9 ms·

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on c

> After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything Setting aside impacts on customers, I wonder how common seizures would need to be to support a purely financial case that businesses that are known to not store identifying information are therefore less likely to incur the cost and effort of scrambling to replace seized hardware.

WaitWaitWha 3y ago
"Once is happenstance. Twice is coincidence. Three times is enemy action." - Ian Fleming, Goldfinger I find this to be a reasonable subjective measure.
tsukikage 3y ago
I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?
- input_sh 3y ago
  They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.
  - password4321 3y ago
    HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/ https://wiebetech.com/products/hotplug-field-kit/
    - rekoil 3y ago
      I guess their OS could defend itself from something like this by actively deleting any potentially compromising customer data as soon as it loses it's connection to the internet. No idea if it does though.
      - cge 3y ago
        The design of their diskless architecture (where everything is provisioned to RAM on boot, and no data needs to be stored at all), and the nature of their service, likely means that they could be even more sensitive, eg, reboot on a minimal acceleration from an internal accelerometer, minor power irregularities, momentary internet outage, etc.
    - kevin_thibedeau 3y ago
      Implement a deadman switch over X10.
    - j16sdiz 3y ago
      I guess they don't have them on hand today? They will come back another day with a pile of batteries.
    - dathinab 3y ago
      yes but requires the Police to have the right warrants and tools and the server to not detect it due to e.g. network disconnect, or you not giving it the latest versions of rooling keys etc.
      - Scoundreller 3y ago
        I’d go with something MEMS based. Always safely shutdown your hardware if you sense an earthquake!
    - AnthonyMouse 3y ago
      This is assuming the point of not having disks is to keep the confidential data in RAM. The problem with disks is they're hard to securely erase. Some NAT mapping gets written to a log or swap file and then you overwrite it but the device silently reallocated that sector and the old one is still there. DRAM doesn't do that. Then if you e.g. power cycle the machine once a day, it never contains data more than a day old.
- Etheryte 3y ago
  I'm wondering this as well and I haven't seen a sufficiently good explanation yet. I know they've done audits of different kinds over the years, I've read up about their infrastructure and the way they run their services, but I don't realistically see any of that being enough of an argument, right there on the spot, when the police turn up with a warrant. What could they possibly have demonstrated and how?
  - stametseater 3y ago
    > What could they possibly have demonstrated and how? Affiliation with an intelligence agency, who tell the petty beat cops to turn around and mind their own business. Probably more or less the same way that BATFE agents pretending to coyly sell illegal machine guns turn away any regular cop who might wander into the fishing expedition. With phone calls to police chiefs I imagine.
- Marsymars 3y ago
  I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.
  - kkielhofner 3y ago
    Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop what I'm doing and wait for XYZ". They're going to say "Oh you're a lawyer? Good for you. Here's a copy. Get out of the way and stand over there." Same thing for any technical or legal competence on the part of the authorities. You assembled enough cause for the warrant to be issued and you're going to walk away because the subject of the warrant basically says "Well see, I can explain everything..."? This is probably the equivalent of Neil deGrasse Tyson talking his way out of a speeding ticket on the side of the road by giving one of his (in)famous "Well actually officer, the Earth revolves around the sun while turning on it's axis at 25k MPH so actually I was..."[0]. Their version of events makes absolutely no sense to me. [0] - https://www.youtube.com/watch?v=TyZSBqQ813c https://www.youtube.com/watch?v=TyZSBqQ813c
    - troad 3y ago
      This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly don’t think the police behave very differently being watched (and these days often filmed) by a dozen high powered lawyers in suits, who will challenge absolutely everything they’ve just done as soon as they’re out the door?
      - 3y ago
- michaelmrose 3y ago
  It was Swedish cops. We all know I US cops would both be unlikely to comprehend the situation and would take everything that wasn't nailed down out of spite even if they did and would experience no consequences however other folks in better countries actually have rights. They had warrants to seize servers containing data relevant to a case. None such exists. They didn't have the right to just steal like US cops.
- mike_hock 3y ago
  You mean, sufficiently convincing that they leave empty-handed for now, knowing they'll have to come back with bigger guns. I'll be watching the news feed for updates on this.
- jdmoreira 3y ago
  This is in Sweden
- jerry1979 3y ago
  Perhaps a business would structure their physical infrastructure in anticipation of the language of search warrants. They could use documentation, the principle of separation of concern, and well-labeled physical devices.
- smsm42 3y ago
  In the US, the goons would probably take everything that had a plug, and the owners would spend a year or two getting their stuff back, if they are lucky. And, the goons enjoy total immunity so if they stole anything on the way, tough cookies. Example: https://www.forbes.com/sites/nicksibilla/2019/09/17/federal-court-cops-accused-of-stealing-over-225000-have-legal-immunity/ https://www.forbes.com/sites/nicksibilla/2019/09/17/federal-... Hopefully in Sweden it works differently.
slowmotiony 3y ago
After getting a call from the CIA to leave their honeypot alone, they left without taking anything ;-)
- slekker 3y ago
  Bold claim. Any more info on this?
  - therein 3y ago
    Absolutely none but they are getting into the too good to be true territory. Given they are legit, they should take this as a compliment I guess.
- InCityDreams 3y ago
  ...as a mullvad user, I salute you.

WaitWaitWha 3y ago

"Once is happenstance. Twice is coincidence. Three times is enemy action." - Ian Fleming, Goldfinger I find this to be a reasonable subjective measure.

tsukikage 3y ago

I did notice that phrase doing a lot of work there. I'm actually super curious: when a bunch of goons turn up on your doorstep fully expecting to cart away boxes of electronics, /how on earth/ do you "demonstrate that this is indeed how our service works", there and then on the spot, in a sufficiently convincing manner that they leave again empty-handed?

input_sh 3y ago
They've invested a lot of resources in what they call "diskless infrastructure", as in everything's in server's RAM. I presume it wouldn't be difficult to argue that as soon as you shut off a server to transfer it away, things they're looking for would be lost.
- password4321 3y ago
  HotPlug allows hot seizure and removal of computers from the field https://news.ycombinator.com/item?id=982930 https://news.ycombinator.com/item?id=982930 (2009) https://wiebetech.com/products/hotplug-field-kit/ https://wiebetech.com/products/hotplug-field-kit/
  - rekoil 3y ago
    I guess their OS could defend itself from something like this by actively deleting any potentially compromising customer data as soon as it loses it's connection to the internet. No idea if it does though.
    - cge 3y ago
      The design of their diskless architecture (where everything is provisioned to RAM on boot, and no data needs to be stored at all), and the nature of their service, likely means that they could be even more sensitive, eg, reboot on a minimal acceleration from an internal accelerometer, minor power irregularities, momentary internet outage, etc.
  - kevin_thibedeau 3y ago
    Implement a deadman switch over X10.
  - j16sdiz 3y ago
    I guess they don't have them on hand today? They will come back another day with a pile of batteries.
  - dathinab 3y ago
    yes but requires the Police to have the right warrants and tools and the server to not detect it due to e.g. network disconnect, or you not giving it the latest versions of rooling keys etc.
    - Scoundreller 3y ago
      I’d go with something MEMS based. Always safely shutdown your hardware if you sense an earthquake!
  - AnthonyMouse 3y ago
    This is assuming the point of not having disks is to keep the confidential data in RAM. The problem with disks is they're hard to securely erase. Some NAT mapping gets written to a log or swap file and then you overwrite it but the device silently reallocated that sector and the old one is still there. DRAM doesn't do that. Then if you e.g. power cycle the machine once a day, it never contains data more than a day old.
Etheryte 3y ago
I'm wondering this as well and I haven't seen a sufficiently good explanation yet. I know they've done audits of different kinds over the years, I've read up about their infrastructure and the way they run their services, but I don't realistically see any of that being enough of an argument, right there on the spot, when the police turn up with a warrant. What could they possibly have demonstrated and how?
- stametseater 3y ago
  > What could they possibly have demonstrated and how? Affiliation with an intelligence agency, who tell the petty beat cops to turn around and mind their own business. Probably more or less the same way that BATFE agents pretending to coyly sell illegal machine guns turn away any regular cop who might wander into the fishing expedition. With phone calls to police chiefs I imagine.
Marsymars 3y ago
I’ve got no real insight, but my guess would be that a) the goons have both technical and legal competence and b) Mullvad had legal representation show up quickly.
- kkielhofner 3y ago
  Have legal representation show up quickly means nothing. Consider the many, many scenarios where search warrants are served on companies with in house legal. Law firms. Individual lawyers. Literally happens every single day. Law enforcement has a warrant signed by a judge. Just because a lawyer of some sort is there doesn't mean they're going to stand around paralyzed saying "Oh there's a lawyer here, better stop what I'm doing and wait for XYZ". They're going to say "Oh you're a lawyer? Good for you. Here's a copy. Get out of the way and stand over there." Same thing for any technical or legal competence on the part of the authorities. You assembled enough cause for the warrant to be issued and you're going to walk away because the subject of the warrant basically says "Well see, I can explain everything..."? This is probably the equivalent of Neil deGrasse Tyson talking his way out of a speeding ticket on the side of the road by giving one of his (in)famous "Well actually officer, the Earth revolves around the sun while turning on it's axis at 25k MPH so actually I was..."[0]. Their version of events makes absolutely no sense to me. [0] - https://www.youtube.com/watch?v=TyZSBqQ813c https://www.youtube.com/watch?v=TyZSBqQ813c
  - troad 3y ago
    This is quite silly. A warrant isn’t a magic bullet that ends all your rights and gives the police superpowers. A lawyer can very much say “no, this information isn’t responsive to the warrant”, where a lay person may not realise this, and volunteer information that they have no legal obligation to hand over. The police absolutely rely on the information and power asymmetry between them and the public. You honestly don’t think the police behave very differently being watched (and these days often filmed) by a dozen high powered lawyers in suits, who will challenge absolutely everything they’ve just done as soon as they’re out the door?
    - 3y ago
michaelmrose 3y ago
It was Swedish cops. We all know I US cops would both be unlikely to comprehend the situation and would take everything that wasn't nailed down out of spite even if they did and would experience no consequences however other folks in better countries actually have rights. They had warrants to seize servers containing data relevant to a case. None such exists. They didn't have the right to just steal like US cops.
mike_hock 3y ago
You mean, sufficiently convincing that they leave empty-handed for now, knowing they'll have to come back with bigger guns. I'll be watching the news feed for updates on this.
jdmoreira 3y ago
This is in Sweden
jerry1979 3y ago
Perhaps a business would structure their physical infrastructure in anticipation of the language of search warrants. They could use documentation, the principle of separation of concern, and well-labeled physical devices.
smsm42 3y ago
In the US, the goons would probably take everything that had a plug, and the owners would spend a year or two getting their stuff back, if they are lucky. And, the goons enjoy total immunity so if they stole anything on the way, tough cookies. Example: https://www.forbes.com/sites/nicksibilla/2019/09/17/federal-court-cops-accused-of-stealing-over-225000-have-legal-immunity/ https://www.forbes.com/sites/nicksibilla/2019/09/17/federal-... Hopefully in Sweden it works differently.

slowmotiony 3y ago

After getting a call from the CIA to leave their honeypot alone, they left without taking anything ;-)

slekker 3y ago
Bold claim. Any more info on this?
- therein 3y ago
  Absolutely none but they are getting into the too good to be true territory. Given they are legit, they should take this as a compliment I guess.
InCityDreams 3y ago
...as a mullvad user, I salute you.