8 ms·

Uber remotely locked down offices during police raids, shutting off computers

196 points by Geekette 9y ago

justinjlynn 9y ago
That's pretty interesting. It must be extremely risky for local employees to alert the main offices to lock down. I'd imagine obstruction of justice isn't a crime your average employee would risk.
- umanwizard 9y ago
  Why would this count as obstruction of justice?
  - ForHackernews 9y ago
    Deliberately hiding or destroying evidence to prevent it being found by police executing a proper search warrant is certainly obstruction of justice. https://www.law.cornell.edu/uscode/text/18/1519 https://www.law.cornell.edu/uscode/text/18/1519
    - justinjlynn 9y ago
      at the very least conspiracy to obstruct
      - Consultant32452 9y ago
        If the police have a warrant for the data on that machine, then remotely locking it down will not matter. All this protects Uber from is fishing expeditions where the police hope to come across an "unlocked door" so they can sift through everything hoping to find something. I get that we don't like Uber, but I support this type of action and think it should be standard operating procedure for every organization.,
        justinjlynn 9y ago
        This has nothing to do with liking or disliking uber. If the police are executing illegal searches then Uber has every right to sue and recover damages. They, unlike your average natural person, have the coffers to pay for it such that they acquire the "don't fuck with us illegally or we'll financially ruin your department" reputation. What I am worried about is the employee that gets directed to lock things down and then, as a result, is possibly personally targeted by police and prosecutor both for it.
    - Consultant32452 9y ago
      If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question.
      - Joky 9y ago
        Pushing this way of thinking about it, you could also say that a raid from the police is useless in general since a judge can simply send a request compelling the company to turn over the evidence in the first place.
        Consultant32452 9y ago
        Yes, a raid, in this case, is almost certainly an abuse of force and an attempt to create social/emotional problems for Uber.
        jimktrains2 9y ago
        And shouldn't that be the case? Shouldn't a raid be a last resort when the evidence being sought is at high risk of disappearing?
        Consultant32452 9y ago
        There is no suggestion at this point that data is disappearing. HN is so weird sometimes. When Google, or Facebook, or whoever grants the authorities free access to our private data without a warrant everyone freaks out. Uber protects our private data and suddenly it's evil. I get that we don't like Uber, but principles still matter and I'm glad they are protecting their own data as well as any customer data from a fishing expedition by the authorities. Now if Uber destroys or refuses to provide data covered under a properly scoped warrant, then I will gladly pick up the pitch fork with you.
        ethbro 9y ago
        A judge "can simply simply a request compelling the company to turn over evidence" in what jurisdiction? My understanding of the majority of warrants are that they have a nebulous grasp on transnational corporations. For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me? The French government isn't going to raise a diplomatic ruckus over a taxi company operating illegally in Paris. And I'd strongly suspect a judge wouldn't be inclined to allow me to forceably repatriate the data (which data?) without further evidence (exactly why I was serving the warrant!). So essentially, I don't see it as being technologically hard to construct a system where I am enabled to operate illegally in a country, as a matter of corporately-sanctioned policy, while skirting around local technical ability and federal legal will to call me to account.
    - Bud 9y ago
      >If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question. Wrong. Compelling them to do so does not mean that compulsion will be successful. Encryption exists.
      - Consultant32452 9y ago
        In the US at least you can be held in contempt and jailed indefinitely for not providing the decryption keys. Presumably other countries have mechanisms to deal with this beyond, "Oh gee, you password protected it, guess you get to go free forever."
        Zak 9y ago
        If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.
        Consultant32452 9y ago
        Congratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.
        Zak 9y ago
        And now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.
        Consultant32452 9y ago
        When you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.
    - dhoulb 9y ago
      I’d imagine the employees aren’t told why they’re paging the number, just that they should. The page might also trigger other processes such as alerting council, that they have the right to do. So possibly not as risky?
      - Bud 9y ago
        That excuse, thin as it is, could perhaps have sufficed for the first occurrence of such an act. But now it's been publicized. And it's a bit hard to pretend that, during a police raid, you're secretly and cryptically notifying the higher-ups, for some mysterious reason that you are completely ignorant of. It's just not credible that an intelligent tech worker who works for Uber and knows how to read English would not figure this out.
        qbrass 9y ago
        But it's not in English and French.
    - paulcole 9y ago
      > Deliberately hiding or destroying evidence Is this what the on-site employees were doing though? According to the article they were: > they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco Depending on whether they knew what the "specially trained staff" was "specially trained" to do, this seems logical and harmless? If the police came to my office I would probably text the company owner to find out WTF is going on.
      - Bud 9y ago
        No. Not logical and harmless. Yes, you might very well text the execs to find out what is going on, in plain English, like, "what the fuck is going on"? What you would not do is to send a cryptic, pre-arranged signal, which is what happened here.
        paulcole 9y ago
        > What you would not do is to send a cryptic, pre-arranged signal Where are you getting this from the article? How do you know it is "cryptic"? Of course it is pre-arranged. Uber is known to run into problems with the government (which includes law enforcement). I'm not surprised there's a protocol for what a manager should do in this situation. If I was hired to work there my first question would be WTF do I do if the police show up? I hate Uber as much as the next fickle HN commenter, but the idea of sending a text/paging a number doesn't feel that odd.
        dane-pgp 9y ago
        Moreover, we should remember that Uber operate in countries whose police likely have a worse reputation than Canada's, so if the policy of "Page this number if the police (or people claiming to be the police) turn up" is applied uniformly across jurisdictions, that may be perfectly reasonable and a lot safer than Uber trying to make politicised judgements of which offices should be left to deal with the legal and security situation by themselves.
- WalterSear 9y ago
  Alerting the central offices isn't a crime, and whoever is in the central offices can vanish behind a wall of bureaucratic malicious compliance.
  - Bud 9y ago
    It most certainly is a crime if it's done with foreknowledge of what the central office will then do, which is clear-cut obstruction of justice. And from all reports, employees were specifically trained to do this, and they knew why. Open and shut case.
    - FanaHOVA 9y ago
      Are you a lawyer?
    - cheez 9y ago
      The only open and shut cases are when the accused is a minority with a public defender.
      - detuur 9y ago
        Oh sorry did our conversation about tech companies interrupt awareness about institutional racism?
  - mhandley 9y ago
    Not to mention that the central office is in the US, and this seems to be used to lock/wipe computers in other countries, so much harder to prosecute them. However, if the person alerting the central office can be shown to have known the expected effect of their alert, then likely they'd still be guilty of obstruction of justice.
  - mannykannot 9y ago
    There are all sorts of acts that are not obstruction of justice, except when they obstruct justice.
- oconnor663 9y ago
  Two thoughts in the other direction: The internal alert might not have been "law enforcement has arrived with a warrant for our computers." It might have been more like "a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later." Employees might have a legal obligation to protect some of the data that's accessible from their office computers. Maybe credit card and banking information, or health information for drivers?
  - viraptor 9y ago
    > a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later Yeah... Not buying it. Random armed men appear in the building and some employee is more worried about the company data, rather than calling police to alert/verify?
  - learc83 9y ago
    >It might have been more like "a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later." The first thing the armed men will do is show identification and a warrant. This isn't a no-knock raid by a swat team in the middle of the night. Judges tend not to take those kind of coy answers very well.
    - dwild 9y ago
      > The first thing the armed men will do is show identification and a warrant. Are you an expert in identification and warrant? I never saw one, you could print a fake one and I couldn't tell if it's right. Same for any identification. Once we talked about doing some relatively public MILSIM with friends. It didn't take 5 minutes for us to realize that it would end badly because of that. If your goal is to access Uber data or any big corporation for that matter, you can see how easy it would be to profit from that. Thus, lock everything down and let legal experts actually take care of that seems like a pretty good solution to avoid this kind of situation. They are there to seize data, they can do it as much as they want. They can then force Uber to unencrypt the computers.
- namlem 9y ago
  How would they prove who did it? It could be done with an encrypted message.
jxramos 9y ago
"""The name is an allusion to "Aliens," in which Sigourney Weaver's Ripley character says "Nuke the entire site from orbit."""" Oh gosh, what a meeting that must have been with the devs who came up with this codename. This should go down in Tech History.
- saluki 9y ago
  Actually this is pretty common, I use names from my favorite movies in code all the time. Star Wars, Harry Potter, etc. Especially when it fits the project or functionality.
  - bbarn 9y ago
    My dog's name is Bishop, same source.
    - imrehg 9y ago
      My last laptop was Nostromo, same place of inspiration.
  - ericcumbee 9y ago
    I use Race Car designations GT40, R8, R18, 919,488
  - saluki 9y ago
    One of my favorites was a friends project who named a feature Kamino that created CLONES of VMs.
imglorp 9y ago
See also https://news.ycombinator.com/item?id=16124165 https://news.ycombinator.com/item?id=16124165
ProAm 9y ago
Another article from Bloomberg that speaks on this [1] [1] https://www.bloomberg.com/news/articles/2018-01-11/uber-s-secret-tool-for-keeping-the-cops-in-the-dark https://www.bloomberg.com/news/articles/2018-01-11/uber-s-se...
Dangeranger 9y ago
If the authorities had a warrant, why wouldn't they just take all the locked computers with them back for further investigation? Then they would have been able to have a judge order Uber to unlock the computers for forensics. Uber's actions are similar to shredding evidence of tax evasion, which in the case of Arthur Anderson during the Enron scandal, resulted in federal obstruction of justice charges, and a strengthening of federal powers for charging of similar actions.[0] Note: I am not a lawyer, nor a resident of Canada, so I am not sure if my proposal above is legal within that country. But it would seems to me that actions similar to the above have taken place in the USA in the case of tax evasion with probable cause. [0] https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruction-after-enron.html https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruc...
- walrus01 9y ago
  > If the authorities had a warrant, why wouldn't they just take all the locked computers with them back for further investigation? Then they would have been able to have a judge order Uber to unlock the computers for forensics. If I had to guess: Very little data is stored on site. If all of your local office computing platform is basically a thin client, confiscating the local equipment with a warrant doesn't do much. You can take it away to a forensics lab and image its disks, but you're not going to get any usable data off it without a network connection into the corporate WAN, crypto keys, sending subpoenas to specific people for their login credentials, etc. I know nothing about Uber's internal software architecture and network topology. But I would be very surprised if most of their day-to-day operational systems like ticketing, customer service, recruiting, finances, were not operated through TLS1.2 connections in a web browser to a set of intranet servers, located thousands of km away from where the branch offices are located.
  - crag 9y ago
    Wait. wait.. if everything is "remote" (on Uber's cloud) then why all this drama of shutting down/locking machines? Just log everyone out and deny login attempts. My other question is, if all the data is in the cloud in SFO, wouldn't the data technically reside in the US? Looks to me like the Canadian police were hoping to get lucky. That some user wouldn't have enough time to log out.
dhoulb 9y ago
Seems like a reasonable way to prevent overly-broad fishing by law enforcement. If they have a warrant they can request information through legal channels. The raids are just theatre.
- pyromine 9y ago
  Uber has already been seen to act adversarial to law enforcement, raids are utilized to try and limit Uber's ability to conceal information. I have no doubt in my mind that Uber would willingly fail to comply to requests for information.
  - king07828 9y ago
    The mirror image of your argument is just as applicable: Law enforcement has already been seen to act adversarial to private interests, remotely logging out of computers is utilized to try and limit law enforcement's ability to obtain information beyond the scope of a warrant. There is little doubt that law enforcement would willingly take information beyond the scope of the warrant and later find a way to use it against them.
    - Bendingo 9y ago
      > Law enforcement has already been seen to act adversarial to private interests If enforcing law is seen as adversarial to private interests, then those private interests are by definition, against the law.
      - dta5003 9y ago
        Really? By that logic the private interest of a lot of non-white drivers of staying alive must be against the law. The time for hero worship and blind trust is over.
- prklmn 9y ago
  Try reading the article before you comment. >> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.
ejcx 9y ago
Or with a different spin. Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously! If the authorities need the data on the computers the will surely present a properly scoped warrant!
- hateduser2 9y ago
  Yours doesn’t discuss the timing or police raids, so it’s not as simple as saying the OP is a spin.
  - Consultant32452 9y ago
    The police are not special in this regard. The police are not your friend. There's no need to invite the police in to go on a fishing expedition for something they don't have enough probable cause of to get a sufficient warrant.
    - ealexhudson 9y ago
      The article specifically says they had a warrant. This software actively obstructed that warrant.
      - Consultant32452 9y ago
        Then the information that is properly scoped in the warrant will be revealed to the authorities. What won't happens is the police will not be given free rein to go on a fishing expedition to random data not specifically granted in the warrant. That's all we're talking about here, the authorities didn't get to go on a fishing expedition.
        DerekL 9y ago
        *free rein
        9y ago
AcerbicZero 9y ago
I'm by no means a fan of Uber, (and I'm not in Canada) but keeping information from plain sight != hiding evidence. Come back with a better warrant.
jbfoo 9y ago
I really hope some law enforcement agency will someday classify uber as a: "organized crime group". I don't mean the drivers --- but management is doing absolutely everything to obsruct law enforncement (for example --- making it virtually impossible for transport inspection to call Uber vehicles).
- pglaskowsky 9y ago
  Uber should have been prosecuted under RICO from the very first day they began coordinating unlicensed, illegal taxi cab operations. Why they weren't remains an open and interesting question.
sova 9y ago
Impressive (and stupid) I'm really astonished to laughter by Uber more and more. They're trying to be a darknet company operating in clearnet... Make up your mind you shady fellows
Spivak 9y ago
I honestly don't see a problem with this. If it weren't for the fact that it's a company this this site hates it would be hailed as a marvel innovation against states that are increasingly cavalier about disrespecting people's digital rights and privacy. If the police have all the proper warrants there's no reason they can't seize the locked servers and workstations and compel them to unlock them after the fact. To me this just falls under the category of unauthorized access. If my threat model included people physically present using force to access my sysadmins' computers I would be implementing the same security with a company-wide lock-down triggered by a panic button on every machine.
- onli 9y ago
  You also see see similar protection mechanism with some of the more security minded individuals. It's a bit like shutting down the PC (to enable the encryption) if you notice a police raid on time, at your home. Or something like USBKill, an USB kill switch (https://www.theregister.co.uk/2015/05/05/usbkills_laptops_to_beat_the_heat/ https://www.theregister.co.uk/2015/05/05/usbkills_laptops_to...).
- prklmn 9y ago
  Did you read the article? Please explain why you think it’s unauthorized access. >> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.
  - 33W 9y ago
    I think the parent's point is that if there is a warrant to collect information, the machines can be seized and the company compelled to comply. This move prevents overreach in the moment.
    - FireBeyond 9y ago
      This doesn't just prevent overreach, it prevents any collection. Also known as "obstruction" (and possibly "destruction").
mod 9y ago
In my opinion it's not your job to willingly provide self-incriminating evidence. I have no idea if that legally applies to corporations (particularly in Canada) but this seems like a precaution I would expect every business to take. You would hope they wouldn't need to take it, but if I were CEO of a company I would order the computers shut down even if everything were above-the-book. Of course, maybe that's why I'm not CEO of a company. Who knows.
- DanBC 9y ago
  (My post is about England. I'm not sure abot other countries.) That's true if they've just come knocking. But at the point they have warrants you're risking prison. Court orders are orders, and they are to be obeyed in full and on time.
  - hackits 9y ago
    You've never been through the family court have you?
    - DanBC 9y ago
      Here's a reasonably recent document from the President of the Family Court division in England. https://www.judiciary.gov.uk/wp-content/uploads/JCO/Documents/Reports/view-7-changing-cultures.pdf https://www.judiciary.gov.uk/wp-content/uploads/JCO/Document... > What I fear is an even greater cause for concern – and it is for me a real concern – is something symptomatic of a deeply rooted culture in the family courts which, however long established, will no longer be tolerated. I refer to the slapdash, lackadaisical and on occasions almost contumelious attitude which still far too frequently characterises the response to orders made by family courts. There is simply no excuse for this. Orders, including interlocutory orders, must be obeyed and complied with to the letter and on time. Too often they are not. They are not preferences, requests or mere indications; they are orders. This principle applies as much to orders by way of interlocutory case management directions as to any other species of order. The court is entitled to expect – and from now on family courts will demand – strict compliance with all such orders. Both parties and non-parties to whom orders are addressed must take heed. Noncompliance with an order by anyone is bad enough. It is a particularly serious matter if the defaulter is a public body. Non-compliance with orders should be expected to have and will usually have a consequence: see Re W (A Child), Re H (Children) [2013] EWCA Civ 1177. But you're talking about a parent ignoring court orders, I guess, in which case this one is more relevant: a mother made false allegations of abuse against the father, and continued to do so; and removed the child; and continued to do so; and she did those things after being ordered not to, and she got a (suspended) prison sentence as a result: http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html > The judge had indicated that she was prepared to authorise disclosure of her Judgment to the Judge at the Kingston Crown Court, and that if the 1st Respondent objected she would be required to make her objections known. On 25th January 2016, the judge ordered her judgment may be released to the sentencing judge. The 1st Respondent received a four-month sentence, suspended for six months on 27th January 2017. EDIT: And here's a direct link to the cases he mentions at the end of the para I link above: http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html
pglaskowsky 9y ago
Misleading headline here on HN; the source article correctly used past tense, since this system is no longer used. The comments comparing this to "shredding" and "destroying" evidence are also misleading; Ripley did not destroy information.
- dang 9y ago
  Ok, we've changed the title to use the article's subtitle. The submitted title was "Uber remotely locks computers during police raids to block information access". Since the site guidelines ask submitters not to use article titles when they're misleading or linkbait, I assume the submitter was trying to helpfully follow the rules. It's better to use representative language from the article itself, though, to avoid blunders—and in this case the subtitle can easily be shortened.
krick 9y ago
So, what else this horrible Uber does? Maybe it locks office doors at night so that random people cannot enter and take whatever they want?
- azernik 9y ago
  More like, putting all documents in their lockboxes (which exist for a good reason) when the police show up during normal business hours with a warrant.
  - larkeith 9y ago
    Details on the specific warrants are scarce in the listed article, but if the police had a warrant for specific data, it seems strange that they would be raiding satellite locations. Moreover, with a properly scoped warrant, my understanding is that authorities may seize locked devices and compel Uber to unlock them. While I am loathe to defend Uber, these measures appear designed explicitly to prevent police fishing expeditions, which I am fully in favour of, and to serve little further purpose.
- detuur 9y ago
  The equivalent here would be locking the door at noon while there's people in the building. Why would you need to "nuke the site from orbit" during business hours? What kind of competitor are you protecting against? One that breaks in in broad daylight with guns and steals servers? It's a system designed to thwart the collection of evidence. And that's very very illegal.
fbru02 9y ago
Why are governments around the globe so keen in taking down Uber?
- zipwitch 9y ago
  Because they're not keen on people whose business model is: "having laws is a cost we don't need to pay".
- mr_toad 9y ago
  In many cities and countries the taxi industries have successfully ‘captured’ the regulatory authority, and now the regulations mainly exist to restrict competition.
theonemind 9y ago
This article doesn't specify exactly the legal problem here. Maybe the article just lacks key details, like how Uber violated the warrant or the legal repercussions they could face. The article vaguely makes it sound like Uber acted within their rights and the police just don't like that they didn't find a bunch of unlocked computers to rummage through, by virtue of what it omits. I don't have a problem with that. If their warrant amounts to a fishing expedition, it actually sounds like harassment of Uber. A warrant should specify something you have some likelihood of finding. If the police walked away empty handed and Uber doesn't face charges for destroying evidence, it seems like they had a bad warrant to begin with.
rdl 9y ago
This is exactly what I'd want a company holding my personal data to do. There are lots of problems with Uber, but this is one of the good things.
Balgair 9y ago
Judges that sign off on search warrants will not be happy with this and will very much want to know what Uber is so concerned about hiding from proper law enforcement. In essence, judges that sign warrants will smell something very fishy here and they will not be happy. Uber is, of course, free to piss-off judges. However, they are not free from the consequences of pissed-off judges. Uber has also shown that they are just fine with handing employees over to the mercy of pissed-off judges, something at an individual without a stellar legal team is unlikely to view as a walk on the beach.
534b44a 9y ago
I really hope justice is served one way or another. This action by Uber feels really shady to me (much worse than Google's tax evasion loopholes). What would be the consequences if something like this happened in a European country such as Germany?
mr_toad 9y ago
Article is a bit vague. It doesn’t mention the police (it seems they were tax inspectors), and although it does say they had a warrant it doesn’t seem likely that police with a warrant wouldn’t have just seized the machines.
danschumann 9y ago
So far, I haven't been super against most of uber's law flouting: taxi service stuff, tax stuff. However, as they grow, as they get autonomous cars, as they get autonomous drones, once they get to the point where there could be more serious consequences, I'd like to see more accountability.
booleandilemma 9y ago
From now on the police should cut power and network access to Uber’s offices just before they conduct their raids.
Paul-ish 9y ago
Couldn't law enforcement cut internet access before the raid to prevent this?
- qbrass 9y ago
  Then you just lock your machines down when there's no internet access.
trisimix 9y ago
Hope uber gets banned and lyft takes their spot. My recent trip to canada was pretty shite using uber.

196 points by Geekette 9y ago

That's pretty interesting. It must be extremely risky for local employees to alert the main offices to lock down. I'd imagine obstruction of justice isn't a crime your average employee would risk.

umanwizard 9y ago
Why would this count as obstruction of justice?
- ForHackernews 9y ago
  Deliberately hiding or destroying evidence to prevent it being found by police executing a proper search warrant is certainly obstruction of justice. https://www.law.cornell.edu/uscode/text/18/1519 https://www.law.cornell.edu/uscode/text/18/1519
  - justinjlynn 9y ago
    at the very least conspiracy to obstruct
    - Consultant32452 9y ago
      If the police have a warrant for the data on that machine, then remotely locking it down will not matter. All this protects Uber from is fishing expeditions where the police hope to come across an "unlocked door" so they can sift through everything hoping to find something. I get that we don't like Uber, but I support this type of action and think it should be standard operating procedure for every organization.,
      - justinjlynn 9y ago
        This has nothing to do with liking or disliking uber. If the police are executing illegal searches then Uber has every right to sue and recover damages. They, unlike your average natural person, have the coffers to pay for it such that they acquire the "don't fuck with us illegally or we'll financially ruin your department" reputation. What I am worried about is the employee that gets directed to lock things down and then, as a result, is possibly personally targeted by police and prosecutor both for it.
  - Consultant32452 9y ago
    If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question.
    - Joky 9y ago
      Pushing this way of thinking about it, you could also say that a raid from the police is useless in general since a judge can simply send a request compelling the company to turn over the evidence in the first place.
      - Consultant32452 9y ago
        Yes, a raid, in this case, is almost certainly an abuse of force and an attempt to create social/emotional problems for Uber.
      - jimktrains2 9y ago
        And shouldn't that be the case? Shouldn't a raid be a last resort when the evidence being sought is at high risk of disappearing?
        Consultant32452 9y ago
        There is no suggestion at this point that data is disappearing. HN is so weird sometimes. When Google, or Facebook, or whoever grants the authorities free access to our private data without a warrant everyone freaks out. Uber protects our private data and suddenly it's evil. I get that we don't like Uber, but principles still matter and I'm glad they are protecting their own data as well as any customer data from a fishing expedition by the authorities. Now if Uber destroys or refuses to provide data covered under a properly scoped warrant, then I will gladly pick up the pitch fork with you.
      - ethbro 9y ago
        A judge "can simply simply a request compelling the company to turn over evidence" in what jurisdiction? My understanding of the majority of warrants are that they have a nebulous grasp on transnational corporations. For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me? The French government isn't going to raise a diplomatic ruckus over a taxi company operating illegally in Paris. And I'd strongly suspect a judge wouldn't be inclined to allow me to forceably repatriate the data (which data?) without further evidence (exactly why I was serving the warrant!). So essentially, I don't see it as being technologically hard to construct a system where I am enabled to operate illegally in a country, as a matter of corporately-sanctioned policy, while skirting around local technical ability and federal legal will to call me to account.
  - Bud 9y ago
    >If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question. Wrong. Compelling them to do so does not mean that compulsion will be successful. Encryption exists.
    - Consultant32452 9y ago
      In the US at least you can be held in contempt and jailed indefinitely for not providing the decryption keys. Presumably other countries have mechanisms to deal with this beyond, "Oh gee, you password protected it, guess you get to go free forever."
      - Zak 9y ago
        If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.
        Consultant32452 9y ago
        Congratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.
        Zak 9y ago
        And now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.
        Consultant32452 9y ago
        When you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.
  - dhoulb 9y ago
    I’d imagine the employees aren’t told why they’re paging the number, just that they should. The page might also trigger other processes such as alerting council, that they have the right to do. So possibly not as risky?
    - Bud 9y ago
      That excuse, thin as it is, could perhaps have sufficed for the first occurrence of such an act. But now it's been publicized. And it's a bit hard to pretend that, during a police raid, you're secretly and cryptically notifying the higher-ups, for some mysterious reason that you are completely ignorant of. It's just not credible that an intelligent tech worker who works for Uber and knows how to read English would not figure this out.
      - qbrass 9y ago
        But it's not in English and French.
  - paulcole 9y ago
    > Deliberately hiding or destroying evidence Is this what the on-site employees were doing though? According to the article they were: > they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco Depending on whether they knew what the "specially trained staff" was "specially trained" to do, this seems logical and harmless? If the police came to my office I would probably text the company owner to find out WTF is going on.
    - Bud 9y ago
      No. Not logical and harmless. Yes, you might very well text the execs to find out what is going on, in plain English, like, "what the fuck is going on"? What you would not do is to send a cryptic, pre-arranged signal, which is what happened here.
      - paulcole 9y ago
        > What you would not do is to send a cryptic, pre-arranged signal Where are you getting this from the article? How do you know it is "cryptic"? Of course it is pre-arranged. Uber is known to run into problems with the government (which includes law enforcement). I'm not surprised there's a protocol for what a manager should do in this situation. If I was hired to work there my first question would be WTF do I do if the police show up? I hate Uber as much as the next fickle HN commenter, but the idea of sending a text/paging a number doesn't feel that odd.
        dane-pgp 9y ago
        Moreover, we should remember that Uber operate in countries whose police likely have a worse reputation than Canada's, so if the policy of "Page this number if the police (or people claiming to be the police) turn up" is applied uniformly across jurisdictions, that may be perfectly reasonable and a lot safer than Uber trying to make politicised judgements of which offices should be left to deal with the legal and security situation by themselves.
WalterSear 9y ago
Alerting the central offices isn't a crime, and whoever is in the central offices can vanish behind a wall of bureaucratic malicious compliance.
- Bud 9y ago
  It most certainly is a crime if it's done with foreknowledge of what the central office will then do, which is clear-cut obstruction of justice. And from all reports, employees were specifically trained to do this, and they knew why. Open and shut case.
  - FanaHOVA 9y ago
    Are you a lawyer?
  - cheez 9y ago
    The only open and shut cases are when the accused is a minority with a public defender.
    - detuur 9y ago
      Oh sorry did our conversation about tech companies interrupt awareness about institutional racism?
- mhandley 9y ago
  Not to mention that the central office is in the US, and this seems to be used to lock/wipe computers in other countries, so much harder to prosecute them. However, if the person alerting the central office can be shown to have known the expected effect of their alert, then likely they'd still be guilty of obstruction of justice.
- mannykannot 9y ago
  There are all sorts of acts that are not obstruction of justice, except when they obstruct justice.
oconnor663 9y ago
Two thoughts in the other direction: The internal alert might not have been "law enforcement has arrived with a warrant for our computers." It might have been more like "a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later." Employees might have a legal obligation to protect some of the data that's accessible from their office computers. Maybe credit card and banking information, or health information for drivers?
- viraptor 9y ago
  > a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later Yeah... Not buying it. Random armed men appear in the building and some employee is more worried about the company data, rather than calling police to alert/verify?
- learc83 9y ago
  >It might have been more like "a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later." The first thing the armed men will do is show identification and a warrant. This isn't a no-knock raid by a swat team in the middle of the night. Judges tend not to take those kind of coy answers very well.
  - dwild 9y ago
    > The first thing the armed men will do is show identification and a warrant. Are you an expert in identification and warrant? I never saw one, you could print a fake one and I couldn't tell if it's right. Same for any identification. Once we talked about doing some relatively public MILSIM with friends. It didn't take 5 minutes for us to realize that it would end badly because of that. If your goal is to access Uber data or any big corporation for that matter, you can see how easy it would be to profit from that. Thus, lock everything down and let legal experts actually take care of that seems like a pretty good solution to avoid this kind of situation. They are there to seize data, they can do it as much as they want. They can then force Uber to unencrypt the computers.
namlem 9y ago
How would they prove who did it? It could be done with an encrypted message.

jxramos 9y ago

"""The name is an allusion to "Aliens," in which Sigourney Weaver's Ripley character says "Nuke the entire site from orbit."""" Oh gosh, what a meeting that must have been with the devs who came up with this codename. This should go down in Tech History.

saluki 9y ago
Actually this is pretty common, I use names from my favorite movies in code all the time. Star Wars, Harry Potter, etc. Especially when it fits the project or functionality.
- bbarn 9y ago
  My dog's name is Bishop, same source.
  - imrehg 9y ago
    My last laptop was Nostromo, same place of inspiration.
- ericcumbee 9y ago
  I use Race Car designations GT40, R8, R18, 919,488
- saluki 9y ago
  One of my favorites was a friends project who named a feature Kamino that created CLONES of VMs.

imglorp 9y ago

See also https://news.ycombinator.com/item?id=16124165 https://news.ycombinator.com/item?id=16124165

ProAm 9y ago

Another article from Bloomberg that speaks on this [1] [1] https://www.bloomberg.com/news/articles/2018-01-11/uber-s-secret-tool-for-keeping-the-cops-in-the-dark https://www.bloomberg.com/news/articles/2018-01-11/uber-s-se...

Dangeranger 9y ago

If the authorities had a warrant, why wouldn't they just take all the locked computers with them back for further investigation? Then they would have been able to have a judge order Uber to unlock the computers for forensics. Uber's actions are similar to shredding evidence of tax evasion, which in the case of Arthur Anderson during the Enron scandal, resulted in federal obstruction of justice charges, and a strengthening of federal powers for charging of similar actions.[0] Note: I am not a lawyer, nor a resident of Canada, so I am not sure if my proposal above is legal within that country. But it would seems to me that actions similar to the above have taken place in the USA in the case of tax evasion with probable cause. [0] https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruction-after-enron.html https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruc...

walrus01 9y ago
> If the authorities had a warrant, why wouldn't they just take all the locked computers with them back for further investigation? Then they would have been able to have a judge order Uber to unlock the computers for forensics. If I had to guess: Very little data is stored on site. If all of your local office computing platform is basically a thin client, confiscating the local equipment with a warrant doesn't do much. You can take it away to a forensics lab and image its disks, but you're not going to get any usable data off it without a network connection into the corporate WAN, crypto keys, sending subpoenas to specific people for their login credentials, etc. I know nothing about Uber's internal software architecture and network topology. But I would be very surprised if most of their day-to-day operational systems like ticketing, customer service, recruiting, finances, were not operated through TLS1.2 connections in a web browser to a set of intranet servers, located thousands of km away from where the branch offices are located.
- crag 9y ago
  Wait. wait.. if everything is "remote" (on Uber's cloud) then why all this drama of shutting down/locking machines? Just log everyone out and deny login attempts. My other question is, if all the data is in the cloud in SFO, wouldn't the data technically reside in the US? Looks to me like the Canadian police were hoping to get lucky. That some user wouldn't have enough time to log out.

dhoulb 9y ago

Seems like a reasonable way to prevent overly-broad fishing by law enforcement. If they have a warrant they can request information through legal channels. The raids are just theatre.

pyromine 9y ago
Uber has already been seen to act adversarial to law enforcement, raids are utilized to try and limit Uber's ability to conceal information. I have no doubt in my mind that Uber would willingly fail to comply to requests for information.
- king07828 9y ago
  The mirror image of your argument is just as applicable: Law enforcement has already been seen to act adversarial to private interests, remotely logging out of computers is utilized to try and limit law enforcement's ability to obtain information beyond the scope of a warrant. There is little doubt that law enforcement would willingly take information beyond the scope of the warrant and later find a way to use it against them.
  - Bendingo 9y ago
    > Law enforcement has already been seen to act adversarial to private interests If enforcing law is seen as adversarial to private interests, then those private interests are by definition, against the law.
    - dta5003 9y ago
      Really? By that logic the private interest of a lot of non-white drivers of staying alive must be against the law. The time for hero worship and blind trust is over.
prklmn 9y ago
Try reading the article before you comment. >> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.

ejcx 9y ago

Or with a different spin. Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously! If the authorities need the data on the computers the will surely present a properly scoped warrant!

hateduser2 9y ago
Yours doesn’t discuss the timing or police raids, so it’s not as simple as saying the OP is a spin.
- Consultant32452 9y ago
  The police are not special in this regard. The police are not your friend. There's no need to invite the police in to go on a fishing expedition for something they don't have enough probable cause of to get a sufficient warrant.
  - ealexhudson 9y ago
    The article specifically says they had a warrant. This software actively obstructed that warrant.
    - Consultant32452 9y ago
      Then the information that is properly scoped in the warrant will be revealed to the authorities. What won't happens is the police will not be given free rein to go on a fishing expedition to random data not specifically granted in the warrant. That's all we're talking about here, the authorities didn't get to go on a fishing expedition.
      - DerekL 9y ago
        *free rein
        9y ago

AcerbicZero 9y ago

I'm by no means a fan of Uber, (and I'm not in Canada) but keeping information from plain sight != hiding evidence. Come back with a better warrant.

jbfoo 9y ago

I really hope some law enforcement agency will someday classify uber as a: "organized crime group". I don't mean the drivers --- but management is doing absolutely everything to obsruct law enforncement (for example --- making it virtually impossible for transport inspection to call Uber vehicles).

pglaskowsky 9y ago
Uber should have been prosecuted under RICO from the very first day they began coordinating unlicensed, illegal taxi cab operations. Why they weren't remains an open and interesting question.

sova 9y ago

Impressive (and stupid) I'm really astonished to laughter by Uber more and more. They're trying to be a darknet company operating in clearnet... Make up your mind you shady fellows

Spivak 9y ago

I honestly don't see a problem with this. If it weren't for the fact that it's a company this this site hates it would be hailed as a marvel innovation against states that are increasingly cavalier about disrespecting people's digital rights and privacy. If the police have all the proper warrants there's no reason they can't seize the locked servers and workstations and compel them to unlock them after the fact. To me this just falls under the category of unauthorized access. If my threat model included people physically present using force to access my sysadmins' computers I would be implementing the same security with a company-wide lock-down triggered by a panic button on every machine.

onli 9y ago
You also see see similar protection mechanism with some of the more security minded individuals. It's a bit like shutting down the PC (to enable the encryption) if you notice a police raid on time, at your home. Or something like USBKill, an USB kill switch (https://www.theregister.co.uk/2015/05/05/usbkills_laptops_to_beat_the_heat/ https://www.theregister.co.uk/2015/05/05/usbkills_laptops_to...).
prklmn 9y ago
Did you read the article? Please explain why you think it’s unauthorized access. >> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.
- 33W 9y ago
  I think the parent's point is that if there is a warrant to collect information, the machines can be seized and the company compelled to comply. This move prevents overreach in the moment.
  - FireBeyond 9y ago
    This doesn't just prevent overreach, it prevents any collection. Also known as "obstruction" (and possibly "destruction").

mod 9y ago

In my opinion it's not your job to willingly provide self-incriminating evidence. I have no idea if that legally applies to corporations (particularly in Canada) but this seems like a precaution I would expect every business to take. You would hope they wouldn't need to take it, but if I were CEO of a company I would order the computers shut down even if everything were above-the-book. Of course, maybe that's why I'm not CEO of a company. Who knows.

DanBC 9y ago
(My post is about England. I'm not sure abot other countries.) That's true if they've just come knocking. But at the point they have warrants you're risking prison. Court orders are orders, and they are to be obeyed in full and on time.
- hackits 9y ago
  You've never been through the family court have you?
  - DanBC 9y ago
    Here's a reasonably recent document from the President of the Family Court division in England. https://www.judiciary.gov.uk/wp-content/uploads/JCO/Documents/Reports/view-7-changing-cultures.pdf https://www.judiciary.gov.uk/wp-content/uploads/JCO/Document... > What I fear is an even greater cause for concern – and it is for me a real concern – is something symptomatic of a deeply rooted culture in the family courts which, however long established, will no longer be tolerated. I refer to the slapdash, lackadaisical and on occasions almost contumelious attitude which still far too frequently characterises the response to orders made by family courts. There is simply no excuse for this. Orders, including interlocutory orders, must be obeyed and complied with to the letter and on time. Too often they are not. They are not preferences, requests or mere indications; they are orders. This principle applies as much to orders by way of interlocutory case management directions as to any other species of order. The court is entitled to expect – and from now on family courts will demand – strict compliance with all such orders. Both parties and non-parties to whom orders are addressed must take heed. Noncompliance with an order by anyone is bad enough. It is a particularly serious matter if the defaulter is a public body. Non-compliance with orders should be expected to have and will usually have a consequence: see Re W (A Child), Re H (Children) [2013] EWCA Civ 1177. But you're talking about a parent ignoring court orders, I guess, in which case this one is more relevant: a mother made false allegations of abuse against the father, and continued to do so; and removed the child; and continued to do so; and she did those things after being ordered not to, and she got a (suspended) prison sentence as a result: http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html > The judge had indicated that she was prepared to authorise disclosure of her Judgment to the Judge at the Kingston Crown Court, and that if the 1st Respondent objected she would be required to make her objections known. On 25th January 2016, the judge ordered her judgment may be released to the sentencing judge. The 1st Respondent received a four-month sentence, suspended for six months on 27th January 2017. EDIT: And here's a direct link to the cases he mentions at the end of the para I link above: http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html

pglaskowsky 9y ago

Misleading headline here on HN; the source article correctly used past tense, since this system is no longer used. The comments comparing this to "shredding" and "destroying" evidence are also misleading; Ripley did not destroy information.

dang 9y ago
Ok, we've changed the title to use the article's subtitle. The submitted title was "Uber remotely locks computers during police raids to block information access". Since the site guidelines ask submitters not to use article titles when they're misleading or linkbait, I assume the submitter was trying to helpfully follow the rules. It's better to use representative language from the article itself, though, to avoid blunders—and in this case the subtitle can easily be shortened.

krick 9y ago

So, what else this horrible Uber does? Maybe it locks office doors at night so that random people cannot enter and take whatever they want?

azernik 9y ago
More like, putting all documents in their lockboxes (which exist for a good reason) when the police show up during normal business hours with a warrant.
- larkeith 9y ago
  Details on the specific warrants are scarce in the listed article, but if the police had a warrant for specific data, it seems strange that they would be raiding satellite locations. Moreover, with a properly scoped warrant, my understanding is that authorities may seize locked devices and compel Uber to unlock them. While I am loathe to defend Uber, these measures appear designed explicitly to prevent police fishing expeditions, which I am fully in favour of, and to serve little further purpose.
detuur 9y ago
The equivalent here would be locking the door at noon while there's people in the building. Why would you need to "nuke the site from orbit" during business hours? What kind of competitor are you protecting against? One that breaks in in broad daylight with guns and steals servers? It's a system designed to thwart the collection of evidence. And that's very very illegal.

fbru02 9y ago

Why are governments around the globe so keen in taking down Uber?

zipwitch 9y ago
Because they're not keen on people whose business model is: "having laws is a cost we don't need to pay".
mr_toad 9y ago
In many cities and countries the taxi industries have successfully ‘captured’ the regulatory authority, and now the regulations mainly exist to restrict competition.

theonemind 9y ago

This article doesn't specify exactly the legal problem here. Maybe the article just lacks key details, like how Uber violated the warrant or the legal repercussions they could face. The article vaguely makes it sound like Uber acted within their rights and the police just don't like that they didn't find a bunch of unlocked computers to rummage through, by virtue of what it omits. I don't have a problem with that. If their warrant amounts to a fishing expedition, it actually sounds like harassment of Uber. A warrant should specify something you have some likelihood of finding. If the police walked away empty handed and Uber doesn't face charges for destroying evidence, it seems like they had a bad warrant to begin with.

rdl 9y ago

This is exactly what I'd want a company holding my personal data to do. There are lots of problems with Uber, but this is one of the good things.

Balgair 9y ago

Judges that sign off on search warrants will not be happy with this and will very much want to know what Uber is so concerned about hiding from proper law enforcement. In essence, judges that sign warrants will smell something very fishy here and they will not be happy. Uber is, of course, free to piss-off judges. However, they are not free from the consequences of pissed-off judges. Uber has also shown that they are just fine with handing employees over to the mercy of pissed-off judges, something at an individual without a stellar legal team is unlikely to view as a walk on the beach.

534b44a 9y ago

I really hope justice is served one way or another. This action by Uber feels really shady to me (much worse than Google's tax evasion loopholes). What would be the consequences if something like this happened in a European country such as Germany?

mr_toad 9y ago

Article is a bit vague. It doesn’t mention the police (it seems they were tax inspectors), and although it does say they had a warrant it doesn’t seem likely that police with a warrant wouldn’t have just seized the machines.

danschumann 9y ago

So far, I haven't been super against most of uber's law flouting: taxi service stuff, tax stuff. However, as they grow, as they get autonomous cars, as they get autonomous drones, once they get to the point where there could be more serious consequences, I'd like to see more accountability.

booleandilemma 9y ago

From now on the police should cut power and network access to Uber’s offices just before they conduct their raids.

Paul-ish 9y ago

Couldn't law enforcement cut internet access before the raid to prevent this?

qbrass 9y ago
Then you just lock your machines down when there's no internet access.

trisimix 9y ago

Hope uber gets banned and lyft takes their spot. My recent trip to canada was pretty shite using uber.