Tech Companies Fight Back After Years of Being Deluged with Secret FBI Requests

https://theintercept.com/2016/06/21/tech-companies-fight-back-after-years-of-being-deluged-with-secret-fbi-requests/

by uptown • 10 years ago

263 73 10 years ago

rhizome2• 10 years ago

A more-detailed exposition on the topic: https://www.emptywheel.net/2016/06/21/key-details-about-the-...

bgentry2• 10 years ago

The FBI’s decision to ask companies for everything and let them figure out what they’re required to turn over has had the effect of potentially putting smaller companies with fewer resources at a disadvantage, say national security attorneys. Without expensive legal representation and a familiarity with the law, companies might turn over more content than is necessary.

You'd think the FBI wouldn't be able to just demand all kinds of stuff they have no legal right to.

It's sad that the current state of our legal and political systems allows this sort of tactic to be effective and go unpunished.

iamdave2• 10 years ago

You'd think the FBI wouldn't be able to just demand all kinds of stuff they have no legal right to.

Paying some respect to established history for a moment, I-personally speaking-am not shocked at all. This sort of clandestine activity is how the FBI was born.

bgentry2• 10 years ago

Yeah, I realize they have a very long history of this sort of behavior (pioneered by J. Edgar Hoover).

crazy1van• 10 years ago

Seems like a case of imbalanced consequences.

If a company doesn't properly comply with a request, the company and some of its workers could quite possibly face criminal consequences. If the FBI's request is eventually found out to be invalid, very little of consequence will happen to the Bureau and even less to the employees.

Unfortunately, this imbalance isn't unique to the FBI or even law enforcement. Even most government regulatory agencies seem to enjoy a presumption of acting in good faith which gets the agency, and even more crucially the employees, out of trouble when they overstep.

rhizome2• 10 years ago

Leading people to forfeit their rights, to motivate them to offer more information than they are legally required to provide, is a long-standing law enforcement strategy.

https://en.wikipedia.org/wiki/Reid_technique

nostrademons2• 10 years ago

Liberal democracies usually operate under the principle that you can ask anything you want of someone, and it's up to them to say "no" if they find it disagreeable. The law is then there to step in when there is a dispute and say which party is right. Even the Bill of Rights depends upon people specifically asserting their rights; if a person voluntarily chooses to incriminate themselves, they've still incriminated themselves, the 5th amendment just states that if the government asks them to bear witness against themself and they refuse to speak, they have done nothing wrong.

While this can lead to unfortunate power imbalances and information asymmetries, it's hard to see how the legal system could operate otherwise. If people were forbidden from asking - who would do the forbidding? What if this is used to prevent contracts that would legitimately be in the best interest of both parties? What if it were used to prevent emerging power centers from challenging the power of the organization that can determine what's legal to ask? How would you even know that such a question has occurred, if one party says "Don't talk about this"?

Probably the best we can hope for is for Congress to pass a law specifically enumerating what electronic records the FBI may request. That seems to be what this article is calling for - consciousness-raising, and public debate. There's plenty of precedent for this, eg. the Miranda rights came from a court case where it was determined that police could not simply assume that a suspect was aware of their constitutional rights, and had to explicitly have them enumerated. But the fact that this needs to be handled on a case-by-case basis is a feature of the legal system, not a bug.

ianstormtaylor• 10 years ago

Great level-headed response! It sounds like there could be an interesting side project for someone—a mini-site that explains each of the things the FBI is allowed to request via each type of request. Or even sponsored by the EFF.

schoen• 10 years ago

Your reply might be inadvertently equivocating on meanings of "request", although I can see an interpretation where you're right.

Bear in mind that in many government data requests, the government is really demanding or instructing someone to provide the data, in a manner calculated to make the recipient think that complying is not optional and that refusing to comply would be punished.

In other contexts, the courts have at least created suppression remedies when law enforcement agents order people to do things that aren't really legally required. And if you as a private party make an improper legal demand of someone, there could be a legal remedy against you just because of that (although maybe that falls under "[t]he law is then there to step in when there is a dispute").

I think there are also cases where people have maintained civil rights challenges against law enforcement officers who gave improper orders (for example, improperly ordering someone to stop doing something -- like photography!). I would think the legal system could pay attention in a broader range of situations to the difference between law enforcement requesting people consent to something and making people believe that they have no choice.

Programmatic• 10 years ago

Liberal democracies usually operate under the principle that you can ask anything you want of someone, and it's up to them to say "no" if they find it disagreeable. The law is then there to step in when there is a dispute and say which party is right.

That is true, but there's a difference between a request and wrapping something in the flag and saying it's a lawful order. A LEO can ask me whatever they want; in some situations it's a lawful order and I go to jail if I don't comply, and in others I can say no. This doesn't mean that a LEO can stop everyone and demand things with no probable cause. With the FBI letters it's even worse because they carry a gag.

Sacho• 10 years ago

Liberal democracies usually operate under the principle that you can ask anything you want of someone

Except in cases like blackmail, extortion, racketeering... even harassment - you won't get much luck asserting the person you were harassing never bothered to tell you to stop. There is a whole host of behaviors that do not require the victim to mount a defense, because we've identified a power imbalance that might make it infeasible.

I think you're missing the problem with the current situation. It's a matter of incentive, and the fact that the FBI has no incentive to stay within the parameters of the law, no incentive to limit its requests, no incentive to get things "right". When a mere mortal citizen steps outside the bounds of the law, they are swiftly punished, and ignorance is no excuse. When anointed government officials overstep the boundary, it's no big deal because quite often, there's just no mechanism to punish them for it. But there needs to be such a punishment, otherwise trust in the system erodes rapidly.

The dilemma you posed is a false one. There is plenty of nuance inbetween the two extremes - "Don't let the FBI ask" and "The FBI can ask about anything and it's your job to figure out if it's legal or not". Possible recourse could require a pattern of abuse, determination of gross negligence, the punishment could be contextualized - mistakes leading to fines in favor of the citizen, while gross abuse leading to criminal charges. There's plenty of room for discussion of the specifics of such a system, but it must exist, and also the public must see it applied effectively in cases of extreme abuse.

I think your comparison of "you can ask anything of someone" ignores the reality of the relationship between two private citizens, and a private citizen and the government. The government expects trust, demands obedience and respect, but you cannot have any of those if it will also bend the rules it is supposed to be following, lie and cheat its citizens out of their rights. Even if staying within the marginal bounds of the law, this creates an adversarial relationship between citizens and the government, and breeds animosity and contempt. I believe there is a middle ground to be found between the government being paralyzed to act due to fear of making mistakes, and citizens living in distrust and fear of the government, which is supposed to serve them.

This "feature" of the legal system, where the weak are trampled because they do not have the power to assert their rights, makes it rotten to the core. Ask any CDL what the outcome of this "feature" is, for the poor, the uneducated, the ignorant, for minorities and for the weak. The law does not need to protect the strong - they already have the power to do so themselves. If a legal system fails to protect those weak in society from abuse, then it is at best pointless, and at worse, just another tool for those in power to subjugate the rest.

EGreg2• 10 years ago

It is one thing to ask, quite another to demand and claim that the law is able to compel the other party to comply. Especially materially misrepresenting the law during a demand by a powerful party that should have known better. Do you think we can't distinguish this from a regular request?

mindslight• 10 years ago

This would be sustainable iff:

1. The party who did not want to be involved in the situation was considered the defendant (as opposed to the current default-inversion where they likely have to go on the offensive in court).

2. The only outcome from 'losing' such cases was enforcement of the original order, rather than fines and jail for noncompliance with the original ambiguously-fraudulent order.

3. The defendant was given gratis legal representation of their choosing.

4. In the case that a defendant did something that was not required of them due to a misrepresentation by the aggressor, they were automatically and fully compensated for damages (more relevant for individuals vs the police).

Without this, those who are less disincentivized to engage in legal battles (eg those who don't risk jail time for losing, are getting paid a salary, and are funded by public money) will use the complexity of the legal system to bully those who would simply rather not get involved. Since the costs are borne by those who would rather not be involved, the complexity of the legal system will grow without bound - the current de facto requirement for the average person to employ a lawyer to interpret the law is already a violation of "equal protection".

rayiner• 10 years ago

You'd think the FBI wouldn't be able to just demand all kinds of stuff they have no legal right to.

The police are entitled to ask for cooperation from people to help with investigations. If there is a crime in my neighborhood, should police be banned from asking me about what I saw just because they can't compel me to do so?

And if you set the boundary for what police "may ask for" == to what police may "compel you to provide" don't you think that'll lead to undesirable growth in the latter?

brokenmachine6• 10 years ago

IMO they should be allowed to ask for whatever they want, but they must also clarify if it is a lawful order or a request.

Then it is up to the requestee to decide whether or not to comply. That is the whole point of living in a democracy and not a police state, correct? Also that is the actual law.

Tricking people into doing more than required by law is fraud in my opinion.

imh• 10 years ago

How about a nice compromise where if the person asks whether they have to comply to a request, the government has to respond truthfully? As far as I know, there are no such requirements.

simonh3• 10 years ago

What they are doing is the equivalent of demanding that people help with the investigation and threatening them with legal consequences if they don't.

The fact is that even if a police officer doesn't have the right to arrest you for refusing to comply, they can absolutely threaten to do so and as a matter of fact if they choose to cuff and detain you that is what will happen regardless of your legal rights regarding any information you might have.

syngrog66• 10 years ago

It is this that is a huge part of how I react negatively to the recent issue where Facebook has suddenly decided to push heavily on me to install a Facebook Messenger Android app on my phone.

You know: the functionality that already worked, that was already a cleanly solved problem in their mobile web app. But yet with a native Android app the store says they "need" to access my camera, my microphone, my GPS, all my contacts, all my photos, videos, my file system, my phone, my wifi interface, etc etc. Because... you know. Just trust us. In order for me to type in a short ASCII text message and hit ENTER and have that delivered to another person. A problem solved with much less code, and much less permissions, both in SMS, email, Usenet, etc, for the prior 30+ years.

I glance over to Shirer's Rise & Fall on my bookshelf, for a second or two, before falling asleep tonight.

"Trust us." - 1932 Germany/Europe is calling

vonklaus2• 10 years ago

The FBI’s decision to ask companies for everything and let them figure out what they’re required to turn over has had the effect of potentially putting smaller companies with fewer resources at a disadvantage, say national security attorneys. Without expensive legal representation and a familiarity with the law, companies might turn over more content than is necessary.

Tech companies should jst turn over more than they're required. If they demand info on 5 users, send 10K gzipped blend of fake & real users and random images from imgur.

bllguo• 10 years ago

It's fun to speculate on things like this but when in the shoes of a small company faced with that request, without the clout of places like Apple and Google, I would not want to piss off the FBI.

nxzero2• 10 years ago

Who's the FBI?

progressive_dad• 10 years ago

It works for FOIA

cmdrfred2• 10 years ago

The prevailing strategy if FOIA requests now seems to be sprinkle some 'personal' information in with the rest and then you get to pick and choose what to release. So it's kind of the reverse of this.

brokenmachine6• 10 years ago

grep <user> filename

I think the FBI could work out how to do it.

vonklaus2• 10 years ago

well they would probabky have to cat every file because they would all be md5 hashstrings ;)

rsync• 10 years ago

The rsync.net warrant canary is 10 years old this year.

https://www.rsync.net/resources/notices/canary.txt

srtjstjsj• 10 years ago

You must have very boring customers.

rms_returns• 10 years ago

Just curious, why is a latest newpaper headline part of a warrant canary?

null0pointer2• 10 years ago

The idea with a canary is that some government request can stop you from disclosing that request ("hey everyone we got subpoena'd") but they can't stop you from NOT updating a page. Putting a newspaper headline on the page basically provides a timestamp so anyone checking can go "hey, their canary hasn't been updated in 6 months... maybe something happened". At least that's my understanding of it.

kyledrake4• 10 years ago

One not-perfect trick: Stop retaining sensitive information. There is nothing in law that forces you to do retain things like IP addresses.

https://www.eff.org/issues/mandatory-data-retention/us

Then they can harass you for data all the time with illegal shit "court" orders and you can give them garbage and they can do nothing about it.

This is the best method I've seen for dealing with this problem on a budget. Unfortunately the tradeoff is losing a lot of not-especially-effective tools for dealing with spammers and the like.

strathmeyer• 10 years ago

You may want to learn about how Lavabit was shutdown.

function_seven• 10 years ago

Lavabit's shutdown revealed the flaw in its premise. That encryption-at-rest was good enough for email security (while using a single TLS key for all in-flight data). Turns out it's not. Only end-to-end encryption—with keys only held by the end-users—can provide that. As despicable as FBI's actions in that case may be, they did the public a service by showing Lavabit's security proposition to be less than what users may have assumed.

EDIT: Nothing I wrote above detracts from your point, though. Re-enforces it, in fact. Lavabit held little or no data, which caused the FBI to escalate to the nuclear give-us-your-master-key option.

beachy2• 10 years ago

As far as IP address goes, you could store a cryptographic hash of the IP, rather than the IP itself. That would prevent you from, say, identifying entire subnets used by spammers, but would be better than nothing.

You'd just need to do the hashing with some kind of tamperproof keystore that exploded when the FBI fiddled with it.

woodman2• 10 years ago

This wouldn't work without some really bizarre implementation that would make it less of a hash and more of a cipher. The range of potential values is too small and highly structured, generating a rainbow table would be braindead simple.

...tamperproof keystore that exploded...

So not one way hashes then?

_delirium• 10 years ago

Relevant: Bruce Schneier's "Data is a toxic asset", https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

nxzero2• 10 years ago

It would be curious to know if given the choice of supporting mass surveillance or not being able to use services and products from brands like Apple, Google, Microsoft, Wikipedia, etc. - what consumers would choose.

If they'd opt to use those brands, seems like the answer to change maybe very simple.

brokenmachine6• 10 years ago

I feel like the public has already implicitly chosen convenience over privacy and freedom.

IMO it is up to us techies to come up with a private and open system that offers the same conveniences without the privacy problems.

The perfect system to me would support:

- distributed (p2p) to avoid isolated silos and censorship

- Tor-style privacy

- encryption

- multi-user database support to allow dynamic sites (ie users have access to store their own posts/data on a site), not just static pages

- distributed torrent-style downloading and streaming of large files

- some kind of bitcoin payment system for people mirroring sites?

Zeronet combined with Tor is very interesting to me, although currently it doesn't support large file chunking or payment-for-storage.

IPFS is good but doesn't have the privacy or multi-user database support.

Qantourisc• 10 years ago

Freenet comes close, no database or torrent iirc though. Or dynamic sites(to my knowledge).

jfoutz• 10 years ago

I wonder if companies could just invoice the FBI for document processing or administrative fees. Just follow the FOIA fee structure. Or, charge a whole lot.

You can't make the NSL public, but it's not like you're complying with a warrant or something that would be immune from fees.

Of course the government will refuse to pay, so you sue. Presumably you could subpoena the emails around the NSL without disclosing the NSL. "We need to get this information from $tech_company", $tech_company provided the information. pay me.

arca_vorago• 10 years ago

The FBI et al issue NSL's without a court order and on their own prerogative correct?

In that case the FBI can get a warrant like the constitution they swore to uphold demands of them.

I'm tired of people bending over backwards for unconstitutional poppycock like warrant-less surveillance. It's a fundamental part of the supreme law of the land, the constitution!

walid• 10 years ago

“Had the FBI put a reasonable position on the table … five years ago they probably would’ve got that through,” Gidari argues. “They’re their own worst enemy on this stuff.”

beedogs• 10 years ago

At this point, I honestly fail to see why the FBI is allowed to continue existing. They seem antithetical to a democratic society.

ianpurton• 10 years ago

Just playing devils advocate but...

Aren't the FBI the good guys going about catching criminals and terrorists? So aren't we morally obliged to help rather than stamp our feet and say no and then publish a blog post about how we are fighting back against the tyranny of law enforcement. FFS.

brianpan• 10 years ago

Is the President a good guy that we are obliged to follow? I think you have it backwards. The FBI derives it's power from the people it serves.

It is in all our interests to have healthy functioning governments that serve their communities well. (Is there any other role of a government?) That happens through discussion and debate, not through doing whatever they tell us to do.

thrkw1234567892• 10 years ago

The (incorrect) concept of the world consisting of good and bad guys whilst dangerous and leading to flawed reasoning about society (of which this post is an excellent example) is fascinating. I'd be really interested in how it became so prevalent in US society.

simonh3• 10 years ago

Do you think that government agencies are beyond reproach and should not be held accountable for their actions?

Unfortunately the FBI has a long history of activities clearly contrary to the public good.

Tech Companies Fight Back After Years of Being Deluged with Secret FBI Requests

Related Stories