Grand jury subpoena for Signal user data • Hacker News Board

Re: Grand jury subpoena for Signal user data

#131

Post by eternalban » Tue, Oct 04, 2016, 6:12 PM UTC

ryandrake wrote: post #57

Bartweiss wrote: post #48

Earlier quoted context omitted.

To me, the big question is what a trustworthy political solution would look like. I see this desire raised a lot, in contexts from HN to Valley-mocking pieces on how encryption is no substitute for advocacy. I completely understand the instinct, but every incarnation of it seems to struggle with the same question. Namely: how do you know when you've won? Restrictions against collecting data on US citizens didn't prod…

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

> Their opponents have been relentlessly chipping away at that "victory" ever since.

There, the "opponents" are a subset of society that have a legitimate right to not to agree with the decision and they are acting within the public framework of our governance to overturn a decision.

Here, the "opponents" of strict privacy rights are spooks and crooks in government and international corporations. It is entirely a differnet matter.

Established inherent rights -- specifically the rights of free speech, freedom of assembly, and protection from unreasonable search and seizures -- need to be protected in context of new capabilities afforded by modern communication, surveillance, and data retention technologies.

Corporations will not pull a dissenting "Roe vs Wade" that would challenge citizen rights. Just let them try that.

Overreaching elements and sub-systems of the government can try and present cases where our (updated) rights present obstacles to their performances of their legitimate legally mandated activities. And there is ample precedence for oversight for such matters.

A technological cold war with government and industry on the technological field is not a realistic option. First of all, it is politically useless since that approach implies that the constitutional framework and our entire system is in effect broken. Second, the "mathematical" bit in the secure and private mediated communication systems is the only element where one could possibly argue for parity in terms of the contending parties' capabilities. Why pick a losing fight when there remains the constitutional field where we have the upper hand, by definition.

[edit: minor cleanup]

Re: Grand jury subpoena for Signal user data

#132

Post by cloudjacker » Tue, Oct 04, 2016, 6:13 PM UTC

zeveb wrote: post #119

cloudjacker wrote: post #109

Earlier quoted context omitted.

Some examples of when a law can be retroactively applied: When the Securities Exchange Commission decides that something is a security, it retroactively applies the civil and criminal compliance back to 1934 because it was always a security. I mean, you can argue it in front of a judge if you want, but thats how they established jurisdiction. Same goes for discretionary tax law at the IRS or any regulatory agency I a…

That just goes to show that the Constitution, while imperfect, is better than what we have now.

I'm not sure what you mean, all of those agencies are formed under the constitution and the systems that support them are also abiding by the constitution

Re: Grand jury subpoena for Signal user data

#133

Post by jimktrains2 » Tue, Oct 04, 2016, 6:29 PM UTC

bahjoite wrote: post #31

jimktrains2 wrote: post #22

I love that they gave them the info in unix millis. A serious question though, how do gag orders work? How do I notify an attorney?

At the bottom of the gag order is states that OWS "may disclose the attached subpoena to an attorney for [OWS] for the purpose of receiving legal advice".

Is that required to be there? Is that just a curtesy? It would be unconstitutional otherwise, but, I don't know. It just seems odd. Is the attorney now bound by a gag order?

Re: Grand jury subpoena for Signal user data

#134

Post by jedahan » Tue, Oct 04, 2016, 6:33 PM UTC

zeveb wrote: post #11

tptacek wrote: post #8

Earlier quoted context omitted.

What metadata? All they were able to produce was whether or not a phone number was associated with Signal at all , and the last time that phone number's account pinged the Signal service for any reason . They produced virtually no metadata to the investigation.

Only because they don't store it. They are able to choose to store it at any point; we can only rely on their honesty (and lack of compulsion). It's better to have a protocol in which there isn't any significant metadata to choose to store. I don't distrust them today, but I have no way of knowing what their future behaviour will be. I'd prefer not to have to trust.

The client is open source[1], we can at least define a limit to what information can be stored that is not end-to-end encrypted.

https://github.com/WhisperSystems/Signal-Android

Re: Grand jury subpoena for Signal user data

#135

Post by zeveb » Tue, Oct 04, 2016, 6:39 PM UTC

cloudjacker wrote: post #132

zeveb wrote: post #119

Earlier quoted context omitted.

That just goes to show that the Constitution, while imperfect, is better than what we have now.

I'm not sure what you mean, all of those agencies are formed under the constitution and the systems that support them are also abiding by the constitution

The Constitution states, 'no Bill of Attainder or ex post facto Law shall be passed'; to the extent that those executive agencies' enabling legislation permits ex post facto regulations, that legislation is unconstitutional.

Re: Grand jury subpoena for Signal user data

#136

Post by Paul-ish » Tue, Oct 04, 2016, 6:40 PM UTC

woah wrote: post #3

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.

Could they be ordered to store metadata, with a gag order not allowing them to say they are doing so?

Re: Grand jury subpoena for Signal user data

#137

Post by indolering » Tue, Oct 04, 2016, 6:53 PM UTC

valarauca1 wrote: post #61

frandroid wrote: post #54

Earlier quoted context omitted.

A blockchain, of sorts...

Blockchains can do this. But they create relatively absurd systems of who can/can't send messages based on how much they've mined. Block chains are HORRIBLE for encrypted messaging. Since your message is PERMANENTLY part of the chain. So if a encryption is broken, or your password gets leaked. ANYONE can read your messages. In most cases a DHT is far simpler. But naturally some nodes can be evil and log metadata. Thi…

Bitcoin: the slowest, most expensive key/value store in history.

Re: Grand jury subpoena for Signal user data

#138

Post by vvpan » Tue, Oct 04, 2016, 7:00 PM UTC

zeveb wrote: post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Is "Pynchon Gate" named after Thomas Pynchon?

Re: Grand jury subpoena for Signal user data

#139

Post by yuhong » Tue, Oct 04, 2016, 7:03 PM UTC

Bartweiss wrote: post #105

ryandrake wrote: post #57

Earlier quoted context omitted.

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

I agree, but I'm talking about a scale even shorter than that. Roe v Wade was a clear and unambiguous advance for abortion rights, and the battle lines are now arrayed somewhere different than they were before Roe. The fight isn't over, but it's fairly clear who holds what. I'm talking about even knowing when you've made progress. If a federal directive came through tomorrow expansively forbidding the NSA from collec…

I think part of the problem in the US is the culture where for example police departments compete for resources, basically to make their own department bigger. One of the ideas in the Ron Paul movement was that governments needs to be smaller. Of course, in the real world it probably should not go as far as Ron Paul suggests, but....

Re: Grand jury subpoena for Signal user data

#140

Post by Kadin » Tue, Oct 04, 2016, 7:25 PM UTC

marketanarchist wrote: post #65

fweespeech wrote: post #45

Earlier quoted context omitted.

They can just make it illegal to own a mathematically secure piece of software without a license.

That would backfire economically and politically I think, especially long term. Let them ban it if they are so foolish.

They wouldn't need to outlaw or ban all cryptography, only the particular communication systems that don't have "lawful intercept" capability. There are already laws for this on the books, although they've generally been interpreted in such a way so as not to apply to non-telephony products so far.

TBH it probably wouldn't require that much Orwellian apparatus; you just make the software slightly harder to use than it already is today, and network effects basically ensure that only people who are really interested in communications without government interception (who the government is presumably interested in) are using it. Then you can start doing endpoint attacks, deanonymization via compromised downloads, etc.

The government's -- and I don't mean just the U.S.'s, but most large governments', I think -- ideal for Internet communications is something similar to the telephone network circa 1975. They're fine with privacy between one individual and another (i.e. keeping your conversations private from your neighbors), but they aren't going to be satisfied with any technology that prevents wiretaps by state-controlled apparatus.

I am not exactly bullish on the ability of technology or technologists to resist this, over the long run. Unless there is a widespread and overwhelming realization on the part of individuals that governments shouldn't have this ability, and I don't think that consensus exists even in the liberal West if you frame the question even moderately advantageously to the government, then they will get it. There will always be pockets of noncompliance, and an ensuing cat-and-mouse game, but the steady state will likely be one that deters mainstream usage.

And if we really are seeing the end of Anglo-American geopolitical dominance in favor of countries whose political systems emphasize stability and harmony over individual rights and dissent, then it becomes very difficult to see that consensus ever manifesting itself at a meaningful global level.