Hacker News new | ask | show | jobs
by YetAnotherNick 588 days ago
Why should it be illegal? Isn't it akin to "right to remain silent"? Why the need to present any information to police unless it is asked by court. Assuming that they didn't delete the data, just moved it to somewhere safe where it couldn't directly be taken away.

We had a raid in one of my previous company due to copyright violation due to a user uploaded content. Authorities came in to take in all the codebase, reports and even employee devices. Basically once given court permission, police would try to collect all the unrelated things which could be taken in the permission, so that they could extort you later.

5 comments

It can be destruction of evidence, which is illegal.
Denying access to data that could still be specifically subpoenaed isn't destruction of evidence, it's a normal security measure. They still have the warrant to search everything in the office, but not the right to use those computers to access uber's entire worldwide infrastructure.

I have no idea what french law says about it but I think it's morally fine and don't care that uber did it.

I think this is an example of law lagging technology. A warrant gives the police the right to inspect and seize contents of a safe inside a house. Similarly, the law should be updated so that a warrant gives the police the right to inspect and seize contents of local computers. Local computers surely have valid certificates that allow the computers to connect to the mothership, right?
Does a search warrant for your house give the police the right to search your car, if they found your car keys in your house? What about your neighbour's or your employer's car - perhaps on the other side of the world - if you happened to have those keys? To compel you not to tell your employer to change the locks, so the seized keys won't work?

These seem like closer real-world analogies for what exactly a warrant to search someone's computer should entitle the police to do.

Your analogy doesn’t work. Your neighbor is not you.

$COMPANY is $COMPANY all around the world and if $COMPANY wants to do business in $COUNTRY (which is not an obligation, they choose to), then yes, they have to entirely cooperate with $COUNTRY.

If they don’t want to, they can still do business elsewhere.

> $COMPANY is $COMPANY all around the world

This is the thing which is not the case. The subsidiary in the US is nearly always a different company than the one(s) in Europe. They'll have different management and different lawyers etc. Sometimes they even have different owners, e.g. because one of them is a joint venture with some other company, or a franchise. And they have to be different, because different countries have different laws and those laws often conflict with each other. So the subsidiary in the US follows US law and the one in France follows the law in France.

You could try to make it otherwise, but it's pretty obvious what would happen then. Companies couldn't formally operate in multiple countries because their laws are incompatible, so instead there would be a straw front company in any given country that nominally isn't owned by the conglomerate, but is effectively just reselling their product/service in that country for an additional margin that only pays the salary of local management. To prevent this you would have to ban companies from having foreign suppliers, which is not very practical.

And since countries know that's what would happen, they allow foreign subsidiaries to be regarded as separate entities even if they have shared ownership, instead of demanding the charade.

I don't think a warrant to search an office should let them use the keys they find there on a company truck five miles away, either. Despite being the same company. (If it's in the parking lot then it's a maybe.)
Not necessarily. Depending on how the org's set up, the system may be permissioned to access too much stuff. I think justice systems should lean less on a general warrant - too much of a fishing expedition - and instead focus on subpoenas specifically related to their area of investigation. E.g. if they seize the CEO's computer on accounting or tax concerns, I sincerely doubt they showed a judge probable cause to seize, I don't know, new product designs. As such they should not be able to access them.
The point you're making is valid, but also exposes a common theme in litigation against big tech. It's pretty common to hear something like "company XYZ used data ABC to train a model about their users and is court ordered to delete it". It's unlikely that anyone in the justice system has even the slightest clue how to ascertain if this actually happened and certainly no way to prove it has been deleted. The court gives the order, the company says they have complied, & everyone pretends to go back to the way things were before hand.
let me just extrapolate this out a bit for you. I live in the US (yes I visited France once long ago, it was nice). I use Uber. My phone is an Android phone running Uber's app.

Can a French prosecutor use Uber's systems to deliver a malicious payload to my phone to gather evidence? If so, is Uber required to assist them in this task?

I just have a hard time believing that any of us could get away with that.
Wasn't half of the concern with the arrest of Ross Ulbricht figuring when they could get him with his computer unlocked, without time to lock/wipe it? They'd have a pretty hard time proving destruction of evidence if 1. they didn't know for sure evidence was on that specific computer and 2. it was destroyed rather than just that the decryption key was removed from memory.

Regardless, the government violating an individual's rights doesn't mean we should yell at uber, it means we should yell at the government.

These two issues are very far apart.

Ross could argue he forgot his password to unlock the data in a single users case.

In the corporate case it would be hard for Uber to argue that the entire company now has no access to any of the subpoenaed data.

Yeah that doesn’t really shift my opinion lol If I activated a kill switch to wipe my local computers when the FBI entered my house I can’t even imagine the hell I’d reap, let alone that my data would be safe because it’s scattered on servers in other countries.

Also we can claim whatever we want but that doesn’t mean it’ll protect us in court.

Unless it wasn’t destroyed, in which case it might be interring with an investigation, which is probably also illegal in France.
It's definitely interference/obstruction at least of the raid itself yeah, but looking at the text and not being a lawyer I have a feeling it may be extremely hard to prosecute for something more substantial than a fine low enough for a french exec have it a as a guaranteed expense (bn€ in tax fraud vs a few k€ in fine). The law does also mention prison but it's not the kind of stuff that ever end up being applied for fiscal related cases.
> I have a feeling it may be extremely hard to prosecute for something more substantial than a fine low enough for a french exec have it a as a guaranteed expense

I know nothing about French law, but this whole thing gives me “organised crime” vibes. In many jurisdictions the punishment dramatically increases when a crime is commited as an organised group whose purpose is to commit said crime. As i said i know nothing about French law so i don’t know if the same concept is present there, let alone if the letter of the law would fit the situation.

But yeah i agree with you they won’t care unless they are sitting in a cell with the chance of sitting a lot more in a cell.

Because the government already has a warrant to obtain this evidence(they can't raid the office otherwise) and you as the company pushing this button are failing to turn over that evidence.
I guess locally encrypted files in my computer is a problem as well then
In many jurisdictions it actually is a problem

https://en.m.wikipedia.org/wiki/Key_disclosure_law

And if raids are court ordered?
I assume when the office was raided there was a warrant that would give police the right to inspect and seize property...
My impression was that they were trying to get remote access to ubers US servers/infrastructure/data?

Might be wrong...

Presumably the French police aren't randomly deciding on a Tuesday for no reason to check the company for proof of them being tax cheats without some court somewhere requesting it, but even if they were, we're talking about a company here, not a person. A person has the right to remain silent, it doesn't make sense for a company to have that same right.

And the 2nd half just reads like pure corruption to me, they paid off some politician (who just so happens to wield the most power in the whole country) to pressure him to get them to stop their investigation into their illegal acts? In what universe could that 2nd sentence be construed as anything other than slimy, corrupt behavior?

> And the 2nd half just reads like pure corruption to me

Why did you conclude that?

There were some user uploaded pirated content in our platform. As far as I know, some media company won approval by some judge for a raid to discover the extent of piracy. It's just in the police rulebook to get everything during the raid where there could be pirated content, including employees laptops.

Sorry, I meant the 2nd sentence of the OP, where they mention Uber paying off Macron.