Uber’s Secret Tool for Keeping the Cops in the Dark

https://www.bloomberg.com/news/articles/2018-01-11/uber-s-secret-tool-for-keeping-the-cops-in-the-dark

by angpappas • 9 years ago

119 106 9 years ago

meri_dian• 9 years ago

A certain segment of the population - disproportionately represented on HN - strongly dislikes both Uber and cops. It's always interesting to see how people react to stories in which two groups they dislike are pitted against one another.

MIKarlsen• 9 years ago

I don't think I belong to any of those groups, but Uber seems like a company that operates on the edge of the law, which I don't find all too attractive.

logfromblammo• 9 years ago

As one of those people, it makes me happy that an obviously sleazy company like Uber is giving the cops something useful to do, so they aren't harassing more ethical businesses.

It's like when the small-time drug dealer and the top bully at your high school get into a fistfight. The ideal outcome is that they both get a savage beating, and then get expelled.

SerLava• 9 years ago

I don't think people here have a problem with police. You might be confusing that with a distaste for homicide and assault by police.

Those don't just automatically go hand in hand. And police accountability is not some kind of team sport.

People here are talking about enforcement of actual laws.

romanovcode• 9 years ago

I actually don't care for both as classic Uber is not legal where I live and instead Uber is just a regular taxi app.

Also, police is fine here and so are cab drivers.

atonse2• 9 years ago

Actually for me, as someone who has strong negative opinions towards both Uber and police brutality, it basically comes down to this: a strong desire for fairness.

I have a strong dislike for companies that willingly flaunt rules that are meant to level the playing field. And this is not the same as companies that disrupt (in fact, the taxi industry was badly in need of disruption and was NOT a level playing field before ride-sharing).

Same goes for police. If a policeman has murdered someone, they should be held to trial just like a civilian would. But we all know that's not actually what happens.

chollida1• 9 years ago

I think the biggest issue here is that Uber actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law.

I mean, someone actually sat down and said, ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant.

frgtpsswrdlame5• 9 years ago

I mean, someone actually sat down and said, ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant.

But was that 'someone' a programmer? I'd say whoever programmed this probably did so on order of their boss. Tech isn't immune to the same pressures that exist in every field. Basically, make the boss happy.

danharaj• 9 years ago

If only programmers could form some sort of collective to advocate for their common interests and hold their bosses accountable to ensure our profession is kept to a high ethical standard while protecting programmers from backlash when they refuse to break the law for their employers.

atonse2• 9 years ago

Sure, or maybe we can just accept that there are a lot of programmers that aren't saints or innocent victims of overbearing bosses, but actually are happy to use their skills to break the law?

You can make a group of programmers think they're pirates going against the establishment, and they'll do anything under that idea.

adrianN• 9 years ago

Programmers, unlike many other professions, are in the happy position that their skills are in high demand. They can afford to have more moral fiber, because it's easier for them to find a new job. I'd also assume that a lawsuit in case they were fired for refusing to write software which the purpose to break the law would go pretty well, but I'm not a lawyer.

forapurpose2• 9 years ago

Pressure isn't an excuse for illegal and unethical behavior; we all have pressures and responsibilities. I'm surprised so many programmers and others were willing to participate, and to do it so reliably that Uber wasn't afraid someone would leak what was going on.

dontreact• 9 years ago

Were they blocking searches with warrants or warrantless raids? And was what they did illegal? I read the article but left unclear on both of these key questions.

grasshopperpurp• 9 years ago

In May 2015 about 10 investigators for the Quebec tax authority burst into Uber Technologies Inc.’s office in Montreal. The authorities believed Uber had violated tax laws and had a warrant to collect evidence.

SilasX2• 9 years ago

Per my comment from a while ago, I think what they did was illegal. [1]

If they had simply kicked off users who were likely cops, that would have been legal. That’s what (some) biker bars do.

But they went beyond that and actively misled such users in a way that wasted their time. That amounts to lying to investigators and is illegal.

You can kick people out of your bar for giving off a cop vibe. You can’t keep them around and feed them fake intel on drug deals so they waste their time.

You can pull your shade down to keep people from looking in your window. You can’t make shadow puppets of a homicide with the intent to get the cop outside to investigate a spurious lead.

[1] https://news.ycombinator.com/item?id=14270214

pbhjpbhj2• 9 years ago

It seems generally useful against any physical intrusion - presumably it could have been constructed against crackers or intruders of any nature.

emn13• 9 years ago

Since you need to to be aware of the raid to use the tool, it seems particularly useful vs. attackers that aren't afraid of being noticed, and whom you cannot keep out otherwise. Particularly the police, in other words. Not that it's impossible it'd be useful otherwise...

avaika• 9 years ago

Disclaimer: I'm not defending anyone who breaks the law. I'm just explaining why and how it might work from my point of view.

It just depends on how people were explained why and what they need to do. In the end these engineers even might have had no idea that the thing they produced will be used this way.

Additionally, I know a bunch of people who developed similar system for small companies in my country. However the situation is different: law enforcement institutions are often misused to get the bribe from business owners. Means the less they can find in your office, the less chances they will take your money away for nothing.

CodesInChaos• 9 years ago

ok when, not if, law enforcement comes to raid one of our offices, how can we do our best to block a lawful search warrant.

When writing end-to-end encrypted chat, client-side encrypted hosting/backup, etc. you ask yourself the same question. And yet I consider those ethical.

StavrosK3• 9 years ago

By that logic, you do the same when you close your door.

This is ridiculous, clearly there's a sliding scale of how much morality versus how much immorality you enable. How far along that scale is a tool whose sole purpose is to block lawful warrants?

mcny• 9 years ago

I am no uber fan but I'd have no problem with a tool like this if I understand it correctly.

I like to believe that if there's a legitimate use for a tool, then the tool is fine. What's the difference between a lawful search warrant and robbery? Why do we focus on the text rather than the fact that the leadership created a protocol and a scheme to do this? Why does Travis get a pass?

dx0343• 9 years ago

In case of robbery you wouldn't have time to call the number. Tech offices don't tend to get robbed when people are at their computers. And if they aren't, devices should be locked and files with it.

LeifCarrotson• 9 years ago

"It should be noted that no ethically-trained software engineer would ever consent to write a HideDataFromPolice procedure. Basic professional ethics would instead require him to write a HideDataFrom procedure, to which Police could be given as a parameter."

- Nathaniel Borenstein (paraphrased)

ihsw2• 9 years ago

Indeed, the tool was developed in an environment where government agencies and related LEOs are categorized as antagonistic and hostile entities, oftentimes operating at the behest of Uber's competitors.

Surely we're all aware that financial avarice is rampant in developing/emerging markets and, when presented with an unaccommodating adversary, these developing/emerging markets will readily resort to "fishing expeditions" and other avenues of blatant extortion.

whatok• 9 years ago

Some of these things could be specced in an obfuscated or completely fragmented way that no one really had any great idea of what the complete product was. That said, there had to have been someone who integrated everything together.

bryanlarsen• 9 years ago

And yet Apple regularly receives praise here for thwarting law enforcement.

The difference seems obvious to us, but it wouldn't be to someone outside of tech, and similar justification will be used by used by people building the Uber program.

I suspect the large majority of entities who are stymied by Apples extensive encryption who wouldn't be stymied by trivial encryption are law enforcement and other state entities.

I also suspect that Uber's protocol has been invoked against against intruders and/or commercial visitors.

So while Apple good and Uber bad, the difference is gray, not black & white.

rm_-rf_slash• 9 years ago

Apple protects its customers. Encryption that stops cops also stops criminals.

Uber is only protecting its profits. The customers are incidental to its blatant lawbreaking.

ctrl-j• 9 years ago

And yet Apple regularly receives praise here for thwarting law enforcement.

That wasn't my takeaway from the Apple/FBI interactions.

They said pretty plainly: "We'll help however we can, but even we can't get into our customers data. We're also not going to break that so that anyone, including you, are able to."

Isn't that a big difference?

rlanday2• 9 years ago

What is “trivial encryption”? This is something that keeps out “bad guys” but not “good guys”? Pretty sure that doesn’t exist.

zvrba• 9 years ago

actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law

It's not that simple.

Team A is given the task of writing SW that locks down all computers in case some alarm goes off (e.g., opening a door without disarming an alarm). In the start, this alarm and all workstations are connected to an on-premises server.

Team B is given the task of moving the server into the cloud (or home office) because HR realized they could automatically monitor which employees enter and exit the office. For security auditing.

The system has been moved to the cloud and team C is given the task of extending the SW to make it possible to block certain employees for logging in, e.g., after they've accumulated a certain number of work hours during a week. To prove that the company complies with work regulations.

Now you have built a system, all under plausible and "just" pretenses, that allows you to lock down an office anytime remotely.

Team D (managers) are given the task of paging a number when a raid happens. Team E is instructed to lock down an office when the number is paged (possibly they're told that it's a system test or something else).

If anyone is doing anything unethical here, it's the managers and, possibly, team E (executing the lockdown).

samfriedman• 9 years ago

When the system is compartmentalized like this, the "anyone doing anything unethical here" is surely the senior leadership who can see the full system and leverage its capabilities for unethical purposes.

mirimir2• 9 years ago

It's not that simple.

I agree, but in a different way. Who's to say that it's not governments that are the major criminals here? Many westerners would agree regarding China, North Korea, Iran, and so on. But what if the laws being used against Uber are products of corruption? To stifle competition against the taxi industry, which seems likely.

But whatever. This is some damn impressive OPSEC, no? I mean, serious anarchocapitalist OPSEC. And that just brings a smile to my face.

mverwijs• 9 years ago

Reminds me of "Snowcrash".

raldi• 9 years ago

Just tell the programmer it's only for use in the company's China offices.

Many companies openly discuss their countermeasures to protect their customer and internal data from lawful requests from the Chinese government. I'm not saying it's right or wrong, just that it's not a secret.

And then once the programmer writes it, it's a piece of cake to make it do the same thing in Canada.

Bartweiss2• 9 years ago

Many companies openly discuss their countermeasures to protect their customer and internal data from lawful requests from the Chinese government.

This seems like a serious counterpoint to "they were using it against lawful warrants therefore it's bad". Arguing that line and simultaneously excusing defensive measures against China, Turkey, or other governments isn't easy.

The obvious resolution is "ethics aren't equivalent to law", and using this tool to dodge ethical requests is still bad. But that's a far more discretionary standard than a lot of the positions I'm seeing here.

wowamit• 9 years ago

a system to keep internal records hidden from intruders entering any of its hundreds of foreign offices

That’s how the engineers must have been convinced on owning up the requirement.

dsfyu404ed• 9 years ago

I think the biggest issue here is that Uber actually has programmers on its staff who think its ok to write a program whose sole purpose is to try and break the law.

People who grew up in a situation where the law and the institutions that create and enforce it did them little good and plenty of bad (i.e. urban poor) often have little respect for it (though they may follow it as that's usually the least worst option when you're moving up the economic ladder).

I don't see a problem with software that shuffles data and access around to create cross-jurisdiction paperwork headaches for the police. Forcing them to cross their t's and dot their i's before going in makes it much harder for people with political ambitions to go fishing for stuff to put on their resume. We all know that law enforcement practices saying no via similar "oh you have to go get the info from these people" spaghetti fairly often with FOIA reqs.

gist• 9 years ago

ok to write a program whose sole purpose is to try and break the law

Is it 'breaking the law' to turn off computers when you see the police knocking at your door (or in the parking log) but don't know why? Meaning they haven't presented a warrant or even exchanged words with you yet?

Even in the particular event cited: "about 10 investigators for the Quebec tax authority burst into Uber Technologies Inc.’s office in Montreal"

The act of bursting in but not (yet) saying anything? I would argue that no laws have been broken.

Edit: A similar situation might be if you see flashing lights behind you when you are driving. Doesn't mean the police are there to stop you could be someone else or could be a mistake you haven't been officially notified of an infraction.

Breaking into an office is not the same as presenting a warrant and then prevent access to data detailed in a warrant.

BearGoesChirp3• 9 years ago

When a lawyer tells someone to not talk to the cops, are they doing anything wrong? Because the lawyer is basically asking 'what can I do to stop a lawful interrogation'.

Does this change if the person is suspected of having pot or of killing children?

greenyoda• 9 years ago

In the U.S., people have the right to remain silent during interrogations, so there's no problem with a lawyer advising a client to exercise that legal right. A lawyer can get in trouble (e.g., get disbarred) if they advise a client to break the law, e.g., by committing perjury or destroying evidence.

Does this change if the person is suspected of having pot or of killing children?

The U.S. legal system has a presumption of innocence, so merely being suspected of committing a crime shouldn't affect the legal rights you're entitled to. (Many innocent people become suspects in police investigations.)

pbhjpbhj2• 9 years ago

Sounds like a fun system to make, context aside.

It's there an OSS version of this somewhere: contact a server, server initiates clients on all devices to perform lockout with pre-arranged credentials. Client can clean caches, wipe partitions, etc., as required.

crankylinuxuser3• 9 years ago

Nahhh, I wouldn't rely on a server. I'd rely on a distributed network or a TOR gateway to a onionsite that is HA'ed with onionbalance. Even better if you can put in a 3g sim and have it talk using that as a backup.

Most of the time, your adversary is a thief with low/mild tech intelligence who'd let it talk to the net. Then game over, data's gone and you have a portable spy rig if you play your cards right.

brndnmtthws5• 9 years ago

What's interesting to me is that governments are becoming less and less important in society. With Google, Facebook, Uber, and Bitcoin, we're moving closer and closer to a world where human-based systems (government) are being supplanted by computer based systems (technology).

I for one believe this can be a good thing, since humans corrupt but computers are strictly deterministic.

maxxxxx2• 9 years ago

The rules for the computers are still made by humans.

brndnmtthws5• 9 years ago

That's true, but they are still deterministic and can be designed to be egalitarian.

Humans, on the other hand, cannot be trusted in the way that a computer can.

kbart• 9 years ago

I'd argue that government gets more and more power with technological advance. Just few decades ago regimes could only dream about total surveillance, now Chinese government are putting this in practice and I'm sure many will follow.

brndnmtthws5• 9 years ago

That's more of an example of human corruption, IMO. Counterpoint: people use various technologies (VPN) to bypass the great wall.

benburwell• 9 years ago

Larry Lessig agrees: https://en.wikipedia.org/wiki/Code_and_Other_Laws_of_Cybersp...

forapurpose2• 9 years ago

computers are strictly deterministic

Maybe in theory, but I haven't found my computers to behave that way.

gaius2• 9 years ago

Like managers at Uber’s hundreds of offices abroad, they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco

Isn’t this “tipping off”? Which is a crime in itself.

bouncing• 9 years ago

In what respect is "tipping off" a crime? Is it a crime if, after seeing a speed trap, I flash my brights at the next motorist?

I'm not a lawyer, but unless there's a gag order, I don't think it's a crime to tell someone you're being raided by police, especially if that someone is your security or legal staff.

crankylinuxuser3• 9 years ago

Legal in this context only means "The government gave themselves permission." It does not mean ethical, or right, or whatever. And with many police in many jurisdictions acting unethically (like stealing cash from motorists, bribery, blatant criminal conduct, and USA DHS duplicating phones/data), yes, you do have to take matters in your own hands.

Now, if they're found guilty, I have no problem "executing" the corporate charter as a death sentence. Just laws need to have teeth, and no piddly $10M fine is a deterrent.

burger_moon• 9 years ago

Is it a crime if, after seeing a speed trap, I flash my brights at the next motorist?

Where I grew up, yes that is a crime, at least in the sense it's something to be ticketed for, they're not going to haul you to jail.

dx0343• 9 years ago

Yes in some countries tipping off is a crime, esp warning about speed traps.

gaius2• 9 years ago

In what respect is "tipping off" a crime?

In the UK, in respect to the Proceeds Of Crime Act 2002. Financial regulations tend to be fairly universal in the West so I don’t doubt Canada has them. Start jailing people who send these messages and it will soon stop.

freeone30002• 9 years ago

Canada passed a law against it, the Proceeds of Crime act.

crankylinuxuser3• 9 years ago

Yeah, this sounds like a great tool. Of course it can be used for good and bad. Hell even "cp" is a potent copyright violating tool, if used in that purpose.

I can easily see a toolkit that makes sure everything is FDE with a distributed key network, and revocation from anywhere if needed. I also see remote distributed shutdown requests, sealed storage locking, remote device nuking, and plenty of other features if a device falls into the wrong hands.... even if that is local law enforcement.

Part of this also feels like the Neuromancer universe, where companies are the state actors, and the real states have only limited jurisdiction.

(And yes, I would help build a set of tools like this. They have multiple purposes, legal and illegal. Not my fault if someone uses them illegally in a jurisdiction. )

msumpter• 9 years ago

So prior to the next warrant served to Uber authorities will sever all communication lines ran into the suite right?

EGreg3• 9 years ago

That itself would trigger the shutdown. No heartbeat signal - shut it all down.

hitgeek• 9 years ago

most of this sounds like good practice for any company that stores large amounts of sensitive data.

perhaps the features were used inappropriately, but I would hope Uber can remote wipe a laptop, log users out of company systems, or centrally enforce encryption policies.

this line is just silly.

--"Later versions of Ripley gave Uber the ability to selectively provide information to government agencies that searched the company’s foreign offices. At the direction of company lawyers, security engineers could select which information to share with officials who had warrants to access Uber’s systems, the people say"

What is the alternative? Giving law enforcement access to all data without any discretion? Querying ride data for 1 person is technically "selectively provide information", but that seems perfectly acceptable.

diego_moita• 9 years ago

I agree.

The majority of people on this site are from countries that work under the rule of the law. I understand that they'd feel uneasy by these subterfuges.

But in places like Russia, China, Belarus, most of Africa and parts of Latin America these resources are more than justified. You should fear the police as much as the bad guys.

Actually, as a non-American, if I were to land on an U.S. airport with a computer or cellphone I'd also take careful measures to avoid abusive searches, even if they're substantiated by law.

dx0343• 9 years ago

But locking out all users by office? I can't think of a legitimate use case for that. Locking/wiping devices of people who left the company is standard but why for a whole office? Robbery doesn't really apply, either they do it when no one's in the office (devices locked anyway) or you won't be able to call HQ.

slivym• 9 years ago

The headline of this is that it was implemented in response to a legal police search that resulted in uber getting banned in a country because it was breaking the law. It was then repeatedly used to obstruct justice.

This wouldn't be news if I told you that Intel makes its engineers encrypt their hard disks and require passwords on wake and insist no one leave their computer unlocked.

The news here is that they're using this technology specifically for obstruction of justice.

mcguire3• 9 years ago

Right!

It's not the technology in question, it's the decision to use it for this specific purpose.

mcguire3• 9 years ago

What the heck does that illustration even mean?

alex_young• 9 years ago

Ripley, after Sigourney Weaver’s flamethrower-wielding hero in the Alien movies.

Sounds more like Ripley's believe it or not

mnm1• 9 years ago

They should have deployed this just once for a US case. I assume some of their communications travel across state lines and that would make their obstruction of justice and evidence tampering a federal crime. With our beyond vague definitions of such crimes, every Uber executive could have been in jail for decades by this point.

NelsonMinar• 9 years ago

It never fucking ends with this company, does it?

Uber’s Secret Tool for Keeping the Cops in the Dark

Related Stories