8 ms·
I think the biggest issue here is that Uber actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the
by chollida1 9y ago
I think the biggest issue here is that Uber actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law.
I mean, someone actually sat down and said, ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant.
- pbhjpbhj 9y agoIt seems generally useful against any physical intrusion - presumably it could have been constructed against crackers or intruders of any nature.
- emn13 9y agoSince you need to to be aware of the raid to use the tool, it seems particularly useful vs. attackers that aren't afraid of being noticed, and whom you cannot keep out otherwise. Particularly the police, in other words. Not that it's impossible it'd be useful otherwise...
- avaika 9y agoDisclaimer: I'm not defending anyone who breaks the law. I'm just explaining why and how it might work from my point of view. It just depends on how people were explained why and what they need to do. In the end these engineers even might have had no idea that the thing they produced will be used this way. Additionally, I know a bunch of people who developed similar system for small companies in my country. However the situation is different: law enforcement institutions are often misused to get the bribe from business owners. Means the less they can find in your office, the less chances they will take your money away for nothing.
- booleandilemma 9y agoThis is the same company that had an internal program called “Hell”. I agree with the parent that Uber developers are just unethical. I’m wondering if they ask you to strangle a kitten during the tech interview, just to see how you react.
- chronic193 9y ago> I’m wondering if they ask you to strangle a kitten during the tech interview, just to see how you react. I'd do it. So would hundreds of thousands of candidate software engineers around the world. You really need to step out of your white night bubble. People are not nice in this world. Nor is it required to be nice.
- mynameisvlad 9y agoPeople name internal programs badly all the time. That shouldn't be an instant "they're unethical" flag. Furthermore, the developers working on these projects could have easily been told they were building something completely different than how it was used. We shouldn't make assumptions about the developer when there are people that we know knew what was going on. And is the last line necessary?
- frgtpsswrdlame 9y ago>I mean, someone actually sat down and said, ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant. But was that 'someone' a programmer? I'd say whoever programmed this probably did so on order of their boss. Tech isn't immune to the same pressures that exist in every field. Basically, make the boss happy.
- danharaj 9y agoIf only programmers could form some sort of collective to advocate for their common interests and hold their bosses accountable to ensure our profession is kept to a high ethical standard while protecting programmers from backlash when they refuse to break the law for their employers.
- throwanem 9y agoYes, when I contemplate the paragon of ethics, the image which invariably comes first to mind is that of a trade union.
- frgtpsswrdlame 9y agoWho's talking about a paragon of ethics? Trade unions don't exist because they are supremely ethical. They don't even exist because they are more ethical than corporations (they're probably not.) They exist because a corporation is inherently coordinated in a way that gives them power over workers. Unions just allow workers to adopt that same inherent coordination to seize power back. Unions aren't a moral force, they're just a counter-balance.
- atonse 9y agoSure, or maybe we can just accept that there are a lot of programmers that aren't saints or innocent victims of overbearing bosses, but actually are happy to use their skills to break the law? You can make a group of programmers think they're pirates going against the establishment, and they'll do anything under that idea.
- dontreact 9y agoWere they blocking searches with warrants or warrantless raids? And was what they did illegal? I read the article but left unclear on both of these key questions.
- grasshopperpurp 9y ago>In May 2015 about 10 investigators for the Quebec tax authority burst into Uber Technologies Inc.’s office in Montreal. The authorities believed Uber had violated tax laws and had a warrant to collect evidence.
- SilasX 9y agoPer my comment from a while ago, I think what they did was illegal. [1] If they had simply kicked off users who were likely cops, that would have been legal. That’s what (some) biker bars do. But they went beyond that and actively misled such users in a way that wasted their time. That amounts to lying to investigators and is illegal. You can kick people out of your bar for giving off a cop vibe. You can’t keep them around and feed them fake intel on drug deals so they waste their time. You can pull your shade down to keep people from looking in your window. You can’t make shadow puppets of a homicide with the intent to get the cop outside to investigate a spurious lead. [1] https://news.ycombinator.com/item?id=14270214 https://news.ycombinator.com/item?id=14270214
- freeone3000 9y agoWhy can't you keep them around and feed them fake intel on drug deals so they waste their time?
- BearGoesChirp 9y ago>You can’t keep them around and feed them fake intel on drug deals so they waste their time. Any relevant case law on this? Lying to the police isn't allowed, but lying to some new guy at the bar is legal, regardless of your suspicions of who the new guy is.
- SilasX 9y ago
- CodesInChaos 9y ago> ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant. When writing end-to-end encrypted chat, client-side encrypted hosting/backup, etc. you ask yourself the same question. And yet I consider those ethical.
- StavrosK 9y agoBy that logic, you do the same when you close your door. This is ridiculous, clearly there's a sliding scale of how much morality versus how much immorality you enable. How far along that scale is a tool whose sole purpose is to block lawful warrants?
- mynameisvlad 9y agoWho says that that's what the end developers were tasked with creating? Maybe they were told they were creating security protocols in place for robberies. We shouldn't make assumptions on what the lowly developer knew or didn't know going into the project, but instead focus on the big wigs who 100% knew what this project was for.
- StavrosK 9y agoI think you can reasonably substitute "developer" for "person" and the grandparent's point still stands.
- mynameisvlad 9y agoSure, the point I was making is this whole thread is focused on these evil developers who are unethical and immoral and horrible for what they did. Which is the wrong approach. We don't know enough details to know what they knew or didn't know going into the project. If Uber at the highest level is okay with deceiving the government, then it's not crazy to think they wouldn't inform their developers about the potentially illegal things they were going to do. And this was all in 2015-2016 when Uber was still a "scrappy startup" in the people's eyes and not the monster it's been exposed to be. However, we 100% know of people who did know about the project, specifically the higher ups. Our anger should be directed at them because they have no excuse.
- mcny 9y agoI am no uber fan but I'd have no problem with a tool like this if I understand it correctly. I like to believe that if there's a legitimate use for a tool, then the tool is fine. What's the difference between a lawful search warrant and robbery? Why do we focus on the text rather than the fact that the leadership created a protocol and a scheme to do this? Why does Travis get a pass?
- dx034 9y agoIn case of robbery you wouldn't have time to call the number. Tech offices don't tend to get robbed when people are at their computers. And if they aren't, devices should be locked and files with it.
- LeifCarrotson 9y ago"It should be noted that no ethically-trained software engineer would ever consent to write a HideDataFromPolice procedure. Basic professional ethics would instead require him to write a HideDataFrom procedure, to which Police could be given as a parameter." - Nathaniel Borenstein (paraphrased)
- mcguire 9y ago"The only original rule in engineering ethics was not to compete against other engineers on the basis of price." (Henry Petroski, from memory) Software engineering doesn't even follow that rule.
- rlanday 9y agoCome on, software engineers love writing crypto software to hide information from the government…
- Bogdanovich 9y agoNot all government officials and police officers are the same. For example Magnitskiy scandal in Russia. https://en.wikipedia.org/wiki/Sergei_Magnitsky#Exposing_the_scandal https://en.wikipedia.org/wiki/Sergei_Magnitsky#Exposing_the_... TL/DR: police had given the materials taken during the police raids to organized criminals, who used them to fraudulently reclaim $230m of the taxes previously paid by the company.
- whatok 9y agoSome of these things could be specced in an obfuscated or completely fragmented way that no one really had any great idea of what the complete product was. That said, there had to have been someone who integrated everything together.
- bryanlarsen 9y agoAnd yet Apple regularly receives praise here for thwarting law enforcement. The difference seems obvious to us, but it wouldn't be to someone outside of tech, and similar justification will be used by used by people building the Uber program. I suspect the large majority of entities who are stymied by Apples extensive encryption who wouldn't be stymied by trivial encryption are law enforcement and other state entities. I also suspect that Uber's protocol has been invoked against against intruders and/or commercial visitors. So while Apple good and Uber bad, the difference is gray, not black & white.
- rm_-rf_slash 9y agoApple protects its customers. Encryption that stops cops also stops criminals. Uber is only protecting its profits. The customers are incidental to its blatant lawbreaking.
- nyolfen 9y agodo you think apple is motivated out of the goodness of its collective heart?
- mikestew 9y agoDo you propose that it is impossible to "do the right thing" and make a profit?
- letsgetphysITal 9y agoApple protects its profits. Encryption that enables privacy protections for consumers also stops cops investigating crime. Apple is not your friend and does not have your best interest at heart. It is a company like Facebook, Microsoft, Ford, Boeing... They all just want the money. If making hard to break encryption sells more units, then that is the only motivation.
- IBM 9y agoThere's no evidence that Apple's ideas about privacy or encryption have any positive effect on sales. The only people who might even be aware of it are tech people, and that doesn't move the needle at all. See the tech people gripes about the Macbook Pro, which went on to sell well anyway.
- zvrba 9y ago> actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law It's not that simple. Team A is given the task of writing SW that locks down all computers in case some alarm goes off (e.g., opening a door without disarming an alarm). In the start, this alarm and all workstations are connected to an on-premises server. Team B is given the task of moving the server into the cloud (or home office) because HR realized they could automatically monitor which employees enter and exit the office. For security auditing. The system has been moved to the cloud and team C is given the task of extending the SW to make it possible to block certain employees for logging in, e.g., after they've accumulated a certain number of work hours during a week. To prove that the company complies with work regulations. Now you have built a system, all under plausible and "just" pretenses, that allows you to lock down an office anytime remotely. Team D (managers) are given the task of paging a number when a raid happens. Team E is instructed to lock down an office when the number is paged (possibly they're told that it's a system test or something else). If anyone is doing anything unethical here, it's the managers and, possibly, team E (executing the lockdown).
- samfriedman 9y agoWhen the system is compartmentalized like this, the "anyone doing anything unethical here" is surely the senior leadership who can see the full system and leverage its capabilities for unethical purposes.
- candiodari 9y agoWhy are we assuming this is something not already in law ? It's pretty well defined, and it's criminal. So in short: if you trigger this system in reaction to a police visit you are guilty of obstruction of justice and can face up to 10 years in jail (in the US, my state). There is nothing the company can do to shield you from this. Anyone who has ordered you to do this would be accessory to obstruction of justice, punishable by up to 10 years of jail (not 100% sure). Neither of those people can defend themselves by saying that it was in the company's interest, or that they were ordered to do so. This is criminal law, and your claim would be akin to saying that your boss asked you to murder someone. If you do it, it's your ass (of course ordering a murder is a crime too, but it doesn't absolve the murderer). This goes to quite extreme lengths and even applies in cases of coercion (so if you murder someone because your boss kidnapped your daughter, you're still a murderer and can still be convicted as such). The same would apply here. One hopes Uber is not just throwing employees under the bus (because the IRS, I guarantee you, would get an obstruction of justice persecution started if Ripley happened to them. They have sent people to jail for far less)
- raldi 9y agoJust tell the programmer it's only for use in the company's China offices. Many companies openly discuss their countermeasures to protect their customer and internal data from lawful requests from the Chinese government. I'm not saying it's right or wrong, just that it's not a secret. And then once the programmer writes it, it's a piece of cake to make it do the same thing in Canada.
- Bartweiss 9y ago> Many companies openly discuss their countermeasures to protect their customer and internal data from lawful requests from the Chinese government. This seems like a serious counterpoint to "they were using it against lawful warrants therefore it's bad". Arguing that line and simultaneously excusing defensive measures against China, Turkey, or other governments isn't easy. The obvious resolution is "ethics aren't equivalent to law", and using this tool to dodge ethical requests is still bad. But that's a far more discretionary standard than a lot of the positions I'm seeing here.
- mirimir 9y agoBut what are "lawful warrants"? The Chinese government must indeed consider its actions to be lawful. So who sets the standard? Maybe Uber just wants to ensure that discovery proceeds after careful negotiation.
- wowamit 9y ago> a system to keep internal records hidden from intruders entering any of its hundreds of foreign offices That’s how the engineers must have been convinced on owning up the requirement.
- dsfyu404ed 9y ago>I think the biggest issue here is that Uber actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law. People who grew up in a situation where the law and the institutions that create and enforce it did them little good and plenty of bad (i.e. urban poor) often have little respect for it (though they may follow it as that's usually the least worst option when you're moving up the economic ladder). I don't see a problem with software that shuffles data and access around to create cross-jurisdiction paperwork headaches for the police. Forcing them to cross their t's and dot their i's before going in makes it much harder for people with political ambitions to go fishing for stuff to put on their resume. We all know that law enforcement practices saying no via similar "oh you have to go get the info from these people" spaghetti fairly often with FOIA reqs.
- gist 9y ago> ok to write a program whose sole purpose is to try and break the law Is it 'breaking the law' to turn off computers when you see the police knocking at your door (or in the parking log) but don't know why? Meaning they haven't presented a warrant or even exchanged words with you yet? Even in the particular event cited: "about 10 investigators for the Quebec tax authority burst into Uber Technologies Inc.’s office in Montreal" The act of bursting in but not (yet) saying anything? I would argue that no laws have been broken. Edit: A similar situation might be if you see flashing lights behind you when you are driving. Doesn't mean the police are there to stop you could be someone else or could be a mistake you haven't been officially notified of an infraction. Breaking into an office is not the same as presenting a warrant and then prevent access to data detailed in a warrant.
- BearGoesChirp 9y agoWhen a lawyer tells someone to not talk to the cops, are they doing anything wrong? Because the lawyer is basically asking 'what can I do to stop a lawful interrogation'. Does this change if the person is suspected of having pot or of killing children?
- greenyoda 9y agoIn the U.S., people have the right to remain silent during interrogations, so there's no problem with a lawyer advising a client to exercise that legal right. A lawyer can get in trouble (e.g., get disbarred) if they advise a client to break the law, e.g., by committing perjury or destroying evidence. > Does this change if the person is suspected of having pot or of killing children? The U.S. legal system has a presumption of innocence, so merely being suspected of committing a crime shouldn't affect the legal rights you're entitled to. (Many innocent people become suspects in police investigations.)
- deleted 9y ago[deleted]