Hacker News Reader

Comment by School-Cotton | Hacker News Reader

Why would this count as obstruction of justice?

Deliberately hiding or destroying evidence to prevent it being found by police executing a proper search warrant is certainly obstruction of justice.

https://www.law.cornell.edu/uscode/text/18/1519

If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question.

Pushing this way of thinking about it, you could also say that a raid from the police is useless in general since a judge can simply send a request compelling the company to turn over the evidence in the first place.

And shouldn't that be the case? Shouldn't a raid be a last resort when the evidence being sought is at high risk of disappearing?

There is no suggestion at this point that data is disappearing. HN is so weird sometimes. When Google, or Facebook, or whoever grants the authorities free access to our private data without a warrant everyone freaks out. Uber protects our private data and suddenly it's evil. I get that we don't like Uber, but principles still matter and I'm glad they are protecting their own data as well as any customer data from a fishing expedition by the authorities.

Now if Uber destroys or refuses to provide data covered under a properly scoped warrant, then I will gladly pick up the pitch fork with you.

A judge "can simply simply a request compelling the company to turn over evidence" in what jurisdiction?

My understanding of the majority of warrants are that they have a nebulous grasp on transnational corporations.

For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me?

The French government isn't going to raise a diplomatic ruckus over a taxi company operating illegally in Paris.

And I'd strongly suspect a judge wouldn't be inclined to allow me to forceably repatriate the data (which data?) without further evidence (exactly why I was serving the warrant!).

So essentially, I don't see it as being technologically hard to construct a system where I am enabled to operate illegally in a country, as a matter of corporately-sanctioned policy, while skirting around local technical ability and federal legal will to call me to account.

>For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me?

The court will simply order you to cease all business functions in France until the data is provided to the court.

It's not that simple. I am not a lawyer, but...

At least for US law, there are split decisions. US v Microsoft (the Ireland case) [1] is currently pending a Supreme Court ruling.

I'd hazard to say that I'd be surprised if they didn't rule in favor of national security concerns, except that Jesner v. Arab Bank [2] is coincidentally also pending.

Given that the latter concerns the Alien Tort Statute [3], aka the ability of US law to be applied internationally, it will be an interesting pair of decisions.

I'm not familiar with how things work in France (other than rough knowledge of EU data privacy directives), but at least in the US things aren't as simple as "what the legal system wants via warrant, the legal system gets."

[1] https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_St...

[2] https://www.oyez.org/cases/2017/16-499

[3] Subject of a fascinating episode of More Perfect, https://www.wnyc.org/story/enemy-of-mankind/

For the Ireland case we're talking about data about a third party criminal whose data happens to be stored by MSFT exclusively in another country.

That's not the case here with Uber. Uber itself, a Canadian company subject to Canadian law, is being compelled to provide data relevant to its own business within Canada. I would be very surprised if Canada allowed businesses to not provide relevant financial information to the tax man.

Relevant known financial information, sure. But that's a small, well-defined subset of Uber's corporate footprint.

What if the warrant was looking for memos on illegally circumventing local parking laws? Memos that may or may not exist?

If Uber hosts that Canadian-focused data on servers outside of Canadian jurisdiction, good luck getting ahold of it unless the government's willing to play the "We'll bankrupt you unless you give us something" card.

And my point is that kind of international leverage isn't available to, say, a suburb outside of Toledo. Which effectively means a company willing to play hardball with encryption (at great legal risk if they slip up) can have their cake (illegal corporate policies) and eat it too (not be held liable for illegal policies).

The warrant is to "make the data available".

You can try saying "lol, the data is in Panama", but the judge is unlikely to care about that.

Yes, a raid, in this case, is almost certainly an abuse of force and an attempt to create social/emotional problems for Uber.

This is Uber, right? The company currently in trouble with another judge in another case for selectively (and not especially competently) turning over evidence?

I’d imagine the employees aren’t told why they’re paging the number, just that they should.

The page might also trigger other processes such as alerting council, that they have the right to do.

So possibly not as risky?

That excuse, thin as it is, could perhaps have sufficed for the first occurrence of such an act. But now it's been publicized. And it's a bit hard to pretend that, during a police raid, you're secretly and cryptically notifying the higher-ups, for some mysterious reason that you are completely ignorant of. It's just not credible that an intelligent tech worker who works for Uber and knows how to read English would not figure this out.

But it's not in English and French.

at the very least conspiracy to obstruct

If the police have a warrant for the data on that machine, then remotely locking it down will not matter.

All this protects Uber from is fishing expeditions where the police hope to come across an "unlocked door" so they can sift through everything hoping to find something.

I get that we don't like Uber, but I support this type of action and think it should be standard operating procedure for every organization.,

This has nothing to do with liking or disliking uber. If the police are executing illegal searches then Uber has every right to sue and recover damages. They, unlike your average natural person, have the coffers to pay for it such that they acquire the "don't fuck with us illegally or we'll financially ruin your department" reputation.

What I am worried about is the employee that gets directed to lock things down and then, as a result, is possibly personally targeted by police and prosecutor both for it.

> Deliberately hiding or destroying evidence

Is this what the on-site employees were doing though? According to the article they were:

> they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco

Depending on whether they knew what the "specially trained staff" was "specially trained" to do, this seems logical and harmless? If the police came to my office I would probably text the company owner to find out WTF is going on.

No. Not logical and harmless. Yes, you might very well text the execs to find out what is going on, in plain English, like, "what the fuck is going on"? What you would not do is to send a cryptic, pre-arranged signal, which is what happened here.

> What you would not do is to send a cryptic, pre-arranged signal

Where are you getting this from the article? How do you know it is "cryptic"? Of course it is pre-arranged.

Uber is known to run into problems with the government (which includes law enforcement). I'm not surprised there's a protocol for what a manager should do in this situation. If I was hired to work there my first question would be WTF do I do if the police show up?

I hate Uber as much as the next fickle HN commenter, but the idea of sending a text/paging a number doesn't feel that odd.

Moreover, we should remember that Uber operate in countries whose police likely have a worse reputation than Canada's, so if the policy of "Page this number if the police (or people claiming to be the police) turn up" is applied uniformly across jurisdictions, that may be perfectly reasonable and a lot safer than Uber trying to make politicised judgements of which offices should be left to deal with the legal and security situation by themselves.

>If police have a proper search warrant then locking the computer will not matter, because the police will have a warrant to compel the company to turn over the specific evidence in question.

Wrong. Compelling them to do so does not mean that compulsion will be successful. Encryption exists.

In the US at least you can be held in contempt and jailed indefinitely for not providing the decryption keys. Presumably other countries have mechanisms to deal with this beyond, "Oh gee, you password protected it, guess you get to go free forever."

If I was designing a remote lockdown procedure to secure systems against a state, I would not design it such that local employees could unlock it without remote authorization, preferably from someone physically located in another legal jurisdiction.

Congratulations, you just won an injunction from the court which requires you cease all business functions in the country until the data is provided.

And now that my lawyers and sysadmins have had the chance to review it, possibly challenge it and come up with a means to provide the data required without giving government agents unfettered access to my systems, I will comply.

When you first replied I incorrectly assumed you were talking about refusing to ever comply with the warrant. But what you just described is exactly how it should go down.

It's not hard to imagine scenarios in which pulling out of a country to avoid providing secret information to that country's government is rational. Canada attempting to collect taxes on Uber rides is not one of those scenarios.

Perhaps, but it's difficult to imagine you're not in violation of some other kinds of laws for which there is ample evidence, and/or that no one in your organization is willing to talk.

Sure, and if I'm systematically violating local law, there might be international agreements that would get my home country to cooperate in an enforcement action against me. On the other hand, the local authorities might want user data that I hold in order to do something horrible to local users that my home country would not like to help them do.

But I digress. I think we've established that we agree the original security procedure with a secure remote lockout is a good idea.

I too, when faced with a search warrant from the police, often like to come up with a means where I give them what they want, or claim it doesn't exist, without giving them an opportunity to look around. They very much are understanding of this.

If you're just there to "look around" and don't already know exactly what you are expecting to find then you shouldn't have been given the warrant to begin with. This is a criminal investigation, not a fishing expedition.

Yeah, and the defenders of Uber's activities here are acting as if the warrant -was- a fishing warrant and wasn't properly scoped, when the validity of this assertion had zero to do with their decision to "Ripley" the office.

It wasn't to prevent an overreaching warrant, it was to prevent -any- warrant from being meaningfully served.

It wasn't an attempt to prevent any warrant at all. It was an attempt to prevent the authorities from accessing data NOT COVERED BY A WARRANT. Once Uber's lawyers have reviewed the warrant they will instruct the sysadmins to provide the covered data in a clean way which doesn't expose extra data. Simple as that.

Generally speaking warrants are not granted for "all of your data." Imagine if every time the authorities got a warrant for some data Google has about a particular suspect, Google would reveal all of its internal data about every user, all of Google's internal financial files, etc. That would be insane.

It appears in this case, Uber has designed a system with exactly that result: the police do not punish the local staff for the remote lockdown, and cannot punish the overseas sysadmins who caused it.

Can you point to a specific case where a defendant was coerced into decrypting some data? As far as I understand it, the 5th Amendment protects a citizen from such coercion.

If you have a physical device such as a Yubikey that unlocks your laptop, the court can order it to be given over, but the requirement that you produce the key from your own memory seems to be a different story.

There’s been quite a few cases, but the Lavabit [0] Case is probably the most famous. Another one that comes to mind is a guy accused of having child porn claiming he can’t remember the password to his data and being held in jail for 2+ years without being convicted [1].

[0] https://arstechnica.com/tech-policy/2014/04/lavabit-held-in-...

[1] http://blogs.findlaw.com/third_circuit/2017/03/man-held-in-c...

The warrant is not for the password, but for the unencrypted data. You do not have to reveal your password, technically, but you do have to provide access to the unencrypted data. Since you do have access to the data, but refuse to provide it, you are failing to comply with the warrant.

There are two cases referenced in this wiki page which are relevant if you're curious. https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...

The closest I can remember is there being a guy who was going through customs coming back to the US. His laptop was inspected, and he had left child porn open on the screen. The inspectors saw it. The guy quickly closed the laptop, causing it to sleep, and causing the disk encryption to kick in, requiring authentication. He was held in contempt when he refused to unlock the laptop.

That is a slightly different situation, as the evidence had been seen, and was known to be in the suspect's possession.

In another case a district judge ordered a Colorado woman to decrypt her laptop. The person did not have to reveal their password, as that might weirdly count as "testimony," but they did have to provide the unencrypted data. It was ruled that the act of production of data does not constitute testifying against yourself.

https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...

Like Apple?

And shredders. Let's not forget Enron :D

Like Apple?

Reply on news.ycombinator.com