12 ms·

Per [0], a possible answer to this seems to be that an arms dealer had connections to a company called Tardigrade Ltd. and all transactions with firms like thes

Per [0], a possible answer to this seems to be that an arms dealer had connections to a company called Tardigrade Ltd. and all transactions with firms like these are prohibited which is why the word "Tardigrade" made it into PayPal's filter. As long as companies like PayPal have issues like that, or with moderation in case of Youtube, Twitter or Facebook, I'd claim neither of these companies have actually solved scale. If they can not properly deal with the issues that arise of scale, they haven't solved it at all. They might be reaping the benefits and dumping the issues on others but they haven't solved anything else at all. [0] https://twitter.com/kenshirriff/status/1304564003859918849 https://twitter.com/kenshirriff/status/1304564003859918849 [1] https://home.treasury.gov/news/press-releases/sm849 https://home.treasury.gov/news/press-releases/sm849

bleepblorp 6y ago
These kinds of problems are a product of scale. For companies the size of Paypal, Google, or Twitter, the revenue from their operations is so great that leaving a few crumbs on the table by not handling corner cases is of no concern. Smaller companies can't afford to lose (for example) 10% of their business to corner cases. For large monopolies, a 90% solution is more than good enough.
- szhu 6y ago
  Yes, large companies have solved their own money-making problems of scale by becoming so large that problems that we find important as a society become ignorable for their bottom line. That doesn't mean that they've solved the problems of scale that we care about as a society.
- eru 6y ago
  Google does care about 10%. But problems that are absolutely pretty big, might still only be 0.01% for Google.
didibus 6y ago
What's your treshold though? I mean, it's easy to get in a raising the bar fallacy here. If this happens to only say 0.1% of PayPal transactions? Would that be good enough? Why that treshold? What about 1% ? Or should it be 0.01% ?
mrweasel 6y ago
I don’t know if PayPal ever claimed otherwise, but I’ve suspected that much of the AI powered moderation online is simply advanced keyword matching. We have to start accepting that either websites are unwilling to or unable to do moderation in any meaningful way, unless they hire human moderators at huge costs. Hearing an interview with the country for Facebook on Danish radio just two weeks ago, it’s pretty clear to me that it’s not that Facebook aren’t willing to implement the moderation politicians requests, the problem is that they can’t. And if Facebook can’t implement moderation, there’s no way PayPal is able to with a much smaller budget.
- Silhouette 6y ago
  Politicians often ask for silly things in connection with technologies they don't really understand, to achieve goals they don't really expect to achieve, just in order to look good to a certain part of the electorate. Consider an analogy between modern social media sites and something like a phone network or postal mail service. What would happen if a politician suggested that phone companies or their national postal service should be required to monitor all communications for some vaguely-defined concept of suspicious activity, and then when something was flagged, have it reviewed by a human and if deemed inappropriate cut off the spread within X hours? It would be considered an absurd suggestion by just about everyone, for being impractical, expensive, intrusive, unreliable and of questionable benefit. And yet, politicians keep suggesting that social media companies should be able to do almost exactly that. There are demands that these companies magically detect any sort of inappropriate content on their systems, and then remove it quickly. Small details like subjectivity, privacy and practicality never seem to feature in the press conference, though.
  - quintushoratius 6y ago
    That's a terrible analogy, for two reasons. 1. Post and phone have an expectation of privacy so the government can't review them (in the US, at least) 2. There is already a system in place to review all phone calls in real time. It's run by several Western intelligence agencies to get around the monitoring rules mentioned in #1.
akerro 6y ago
Are you telling me I can start website called "ebay ltd" and get donations from paypal for hosting wikileaks and snowden leaks and paypay might block ebay transactions along with my ebay ltd?
- deleted 6y ago
  [deleted]
- js4ever 6y ago
  No because Ebay is well known, but pick a name of a small to medium start up and yes you can probably kill their paypal account
- 0x00000000 6y ago
  PayPal seems to arbitrarily block transactions on eBay too. Happened to my friend and he called support and they told him there is nothing they can do. In disbelief he called again and got the same response.
saddlerustle 6y ago
PayPal compliance is a very different problem to social media moderation. Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word, so for a consumer service like PayPal the only real option is to block the transaction. In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.
- the8472 6y ago
  But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.
  - deleted 6y ago
    [deleted]
  - lotsofpulp 6y ago
    I would say it’s not much different with regular banks in the US, as they can and do refuse service with no recourse if you do something they seem suspicious.
  - eru 6y ago
    > But for regular banks service to private citizens is also compulsory, [...] Depends very much on jurisdiction. PayPal is active in many jurisdictions, too.
  - gruez 6y ago
    >But for regular banks service to private citizens is also compulsory what country is that? AFAIK in the US most businesses can refuse to do business with you for any reason, except a very limited set of reasons related to discrimination[1]. [1] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group
henearkr 6y ago
Next time somebody here creates a shell company for very bad things, please try naming it YPal!
- Fnoord 6y ago
  The first name and deity name Isis [1] got tarnished by ISIS (which later got renamed to IS). PayPal is also just two words blended together. I'm not sure they're anyone's friend though. [1] https://en.m.wikipedia.org/wiki/Isis https://en.m.wikipedia.org/wiki/Isis
thiht 6y ago
My guess is more simply that "tardigrade" contains the substring "tard", which is sometimes used as short for "retard" in their state of the art regexp filter. Their filter is probably like /iran|tard|cuban|.../i (see also: https://www.insidehook.com/daily_brief/news-opinion/paypal-wont-let-you-send-payments-that-include-words-like-iran-or-cuban-in-the-memo https://www.insidehook.com/daily_brief/news-opinion/paypal-w... and https://news.ycombinator.com/item?id=24359821 https://news.ycombinator.com/item?id=24359821)
imnotjames 6y ago
PayPal gets a list of banned strings from the Office of Foreign Asset controls. If any match those strings it's flagged for a review. This is more or less legally required for any company that moves money in the United States of America. You will probably find the same issues with the same terms on any other banking for financial body. Technically, these aren't being blocked. They're being audited. The payments will still go through. The way this is taking place is following very specific legally "known good" pathways - so that when paypal does accidentally let a payment through to a sanctioned entity they are able to argue that they took every available precaution and should not have to pay the $250k per transaction fine. The last time PayPal had to pay these fines - for example - it was ~$7m. That's not including legal fees. https://fcpablog.com/2015/03/27/ofac-fines-paypal-77-million-for-486-sanctions-violations/ https://fcpablog.com/2015/03/27/ofac-fines-paypal-77-million...
- shean_massey 6y ago
  In all software I've seen dealing with these issues (ofac, aml, Dow Jones listings, etc) the flagging should result in manual verification but you're able to configure risk allowances. They almost all certainly allow some bad transactions through accepting the potential risk/cost of actually hiring huge teams of manual auditors. Just being flagged does not always lead to audits.
- calvinmorrison 6y ago
  It's very annoying. I worked at a shop that sold cigars online. No actual cubans, but brands that used the name cuba in it. Inadvertently every time it would get flagged.
  - CydeWeys 6y ago
    This seems like poor branding on the part of the cigar brands (at least for online sales).
    - btrask 6y ago
      Is "I Can't Believe It's Not Butter!" a bad brand for margarine? Imagine it getting flagged by the butter police.
BEEdwards 6y ago
Key word blocking is the dumbest thing ever, arms dealers used it for some transactions, okay they'll just use a different code word, but now people legitimately using tartigrade are boned. When they ban the new code word, they'll just switch again, once again screwing over the legitimate users of that word. its wackamole only stupider because at least wackamole at the arcade gives you prize tickets.
hakfoo 6y ago
I feel like I'm missing some obvious link here. If changing the name on a legitimate transaction is enough to let it go through, what stops actual Evil Terrorists (tm) from just telling their financiers that their name has changed every three months to stay ahead of specific filters? If I had infinite resources, IMO, the way to go with this sort of thing is to have no blocked transactions or obvious failures, and only relaying the suspicious transactions for law-enforcement to review. If there are crimes, actually get involved and prosecute them, don't just create weird financial black-holes for innocent people and behaviour. From the customer side, no more stupid disruptions. If there are actual bad actors at play, they don't get any immediate feedback they've been flagged and are less likely to change their strategies and cover their tracks. If there are too many transactions getting flagged this way and law-enforcement ends up buried under dots to connect, then that's a signaling mechanism for them too-- they've obviously done a bad job of crafting their filters and need to adjust for signal/noise.
- WesolyKubeczek 6y ago
  It makes the government officials and a certain percentage of ignorant public see how much busywork is done to stop the terrorists and feel good about it. I bet a lot of malevolent transactions do slip through the cracks because of how laughably naive this system is.
baybal2 6y ago
From a 2019 Worldcheck copy, and OFAC SDN https://www.treasury.gov/ofac/downloads/sdnlist.txt https://www.treasury.gov/ofac/downloads/sdnlist.txt > TARDIGRADE LIMITED, Dimitriados 1, Limassol 4004, Cyprus; Registration Number C378737 (Cyprus) [GLOMAG] (Linked To: TESIC, Slobodan). > TESIC, Slobodan (a.k.a. SLOBODAN, Tezic), Serbia; DOB 21 Dec 1958; POB Kiseljak, Bosnia and Herzegovina; nationality Serbia; citizen Serbia; Gender Male; Passport 009511357 (Serbia) expires 27 Oct 2020; alt. Passport 007671811 (Serbia) expires 05 Aug 2019 (individual) [GLOMAG]. > [GLOMAG]: Executive Order 13818 - Global Magnitsky;
- athms 6y ago
  You are misspelling TARĐIGRADE. That word is Serbian, not English. The Latin form of the language has the letters /d/ (upper "D" and lower "d") and /dz/ (upper "Đ" and lower "đ"). There is also a TARGET TRANSPORTATION LIMITED on the list. PayPal, in their infinite stupidity, would probably block transfers to the retailer Target.
ponker 6y ago
I’m sure the PayPal CEO is deeply wounded by a HN commenter declaring that they haven’t “solved scale,” but perhaps he’s comforted by the tens of billions of dollars they make each year.

bleepblorp 6y ago

These kinds of problems are a product of scale. For companies the size of Paypal, Google, or Twitter, the revenue from their operations is so great that leaving a few crumbs on the table by not handling corner cases is of no concern. Smaller companies can't afford to lose (for example) 10% of their business to corner cases. For large monopolies, a 90% solution is more than good enough.

szhu 6y ago
Yes, large companies have solved their own money-making problems of scale by becoming so large that problems that we find important as a society become ignorable for their bottom line. That doesn't mean that they've solved the problems of scale that we care about as a society.
eru 6y ago
Google does care about 10%. But problems that are absolutely pretty big, might still only be 0.01% for Google.

didibus 6y ago

What's your treshold though? I mean, it's easy to get in a raising the bar fallacy here. If this happens to only say 0.1% of PayPal transactions? Would that be good enough? Why that treshold? What about 1% ? Or should it be 0.01% ?

mrweasel 6y ago

I don’t know if PayPal ever claimed otherwise, but I’ve suspected that much of the AI powered moderation online is simply advanced keyword matching. We have to start accepting that either websites are unwilling to or unable to do moderation in any meaningful way, unless they hire human moderators at huge costs. Hearing an interview with the country for Facebook on Danish radio just two weeks ago, it’s pretty clear to me that it’s not that Facebook aren’t willing to implement the moderation politicians requests, the problem is that they can’t. And if Facebook can’t implement moderation, there’s no way PayPal is able to with a much smaller budget.

Silhouette 6y ago
Politicians often ask for silly things in connection with technologies they don't really understand, to achieve goals they don't really expect to achieve, just in order to look good to a certain part of the electorate. Consider an analogy between modern social media sites and something like a phone network or postal mail service. What would happen if a politician suggested that phone companies or their national postal service should be required to monitor all communications for some vaguely-defined concept of suspicious activity, and then when something was flagged, have it reviewed by a human and if deemed inappropriate cut off the spread within X hours? It would be considered an absurd suggestion by just about everyone, for being impractical, expensive, intrusive, unreliable and of questionable benefit. And yet, politicians keep suggesting that social media companies should be able to do almost exactly that. There are demands that these companies magically detect any sort of inappropriate content on their systems, and then remove it quickly. Small details like subjectivity, privacy and practicality never seem to feature in the press conference, though.
- quintushoratius 6y ago
  That's a terrible analogy, for two reasons. 1. Post and phone have an expectation of privacy so the government can't review them (in the US, at least) 2. There is already a system in place to review all phone calls in real time. It's run by several Western intelligence agencies to get around the monitoring rules mentioned in #1.

akerro 6y ago

Are you telling me I can start website called "ebay ltd" and get donations from paypal for hosting wikileaks and snowden leaks and paypay might block ebay transactions along with my ebay ltd?

deleted 6y ago
[deleted]
js4ever 6y ago
No because Ebay is well known, but pick a name of a small to medium start up and yes you can probably kill their paypal account
0x00000000 6y ago
PayPal seems to arbitrarily block transactions on eBay too. Happened to my friend and he called support and they told him there is nothing they can do. In disbelief he called again and got the same response.

saddlerustle 6y ago

PayPal compliance is a very different problem to social media moderation. Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so. And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word, so for a consumer service like PayPal the only real option is to block the transaction. In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.

the8472 6y ago
But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.
- deleted 6y ago
  [deleted]
- lotsofpulp 6y ago
  I would say it’s not much different with regular banks in the US, as they can and do refuse service with no recourse if you do something they seem suspicious.
- eru 6y ago
  > But for regular banks service to private citizens is also compulsory, [...] Depends very much on jurisdiction. PayPal is active in many jurisdictions, too.
- gruez 6y ago
  >But for regular banks service to private citizens is also compulsory what country is that? AFAIK in the US most businesses can refuse to do business with you for any reason, except a very limited set of reasons related to discrimination[1]. [1] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group

henearkr 6y ago

Next time somebody here creates a shell company for very bad things, please try naming it YPal!

Fnoord 6y ago
The first name and deity name Isis [1] got tarnished by ISIS (which later got renamed to IS). PayPal is also just two words blended together. I'm not sure they're anyone's friend though. [1] https://en.m.wikipedia.org/wiki/Isis https://en.m.wikipedia.org/wiki/Isis

thiht 6y ago

My guess is more simply that "tardigrade" contains the substring "tard", which is sometimes used as short for "retard" in their state of the art regexp filter. Their filter is probably like /iran|tard|cuban|.../i (see also: https://www.insidehook.com/daily_brief/news-opinion/paypal-wont-let-you-send-payments-that-include-words-like-iran-or-cuban-in-the-memo https://www.insidehook.com/daily_brief/news-opinion/paypal-w... and https://news.ycombinator.com/item?id=24359821 https://news.ycombinator.com/item?id=24359821)

imnotjames 6y ago

PayPal gets a list of banned strings from the Office of Foreign Asset controls. If any match those strings it's flagged for a review. This is more or less legally required for any company that moves money in the United States of America. You will probably find the same issues with the same terms on any other banking for financial body. Technically, these aren't being blocked. They're being audited. The payments will still go through. The way this is taking place is following very specific legally "known good" pathways - so that when paypal does accidentally let a payment through to a sanctioned entity they are able to argue that they took every available precaution and should not have to pay the $250k per transaction fine. The last time PayPal had to pay these fines - for example - it was ~$7m. That's not including legal fees. https://fcpablog.com/2015/03/27/ofac-fines-paypal-77-million-for-486-sanctions-violations/ https://fcpablog.com/2015/03/27/ofac-fines-paypal-77-million...

shean_massey 6y ago
In all software I've seen dealing with these issues (ofac, aml, Dow Jones listings, etc) the flagging should result in manual verification but you're able to configure risk allowances. They almost all certainly allow some bad transactions through accepting the potential risk/cost of actually hiring huge teams of manual auditors. Just being flagged does not always lead to audits.
calvinmorrison 6y ago
It's very annoying. I worked at a shop that sold cigars online. No actual cubans, but brands that used the name cuba in it. Inadvertently every time it would get flagged.
- CydeWeys 6y ago
  This seems like poor branding on the part of the cigar brands (at least for online sales).
  - btrask 6y ago
    Is "I Can't Believe It's Not Butter!" a bad brand for margarine? Imagine it getting flagged by the butter police.

BEEdwards 6y ago

Key word blocking is the dumbest thing ever, arms dealers used it for some transactions, okay they'll just use a different code word, but now people legitimately using tartigrade are boned. When they ban the new code word, they'll just switch again, once again screwing over the legitimate users of that word. its wackamole only stupider because at least wackamole at the arcade gives you prize tickets.

hakfoo 6y ago

I feel like I'm missing some obvious link here. If changing the name on a legitimate transaction is enough to let it go through, what stops actual Evil Terrorists (tm) from just telling their financiers that their name has changed every three months to stay ahead of specific filters? If I had infinite resources, IMO, the way to go with this sort of thing is to have no blocked transactions or obvious failures, and only relaying the suspicious transactions for law-enforcement to review. If there are crimes, actually get involved and prosecute them, don't just create weird financial black-holes for innocent people and behaviour. From the customer side, no more stupid disruptions. If there are actual bad actors at play, they don't get any immediate feedback they've been flagged and are less likely to change their strategies and cover their tracks. If there are too many transactions getting flagged this way and law-enforcement ends up buried under dots to connect, then that's a signaling mechanism for them too-- they've obviously done a bad job of crafting their filters and need to adjust for signal/noise.

WesolyKubeczek 6y ago
It makes the government officials and a certain percentage of ignorant public see how much busywork is done to stop the terrorists and feel good about it. I bet a lot of malevolent transactions do slip through the cracks because of how laughably naive this system is.

baybal2 6y ago

From a 2019 Worldcheck copy, and OFAC SDN https://www.treasury.gov/ofac/downloads/sdnlist.txt https://www.treasury.gov/ofac/downloads/sdnlist.txt > TARDIGRADE LIMITED, Dimitriados 1, Limassol 4004, Cyprus; Registration Number C378737 (Cyprus) [GLOMAG] (Linked To: TESIC, Slobodan). > TESIC, Slobodan (a.k.a. SLOBODAN, Tezic), Serbia; DOB 21 Dec 1958; POB Kiseljak, Bosnia and Herzegovina; nationality Serbia; citizen Serbia; Gender Male; Passport 009511357 (Serbia) expires 27 Oct 2020; alt. Passport 007671811 (Serbia) expires 05 Aug 2019 (individual) [GLOMAG]. > [GLOMAG]: Executive Order 13818 - Global Magnitsky;

athms 6y ago
You are misspelling TARĐIGRADE. That word is Serbian, not English. The Latin form of the language has the letters /d/ (upper "D" and lower "d") and /dz/ (upper "Đ" and lower "đ"). There is also a TARGET TRANSPORTATION LIMITED on the list. PayPal, in their infinite stupidity, would probably block transfers to the retailer Target.

ponker 6y ago

I’m sure the PayPal CEO is deeply wounded by a HN commenter declaring that they haven’t “solved scale,” but perhaps he’s comforted by the tens of billions of dollars they make each year.