4 ms·

This seems like such a weird problem to me. If they're criminals, just send the cops? If you can't send the cops, then they aren't criminals? How do you end up

This seems like such a weird problem to me. If they're criminals, just send the cops? If you can't send the cops, then they aren't criminals? How do you end up in this limbo where you need critical infrastructure to play judge?

lolinder 3y ago
The internet is a global system that spans ~all jurisdictions, and most internet criminals live in jurisdictions that don't prosecute internet crimes as long as the bad actors leave citizens of their own country alone. So they're criminals as far as the US and allies are concerned, but de facto not criminals where they live. If they're going to be locked out of the system, it has to be by the infrastructure, because their government has no interest in stopping them.
- AlienRobot 3y ago
  I see. Perhaps there should be a legal framework to get the government to demand companies like cloudflare stop serving these international criminals, then. That way it wouldn't depend on a private entity making the judgement. Do you ever think it's weird that we have gone through web 1.0, web 2.0, semantic web, intertubes clogged with spam bots, web 3.0: crypto edition, and the dawn of AI scraping, and we still haven't figured out these issues?
  - Caligatio 3y ago
    Which government do you mean when you say "the government"? Any national government? Only the US government? Only governments in which the US is friendly and/or has agreements with? Would you want authoritarian governments to be able to demand Cloudflare stop serving those they consider criminals that are outside their borders? International law is messy.
    - toast0 3y ago
      The rule of thumb is governments where Cloudflare has equipment, personel, or banking. There is a procedure to get a foreign case recognized in the US, too, but it has to be serious, and it's not an easy process.
      - Caligatio 3y ago
        CloudFlare has equipment in 120+ countries, including China: https://www.cloudflare.com/network/ https://www.cloudflare.com/network/ I again ask: is it desirable for any of those countries to be able to unilaterally force a company to enforce its laws regardless of where the individual in question is?
        toast0 3y ago
        If the equipment is in country X, it seems reasonable to enforce the rules of country X. Plenty of companies refuse to operate in specific countries, including China, because they don't want to follow rules of that country. If CloudFlare chooses to do business in China, that's a choice they're making and it comes with consequences. Maybe they can offer service where customers will only be served from equipment outside of China, maybe that's not something they choose.
    - immibis 3y ago
      For starters, Cloudflare is a USA company so it has to do whatever the USA government tells it. See National Security Letters. They can easily order it to reveal the origin server of a website, or the sign-up IP address of the account, or to stop providing services to one.
newaccount74 3y ago
Cloudflare shields criminals from cops. They do so because of "free speech" or whatever. There was recently a story about a swatting victim, who tried to get the forum the swatters use to shut down. Cloud flare refused to give the identity of the criminals, the case even went to court and the victim lost and now apparently has to pay court costs. Our legal system is unfortunately not perfect, which is why it matters what infrastructure providers do. Do they enable criminals by shielding them from the police? Or do they have policies in place that prevent abuse of their service? With Cloudflare, I'm pretty sure they lean towards the former.
- ehutch79 3y ago
  I'm reasonably sure cloudflare would comply with any subpoenas / warrants sent their way.
  - derefr 3y ago
    Which is a catch-22, because subpoenas / warrants for collection of digital information have to name a specific intended target (a real legal identity under suspicion, not some pseudonym) — and "the real legal identity of the suspect" is exactly the thing that Cloudflare's proxy-shielding prevents you from learning. Courts won't act until they have some specific individual to act toward. (This is also why, whenever you hear about e.g. police stings on Tor forums, they never mention requesting courts to issue warrants to ISPs for collection of e.g. traffic-analysis-correlation info about locations of servers hosting illegal content. Instead, this de-anonymization step is something they always have to achieve extra-judicially, usually by contracting a private network threat intelligence firm.)
    - struant 3y ago
      Or you don't hear about the methods they are using for deanonymizing because they would get the cases thrown out of a court. Warrantless wiretapping and the like... And the private firm is just lying for them so law enforcement can do parallel construction.
- 3y ago
hnbad 3y ago
Are you American? Because that sounds like such an American idea of how the world works. To answer your question: most malware actors can be traced back to Russia, what exactly do you think "sending the cops" after them will accomplish and if the answer is "nothing", then does that mean you don't think they can be called criminals?
- AlienRobot 3y ago
  It doesn't need to be physical cops. What I mean is that if crimes are being committed, the legal system should initiate a process that either puts them in jail (which as you say may not be possible) or ends up with cloudflare banning and other internet companies blacklisting them. That way, the burden of judging criminality isn't on random companies but on the appropriate authorities.
  - wlonkly 3y ago
    Legal systems. And getting the Russian and American legal systems to cooperate is about as hard as getting Russia and America to cooperate.
stef25 3y ago
Who you going to send to an online pharmacy hosted say in Egypt?
- caskstrength 3y ago
  Why do you need to take down Egyptian pharmacy in the first place?
  - iopq 3y ago
    Because they send controlled substances to the US and falsely label them as "supplements" I know, because I bought RX stuff from India and it did not get labelled as medication
    - caskstrength 3y ago
      Someone bought roids from India and didn't get busted by DEA in the process?! The horror!

lolinder 3y ago

The internet is a global system that spans ~all jurisdictions, and most internet criminals live in jurisdictions that don't prosecute internet crimes as long as the bad actors leave citizens of their own country alone. So they're criminals as far as the US and allies are concerned, but de facto not criminals where they live. If they're going to be locked out of the system, it has to be by the infrastructure, because their government has no interest in stopping them.

AlienRobot 3y ago
I see. Perhaps there should be a legal framework to get the government to demand companies like cloudflare stop serving these international criminals, then. That way it wouldn't depend on a private entity making the judgement. Do you ever think it's weird that we have gone through web 1.0, web 2.0, semantic web, intertubes clogged with spam bots, web 3.0: crypto edition, and the dawn of AI scraping, and we still haven't figured out these issues?
- Caligatio 3y ago
  Which government do you mean when you say "the government"? Any national government? Only the US government? Only governments in which the US is friendly and/or has agreements with? Would you want authoritarian governments to be able to demand Cloudflare stop serving those they consider criminals that are outside their borders? International law is messy.
  - toast0 3y ago
    The rule of thumb is governments where Cloudflare has equipment, personel, or banking. There is a procedure to get a foreign case recognized in the US, too, but it has to be serious, and it's not an easy process.
    - Caligatio 3y ago
      CloudFlare has equipment in 120+ countries, including China: https://www.cloudflare.com/network/ https://www.cloudflare.com/network/ I again ask: is it desirable for any of those countries to be able to unilaterally force a company to enforce its laws regardless of where the individual in question is?
      - toast0 3y ago
        If the equipment is in country X, it seems reasonable to enforce the rules of country X. Plenty of companies refuse to operate in specific countries, including China, because they don't want to follow rules of that country. If CloudFlare chooses to do business in China, that's a choice they're making and it comes with consequences. Maybe they can offer service where customers will only be served from equipment outside of China, maybe that's not something they choose.
  - immibis 3y ago
    For starters, Cloudflare is a USA company so it has to do whatever the USA government tells it. See National Security Letters. They can easily order it to reveal the origin server of a website, or the sign-up IP address of the account, or to stop providing services to one.

newaccount74 3y ago

Cloudflare shields criminals from cops. They do so because of "free speech" or whatever. There was recently a story about a swatting victim, who tried to get the forum the swatters use to shut down. Cloud flare refused to give the identity of the criminals, the case even went to court and the victim lost and now apparently has to pay court costs. Our legal system is unfortunately not perfect, which is why it matters what infrastructure providers do. Do they enable criminals by shielding them from the police? Or do they have policies in place that prevent abuse of their service? With Cloudflare, I'm pretty sure they lean towards the former.

ehutch79 3y ago
I'm reasonably sure cloudflare would comply with any subpoenas / warrants sent their way.
- derefr 3y ago
  Which is a catch-22, because subpoenas / warrants for collection of digital information have to name a specific intended target (a real legal identity under suspicion, not some pseudonym) — and "the real legal identity of the suspect" is exactly the thing that Cloudflare's proxy-shielding prevents you from learning. Courts won't act until they have some specific individual to act toward. (This is also why, whenever you hear about e.g. police stings on Tor forums, they never mention requesting courts to issue warrants to ISPs for collection of e.g. traffic-analysis-correlation info about locations of servers hosting illegal content. Instead, this de-anonymization step is something they always have to achieve extra-judicially, usually by contracting a private network threat intelligence firm.)
  - struant 3y ago
    Or you don't hear about the methods they are using for deanonymizing because they would get the cases thrown out of a court. Warrantless wiretapping and the like... And the private firm is just lying for them so law enforcement can do parallel construction.
3y ago

hnbad 3y ago

Are you American? Because that sounds like such an American idea of how the world works. To answer your question: most malware actors can be traced back to Russia, what exactly do you think "sending the cops" after them will accomplish and if the answer is "nothing", then does that mean you don't think they can be called criminals?

AlienRobot 3y ago
It doesn't need to be physical cops. What I mean is that if crimes are being committed, the legal system should initiate a process that either puts them in jail (which as you say may not be possible) or ends up with cloudflare banning and other internet companies blacklisting them. That way, the burden of judging criminality isn't on random companies but on the appropriate authorities.
- wlonkly 3y ago
  Legal systems. And getting the Russian and American legal systems to cooperate is about as hard as getting Russia and America to cooperate.

stef25 3y ago

Who you going to send to an online pharmacy hosted say in Egypt?

caskstrength 3y ago
Why do you need to take down Egyptian pharmacy in the first place?
- iopq 3y ago
  Because they send controlled substances to the US and falsely label them as "supplements" I know, because I bought RX stuff from India and it did not get labelled as medication
  - caskstrength 3y ago
    Someone bought roids from India and didn't get busted by DEA in the process?! The horror!