5 ms·

Or with a different spin. Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriou

by ejcx 9y ago

Or with a different spin. Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously! If the authorities need the data on the computers the will surely present a properly scoped warrant!

hateduser2 9y ago
Yours doesn’t discuss the timing or police raids, so it’s not as simple as saying the OP is a spin.
- Consultant32452 9y ago
  The police are not special in this regard. The police are not your friend. There's no need to invite the police in to go on a fishing expedition for something they don't have enough probable cause of to get a sufficient warrant.
  - ealexhudson 9y ago
    The article specifically says they had a warrant. This software actively obstructed that warrant.
    - Consultant32452 9y ago
      Then the information that is properly scoped in the warrant will be revealed to the authorities. What won't happens is the police will not be given free rein to go on a fishing expedition to random data not specifically granted in the warrant. That's all we're talking about here, the authorities didn't get to go on a fishing expedition.
      - DerekL 9y ago
        *free rein
        Consultant32452 9y ago
        Fixed, thanks
      - FireBeyond 9y ago
        What? No, that's not what happened. It's not a piece of software that says "here, based on the scope of your warrant, here's the information you require". It says, in about as many words, "FOAD until our counsel green lights unlocking, potentially before or after some housecleaning".
        Consultant32452 9y ago
        >It's not a piece of software that says "here, based on the scope of your warrant, here's the information you require". Correct, Uber's lawyers will be able to review and perhaps fight the warrant in courts. Uber's sysadmins will have time to figure out how to reveal the required data in a clean way that does not compromise the rest of Uber's data which includes but is not limited to data about where private citizens travel from time to time. >"FOAD until our counsel green lights unlocking Perfect, yes it does say this. We should all say this. Would you like Google or Facebook or whatever other service you use to reveal your private information if the government does not provide a proper warrant? >potentially before or after some housecleaning". Okay, well in this imaginary scenario Uber would be guilty of tampering with evidence and I'm confident Canada has relevant laws.
        FireBeyond 9y ago
        > if the government does not provide a proper warrant? How or in what way was this warrant deemed to be improper? There was zero consideration of that, instead it was "nuke from orbit" at first sight.
        Consultant32452 9y ago
        By the judicial system, obviously. Uber's lawyers will review the warrant and if they agree that it's proper they will instruct their sysadmins to provide ONLY THE DATA COVERED BY THE WARRANT to authorities. If they don't feel the warrant is proper, they will fight it in court. The vast majority of times warrants are upheld, so really all that happens is the authorities are only granted access to the data they had probable cause to request. What you're suggesting is that the authorities should have access to anything and everything that a person who happened to be logged in at the time of the raid had access too. You are suggesting that the authorities should always be granted arbitrary access to a random amount of data, which is almost certainly not relevant to their case, any time they get a warrant for any data at all. Further, you are acting as if that article is the end of the story, but it's not. There will be legal review by relevant professionals and Uber will provide whatever it is legally required to provide.
    - notatoad 9y ago
      Having a warrant doesn't mean that it's a valid warrant for the what police say it is for, nor does it mean that anybody at Uber's montreal offices is qualified to make that call. Locking down the computers until Uber's lawyers have had a chance to verify what the warrant covers and what access the investigators are entitled to seems like a fairly prudent security measure. If somebody showed up at your office with a piece of paper saying they were allowed access to everything on your computer, would you unquestioningly give them that access? Personally, I'd hope any services that I trust my data to wouldn't give up access without some verification that it's a legitimate request.
WhitneyLand 9y ago
If there becomes reason for the courts to weigh in I would not bet on a lot of judges buying into that logic.
- Spivak 9y ago
  Why wouldn't a judge buy the logic that the purpose of security is to deny access to anyone not explicitly authorized? I mean it's not like there needs to be a special provision to detect and allow police.
  - s73ver_ 9y ago
    Because the warrant was obtained for the information. Judges generally frown upon cuteness used to try and be 'technically correct' regarding their orders.
    - Zak 9y ago
      I think there's a sort of... for lack of a better term, I'll call it information arbitrage, going on here. The person who first see the police is likely a receptionist or similar who does not have access to the information specified by the warrant. That person, quite reasonably makes the local management aware the police are present immediately. Management hasn't encountered the police or seen the warrant yet. They don't know the nature of the encounter, but they know they're supposed to tell corporate immediately. They do so, and make no attempt to prevent the execution of the warrant once they have received it. Corporate, located in another country doesn't know what's going on except that people claiming to be police showed up at a foreign office. They initiate a lockdown of the local computers until legal can sort it out. Now if management read a warrant demanding access to something on local computers, then made a call to corporate they knew would cause those computers to be remotely locked, they could be in trouble. I make no comment here about whether Uber is good, but Uber is definitely smart.
craftyguy 9y ago
> present a properly scoped warrant! Gosh, I first read this as "a poorly scoped warrant" and didn't think twice about it.
otterley 9y ago
As I understand it, Ripley's purpose is to destroy evidence in anticipation of a lawfully conducted search. If so, this would likely contravene anti-spoliation laws in the U.S., among other jurisdictions. See, e.g., http://apps.americanbar.org/abastore/products/books/abstracts/5190497_chap1_abs.pdf http://apps.americanbar.org/abastore/products/books/abstract...
- 013a 9y ago
  Destroy Evidence is strong phrasing. The evidence still exists, its just no longer within the scope of the police warrants. My interpretation of the article is that the information is all stored on Uber's US-based servers and the tool remotely revokes the satellite offices' connection to the servers, probably also shutting down the machines so nothing is left recoverable in memory. In weaker, but likely relatively accurate words: They're logging all of their remote users out of Google Drive so the authorities can't access the spreadsheets there. In essence. That's what I'm reading. Point being, Uber could still be compelled to present the evidence in court, and Uber may comply with that compulsion. Does a Canadian warrant give the Canadian government the right to access information stored on a server in the United States? The answer to that is an emphatic No. Does it give them the right to possess an API key which would allow them to access information stored on a server in the United States? Does this change if it could be reasonably expected that the information was, at some point, in the ephemeral memory, not even a hard disk as far as we know, of a computer on Canadian soil? I really don't know. We all knew the global power of the internet would begin to raise questions like this, and our legal framework simply hasn't dealt with them yet.
  - jackvalentine 9y ago
    > probably also shutting down the machines so nothing is left recoverable in memory. That seems like it would fit the definition of “destroy” to me.
  - slivym 9y ago
    Well firstly, no cloud storage system works with 0 locally cached data. What Uber are essentially doing is deleting evidence covered by the warrant by deleting the local copies. The evidence may exist elsewhere, but that doesn't mean that deleting the evidence covered by the warrant is any less illegal. Once the warrant is served, anything done to delete anything off that computer is obstruction of justice, it doesn't matter what the mechanism of storage is- whether it's RAM, Hard Disk or floppy disk. Secondly, the warrant is what compels uber to give access to the evidence, there's no 'We don't feel like it right now, go to the courts to try something else'. The ability of the authorities to gain evidence through other legal avenues provides literally no defence for uber in failing to comply with a warrant.
plandis 9y ago
From the article it looks like they did have a warrant. Denying the police from executing that warrant is probably against the law (I know it is in the US; not sure in Canada)
- bigiain 9y ago
  Who did the "denying" though? Someone in Canada just paged a number they'd been trained to when cops show up. That could easily be no more obstructing that calling your lawyer immediately (depending on what you could prove they knew about what'd happen then). Some team in San Francisco remotely shut down (and possibly deleted data/evidence from) company machines. Anybody on that team might want to forgo any planned trips to Canada, but it'd be a long stretch to think Canada would try to extradite them to face contempt of court charges.
  - sangnoir 9y ago
    > Who did the "denying" though?...Some team in San Francisco remotely shut down "Uber", the legal person is who. Why does HN think the law is a series of fixed instructions rigidly executed by a computer and can be easily hacked by overly clever constructs? "Well, I didn't shoot my wife, I just set-off the first domino on this rube goldburg machine - the hamster pulled the trigger - gotcha! ha ha ha". This will be put in front of a judge, and they will see through this for what it is.
    - bigiain 9y ago
      Yeah - I 100% agree that a judge will interpret this appropriately, but the dumb idea of "corporate personhood" still means there's questions to ask about who genuinely risks going to jail in a cross jurisdictional problem like this. It's pretty clear "Uber the legal person" is pretty happy breaking laws and has a long history of not suffering any real personal consequences. I'm reasonably sure a Canadian judge doesn't even have an existentially dangerous penalty they could apply to Uber-the-legal-person. Worst case seems to be they could shut Uber down in Canada and jail some local senior management. Uber-the-global-corporation probably has contingency plans and has determined and budgeted for that risk. That's their "business as usual". "The law", while generally robust locally against clever constructs, is probably not as effective a tool against globally distributed corporations - at least not in a very satisfying "Yeah, someone's gonna pay for that" kind of way...

by ejcx 9y ago

hateduser2 9y ago

Yours doesn’t discuss the timing or police raids, so it’s not as simple as saying the OP is a spin.

Consultant32452 9y ago
The police are not special in this regard. The police are not your friend. There's no need to invite the police in to go on a fishing expedition for something they don't have enough probable cause of to get a sufficient warrant.
- ealexhudson 9y ago
  The article specifically says they had a warrant. This software actively obstructed that warrant.
  - Consultant32452 9y ago
    Then the information that is properly scoped in the warrant will be revealed to the authorities. What won't happens is the police will not be given free rein to go on a fishing expedition to random data not specifically granted in the warrant. That's all we're talking about here, the authorities didn't get to go on a fishing expedition.
    - DerekL 9y ago
      *free rein
      - Consultant32452 9y ago
        Fixed, thanks
    - FireBeyond 9y ago
      What? No, that's not what happened. It's not a piece of software that says "here, based on the scope of your warrant, here's the information you require". It says, in about as many words, "FOAD until our counsel green lights unlocking, potentially before or after some housecleaning".
      - Consultant32452 9y ago
        >It's not a piece of software that says "here, based on the scope of your warrant, here's the information you require". Correct, Uber's lawyers will be able to review and perhaps fight the warrant in courts. Uber's sysadmins will have time to figure out how to reveal the required data in a clean way that does not compromise the rest of Uber's data which includes but is not limited to data about where private citizens travel from time to time. >"FOAD until our counsel green lights unlocking Perfect, yes it does say this. We should all say this. Would you like Google or Facebook or whatever other service you use to reveal your private information if the government does not provide a proper warrant? >potentially before or after some housecleaning". Okay, well in this imaginary scenario Uber would be guilty of tampering with evidence and I'm confident Canada has relevant laws.
        FireBeyond 9y ago
        > if the government does not provide a proper warrant? How or in what way was this warrant deemed to be improper? There was zero consideration of that, instead it was "nuke from orbit" at first sight.
        Consultant32452 9y ago
        By the judicial system, obviously. Uber's lawyers will review the warrant and if they agree that it's proper they will instruct their sysadmins to provide ONLY THE DATA COVERED BY THE WARRANT to authorities. If they don't feel the warrant is proper, they will fight it in court. The vast majority of times warrants are upheld, so really all that happens is the authorities are only granted access to the data they had probable cause to request. What you're suggesting is that the authorities should have access to anything and everything that a person who happened to be logged in at the time of the raid had access too. You are suggesting that the authorities should always be granted arbitrary access to a random amount of data, which is almost certainly not relevant to their case, any time they get a warrant for any data at all. Further, you are acting as if that article is the end of the story, but it's not. There will be legal review by relevant professionals and Uber will provide whatever it is legally required to provide.
  - notatoad 9y ago
    Having a warrant doesn't mean that it's a valid warrant for the what police say it is for, nor does it mean that anybody at Uber's montreal offices is qualified to make that call. Locking down the computers until Uber's lawyers have had a chance to verify what the warrant covers and what access the investigators are entitled to seems like a fairly prudent security measure. If somebody showed up at your office with a piece of paper saying they were allowed access to everything on your computer, would you unquestioningly give them that access? Personally, I'd hope any services that I trust my data to wouldn't give up access without some verification that it's a legitimate request.

WhitneyLand 9y ago

If there becomes reason for the courts to weigh in I would not bet on a lot of judges buying into that logic.

Spivak 9y ago
Why wouldn't a judge buy the logic that the purpose of security is to deny access to anyone not explicitly authorized? I mean it's not like there needs to be a special provision to detect and allow police.
- s73ver_ 9y ago
  Because the warrant was obtained for the information. Judges generally frown upon cuteness used to try and be 'technically correct' regarding their orders.
  - Zak 9y ago
    I think there's a sort of... for lack of a better term, I'll call it information arbitrage, going on here. The person who first see the police is likely a receptionist or similar who does not have access to the information specified by the warrant. That person, quite reasonably makes the local management aware the police are present immediately. Management hasn't encountered the police or seen the warrant yet. They don't know the nature of the encounter, but they know they're supposed to tell corporate immediately. They do so, and make no attempt to prevent the execution of the warrant once they have received it. Corporate, located in another country doesn't know what's going on except that people claiming to be police showed up at a foreign office. They initiate a lockdown of the local computers until legal can sort it out. Now if management read a warrant demanding access to something on local computers, then made a call to corporate they knew would cause those computers to be remotely locked, they could be in trouble. I make no comment here about whether Uber is good, but Uber is definitely smart.

craftyguy 9y ago

> present a properly scoped warrant! Gosh, I first read this as "a poorly scoped warrant" and didn't think twice about it.

otterley 9y ago

As I understand it, Ripley's purpose is to destroy evidence in anticipation of a lawfully conducted search. If so, this would likely contravene anti-spoliation laws in the U.S., among other jurisdictions. See, e.g., http://apps.americanbar.org/abastore/products/books/abstracts/5190497_chap1_abs.pdf http://apps.americanbar.org/abastore/products/books/abstract...

013a 9y ago
Destroy Evidence is strong phrasing. The evidence still exists, its just no longer within the scope of the police warrants. My interpretation of the article is that the information is all stored on Uber's US-based servers and the tool remotely revokes the satellite offices' connection to the servers, probably also shutting down the machines so nothing is left recoverable in memory. In weaker, but likely relatively accurate words: They're logging all of their remote users out of Google Drive so the authorities can't access the spreadsheets there. In essence. That's what I'm reading. Point being, Uber could still be compelled to present the evidence in court, and Uber may comply with that compulsion. Does a Canadian warrant give the Canadian government the right to access information stored on a server in the United States? The answer to that is an emphatic No. Does it give them the right to possess an API key which would allow them to access information stored on a server in the United States? Does this change if it could be reasonably expected that the information was, at some point, in the ephemeral memory, not even a hard disk as far as we know, of a computer on Canadian soil? I really don't know. We all knew the global power of the internet would begin to raise questions like this, and our legal framework simply hasn't dealt with them yet.
- jackvalentine 9y ago
  > probably also shutting down the machines so nothing is left recoverable in memory. That seems like it would fit the definition of “destroy” to me.
- slivym 9y ago
  Well firstly, no cloud storage system works with 0 locally cached data. What Uber are essentially doing is deleting evidence covered by the warrant by deleting the local copies. The evidence may exist elsewhere, but that doesn't mean that deleting the evidence covered by the warrant is any less illegal. Once the warrant is served, anything done to delete anything off that computer is obstruction of justice, it doesn't matter what the mechanism of storage is- whether it's RAM, Hard Disk or floppy disk. Secondly, the warrant is what compels uber to give access to the evidence, there's no 'We don't feel like it right now, go to the courts to try something else'. The ability of the authorities to gain evidence through other legal avenues provides literally no defence for uber in failing to comply with a warrant.

plandis 9y ago

From the article it looks like they did have a warrant. Denying the police from executing that warrant is probably against the law (I know it is in the US; not sure in Canada)

bigiain 9y ago
Who did the "denying" though? Someone in Canada just paged a number they'd been trained to when cops show up. That could easily be no more obstructing that calling your lawyer immediately (depending on what you could prove they knew about what'd happen then). Some team in San Francisco remotely shut down (and possibly deleted data/evidence from) company machines. Anybody on that team might want to forgo any planned trips to Canada, but it'd be a long stretch to think Canada would try to extradite them to face contempt of court charges.
- sangnoir 9y ago
  > Who did the "denying" though?...Some team in San Francisco remotely shut down "Uber", the legal person is who. Why does HN think the law is a series of fixed instructions rigidly executed by a computer and can be easily hacked by overly clever constructs? "Well, I didn't shoot my wife, I just set-off the first domino on this rube goldburg machine - the hamster pulled the trigger - gotcha! ha ha ha". This will be put in front of a judge, and they will see through this for what it is.
  - bigiain 9y ago
    Yeah - I 100% agree that a judge will interpret this appropriately, but the dumb idea of "corporate personhood" still means there's questions to ask about who genuinely risks going to jail in a cross jurisdictional problem like this. It's pretty clear "Uber the legal person" is pretty happy breaking laws and has a long history of not suffering any real personal consequences. I'm reasonably sure a Canadian judge doesn't even have an existentially dangerous penalty they could apply to Uber-the-legal-person. Worst case seems to be they could shut Uber down in Canada and jail some local senior management. Uber-the-global-corporation probably has contingency plans and has determined and budgeted for that risk. That's their "business as usual". "The law", while generally robust locally against clever constructs, is probably not as effective a tool against globally distributed corporations - at least not in a very satisfying "Yeah, someone's gonna pay for that" kind of way...