6 ms·

I'm actually curious, are they allowed to encrypt backups if FBI requested them not to? I thought as American company you have to comply with the law as well. N

I'm actually curious, are they allowed to encrypt backups if FBI requested them not to? I thought as American company you have to comply with the law as well. Not sure though Edit: damn downvotes, is this reddit? I'm literally asking because I don't know. nothing is controversial here

barsonme 5y ago
The FBI can request until they’re blue in the face. They don’t make laws. And so far, there aren’t any laws preventing Apple from encrypting backups.
- robertwt7 5y ago
  Right.. yeah because some laws like anti terrorism or money laundering etc stated that tech companies has to save the data and share with the gov if the gov requested. Source: I work in fintech
  - Hamuko 5y ago
    Do these laws specify that you're not allowed to make features that encrypt data?
    - robertwt7 5y ago
      No not that, what I meant was that you have to be able to provide when requested. Meaning that you have to be able to decrypt it if requested. Not just 1 way encryption
      - Hamuko 5y ago
        So is Amazon breaking the law if I upload GPG-encrypted files to S3?
        rswail 5y ago
        No, because AWS is not providing financial services. If you are and you upload encrypted data to S3, then you'd better have the ability to decrypt it if required by the financial regulators, otherwise you are breaking the law.
        Hamuko 5y ago
        This sounds a lot more like financial institution regulation than tech company regulation.
        robertwt7 5y ago
        Yes but the point is the government has the ability to do that. Exactly my question
        pseudalopex 5y ago
        You said "tech companies has to save the data and share with the gov".
    - leeoniya 5y ago
      as long as you also make features to decrypt same data
  - rswail 5y ago
    If you work in finance and are subject to AML/KYC (anti money laundering, know your customer) laws, then it's not whether or not you encrypt data. You cannot encrypt the data in a way that is not accessible under those laws for the transactions you perform. So that has nothing to do with the mechanism of securing data and everything to do with the finance organization compliance with the laws. "Fintech" is a fancy word for a company doing financial applications, not a copout on financial regulations by using the "tech" word as an excuse. There are a bunch of standards requiring encryption at rest and encryption in transit of PII and other data in finance. That does not mean that authorized users do not have access to it.
sneak 5y ago
It's legal to do e2e backups; Google does for android. Apple knows which way the wind blows. If they piss off the USG spies, there are lots of "unrelated" ways to make them hurt, including but not limited to additional regulation or antitrust enforcement against their anticompetitive moneymaker App Store. What this means is that if you are big enough, the 1A doesn't actually apply to you and you can't publish any legal software you like, because the FBI/IC/military will cause you to suffer even though you haven't broken the law.

barsonme 5y ago

The FBI can request until they’re blue in the face. They don’t make laws. And so far, there aren’t any laws preventing Apple from encrypting backups.

robertwt7 5y ago
Right.. yeah because some laws like anti terrorism or money laundering etc stated that tech companies has to save the data and share with the gov if the gov requested. Source: I work in fintech
- Hamuko 5y ago
  Do these laws specify that you're not allowed to make features that encrypt data?
  - robertwt7 5y ago
    No not that, what I meant was that you have to be able to provide when requested. Meaning that you have to be able to decrypt it if requested. Not just 1 way encryption
    - Hamuko 5y ago
      So is Amazon breaking the law if I upload GPG-encrypted files to S3?
      - rswail 5y ago
        No, because AWS is not providing financial services. If you are and you upload encrypted data to S3, then you'd better have the ability to decrypt it if required by the financial regulators, otherwise you are breaking the law.
        Hamuko 5y ago
        This sounds a lot more like financial institution regulation than tech company regulation.
        robertwt7 5y ago
        Yes but the point is the government has the ability to do that. Exactly my question
        pseudalopex 5y ago
        You said "tech companies has to save the data and share with the gov".
  - leeoniya 5y ago
    as long as you also make features to decrypt same data
- rswail 5y ago
  If you work in finance and are subject to AML/KYC (anti money laundering, know your customer) laws, then it's not whether or not you encrypt data. You cannot encrypt the data in a way that is not accessible under those laws for the transactions you perform. So that has nothing to do with the mechanism of securing data and everything to do with the finance organization compliance with the laws. "Fintech" is a fancy word for a company doing financial applications, not a copout on financial regulations by using the "tech" word as an excuse. There are a bunch of standards requiring encryption at rest and encryption in transit of PII and other data in finance. That does not mean that authorized users do not have access to it.

sneak 5y ago

It's legal to do e2e backups; Google does for android. Apple knows which way the wind blows. If they piss off the USG spies, there are lots of "unrelated" ways to make them hurt, including but not limited to additional regulation or antitrust enforcement against their anticompetitive moneymaker App Store. What this means is that if you are big enough, the 1A doesn't actually apply to you and you can't publish any legal software you like, because the FBI/IC/military will cause you to suffer even though you haven't broken the law.