3 ms·

The perspective of the law enforcement agencies, as usual, beggars belief. IMO Facebook/WhatsApp were totally in the right here: they were not issued any legal

The perspective of the law enforcement agencies, as usual, beggars belief. IMO Facebook/WhatsApp were totally in the right here: they were not issued any legal documents or binding court orders, saw that their systems had been compromised, and therefore informed _all compromised users_ without discrimination. Really though, using "terror suspect" here is like crying "think of the children": it's sensationalist garbage designed to drum up public support through fear. This is the same old e2e encryption vs. overstepping law enforcement debate, but with the kinky old "what about terrorism" mixed with the currently fashionable "boo Facebook and other tech giants" angle. Basically, Facebook did something (which I believe was) ethical and law enforcement agencies employing covert tactics that skirt the well-established legal processes got caught with their pants down.

ianhawes 7y ago
I wonder if the evolution of law enforcement to this attack will be to have a court issue a gag order preventing said companies from notifying their users of attempted or successful attacks.
- deleted 7y ago
  [deleted]
- gst 7y ago
  Doesn't the GDPR currently require companies to notify users about such attacks (does "personal data breach" also apply to client-side stored data)? > When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. (Source: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/)
shkkmo 7y ago
In fact, I would argue this makes the law enforcement agencies in question look incompetent since they should not have been trying to bypass the courts and traditional monitoring / investigation in such a manner that having a single zero day closed has such a significant effect on their investigation.

ianhawes 7y ago

I wonder if the evolution of law enforcement to this attack will be to have a court issue a gag order preventing said companies from notifying their users of attempted or successful attacks.

deleted 7y ago
[deleted]
gst 7y ago
Doesn't the GDPR currently require companies to notify users about such attacks (does "personal data breach" also apply to client-side stored data)? > When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. (Source: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/)

shkkmo 7y ago

In fact, I would argue this makes the law enforcement agencies in question look incompetent since they should not have been trying to bypass the courts and traditional monitoring / investigation in such a manner that having a single zero day closed has such a significant effect on their investigation.