Hacker News new | ask | show | jobs
FBI held back ransomware decryption key to run operation targeting hackers (washingtonpost.com)
113 points by lnguyen 1739 days ago
8 comments

Related: the video "Why The Cops Won't Help You When You're Getting Stabbed" https://www.youtube.com/watch?v=jAfUI_hETy0

TL;DW: In the US, the police owes you no protection. See https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale...

That’s not at all what it says. It says a restraining order isn’t grounds for personal protection. Additionally it says even if it did grant personal protection there would be no monetary compensation for failure to protect. Nothing about that has anything to do with whether a law enforcement officer has an obligation to act when they see a crime being committed.

> were a mandate for enforcement to exist, it would not create an individual right to enforcement that could be considered a protected entitlement under the precedent of Board of Regents of State Colleges v. Roth; and even if there were a protected individual entitlement to enforcement of a restraining order, such entitlement would have no monetary value and hence would not count as property for the Due Process Clause.

Case in point, the officer assigned to stoneman Douglas was arrested for inaction:

https://www.washingtonpost.com/nation/2019/06/09/scot-peters...

Actually it IS what it's saying indirectly.

Case law stating that police have ZERO DUTY or LEGAL OBLIGATION to protect goes back to the 1850s. This case is merely the latest is in literally DOZENS of examples of case law saying this.

The Constitution and US case law very literally and repeated has said: "Your own protection is 100% ONLY on you"

And honestly this is why the 2nd amendment still is relevant and universal to all individuals.

or rather, why you can't sue them if they fail to protect you, which is slightly different. It is still their role to protect you.

Kind of like it is a doctor's role to try to cure you but you can't sue the doctor if they don't succeed.

Eh, in the US if a doctor does like none of her peers and fails to cure you, yes, doctors do get sued.

The point of the video was police as a fraternity don't have any obligation to protect you, personally, absent special circumstances. Which, when you get down to it is sort of like doctors-- if I have a heart attack across the street from a hospital, you know, I'd appreciate them trying to save me but unless there is some special circumstance I'm not confident they're required to.

> if I have a heart attack across the street from a hospital, you know, I'd appreciate them trying to save me but unless there is some special circumstance I'm not confident they're required to.

In some countries, especially in central Europe, failing to give aid where reasonable can even be a crime. In the US it depends on jurisdiction.

https://en.wikipedia.org/wiki/Duty_to_rescue

> US if a doctor does like none of her peers and fails to cure you, yes, doctors do get sued.

Can you clarify this? Are you saying if a Dr fails to cure you, they are opening themselves up to liability, or they only open themselves up to liability if they go outside of standard protocols and fail to cure you, they are now liable?

I was under the impression that neither of these scenarios open you up to liability- that medical malpractice is an entirely different things. However, I don't know.

Additionally- this seems to create really bad incentives, where the liability-free protocols take precedence over a doctor's judgement.

If you can demonstrate that a doctor did not follow "standard operating procedure" and thereby caused harm by not correcting an issue or making it worse, that's a pretty solid malpractice case. Which is why things like experimental intervention involve contracts and disclaimers that you have been informed of the experimental nature, not guaranteed to help, blah blah blah.
It their role to protect capital (i.e. private property), not people. Protecting people is an occasional consequence of that, but when the two are at odds, they almost always side against people.
The police will not help you much when your capital (i.e. private property) gets stolen, and will often defend thieves against victims trying to reclaim rightful property.

The police are there to protect the government against threats to stability and the monopoly on the use of power. Police are always quick to defend 'their own' (other police) and government agencies/agents.

> The police will not help you much when your capital (i.e. private property)

Most people don't hold much private property apart from maybe their house. Pretty much everything else from vehicles to toothbrushes fall under the category of personal property.

Private property generates capital for the owner without the owner performing labour, personal property does not. Police will protect the former, not the ladder.

I was responding to a parent comment which said "capital (i.e. private property)", not coming up with my own definition or wording, so if you have an issue with the semantics, please take it up with them.

That said, the police usually aren't especially interested in protecting business assets and property from being damaged or stolen either. Ask any business manager or owner who has had property damaged or stolen, and they will tell you that the police (in most areas) don't particularly care.

What if the ladder is rented out to do-it-your-selfers, is it then private property?
You can sue anyone for anything if you have the right legal team
Can you sue a doctor if they don't try?
Grey zone. You can't sue them because they haven't tried all the experimental treatments known. You probably can't even sue them if it is a misdiagnosis, unless it was egregious.

The police equivalent is that you don't expect them to be able to intercept every bullet fired everywhere. Particular if it is a the risk of their own lives.

This is a very general statement. I wonder if it’s true?
That Castle Rock case is sad.
I don't like this. To analogize this to a medical problem-- it would be severely unethical for a doctor to withhold proven treatment in order to study the course of a disease.

The FBI shouldn't continue to victimize for a (failed) chance at stopping the perpetrators.

Oof good point. You don't want to be compared to the Tuskegee Study.
And was a historic violation of medical ethics with damage that reverberates into the present.
I think it's fair to argue we are seeing this in real time right now around Covid and refusals by certain hospital systems to even let people try something like Ivermectin or other off label drugs.
It's worse than the analogy as in this case the "disease" clearly noticed it was being studied, which could have had catastrophic results and leave the disease better at hiding in the future.
This is SOP for the FBI. They've also gotten caught leaving a CSAM distribution network running after gaining control of it, for the same reason.
Working to fix things in the long run. I don't see an issue here.
Unsuccessfully though. In the end this just added harm with no benefit.
Yeah, and that's a shame. Hindsight is 20/20.

At the end of the day though, they couldn't have known that would happen, and they made the right choice. The Kaseya hack was terrible - they were trying to stop that happening again.

It's unethical to allow harm to fall upon innocent people to stop a bad person.
That's just the trolley problem, as other commenters have said. This whole debate is, which is a shame, because it means we're unlikely to convince each other.
This is not a trolley problem. The trolley problem has two assured outcomes - both leading to harm - and requires active intervention to choose the lower harm.

This has definitive harm for a potential gain against future potential harm, versus stopping an active harm at no direct real cost. It's a bird in hand versus two in the bush.

You can't use people in wagers like that.

This quickly devolves into killing one person to save 5... it's a difficult question.
More like definitely killing 5 people to maybe catch a murder.
It's not that clear cut. This is just a variation of the trolley problem.
> they made the right choice

You can't say that definitively. It seems unethical and incorrect to me.

They had to make the choice with the info available at that time. And exposing and prosecuting ransomware criminals could help to prevent future cases: The perpetrators are techies who are not street thugs, they could make money with legit work.
I agree with everything you wrote, but I don't see how any of it proves that they made the "correct decision."
Great but if I actively held something like that back I would probably be procecuted as an accomplice.
I am not sure I see a huge issue here. The FBI does similar things when investigating any other criminal enterprise. Sometimes it's difficult to weigh the short term benefit against a potentially larger longer term benefit.
The FBI doing secret projects without understanding the technology behind them?

*shocked pikachu meme*

I trust our government's tech and hacking capabilities as much as I trust politicians to ensure that ISPs are held accountable for subsidies and grants.
I don't see why the FBI would have bad intentions here.

Everyone in the US, including the FBI and the NSA have in their best interest a functioning economy without companies being ransomwared to death.

The FBI's intentions are getting more funds.

Seeming to be doing something useful is more important to that end than actually doing something useful, hence their colorful history of creating easy problems to fix and then solving them to great fanfare, particularly well-documented in the aftermath of 9/11.

It's much safer to find mentally unstable people, surround them by undercover agents and get them to incriminate themselves than it is to go after actual criminals.

They didn't have bad intentions, but they might have mismatched incentives.

An FBI agent wants to stop criminals and have a big bust more-so than they want to generally preserve the economy.

Intentions don't necessarily correspond very much to outcomes.