4 ms·

For those who are skeptical about these conspiracy theories, I've tried to explain why large vendors accede in a previous post and got great skeptical questions

by yajoe 13y ago

For those who are skeptical about these conspiracy theories, I've tried to explain why large vendors accede in a previous post and got great skeptical questions: https://news.ycombinator.com/item?id=5706695 https://news.ycombinator.com/item?id=5706695 tl;dr -- Most large public services you use (Skype, Exchange, likely Gmail, etc) have backdoors. Large vendors believe they have to respond to subpoenas or face public obstruction or co-conspiracy charges. As a result, they place these backdoors to avoid the PR or believe they are required to play by the US govt's rules. They may not be realtime backdoors, and they may require a bunch of processing, but it is possible to read most messages sent through large, popular systems (both voice and text like email, sms, chat). I think everyone is waiting for a major court ruling or congressional bill to clarify what's what. snippet of previous post to explain the vendor's mentality: > The govt comes by with a subpoena (secret, classified, or public) and requires Microsoft or the customer company to produce communication records that exist in a form that may be used as evidence. Failure to do so is best contempt of court and worst obstruction of justice. No 5th amendment privilege for other people's crimes [and prior to last year's ruling, it was assumed that passwords (or private keys) could be compelled for any reason in the US, and systems were built with that assumption]. So everyone who chooses to store or process messages makes it so the encryption is reversible and they can honor court requests. Nothing is private as a result. > There is not yet a way to build a messaging service that has both features [content-aware features like URL detection, spell-checkers, web browsing for dumb clients, targeted ads to fund free services, etc] AND [pure] privacy [in the US].

DenisM 13y ago
> The govt comes by with a subpoena (secret, classified, or public) and requires Microsoft or the customer company to produce communication records that exist in a form that may be used as evidence. Failure to do so is best contempt of court and worst obstruction of justice. This assertion seems dubious - IIRC the law (court order or subpoena or whatever) cannot compel a company to disclose information which they do not have in their possession. What are your sources (and/or credentials) supporting this opinion? [EDIT] While we're at it, could you please also substantiate the following claim of yours? It doesn't look right either - if this were so, then emails would be retained indefinitely whereas we know for a fact that they are routinely and aggressively purged, except when explicitly held for discovery. >There is a prevailing theory that companies are responsible for employee actions, and failing to log is seen as unacceptable.
- ds9 13y ago
  I recall some court rulings here in the US that a company could be required to install new software to write log data to disk, once the court found out that it was available in memory. This is only a special case of "information which they [do] have in their possession", but shows that that rule goes further than one might think. I am concerned about another scenario. I'm working on a site where people can exchange messages they've encrypted at the endpoints, such that the participants alone have the decryption ability and the server does not (assuming drawkbox is mistaken in some of his claims). Will it be illegal to launch this in the US if the requested law is passed first? Sometimes in tax law, courts have held that because Congress was considering a bill, the taxpayer was on notice that something was going to be illegal, and then the taxpayer was unable to rely on it, even though it was legal when he did it. Besides, USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded.
  - DenisM 13y ago
    I think it's best to look for a lawyer to get specific advice. Black-and-white statements like "USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded" only serve to cloud your judgement and blind you to the intricacies of the situation and your available options. You know it's not true.
jlgreco 13y ago
(I'm one of the guys that was talking with you in that link) To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. Once they have the capability, the government can then capable of compelling them to comply. I don't think the government is compelling them to build the capability in the first place. To use a concrete example, Bitlocker is presumably not backdoored by Microsoft and I don't believe that the government has any (public) laws that would allow them to compel Microsoft to modify Bitlocker in such a way. Microsoft's refusal to backdoor Bitlocker could not get them into any sort of official trouble. If Microsoft had Bitlocker backdoored already for whatever reason (say, customer service data recovery), then the government could compel them to comply them to unlock drives. I don't think we really disagree on anything substantial.
- btilly 13y ago
  To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. I disagree. Most are "backdoorable" because it is easier to build a service that way. For instance consider gmail. The hard requirement is that a person armed with a user name and password can login from a browser and get access to that email. The common requirement is that a person armed with the right cookie can get that email. Now in theory you could encrypt all of the emails on the server, but now your operations costs went through the roof. However if you store them in plain text then you can use smart indexing, and your operations costs are much more manageable. However once you've decided to have plain text files on your server, EVEN IF you aren't doing anything with them other than storing/sending them to the user, you're now able to backdoor those files, and hence can be compared to by a court. There have been many email systems out there. Open source (qmail, sendmail, etc), proprietary (Exchange, Dovecot, etc), hosted in the cloud (Hotmail, Gmail, etc), hosted at your company (Exim, Oracle Communications Messaging Server, etc), built on top of platforms not meant to do email (Lotus Notes being a prime example) and so on. Every single one of the ones I named and many, many, more stored data in plain text and legal discovery could be compelled on them. Simply because that was the easiest way to build them. There are exceptions, but they are exceptions because they were meant to be. Hushmail comes to mind. However even there, even when it was designed to store data in encrypted format, if the government can find a way to force you to extract data, they will push you to do so. (See http://en.wikipedia.org/wiki/Hushmail http://en.wikipedia.org/wiki/Hushmail for a description of the way in which the government got Hushmail to capture plain text, even though the data was stored in plain text.) The moral? Often the government has access not because evil profit-mongering corporations did wrong, but simply because obvious technical decisions leave them able to do so. And this can be true even when those corporations made a good faith effort to make that impossible.
LowKarmaAccount 13y ago
> Most large public services you use (Skype, Exchange, likely Gmail, etc) have backdoors. Google gave up Paula Broadwell's joint Gmail account with David Petraeus to the FBI after receiving a subpoena. Gmail isn't secure unless you log in through Tor, compose your message on a separate editor (to avoid autosaving of plaintext) and then copy and paste a PGP encrypted message before you send it. Now, you might think that this is a ridiculous and impractical thing to do, especially if you are not guilty of any crimes. But Paula Broadwell wasn't guilty of any crimes (or at least wasn't charged with any crimes) before Google happily violated her privacy by giving away her information without a warrant.
- declan 13y ago
  It would have been a search warrant from the FBI, not a subpoena. The FBI was notified about the Broadwell "harassment" in mid-2012, and by then Google had nationalized Warshak and was requiring a search warrant for the contents of email communications.
  - LowKarmaAccount 13y ago
    You're right. The FBI did have a warrant to monitor her email accounts [ǣ] (it's too late to edit my previous comment). The troubling thing about the Broadwell story was the FBI's preferential treatment of Kelley because she knew members of the agency. It shows how easy it is to get the FBI to investigate your enemies if you have connections; otherwise it is difficult to get the FBI to care about your case, especially if no one was physically hurt and no monetary damage was caused. [ǣ] http://online.wsj.com/article/SB10001424127887324073504578113460852395852.html http://online.wsj.com/article/SB1000142412788732407350457811...
declan 13y ago
The parent post says companies "believe they have to respond to subpoenas or face public obstruction or co-conspiracy charges." This is simply not true. Google fought a DOJ subpoena for search terms in court (while Yahoo, AOL, and Microsoft did not): http://news.cnet.com/FAQ-What-does-the-Google-subpoena-mean/2100-1029_3-6029042.html http://news.cnet.com/FAQ-What-does-the-Google-subpoena-mean/... Twitter successfully fought for the ability to notify the Wikileaks crew of a DOJ (d) order it received, who then fought it in court with the help of EFF and ACLU: http://news.cnet.com/8301-31921_3-20027893-281.html http://news.cnet.com/8301-31921_3-20027893-281.html Facebook fought a subpoena from the state of Virginia: http://news.cnet.com/8301-13578_3-10352587-38.html http://news.cnet.com/8301-13578_3-10352587-38.html Amazon.com fought the DOJ in court in Wisconsin and fought the North Carolina tax collectors in court in Seattle: http://news.cnet.com/8301-13578_3-9824977-38.html http://news.cnet.com/8301-13578_3-9824977-38.html http://news.cnet.com/8301-31921_3-20020680-281.html http://news.cnet.com/8301-31921_3-20020680-281.html And, perhaps most importantly, Google is currently challenging a secret NSL it received from the FBI in federal court in San Francisco, making it the first large Internet company to do so. In other words, the thesis of the parent's post -- that "contempt of court" is likely -- has been disproven by recent history. That said, I think it's fair to say that AT&T, Verizon, and the other telcos have a much closer relationship with law enforcement and are less likely to take privacy-protective steps via litigation. Look at AT&T's warrantless wiretapping for the NSA. And in the case of the recently-publicized DOJ subpoena to Verizon for the AP's phone records, Verizon could have notified the affected journalists, but chose not to do so.
hawleyal 13y ago
> There is not yet a way to build a messaging service that has both features [content-aware features like URL detection, spell-checkers, web browsing for dumb clients, targeted ads to fund free services, etc] AND [pure] privacy [in the US]. If you did it on the client, and not on the server, you could provide those features without reading messages, or breaking end-to-end encryption.

by yajoe 13y ago

DenisM 13y ago

> The govt comes by with a subpoena (secret, classified, or public) and requires Microsoft or the customer company to produce communication records that exist in a form that may be used as evidence. Failure to do so is best contempt of court and worst obstruction of justice. This assertion seems dubious - IIRC the law (court order or subpoena or whatever) cannot compel a company to disclose information which they do not have in their possession. What are your sources (and/or credentials) supporting this opinion? [EDIT] While we're at it, could you please also substantiate the following claim of yours? It doesn't look right either - if this were so, then emails would be retained indefinitely whereas we know for a fact that they are routinely and aggressively purged, except when explicitly held for discovery. >There is a prevailing theory that companies are responsible for employee actions, and failing to log is seen as unacceptable.

ds9 13y ago
I recall some court rulings here in the US that a company could be required to install new software to write log data to disk, once the court found out that it was available in memory. This is only a special case of "information which they [do] have in their possession", but shows that that rule goes further than one might think. I am concerned about another scenario. I'm working on a site where people can exchange messages they've encrypted at the endpoints, such that the participants alone have the decryption ability and the server does not (assuming drawkbox is mistaken in some of his claims). Will it be illegal to launch this in the US if the requested law is passed first? Sometimes in tax law, courts have held that because Congress was considering a bill, the taxpayer was on notice that something was going to be illegal, and then the taxpayer was unable to rely on it, even though it was legal when he did it. Besides, USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded.
- DenisM 13y ago
  I think it's best to look for a lawyer to get specific advice. Black-and-white statements like "USG in recent years has proved to be unrestrained by legal barriers to anything it has demanded" only serve to cloud your judgement and blind you to the intricacies of the situation and your available options. You know it's not true.

jlgreco 13y ago

(I'm one of the guys that was talking with you in that link) To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. Once they have the capability, the government can then capable of compelling them to comply. I don't think the government is compelling them to build the capability in the first place. To use a concrete example, Bitlocker is presumably not backdoored by Microsoft and I don't believe that the government has any (public) laws that would allow them to compel Microsoft to modify Bitlocker in such a way. Microsoft's refusal to backdoor Bitlocker could not get them into any sort of official trouble. If Microsoft had Bitlocker backdoored already for whatever reason (say, customer service data recovery), then the government could compel them to comply them to unlock drives. I don't think we really disagree on anything substantial.

btilly 13y ago
To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. I disagree. Most are "backdoorable" because it is easier to build a service that way. For instance consider gmail. The hard requirement is that a person armed with a user name and password can login from a browser and get access to that email. The common requirement is that a person armed with the right cookie can get that email. Now in theory you could encrypt all of the emails on the server, but now your operations costs went through the roof. However if you store them in plain text then you can use smart indexing, and your operations costs are much more manageable. However once you've decided to have plain text files on your server, EVEN IF you aren't doing anything with them other than storing/sending them to the user, you're now able to backdoor those files, and hence can be compared to by a court. There have been many email systems out there. Open source (qmail, sendmail, etc), proprietary (Exchange, Dovecot, etc), hosted in the cloud (Hotmail, Gmail, etc), hosted at your company (Exim, Oracle Communications Messaging Server, etc), built on top of platforms not meant to do email (Lotus Notes being a prime example) and so on. Every single one of the ones I named and many, many, more stored data in plain text and legal discovery could be compelled on them. Simply because that was the easiest way to build them. There are exceptions, but they are exceptions because they were meant to be. Hushmail comes to mind. However even there, even when it was designed to store data in encrypted format, if the government can find a way to force you to extract data, they will push you to do so. (See http://en.wikipedia.org/wiki/Hushmail http://en.wikipedia.org/wiki/Hushmail for a description of the way in which the government got Hushmail to capture plain text, even though the data was stored in plain text.) The moral? Often the government has access not because evil profit-mongering corporations did wrong, but simply because obvious technical decisions leave them able to do so. And this can be true even when those corporations made a good faith effort to make that impossible.

LowKarmaAccount 13y ago

> Most large public services you use (Skype, Exchange, likely Gmail, etc) have backdoors. Google gave up Paula Broadwell's joint Gmail account with David Petraeus to the FBI after receiving a subpoena. Gmail isn't secure unless you log in through Tor, compose your message on a separate editor (to avoid autosaving of plaintext) and then copy and paste a PGP encrypted message before you send it. Now, you might think that this is a ridiculous and impractical thing to do, especially if you are not guilty of any crimes. But Paula Broadwell wasn't guilty of any crimes (or at least wasn't charged with any crimes) before Google happily violated her privacy by giving away her information without a warrant.

declan 13y ago
It would have been a search warrant from the FBI, not a subpoena. The FBI was notified about the Broadwell "harassment" in mid-2012, and by then Google had nationalized Warshak and was requiring a search warrant for the contents of email communications.
- LowKarmaAccount 13y ago
  You're right. The FBI did have a warrant to monitor her email accounts [ǣ] (it's too late to edit my previous comment). The troubling thing about the Broadwell story was the FBI's preferential treatment of Kelley because she knew members of the agency. It shows how easy it is to get the FBI to investigate your enemies if you have connections; otherwise it is difficult to get the FBI to care about your case, especially if no one was physically hurt and no monetary damage was caused. [ǣ] http://online.wsj.com/article/SB10001424127887324073504578113460852395852.html http://online.wsj.com/article/SB1000142412788732407350457811...

declan 13y ago

The parent post says companies "believe they have to respond to subpoenas or face public obstruction or co-conspiracy charges." This is simply not true. Google fought a DOJ subpoena for search terms in court (while Yahoo, AOL, and Microsoft did not): http://news.cnet.com/FAQ-What-does-the-Google-subpoena-mean/2100-1029_3-6029042.html http://news.cnet.com/FAQ-What-does-the-Google-subpoena-mean/... Twitter successfully fought for the ability to notify the Wikileaks crew of a DOJ (d) order it received, who then fought it in court with the help of EFF and ACLU: http://news.cnet.com/8301-31921_3-20027893-281.html http://news.cnet.com/8301-31921_3-20027893-281.html Facebook fought a subpoena from the state of Virginia: http://news.cnet.com/8301-13578_3-10352587-38.html http://news.cnet.com/8301-13578_3-10352587-38.html Amazon.com fought the DOJ in court in Wisconsin and fought the North Carolina tax collectors in court in Seattle: http://news.cnet.com/8301-13578_3-9824977-38.html http://news.cnet.com/8301-13578_3-9824977-38.html http://news.cnet.com/8301-31921_3-20020680-281.html http://news.cnet.com/8301-31921_3-20020680-281.html And, perhaps most importantly, Google is currently challenging a secret NSL it received from the FBI in federal court in San Francisco, making it the first large Internet company to do so. In other words, the thesis of the parent's post -- that "contempt of court" is likely -- has been disproven by recent history. That said, I think it's fair to say that AT&T, Verizon, and the other telcos have a much closer relationship with law enforcement and are less likely to take privacy-protective steps via litigation. Look at AT&T's warrantless wiretapping for the NSA. And in the case of the recently-publicized DOJ subpoena to Verizon for the AP's phone records, Verizon could have notified the affected journalists, but chose not to do so.

hawleyal 13y ago

> There is not yet a way to build a messaging service that has both features [content-aware features like URL detection, spell-checkers, web browsing for dumb clients, targeted ads to fund free services, etc] AND [pure] privacy [in the US]. If you did it on the client, and not on the server, you could provide those features without reading messages, or breaking end-to-end encryption.