Live data from Hacker News

How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

nytimes.com

211–220 of 805 posts

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#211
post #75

Earlier quoted context omitted.

Flee? Sure, if you are already wanted for arrest. Otherwise you can also move/emigrate. Which sounds a lot less dramatic than 'flee'.

For what it's worth, the US government requires income tax to be paid on foreign earnings, even while living and working overseas. To avoid that, you'd have to also renounce citizenships, which is expensive and at the government's discretion.

> [the US] requires income tax to be paid on foreign earnings

Which is a common reason to wish to renounce US citizenship. But there is a trap which prevents renunciation because you don't like to be unfairly taxed:

"If the Department of Homeland Security determines that the renunciation is motivated by tax avoidance purposes, the individual will be found inadmissible to the United States under Section 212(a)(10)(E) of the Immigration and Nationality Act"

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#212
post #111

It took me about 8 paragraphs in to figure out what Greyball is, so to save you the time: Uber used various data sources to identify which people are likely government officials who are trying to collect incriminating data on them, and then blocks them from the service so they can't be caught in sting operations. But there's a lot in the article that doesn't make sense: >Other techniques included looking at the user’…

I'd like to see them subpoenaed to explain what they were doing. They were deliberately violating the law, and trying to avoid detection just makes things much, much worse. This has got to be illegal.

The article says Uber's legal team approved it:

>At least 50 to 60 people inside Uber knew about Greyball, and some had qualms about whether it was ethical or legal. Greyball was approved by Uber’s legal team, headed by Salle Yoo, the general counsel.

I (though not a lawyer) assume their reasoning was: "It's legal to use public sources to identify possible law enforcement agents, it's legal to deny services to them. Seems legit."

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#213
post #11

Earlier quoted context omitted.

People generally feel more empowered to call out a company when others do. It's not so much about the media piling on Uber, as employees feeling safe in talking about their company's problems.

I don't think NYTimes need empowerment or to wait for someone to call out Uber to publish this story. I can only guess of a negative PR campaign from an apparent competitor, it's very obvious if you see anonymous medium posts(minus the susan flower's) and the hyperbole created about Travis's video and now this. Like everyone, I want them to pay for the culture they created at their company which resulted in employee…

> I don't think NYTimes need empowerment or to wait for someone to call out Uber to publish this story.

Yes, they do. Reputable journalists rely on sources before writing stories.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#214

I'm not excusing Uber at all because what they've done is extremely bad in multiple cases but find it strange all these hit pieces are coming out of the wood works. There is a large section of society that hates Uber and will spring at any chance to bring it down. Which is partially what I think happened with the whole #boycottUber thing and the new video of kalanick yelling at the driver. However, the sexism and dys…

I think it's a mistake to interpret the wave of stories about Uber's misbehavior as indicative of a "hit job" or "media bias" against Uber. Courage is contagious, and as people have started to speak out publicly against Uber's abuses, it appears current and former employees are becoming emboldened to share their experiences as well. I hope that this wave of public backlash will demonstrate to Uber, and the tech indus…

Also note the author of all these pieces from the NYT is Mike Isaac, who is very well connected with Uber sources.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#215

This is certainly a hardball approach, but I see nothing especially wrong with it. When you install Uber, you authorize it to send location data. If you happen to work at a transportation enforcement office, that is going to be immediately apparent to them unless you take countermeasures, such as using a GPS spoofing app. If I declare myself to be an enemy of a given entity, I fully expect them to use every resource…

> If I declare myself to be an enemy of a given entity, I fully expect them to use every resource at their disposal to attempt to defeat me For dealing with individuals, I don't agree that it's ok to use every resource at their disposal. For example, getting the person fired or slandering them is not acceptable. But this is dealing with government. Avoiding the law and law enforcement is wrong and often illegal.

This program was cleared by what I assume to be a highly paid, competent legal department. So I'm going to guess that you are wrong about the "illegal" part. They are a private business that can refuse service to anyone. Even businesses that aren't even close to breaking the law may have perfectly legitimate reasons to avoid serving people in law enforcement, whose job it often is to cause problems and increase expenses for the businesses they visit.

It would be illegal to refuse to allow them to do their job if they properly identified themselves as officers, and those officers had some kind of court order authorizing them to seize a car for example. But these are undercover agents posing as legitimate customers - a completely different scenario.

>For dealing with individuals, I don't agree that it's ok to use every resource at their disposal. For example, getting the person fired or slandering them is not acceptable.

I agree with this, but your government doesn't. Imagine you are falsely accused of a crime. You are quite likely to be fired, you will certainly be publicly slandered, and you may lose family and friends over it. It will take years and substantial amounts of money to clear your name, and when you do, most of the damage will have already been done anyway. In the end, you won't even receive as much as an apology.

The government doesn't offer you the same kind of mercy that you believe you should afford to others. So there's no reason to afford the government or anyone employed by it any courtesy beyond the bare minimum to which they are legally entitled. In the case of an unannounced undercover agent, they are nothing more than fellow humans with absolutely no special rights.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#216

Earlier quoted context omitted.

> What if local law enforcement officer was posing undercover as an Uber customer as part of a sexual assault investigation or trying to track down all drivers in relation to a recent crime? If they were, then I suspect that Uber would go out of their way to cooperate, using the detailed information they have on ride histories. Get a warrant, serve it to Uber, and get the data needed for the investigation. This ignor…

They're pre-emptively choosing to obstruct enforcement of whatever laws they deem unacceptable. So that's quite a rosy expectation about their willingness to cooperate.

The US has a pretty robust system for dealing with this. Get a warrant.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#217
post #182
post #111

It took me about 8 paragraphs in to figure out what Greyball is, so to save you the time: Uber used various data sources to identify which people are likely government officials who are trying to collect incriminating data on them, and then blocks them from the service so they can't be caught in sting operations. But there's a lot in the article that doesn't make sense: >Other techniques included looking at the user’…

Maybe not a popular opinion but I find this entire thing pure genius. >I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that? The first 6 digits of a credit card can identify the issuing bank (BIN number - https://en.wikipedia.org/wiki/Payment_card_number ). If you ask your merchant they can readily provide you and up to date list.…

> [credit card BIN numbers] plus public payroll records

Do California public records really make available where specific public employees bank?

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#218
post #168

Earlier quoted context omitted.

> I couldn't find a good source, but it doesn't seem like that's something a CC merchant would have access to. Do they really get to see that? The first six digits identify the issuing institution. Here's a free service for looking up a bank based on that information: https://binbase.com

Interesting! But don't the CC agreements require them to only use CC numbers for the absolute minimum purposes necessary to process the transaction? (They can't store the numbers themselves except the last four digits IIRC.) So (based on the site) they could presumably use that number as part of fraud prevention but not to "identify possible narcs" -- I imagine the CC companies will be livid at this usage.

CC processing agreements don't normally have any such restriction - the only information that absolutely can't be stored is the CVV/CVC number.

If you handle CC information, you are subject to security standards auditing (called PCI compliance - like encryption at rest, etc.), but the BIN number and last 4 digits are not considered privileged information.

I'm also not aware of any restrictions on how you want to use the BIN information - for example, merchants often use the BIN number to block prepaid card usage.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#219
post #38

Earlier quoted context omitted.

That struck me too. A normal company might do this, but they'd at least pretend it was meant to deter criminals or catch abusers or whatever. Instead their statement says: "This program denies ride requests to users who are violating our terms of service — whether that’s people aiming to physically harm drivers, competitors looking to disrupt our operations, or opponents who collude with officials on secret ‘stings’…

Both things can be correct if you believe the law in question is bad. The Jefferson quote comes to mind: "If a law is unjust, a man is not only right to disobey it, he is obligated to do so."

This. I know this country is unique. It's a country born from rebellion to begin with.

Re: How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

#220
post #113

Earlier quoted context omitted.

> What if you were just robbed or assaulted by a driver and Uber sends fake data about nearby cars when a cop is trying to use the app to track them down? You can't use the app to track anyone down. Driver reviews of passengers and passenger reviews of drivers are annoynomous for this reason. If a cop is trying to track an uber driver they would be much better off getting the license plate from the passenger and runn…

Yeah, but you could also use it to see where cars are in the area and track them down from there? Except if you're a cop they flagged and they send you bullshit noise on purpose. I guess that's fine, right?

Yes, it is fine. Uber is a private company and its data is private. It's an interesting thought experiment but I just can't get behind the idea that a private company has a moral or ethical responsibility to ensure that data they're providing to the public via their own app doesn't mislead law enforcement. If there was a court order for the data and it was inaccurate or false that's one thing but this is completely different.
Post reply on HN