5 ms·
If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote
by Zak 9y ago
If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.
- Consultant32452 9y agoCongratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.
- Zak 9y agoAnd now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.
- Consultant32452 9y agoWhen you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.
- Zak 9y agoIt's not hard to imagine scenarios in which pulling out of a country to avoid providing secret information to that country's government is rational. Canada attempting to collect taxes on Uber rides is not one of those scenarios.
- Consultant32452 9y agoPerhaps, but it's difficult to imagine you're not in violation of some other kinds of laws for which there is ample evidence, and/or that no one in your organization is willing to talk.
- Zak 9y agoSure, and if I'm systematically violating local law, there might be international agreements that would get my home country to cooperate in an enforcement action against me. On the other hand, the local authorities might want user data that I hold in order to do something horrible to local users that my home country would not like to help them do. But I digress. I think we've established that we agree the original security procedure with a secure remote lockout is a good idea.
- FireBeyond 9y agoI too, when faced with a search warrant from the police, often like to come up with a means where I give them what they want, or claim it doesn't exist, without giving them an opportunity to look around. They very much are understanding of this.
- Consultant32452 9y agoIf you're just there to "look around" and don't already know exactly what you are expecting to find then you shouldn't have been given the warrant to begin with. This is a criminal investigation, not a fishing expedition.
- FireBeyond 9y agoYeah, and the defenders of Uber's activities here are acting as if the warrant -was- a fishing warrant and wasn't properly scoped, when the validity of this assertion had zero to do with their decision to "Ripley" the office. It wasn't to prevent an overreaching warrant, it was to prevent -any- warrant from being meaningfully served.
- Consultant32452 9y agoIt wasn't an attempt to prevent any warrant at all. It was an attempt to prevent the authorities from accessing data NOT COVERED BY A WARRANT. Once Uber's lawyers have reviewed the warrant they will instruct the sysadmins to provide the covered data in a clean way which doesn't expose extra data. Simple as that. Generally speaking warrants are not granted for "all of your data." Imagine if every time the authorities got a warrant for some data Google has about a particular suspect, Google would reveal all of its internal data about every user, all of Google's internal financial files, etc. That would be insane.
- Zak 9y agoIt appears in this case, Uber has designed a system with exactly that result: the police do not punish the local staff for the remote lockdown, and cannot punish the overseas sysadmins who caused it.