11 ms·
Commerce Department Proposes Imposing "Know Your Customer" on IaaS Providers
- dcow 3y agoI sit in the middle. Imposing seems a bit strict, but we absolutely do need a better default digital identity layer than “I have an inbox”, no matter what the anons say. With Persona you can IDV using mDL. It’s already happening. What hasn’t happened yet is the “pay with apple/google wallet” UX for situations when someone needs to verify your identity. Passkeys with a VC presentation extension would be really cool.
- ETH_start 3y ago"I have an inbox" is the principle behind Internet Freedom, where services can be accessed permissionlessly and people can interact freely without government restrictions. This takes us down a road to a centralized internet with government agencies acting as gatekeepers. Not only is this dangerous, in making political repression orders of magnitude easier, it is inefficient, as it replaces the apolitical efficiency of the permissionless internet with a bureaucratic and friction-laden process for internet interactions.
- naasking 3y agoCentralized identity also arguably weakens security. The assumption that you can rely on this identity to disincetivize this actor from behaving badly means you'll be less strict about implementing robust protocols or policies to detect or mitigate bad behaviour. Identities will be forged or circumvented at some point, and this laxer security will make the consequences of the breach so much larger as a result.
- ETH_start 3y agoIt also creates PII honeypots that can be hacked. But I'm willing to even concede that a highly controlled internet will lead to less internet crime. But it'll be a Devil's Bargain where the price of less internet crime will be less economic activity and wealth. Repression of the general population to reduce the threat posed by bad actors is counter-productive to the larger goal of a safer and more prosperous world. Less prosperous as repression inhibits productivity and less safe because less prosperity makes people less able to reduce the risks that they face. To give a concrete example: the people of a city that has access to Uber or an Uber-like service (more prosperity) are safer than those of a city relying on older taxi technology involving flagging down cabs with no ratings (less prosperity). The former have greater freedom of movement which has a huge number of positive second order effects, many of which improve personal safety. The emergence and rapid evolution of services like Uber is largely because of Internet Freedom giving internet projects space for deployment and iteration outside the confines of regimented safety processes.
- dcow 3y agoCurious, why are we okay with this when it’s your job securing trade secrets and IP but not when it’s your nation securing its citizens and preventing spam and fraud?
- naasking 3y agoIs there evidence it would prevent spam and fraud? Is there evidence that it would "secure its citizens"? Also, plenty of people on this forum are not OK with securing IP either, seeing it as a serious impediment to the free flow of ideas and the advancement of human knowledge. Basically the same argument the OP just described.
- ETH_start 3y agoSorry, can you elaborate? You mean why are we okay with employers imposing restrictions on employees to protect trade secrets, but not with governments imposing restrictions on citizens to protect people from being spammed and defrauded?
- redwood 3y agoI would have thought this essentially already existed what about OFAC for example?
- salawat 3y agoSo you want OFCC? Office of Foreign Compute Control?
- redwood 3y agoI just mean that you already have to know your customer. What am I missing?
- salawat 3y agoOFAC only applies to financial institutions, and maintains a centralized list yhat is checked on every transaction. If any of the endpoint data matches an individual on that list, money is allowed only to flow in to an account, never to leave. It's essentially a "you are banned from evonomic activity button". But that's only a small part of the AML/KYC package. The other part is the active surveillance obligations on behalf of law enforcement that a financial has to engage in. I.e., the filing of SAR (suspicious activity reports), and reports whenever large amounts of cash are withdrawn from their custody. These are the AML side of things, that basically turns the financial system into an extension of paw enforcement. This proposed KYC program from Commerce is applying the same template of obligations to U.S. cloud providers. Maybe it'll only be them for a few years, but much like FATCA ended up expanding OFAC's influence worldwide, so to likely will this be propagated worldwide.
- redwood 3y agoGot it, in other words going beyond just a moment of someone signing up or putting in a credit card to actually continuously evaluating whether or not it looks like a user of the service may be on the list.. tricky indeed
- reaperman 3y agoIs a VPN like Mullvad “infrastructure”? I’m having trouble figuring out who is an “IaaS” provider.
- wmf 3y agoGenerally IaaS means VMs or bare metal servers. VPN would be more like network as a service.
- nimbius 3y agoSaaS: gmail, vpn providers, ebay. IaaS: running your own email server, your own cloud, your own vpn. I'm vehemently against the idea of a KYC for iaas. This just feels like another swipe at destroying internet anonymity. "Foreign actors" already route traffic over every network in the US. Preventing them from getting an ec2 isnt necessary as senators can already request aws drop customers because they dont like them (joe lieberman personally pulled the plug on wikileaks)
- forgetfreeman 3y agoInternet anonymity was destroyed decades ago. That horse is not going back into the barn.
- int_19h 3y agoAll the more reason to fight tooth and nail for whatever scraps we still have left.
- which 3y agoNot really. With Tor, Protonmail, njal.la, Flokinet (or one of a hundred other competitors), and $100 in Bitcoin from an ATM that you convert to Monero, you have enough to host a website and domain that are completely disassociated from your real life identity for a year.
- lostemptations5 3y agoSo easy!
- which 3y agoI wouldn't say easy but things are definitely easier now that it is possible to pay for things anonymously without having to use things like Liberty Reserve. On the other hand less of the web is usable now without Javascript and tracking than before.
- forgetfreeman 3y ago
- mistrial9 3y agothis is a "ratchet" mechanism; once implemented, there is no going back. Everything is gravy when you are making the money and all your ID is accepted, but the first day you are fired and locked out for it, or the election in your country goes a way that someone does not like.. you may change your mind. Is there a way forward? yes, penalties for abuse, not "papers please" life for every peon on Earth.
- unethical_ban 3y agoSo, complete de-anonimization of internet infrastructure in the United States. If you have something to say on a platform we don't already control (Meta, etc) then you must provide your private data to the government to do so. Watch the US say in a few years that they will block all international VPN connectivity for security reasons.
- threeseed 3y agoNo one is forced to use Facebook or buy an instance from AWS. You can run your own infrastructure in whatever data centre is willing to host you.
- didntcheck 3y agoAs a legal measure, this proposal will affect all IaaS platforms, so you can't just find another that doesn't do it "Just build your own website" has rapidly turned into "just build your own data center, domain registrar, CDN and DDoS protection shield, T1 ISP, advertising network, search engine, and defeat the VISA/MasterCard duopoly if you want any income". The pro-deplatforming crowd has shown that they'll use every possible measure to make a site they don't like impossible to operate, rather than stopping at their claim that they just don't want the content on Facebook or whatever
- threeseed 3y agoa) You can simply run your own servers in a data centre. b) You don't just get to demand that the entire world bends to your whims.
- whatshisface 3y agoI think the issue is that some people very much do get to demand that the entire world bends to their whims...
- gotoeleven 3y agoIf it prevents even one misgendering it will all be worth it.
- greatgib 3y agoThe tech world is really becoming a surveillance nightmare. Always for the same dubious straw men reasons of terrorism and co, they want to control everyone. Like for banks, the excuse is to ensure that no forbidden foreign actor is allowed the use of the service , but just for that the billion legitimate users will all have to provide their complete justificative info, IPs, and support documents to later be used by the org or gov for whatever reason they will want once they will have them. Like for banks. Imagine if the same thing was requested in the real world, like forced to prove your identity when you take gas, When you buy a computer, when you buy a condom.
- tiznow 3y agoalways_has_been.jpg
- pessimizer 3y ago> The tech world is really becoming a surveillance nightmare. Most definitely was not.
- forgetfreeman 3y ago30 years ago maybe.
- deleted 3y ago[deleted]
- api 3y agoThe strongest incentives for surveillance are actually in the private sector: the need for internal KPIs, selling data, targeted advertising, product and sales funnel optimization, and now AI training data. The government pushes surveillance too but in my experience it’s the secondary driver, at least in the US. Might be different in other countries. I’m really pessimistic about privacy online given that every single incentive both public and private encourages maximum privacy invasion and centralization. I mean every single incentive. It’s almost impossible to resist. We might have a chance if end users cared enough to pay for privacy and avoid things that invade it, but very few do. Most people care about convenience, features, and cost, and that’s it. Nothing else matters.
- js4ever 3y ago"At minimum, U.S. IaaS providers must gather and retain specific identifying information from potential foreign customers and foreign beneficial owners to verify their identity, including their: Name; Address; Means and source of payment; Email address; Telephone number; and “IP address(es) used for access or administration and the date and time of each such access or administrative action.” I'm pretty sure all IaaS providers already have all that (except maybe the phone number which is not mandatory
- unethical_ban 3y agoWith vultr you just need an email address and you can pay with Bitcoin.
- incompatible 3y agoI doubt that they'd typically verify that the name and address are accurate. Unlike opening an account at a bank or getting a cell phone connection (at least where I live) which require ID in a form that the government approves of.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- FpUser 3y ago[flagged]
- ETH_start 3y agoThis is an absolutely Big Brother mandate. Bad actors and foreign threats will always exist, implying that privacy will always be criminalized under this paradigm whereby the presence of a threat justifies invading people's privacy.
- forgetfreeman 3y agoNo perfect solutions exist so nothing should be done. Gotcha.
- whatshisface 3y agoNothing should be "done" about the fact I don't know your name.
- forgetfreeman 3y ago1. you aren't a sovereign nation so tf are you even on about. 2. I'm not engaged in any activities that warrant scrutiny, so again tf are you even on about.
- ronsor 3y agoDoing "something" because something must be done is not logical either. https://en.wikipedia.org/wiki/Politician%27s_syllogism https://en.wikipedia.org/wiki/Politician%27s_syllogism
- forgetfreeman 3y agoNeither is shitting on someone else's proposal when you have nothing to replace it with.
- salawat 3y agoNot doing something is always an option. Not all things need be made. In point of fact, there are many things that should not be made.
- wolverine876 3y agoDon't most businesses want to harvest customer info anyway? Will there be opposition from the IaaS providers?
- Canada 3y agoEvil, I guess that means I need to dump AWS and Digital Ocean now. I think it's worth contacting your support rep if you don't like this and letting them know you're going looking to take your business elsewhere if this happens.
- forgetfreeman 3y agoK so we've decided any level of oversight into who might be using iaas to (for example) train belligerent ai models is evil? On what grounds?
- sirreal14 3y agoAI safetyists have already called for airstriking """rouge""" data centers, don't play coy and pretend that your worldview stops at KYC for infrastructure.
- forgetfreeman 3y agoI have literally no idea wtf you're talking about but now that you bring it up being able to quickly eliminate the source point(s) for targeted attacks on critical infrastructure seems pretty uncontroversial.
- T-A 3y ago> I have literally no idea wtf you're talking about Probably this: https://twitter.com/ESYudkowsky/status/1641953192761266177 https://twitter.com/ESYudkowsky/status/1641953192761266177
- forgetfreeman 3y agoMuch appreciated
- Canada 3y agoYes, any oversight of compute jobs is evil, full stop. And really, once you start using a lot of resources at a cloud company they start asking about you and your workloads because they want to up sell you more services. I'm sure they're also thinking about what kind of credit risk you might be since the industry generally operates on a post-payment basis. They will also require further information if you're doing things that have potential to harm their services such as email sending. There is no good reason to demand the identity of people spending 1000 bucks a month on virtual machines that nobody is complaining about, it's outright totalitarian.
- earthwalker99 3y ago[flagged]
- aaomidi 3y agoI remember when I signed up for hetzner, they had something like this?
- CodesInChaos 3y agoI think Hetzner does that to combat fraudulent signups, not because they're required to do so by law. But in general Germany is quite hostile to online privacy, it's not a role model other countries should follow.
- nobody9999 3y agoRelated[0][1] news: Judge’s Ruling Sets Back Law Meant to Fight Money Laundering "An Alabama judge barred the government from collecting certain company ownership data to help the Treasury Department identify money launderers, and called the effort a case of congressional overreach." [0] https://www.nytimes.com/2024/03/03/us/politics/judge-ruling-corporate-transparenct-act.html https://www.nytimes.com/2024/03/03/us/politics/judge-ruling-... [1] https://archive.is/6gOMl https://archive.is/6gOMl
- hnburnsy 3y ago> Related[0][1] news: > > Judge’s Ruling Sets Back Law Meant to Fight Money Laundering > > "An Alabama judge barred the government from collecting certain company ownership data to help the Treasury Department identify money launderers, and called the effort a case of congressional overreach." > > [0] https://www.nytimes.com/2024/03/03/us/politics/judge-ruling-corporate-transparenct-act.html https://www.nytimes.com/2024/03/03/us/politics/judge-ruling-... > > [1] https://archive.is/6gOMl https://archive.is/6gOMl I don't know why there has not been more uproar over this. By the end of the year over 33 million business owners in the US will be required to give FinCen identifying info including a photo ID for owners of 25% of their business. In addition those just filling out the application must do the same.
- anon373839 3y agoWhere to direct the uproar? It doesn't matter which partisan puppet sits in the Oval Office or any other office -- they will continue to sell you out to Big Surveillance, as their predecessors have done. The only real difference among them is the culture war window dressing, and that's tiresome.
- Animats 3y agoThis includes criminalizing having too much compute power: "The proposed rule requires U.S. IaaS providers and their foreign resellers to report known instances of foreign persons training “large AI models with potential capabilities that could be used in malicious cyber-enabled activity” to Commerce. Use a GPU, go to prison?
- matt123456789 3y agoReporting known instances of transactions which could result in the training of a large AI model with potential capabilities that could be used in malicious cyber-enabled activity. Which is to say: every language model and image generator with >100M params. In other words, IaaS providers must report nearly every transaction, since you can train a LoRA module for a small model on a few hundred ARM cores, or on nearly any datacenter GPU. To be clear though, the rule doesn’t include prison time for you, the GPU user. The prison time and/or fines are for the noncompliant IaaS provider, which means that cloud GPUs (and possibly every other resource) will be much more expensive and harder to access.
- RabbiNoseberg 3y ago[dead]
- benced 3y agoI’m disappointed none of the top comments here mention Commerce’s years-long effort to restrict Chinese access to leading-edge GPUs. The origin of this policy is the simple realization that those restrictions are meaningless if an AWS account gets around them. Argue against that if you’d like, but argue against the correct thing.
- matt123456789 3y agoYes, that is another thing that Commerce is doing. And your assumption of the motivation for this proposal is probably accurate. But the two things are not the same. Here, the wording of the proposed rule doesn’t appear to limit it in scope to H100s and GroqRacks. That makes this a separate issue. It also imposes entirely separate restrictions and reporting requirements on an entirely different class of provider. I’m not sure why you’re insisting that we treat them as the same issue.
- benced 3y agoI don't think I've seen a single comment along the lines of "I don't like this rule but it would be reasonable for only A100 and H100 equipped instances" (which would be my personal stance FWIW). Instead, it's just binary opposition to any form of KYC on compute.
- deleted 3y ago[deleted]
- donw 3y agoSo, basically the same as in the People’s Republic of China
- whatshisface 3y agoThe executive branch should not be allowed to do an end run around Congress for something this significant. If enacted, this would give foreign hosting companies like Hetzner a huge efficiency advantage over domestic suppliers. (Data center customers aren't presently unknown to law enforcement, because banks will help trace payments. However this could, due to the per-user burden, make it impractical for smaller hosts to offer free tiers, or even to serve small accounts.)
- jevoten 3y agoEasy way to bypass the 4th amendment - force private business to pre-emptively surveil everyone.