7 ms·

Something doesn't square up. knowingly and intentionally participated" in a criminal ring that distributed narcotics by facilitating the "sale and service

Something doesn't square up. knowingly and intentionally participated" in a criminal ring that distributed narcotics by facilitating the "sale and service of encrypted communications devices." followed by Canada-based Sky Global is a provider of custom handsets and the developer of Sky ECC, a subscription-based end-to-end encrypted messaging application. Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. At least from a technical aspect, the state's case doesn't really hold up. However on the other side of the equation I have to ask. There has to be away they knew, and I think that is what the government is getting at, even if you can't read the exact messages, surely you aren't oblivious to what your users are discussing. I think this will come down to the makeup of the user base. If say only 10% of your customers are using it for illicit purposes, you can claim you didn't know, of couldn't have know because the messages are E2E encrypted, however if that number is 50+%, then I think the case could be made that yes even though you couldn't read the exact messages, you can still be held liable. I'm not an expert in this field and this is my Monday morning quarterback, so if someone has any better insights please correct me.

Aerroon 6y ago
>I think this will come down to the makeup of the user base. If say only 10% of your customers are using it for illicit purposes, you can claim you didn't know, of couldn't have know because the messages are E2E encrypted, however if that number is 50+%, then I think the case could be made that yes even though you couldn't read the exact messages, you can still be held liable. But what are you supposed to do in this situation? You get an inkling that the service you're providing is used by drug traffickers. If you start taking actions against that then it means you know, therefore more likely to be guilty in the eyes of the law. If you tell law enforcement then you're also taking a risk, because it's still happening in your backyard. On top of that, anything you do has a good chance of destroying the business as well.
- salawat 6y ago
  You let law enforcement do their job, and forward what little you can. If you implemented e-2-e encryption properly it isn't your problem you have no access to anything but metadata. If you didn't, and you really have access to keys that enable law enforcement to intercept or crack the encryption, then you weren't really end-to-end encrypted were you? Law enforcement interaction, and adherence to the law is not that much different than following and implementing a protocol. They can ask. You are expected to make a best effort attempt at accomodating what they ask for, given they have probable cost and a warrant. If they say that isn't good enough, you fight it in Court until either a judge modifies the protocol, or stipulates it's a legislative question. Queue lobbying. At all times, law enforcement are bound by probable cause. If they have it, you have to assist to the best of your ability, which for an e-2-e encrypted data stream is pretty much just metadata submission, or production of ciphertext if you're really going full centralized comm-stream tapping CALEA. Design your comm system like WebRTC, where your infra is only there to help two endpoints meet, and you have not even that. That's all there is to it really. Awful people doing awful things is a certainty. LE just have their knickers getting in a twist because their prey are starting to play the game with the blinders of technical ignorance off. What Law Enforcement wants is everyone to agree that they get privileged access to any message propagating through societal infrastructure... I sure hope everyone here understands why it is essential that they don't have it.
  - anonymousiam 6y ago
    Great idea, until "law enforcement" comes back with a "demand letter". Take a look at how that worked out for LavaBit: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
    - salawat 6y ago
      The correct response in his case was civil disobedience, cracking open every last detail of what he was being put through, and counting on the rest of us to come to our senses. It's sad, but there really is no other way to reasonably confront tyrannical overreach. If you play by the rules and refuse to be non-compliant, you also sacrifice the one weapon an overreaching Administration has to fear: the Truth. Now in a more naive mindset in my life I'd say go to the press. Nowadays though? It's a hard call who to go to to get the thumbscrews turned on those in power.
throwaway0a5e 6y ago
>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. At least from a technical aspect, the state's case doesn't really hold up. When has a prosecutor ever let reality stop them from throwing shit at the wall to see what sticks? It is highly unlikely that anyone developing an app that facilitates crime will leave themselves access to user data. It's a pointless risk from a business and criminal liability perspective. Pretty much everything illegal runs on the "don't ask don't tell" principal. The less you know the less of a target you are.
EthanHeilman 6y ago
>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. In the past the issue has been did the company intentionally develop and market the product for drug trafficking. For instance did they send sales reps to contact criminal organizations and offer their products as a way to do crimes. One company produced electronic devices for the purposes of evading wiretaps and then visited various mafia owned bars to meet criminals and sold those devices to members of those syndicates [citation needed] specifically for the purposes of evading wiretaps. You might have heard of that company, it later became Apple Computer. >"Somehow, despite the fact that many of their blue boxes had been seized by law enforcement, and there were definitely indicators that they were all made by the same outfit, the boxes were never linked back to Woz and Jobs." - [0] Edit: I can't find anything to back up my memories that Woz talks about selling blue boxes at a bar. I may have misremembered. I have added a [citation need] [0]: Concerning Steve Wozniak’s Blue Boxes https://512pixels.net/2018/03/woz-blue-box/ https://512pixels.net/2018/03/woz-blue-box/
- joelkevinjones 6y ago
  From my understanding, a Blue Box doesn't evade wiretaps, but allows one to make long distance calls for free.
  - EthanHeilman 6y ago
    A blue box gives you administrative access to the switching equipment by tricking the switching equipment into thinking it is receiving control plane information from another switch. It's like being able to send BGP messages to routers. This means you can make long distance calls for free, but it also means you can route your call through whatever switches you want and lying about both the source and destination at each hop. Because wiretapping systems often rely on the switching infrastructure and with a blue box you control the infrastructure, you can make yourself invisible. It was God-mode for the phone network.
    - Maursault 6y ago

Aerroon 6y ago

>I think this will come down to the makeup of the user base. If say only 10% of your customers are using it for illicit purposes, you can claim you didn't know, of couldn't have know because the messages are E2E encrypted, however if that number is 50+%, then I think the case could be made that yes even though you couldn't read the exact messages, you can still be held liable. But what are you supposed to do in this situation? You get an inkling that the service you're providing is used by drug traffickers. If you start taking actions against that then it means you know, therefore more likely to be guilty in the eyes of the law. If you tell law enforcement then you're also taking a risk, because it's still happening in your backyard. On top of that, anything you do has a good chance of destroying the business as well.

salawat 6y ago
You let law enforcement do their job, and forward what little you can. If you implemented e-2-e encryption properly it isn't your problem you have no access to anything but metadata. If you didn't, and you really have access to keys that enable law enforcement to intercept or crack the encryption, then you weren't really end-to-end encrypted were you? Law enforcement interaction, and adherence to the law is not that much different than following and implementing a protocol. They can ask. You are expected to make a best effort attempt at accomodating what they ask for, given they have probable cost and a warrant. If they say that isn't good enough, you fight it in Court until either a judge modifies the protocol, or stipulates it's a legislative question. Queue lobbying. At all times, law enforcement are bound by probable cause. If they have it, you have to assist to the best of your ability, which for an e-2-e encrypted data stream is pretty much just metadata submission, or production of ciphertext if you're really going full centralized comm-stream tapping CALEA. Design your comm system like WebRTC, where your infra is only there to help two endpoints meet, and you have not even that. That's all there is to it really. Awful people doing awful things is a certainty. LE just have their knickers getting in a twist because their prey are starting to play the game with the blinders of technical ignorance off. What Law Enforcement wants is everyone to agree that they get privileged access to any message propagating through societal infrastructure... I sure hope everyone here understands why it is essential that they don't have it.
- anonymousiam 6y ago
  Great idea, until "law enforcement" comes back with a "demand letter". Take a look at how that worked out for LavaBit: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
  - salawat 6y ago
    The correct response in his case was civil disobedience, cracking open every last detail of what he was being put through, and counting on the rest of us to come to our senses. It's sad, but there really is no other way to reasonably confront tyrannical overreach. If you play by the rules and refuse to be non-compliant, you also sacrifice the one weapon an overreaching Administration has to fear: the Truth. Now in a more naive mindset in my life I'd say go to the press. Nowadays though? It's a hard call who to go to to get the thumbscrews turned on those in power.

throwaway0a5e 6y ago

>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. At least from a technical aspect, the state's case doesn't really hold up. When has a prosecutor ever let reality stop them from throwing shit at the wall to see what sticks? It is highly unlikely that anyone developing an app that facilitates crime will leave themselves access to user data. It's a pointless risk from a business and criminal liability perspective. Pretty much everything illegal runs on the "don't ask don't tell" principal. The less you know the less of a target you are.

EthanHeilman 6y ago

>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. In the past the issue has been did the company intentionally develop and market the product for drug trafficking. For instance did they send sales reps to contact criminal organizations and offer their products as a way to do crimes. One company produced electronic devices for the purposes of evading wiretaps and then visited various mafia owned bars to meet criminals and sold those devices to members of those syndicates [citation needed] specifically for the purposes of evading wiretaps. You might have heard of that company, it later became Apple Computer. >"Somehow, despite the fact that many of their blue boxes had been seized by law enforcement, and there were definitely indicators that they were all made by the same outfit, the boxes were never linked back to Woz and Jobs." - [0] Edit: I can't find anything to back up my memories that Woz talks about selling blue boxes at a bar. I may have misremembered. I have added a [citation need] [0]: Concerning Steve Wozniak’s Blue Boxes https://512pixels.net/2018/03/woz-blue-box/ https://512pixels.net/2018/03/woz-blue-box/

joelkevinjones 6y ago
From my understanding, a Blue Box doesn't evade wiretaps, but allows one to make long distance calls for free.
- EthanHeilman 6y ago
  A blue box gives you administrative access to the switching equipment by tricking the switching equipment into thinking it is receiving control plane information from another switch. It's like being able to send BGP messages to routers. This means you can make long distance calls for free, but it also means you can route your call through whatever switches you want and lying about both the source and destination at each hop. Because wiretapping systems often rely on the switching infrastructure and with a blue box you control the infrastructure, you can make yourself invisible. It was God-mode for the phone network.
  - Maursault 6y ago