Hacker News Reader

Comment by monero-xmr | Hacker News Reader

It sounds like this was a piece of software where you uploaded a PDF of “proof” that you had the authority to track anyone in America, and then it let you. And someone finally bothered to look at the proof and it was a blank page.

This is why I’m against giving the government the power to intercept communications or middle-man encryption. They always pitch it like “This power will be protected by courts and warrants and Fort Knox level security!!” and then it’s a checkbox that any bureaucrat can use to violate civil liberties en masse.

View on HN

See also LOVEINT. Every once in a while, some NSA spy gets caught spying on their loved ones. Not even incompetence, just plain malice and abuse. Looks like they don't even face any criminal charges either.

Governments are essentially adversaries, enemies we have to defend against. It must be mathematically impossible for them to abuse their power. Anything short of that is not enough.

> Anything short of that is not enough.

I like that in spirit, but not as a practical standard. A major function of government is to prevent abuses of power. So I'm more inclined to shoot for overall minimization of abuse.

Well, in this case a random law enforcement deputy could get sensitive location information about random people with no meaningful cross-check of any sort - and this has only come to light after the fact, as part of a criminal investigation. So there's reason to be highly skeptical that the status quo is the best we can do when it comes to preventing abuse across the board.

> A major function of government is to prevent abuses of power.

But they can still do this. If you want to know where someone is, instead of compelling devices or carriers to spy on everyone at all times, you attach a tracker to the suspect's vehicle, or assign an agent to follow them. That's more expensive -- which is the deterrent to abuse.

A bad cop doesn't have time to follow around their ex all day. They do have time to follow around the subject of an official investigation, because that's their job. Tracking devices cost money, so it limits the number of people who can be tracked at once and prevents mass surveillance.

The argument for compulsory backdoors is purely an efficiency case, but efficiency is less important than preventing abuse.

The carrier is not spying on you here. A cell phone network has to know your phone's location in order to function at all, and this info has only gotten more and more fine-grained with newer network standards. There's nothing wrong with granting access to such data with proper authorization.

The "expense" involved in getting warrants approved is a better check on abuse, since it's very easy to do this as part of official law enforcement duties, and quite hard otherwise - the corrupt cop will need to come up with some reasonable justification, and not have it fall apart under deeper scrutiny. Of course if your local judge will rubber-stamp blank_document.docx as a proper "warrant" you have a problem again. But that can be addressed in turn.

It would be simple to design a cellular data network that didn't tie account holders to devices. Issue access tokens good for e.g. 10 GB of data to the mobile device. Don't store the token in connection with the account. Anyone could buy a prepaid card with tokens for cash at any convenience store. The network identifies the device via the token, which is temporary and anonymous. Telephone routing is done via VoIP which anyone has the option of routing through a VPN.

It's designed the way it is now on purpose, to spy on everyone.

> The "expense" involved in getting warrants approved is a better check on abuse

Except that they don't actually get warrants when they're doing abuse, they just lie about it because the phone company has minimal incentive to check and the victim who does typically isn't notified.

> Of course if your local judge will rubber-stamp blank_document.docx as a proper "warrant" you have a problem again. But that can be addressed in turn.

"Quis custodiet ipsos custodes" is in latin because it was published circa 100 AD. No effective solution to this problem has yet been uncovered.

There was a phone called the AN0M that came on the market a couple years ago that purportedly had similar features, turns out it was an FBI honeypot op to sell it to people that were seeking "privacy" with the hope that criminals would purchase it.

https://www.vice.com/en/article/n7b4gg/anom-phone-arcaneos-f...

This is why open source and strong cryptography are important. Anybody can sell you some snake oil when you can't verify how it works.

> But they can still do this [...] attach a tracker

I was responding to somebody who wanted it to be "mathematically impossible for them to abuse their power". Attachable trackers aren't sufficient to achieve that.

That's just impossible. Even if everyone had perfect e2e encryption, the government could just ban it and throw people who use it in jail.

You can't solve social problems with technology.

What is necessary is a governmental system which tends away from the abuse of power. This requires better voting, more transparency, and the literacy and engagement of its citizens.

The problem is, just like in Conway's game of life, the current system's state informs what states it'll progress to. If a system tends toward corruption or abuse and isn't actively changed, well eventually it no longer will be possible to change.

https://xkcd.com/538

That's why you use a constitution strong enough to prevent the government from having authority to ban a tool like that. The solution's been known and described for 250+ years now.

The problem is, if you rely on tools - and a constitution is nothing else than a tool - you will end up developing a reliance on that tool. And all of a sudden, that tool breaks, and you're fucked.

Democracy must be fought for every single day, and for that matter so does all progress. Democracy isn't something a society automatically converges to and which everyone loves, it must actively be maintained or someone will come, sow mistrust and preach "easy" solutions - and then you wake up and your country isn't a democracy any more.

The US Constitution certainly isn't modern or flexible enough to definitively protect (users of) E2EE. There are arguments for their protection, but none is ironclad (like "this is speech that is protected" ironclad). I'm not saying the Bill of Rights was wrong in its time period, but it would be more appropriate to lay out fundamental principles that must be upheld, and protection for E2EE (users) could then be derived. There's some of that already, but not in a clear and comprehensive manner.

The first amendment protects speech. Code is speech. E2EE is code. Therefore, the first amendment protects E2EE.

I forgot about that argument. I think it's not ironclad because "code is speech" seems like a stretch to me. I guess I'm being a bit unfair; when I say I want ironclad principles, I mean the kind that you can interpret literally and deduce whatever correctly. Admittedly harder to do.

Having the right to build a dragster car in your garage doesn't imply being allowed to drive on public roads with it.

That's silly. A constitution is just a piece of paper. It has no inherent power. It's the institutions put in place to enforce the constitution that give it power. If those institutions rot, the constitution will not protect you. As we've seen time and again.

A constitution is a piece of paper. At the end of the day, especially in a representative democracy is it's people. If the people drifting towards authoritarianism in mass, they will gladly wrap that piece of paper around a stick, light it on fire, and impale you with it all while claiming their new king.

Constitution is nothing but paper. What stops the government from just ignoring it? Happened in my country. Supreme court started censoring people despite the fact it's unconstitutional. Police follows their orders so whatever they write on documents is law. A literal judiciary dictatorship was silently installed and nobody even acknowledged it.

This is why you should never allow them to disarm you. At the end of the day, it all comes down to the threat of deadly force. The government should be in a state of permanent existential dread, its power always threatened by the population.

You can address social problems with transparency in access.

Something like browser certificate transparency, but for search warrants.

Interestingly they don't even need to ban the tech, just throw out enough FUD about people attempting to take back control of their personal data using the tech and you can set some nice precedent (in the mind of the judge and people) that those who use these tools _must_ have something evil to hide.

https://news.ycombinator.com/item?id=36197168

> You can't solve social problems with technology.

Sure we can. Every time people make subversive technology, it literally changes the world and its power structures. Computers are the ultimate example of subversive technology, they can make a mockery of courts and police using nothing but mathematics. It's really no wonder they want to control computing by only allowing us to run signed software, it's too subversive otherwise.

Every time new technology shows up, they have to increase their tyranny in order to maintain the same level of control they used to enjoy. Just assume anyone using such technology is guilty? Sounds like tyranny to me. The next step is to get everyone to use the technology so they can't just assume that. At some point we'll find their limits. We'll end up with either an uncontrollable population or a totalitarian government.

Want mathematical assurance that your government won't abuse power against you? Either you have to be the government or you don't live in a society with a government. Abuse isn't so easily constrained. Try proactive regulations, vigilance, and strict punishments (not comprehensive). Best effort, but what else can you do?

"Government can never abuse power or government can systemically abuse power" is a false dichotomy. You can make it cost more so it happens less.

Encryption is the common example. As far as anybody knows the government can't break e.g. AES. But they can still find out what's on your device because with a warrant they can install surveillance devices in your house to capture it when you enter your passphrase, then seize your device.

Which makes it possible but not easy, which limits the scope for abuse.

> "Government can never abuse power or government can systemically abuse power" is a false dichotomy.

I didn't make it a dichotomy. I was just commenting that "mathematically impossible" is too strong to the point of absurdity. Not fun at parties, but I would hope it's fine on Hacker News. I then provided a rough overview of a system to mitigate abuse. We're not even disagreeing about trying to minimize government abuse.

To discuss your example of encryption, the abuse is the government installing and using the surveillance devices (let's assume the suspicion isn't beyond reasonable doubt or whatever and the warrant is invalid). The question is whether that abuse is prevented or routed and justice is enacted.

The standard for a warrant is probable cause, a far lower bar than beyond reasonable doubt.

Oops. Perhaps it should be different but I know next to nothing about the topic. I think my point still stands, though. Thanks for the info.

Law enforcement burglarizing your house to install hidden cameras without a warrant is indeed something you would want the system to address, but it's also a much narrower problem, because it's expensive and dangerous. Typically when doing that sort of thing with a warrant, it would be done by a team who e.g. ensures that the homeowner doesn't come back while the cops are in there installing the bug, and who wouldn't go to jail if the suspect's brother unexpectedly shows up just then and catches them -- because they had a warrant.

Whereas anybody can forge a document and submit it to the phone company, and the scope of who is able and willing to abuse that data is very large. So it should be narrowed by not collecting it and forcing access to go via the more expensive route which is less subject to abuse.

Sure. We're not really disagreeing, just talking past each other. The more robust systems are to prevent abuse, the better.

With us all carrying cell phones and most all EVs having a net connection, anonymity is hopeless. For phones I could get a burner and then when I login in, no privacy. So then a burner w net connection that somehow isn't on at my house, and I ssh to my home computer to read my email. For my EV w a net connection, I could pull the fuse for the lte modem. But I like the map w routing and plug and charge at a supercharger.

I only have one idea, I use my friends phone and my friends car. We need a big swap meet every morning.

> ssh to my home

Dead giveaway

Okay, but what about trusting everyone in the world and doing a random car and phone swap every morning, isn't that a great idea?

Tor; the onion rideshare.

If you try to use Tor for anything, then you find many sites block it or want you to click on captuas that won't work right over it.

> and most all EVs having a net connection

This is a drivetrain-agnostic feature; ICE vehicles have OnStar and all that jazz too.

Ironically, some of the documents he uploaded included award certificates and a list of justifications for a merit promotion.

Referenced in paragraph 13, but unfortunately not attached: https://www.justice.gov/d9/press-releases/attachments/2022/0...

Yea I sometimes get a feeling that a large portion of the population just doesn’t understand conditionals. If you tell them “you have the authority to do X if Y”, they just ignore the Y part.

People who are drunk on power subscribe to the "ask for forgiveness, not permission" philosophy. They think everything they do is right and just. They cannot understand or even believe people would not trust them and see the conditional as a pointless hindrance, bureaucratic red tape meant to stifle upstanding people like them.

Also, the system doesn't really penalize this philosophy. Try to do everything by the book and you find that you can't really get anything done. Cut some corners, you get shit done and, in the worst case, you get a mild slap on the wrist several years later.

And completely break down some walls, injuring others in the process? Get a promotion, and if caught just move somewhere else to do the same thing over again.

People love to wield power over those they oppose and don't care if the system they implement is abused until they're the targets of the abuse.

For example: most people love the police when they coercing wealth from strangers to fund their projects but hate when the same police step on their chest until they stop breathing during a traffic stop.

Your first sentence is generally true but

> when they coercing wealth from strangers to fund their projects

I have no idea what you're referencing here, so I can't say if it's abuse or not.

It's not about understanding, it's about seeing these sort of rules bent dozens of times first and then finally doing it yourself. Rules are only as strong as their enforcement and in many cases it turns out that no-one has neither the incentive nor the ability to enforce them very hard.

After some bantering with Swedish police officers on Twitter I’ve come to believe that many of them simply do not make a distinction between what they have the authority to do, and what they can get away with in practice.

One of the things that would help this if anytime any of these surveillance powers get used, they have to be used as part of a specific ongoing investigation, and when that investigation is closed, everything related to it becomes a matter of public record.

And then you have some hard rules like, investigations are automatically closed after the statute of limitations runs, or if the target of the investigation dies, or the victim chooses not to press charges etc. Things not in the control of the investigators, so they can't keep an investigation open forever to prevent their abuses from becoming public.

This is unworkable, sadly. I don't want my past location data to become a "matter of public record" merely because I have been caught up as a bystander in some random law enforcement investigation and it all ends up in the case file.

Obviously personally identifying information could be redacted without doing so for the request itself.

But you're just reiterating the problem that third parties are collecting the location data of innocent bystanders. Otherwise it wouldn't exist to be in the file.

Because the government and pretty much all those power ignore Y, and whenever they get caught, vast majority of cases they don't get punished. Of course anyone remotely intelligent would ignore the Y part too. Only extremely gullible people with their blind trust in government would look at Y part and nod along. This particular case very much the exception.

> and someone finally bothered to look at the proof and it was a blank page.

I think I agree more than not with your worldview, but it seems like in this case this was the first time the person tried to improperly use the system... and he was caught and is now being sentenced. So I would say this is an example of the system "working".

I'm sure there are civil rights abuses that happen much more frequently, which we don't here about, but this specific incident seems like something that should be cheered.

According to the second sentence of the article, the officer tracked multiple people and their locations. He clearly wasn't caught the first time he used the tool inappropriately because he was found guilty of using it illegally multiple times.

The officer very clearly was not forthcoming with the investigation, judging from him falsifying documents after the investigation started. So he may have other undetected crimes.

In fact, the only fair conclusion I think you can draw is that some officer(s) use the tool inappropriately. Because it's not clear if all uses are audited, or this officer was found on a random check. But in my opinion saying "the system worked" is inappropriate given the lack of data.

Is this some kind of parody? He got caught because it was a literal blank piece of paper. Anyone with any sense would write some bullshit paragraph and I'm sure plenty did and got away with it.

I read it the exact opposite way. It turns out that when you punish people with a decade in prison for lying, you can just operate on their word and verify later.

I don't need a system that never gives data to a malicious user. It doesn't need to be Fort Knox. It needs to be logged and audited regularly and for people who abuse it to be punished severely.

I'm sure there are lots of technical measures keeping my bank account safe. But, the greatest measure is that if you take the money the US government will throw you in jail.

Courts are also sometimes full of work so any request by the executive will be granted by default. The chances of repercussions are much smaller to decide this way.

Reply on news.ycombinator.com