That's pretty interesting. It must be extremely risky for local employees to alert the main offices to lock down. I'd imagine obstruction of justice isn't a crime your average employee would risk.
And from all reports, employees were specifically trained to do this, and they knew why. Open and shut case.
The internal alert might not have been "law enforcement has arrived with a warrant for our computers." It might have been more like "a bunch of armed men just demanded to be let into the building, I don't know who they are yet, shut everything down now and ask questions later."
Employees might have a legal obligation to protect some of the data that's accessible from their office computers. Maybe credit card and banking information, or health information for drivers?
Yeah... Not buying it. Random armed men appear in the building and some employee is more worried about the company data, rather than calling police to alert/verify?
The first thing the armed men will do is show identification and a warrant. This isn't a no-knock raid by a swat team in the middle of the night.
Judges tend not to take those kind of coy answers very well.
Are you an expert in identification and warrant? I never saw one, you could print a fake one and I couldn't tell if it's right. Same for any identification.
Once we talked about doing some relatively public MILSIM with friends. It didn't take 5 minutes for us to realize that it would end badly because of that. If your goal is to access Uber data or any big corporation for that matter, you can see how easy it would be to profit from that.
Thus, lock everything down and let legal experts actually take care of that seems like a pretty good solution to avoid this kind of situation. They are there to seize data, they can do it as much as they want. They can then force Uber to unencrypt the computers.
If they're going to risk decades in jail anyway, there's a good chance they're just going to shoot you if you start telling them they can't have what they want.
Your job isn't worth risking obstruction charges or facing down criminals.
All this protects Uber from is fishing expeditions where the police hope to come across an "unlocked door" so they can sift through everything hoping to find something.
I get that we don't like Uber, but I support this type of action and think it should be standard operating procedure for every organization.,
What I am worried about is the employee that gets directed to lock things down and then, as a result, is possibly personally targeted by police and prosecutor both for it.
Now if Uber destroys or refuses to provide data covered under a properly scoped warrant, then I will gladly pick up the pitch fork with you.
My understanding of the majority of warrants are that they have a nebulous grasp on transnational corporations.
For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me?
The French government isn't going to raise a diplomatic ruckus over a taxi company operating illegally in Paris.
And I'd strongly suspect a judge wouldn't be inclined to allow me to forceably repatriate the data (which data?) without further evidence (exactly why I was serving the warrant!).
So essentially, I don't see it as being technologically hard to construct a system where I am enabled to operate illegally in a country, as a matter of corporately-sanctioned policy, while skirting around local technical ability and federal legal will to call me to account.
You can try saying "lol, the data is in Panama", but the judge is unlikely to care about that.
The court will simply order you to cease all business functions in France until the data is provided to the court.
At least for US law, there are split decisions. US v Microsoft (the Ireland case) [1] is currently pending a Supreme Court ruling.
I'd hazard to say that I'd be surprised if they didn't rule in favor of national security concerns, except that Jesner v. Arab Bank [2] is coincidentally also pending.
Given that the latter concerns the Alien Tort Statute [3], aka the ability of US law to be applied internationally, it will be an interesting pair of decisions.
I'm not familiar with how things work in France (other than rough knowledge of EU data privacy directives), but at least in the US things aren't as simple as "what the legal system wants via warrant, the legal system gets."
[1] https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_St...
[2] https://www.oyez.org/cases/2017/16-499
[3] Subject of a fascinating episode of More Perfect, https://www.wnyc.org/story/enemy-of-mankind/
That's not the case here with Uber. Uber itself, a Canadian company subject to Canadian law, is being compelled to provide data relevant to its own business within Canada. I would be very surprised if Canada allowed businesses to not provide relevant financial information to the tax man.
What if the warrant was looking for memos on illegally circumventing local parking laws? Memos that may or may not exist?
If Uber hosts that Canadian-focused data on servers outside of Canadian jurisdiction, good luck getting ahold of it unless the government's willing to play the "We'll bankrupt you unless you give us something" card.
And my point is that kind of international leverage isn't available to, say, a suburb outside of Toledo. Which effectively means a company willing to play hardball with encryption (at great legal risk if they slip up) can have their cake (illegal corporate policies) and eat it too (not be held liable for illegal policies).
Wrong. Compelling them to do so does not mean that compulsion will be successful. Encryption exists.
But I digress. I think we've established that we agree the original security procedure with a secure remote lockout is a good idea.
It wasn't to prevent an overreaching warrant, it was to prevent -any- warrant from being meaningfully served.
Generally speaking warrants are not granted for "all of your data." Imagine if every time the authorities got a warrant for some data Google has about a particular suspect, Google would reveal all of its internal data about every user, all of Google's internal financial files, etc. That would be insane.
If you have a physical device such as a Yubikey that unlocks your laptop, the court can order it to be given over, but the requirement that you produce the key from your own memory seems to be a different story.
That is a slightly different situation, as the evidence had been seen, and was known to be in the suspect's possession.
https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
There are two cases referenced in this wiki page which are relevant if you're curious. https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
[0] https://arstechnica.com/tech-policy/2014/04/lavabit-held-in-...
[1] http://blogs.findlaw.com/third_circuit/2017/03/man-held-in-c...
The page might also trigger other processes such as alerting council, that they have the right to do.
So possibly not as risky?
Is this what the on-site employees were doing though? According to the article they were:
> they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco
Depending on whether they knew what the "specially trained staff" was "specially trained" to do, this seems logical and harmless? If the police came to my office I would probably text the company owner to find out WTF is going on.
Where are you getting this from the article? How do you know it is "cryptic"? Of course it is pre-arranged.
Uber is known to run into problems with the government (which includes law enforcement). I'm not surprised there's a protocol for what a manager should do in this situation. If I was hired to work there my first question would be WTF do I do if the police show up?
I hate Uber as much as the next fickle HN commenter, but the idea of sending a text/paging a number doesn't feel that odd.