A Developer’s Guide to Responding to National Security Letters
twilio.com
twilio.com
Good luck with that, unless your vision of doing business doesn't involve ever charging customers, especially for b2b.
What Silk Road and Bitcoin demonstrated is the huge popularity of dark markets for retail drug sales. With product authenticity and seller reliability attested through customer reviews. And without risk of meatspace violence (except if busted, of course).
And sure, that stuff is still widely illegal. However, when laws are ignored by substantial minorities, their legitimacy becomes questionable. African Americans didn't end segregation in the US through petitioning legislatures. They broke the laws, creating a crisis, and forcing the federal government to act. Lesbian and gay activists did much the same, at least initially.
Also, again, good luck getting any b2b when you tell them they need to pay in bitcoin only.
Verification times are clearly an engineering problem, not a fundamental issue. Long-term solutions are currently under experimentation (lightning, DAG currencies, etc.)
For small amounts, meatspace trades are doable using LocalBitcoins.com etc. For huge amounts, I suspect that expert assistance is available. It's the middle ground that's nontrivial.
False. You can mine it, you can receive it for free from someone else, and you can exchange goods/services for it.
BTC-e went down hard for example. But they had some much more obvious links with criminal enterprise.
Although even if it is possible to stay outside of the reach of the US, losing access to the international banking system is quite the handicap for any business.
That means not doing business in the US at all.
With the NSA's twisted logic that a search is not a search unless it matches and it's fine to search data so long as there's a chance it involves a non-US citizen I think jurisdiction is largely irrelevant for attacks other than the necessity of one seeing as the NSA has access to a secret court that has a history of never siding against them.
I'd view eliminating tyrannical government orders as a plus.
This helps for data from the past, but TLAs can order you to change your code such that it will in future retain data they want to see.
The article body just talks about how they respond to an NSL, clearly all steps taken under direct and careful legal advice.
So the title might have been "What our Lawyers do When we Receive an NSL".
if the DOJ would rather not get any information at all rather than have their request for information scrutinized by a court, there is something seriously wrong with the national security letter process. people who have had a pulse in recent years will chime in that there are many other problems with the NSL process.
but this one is a bit different, because shows that the FBI is explicitly avoiding the rule of law as a policy. aren't they the ones responsible for upholding the rule of law as part of the department of justice? why yes, yes they are. they have dirt to hide, and they are not good at deflecting guilt. they know they can consistently over-reach with these NSLs to violate the rights of companies and individuals. so they do it.
this behavior implies ongoing abuse that they would rather have covered up than accomplish their agency's goals, even if those goals are wrong.
i guess my solution would be to clean house. fire people (and revoke security clearance) starting at the top and work your way down while promoting people who weren't abusers. at the same time, start firing from the bottom, targeting those who complied with bad orders from above. replace them with new recruits who can be trained to have their heart in the right place. the agency is back to citizen-friendly operating order within 5 years or so. a blink of the eye in the timeline of the twilight years of a former empire.
It could have simply been: what's the fastest way to get the info and there were two options. One quickly became the slow option and was ruled out.
That's my charitable interpretation.
Not disagreeing with the idea that there aren't a variety of reforms that seem mutually beneficial, such as shorter timeframes — just noting that there are not equivalent to NDAs.
I propose a tl;dr version: get a lawyer.
Do not deal with it yourself. It's cool to read about how a company (with a team of legals) can respond to the letter. "A Developer's Guide" is not the same as "A Company's Guide". "A [d]eveloper" is an individual, not an organization entity.
Of course if you're an individual dev, and you host your project in the cloud, then the cloud provider may get served with an NSL that covers your users, without you even learning this happened (unless the company, like Twilio, has a really well-thought-out process for dealing with these and is willing to negotiate them a bit where the law permits).
Providing a template so one (individual or an organization) can talk to FBI and whatnot is wrong because that's encouraging people NOT to seek help. This is not some insurance appeal letter. Your lawyer should know what to do, not you. If the NLS is accompanied with a gag order, the gag order will never prevent the recipient to seek legal help.
This post may be just as helpful, if not moreso, to a lawyer than to a developer! But as a developer, I would think you would find some comfort using twilio in knowledge that they put a lot of thought into privacy. Like, maybe that is the real intent here, some pretty high-quality marketing -- not so much an instructional.
And as a secondary thing, any organization that has a spine when it comes to user privacy wants some company. If the industry as a whole gets behind a standard approach, then no one is going to get singled out for unwanted special attention.
Any lawyer is better than no lawyer, particularly when it comes to convoluted legal domains such as those authorizing NSLs.
There's still a huge cloud of uncertainty around NSLs, to the point that many people seem uncertain about whether they can even disclose having received one to their counsel.
I think the other letters I've seen posted online say something similar, and 18 USC 2709 itself says much the same thing. https://www.law.cornell.edu/uscode/text/18/2709
https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Rea...
Same reason you want to find someone who knows C very well to review your security-sensitive C code. It would be nice if C didn't come with rules about undefined behavior that are surprising to people who haven't deeply studied C, but it does, and no amount of wishing it didn't will change the fact that you are inviting immense and needless risk by not finding an expert (or, if you'd prefer, spending years becoming one yourself, which you can certainly do if you have the luxury of years).
Edit: Even if your firm has general counsel, it's not uncommon to hire outside attorneys for specific matters.
Subpoenas, search warrants, etc.
Any unusual access to data in one country automatically informs customers (or triggers an alert), with this information being sourced from the other country.
This protects both the employees in the US (they did not say anything) and bypasses the letter requirements
Congress shall make no law respecting an establishment of religion or prohibiting the free exercise thereof, or abridging the freedom of speech or of the press, or the right of the people peaceably to assemble and to petition the government for a redress of grievances.
Given that the above is the law of our land, how can a recipient of an NSL be barred from publishing it in its entirety or giving it to a news outlet to do so? "No law" is clear in both meaning and intent.
Most of these are fairly narrow. National security letters are generally the most questionable limitation, although their use has been clarified somewhat.