they have something in place for this situation. Of course in most cases evil people don't know they are under investigation. This mostly is a factor when a company is sued.
- grok2 9y ago
  I wonder why should email be different (why should you change the expiration policy?) Is it explicitly called out in some law that it has to be treated differently? What about if you always use a service that auto-deletes communication every few hours (and it is well-known that this is what the service does and you have no control over it), will that be treated like you are using the phone service for communication?
  - ryandrake 9y ago
    I think the right question is, "Why should a phone call be different?" What intrinsic quality of a phone call makes it not subject to data retention, whereas an E-mail or a text message would be?
    - kazinator 9y ago
      And the answer boils down to: in a phone call you can blurt out shit such that, if it were written down in an edit window, you wouldn't click "Send". Also: a phone call can capture surrounding audio not intended to be part of the phone call. That audio can either leak information itself, or reveal the originator's location.

dqv 9y ago

They seem to be talking about litigation hold, which must be triggered by some event that makes the company aware of the potential for litigation.

conradev 9y ago

If they switched to using phone calls to discuss sensitive information and didn't record them, would they still be violating the rules?

btian 9y ago
no. that's why most corporate lawyers prefer you call them instead of email
- deleted 9y ago
  [deleted]
- ryandrake 9y ago
  What is a phone call, if not "a conversation that self-destructs after it's done"? Not commenting on how the law (which was written before "apps" existed) treats it, but on the true nature of a phone call vs. a messaging app.
  - spayu61 9y ago
    I believe the difference is intent--a phone call self destructs by default. They are not meant to be recorded (we even have laws here that prohibit it without consent of both parts). Messaging apps have, traditionally, kept logs, in both ends and in the server.
    - ISL 9y ago
      Entirely agreed, though it is true that intentionally-private messaging apps have, traditionally, not kept logs. That's a tradition worth keeping!
  - DannyBee 9y ago
    There are many many records of phone calls. I can ask your phone provider for them. I can subpoena you and make you testify to their content, etc.

zeep 9y ago

If they didn't use encryption, the NSA could recover everything from their data centers and then the FBI could do parallel construction?