Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

Post reply on HN
Print view View original

171–180 of 226 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#171

Post by wolverine876 »

While I generally support Signal's mission, let's not get too taken in by their own PR and its triumphal tone, however satisfying it may be to thumb one's nose at the powerful. (People tend to trust the PR they like and distrust PR they don't like - let's think critically about of all of it.)

Based only on this post and the Cellebrite hack, Signal appears overconfident, taken with their own press clippings, and making enemies. That's not behavior that leads to good security: Paranoid, worried about the next vulnerability, and utilizing excellent risk management to prevent conflict are what I would look for. How does it help their millions of users when Signal provokes a leading forensics firm and the U.S. DoJ?

Could you imagine a security team at a company doing this, making problems for the company? It would be absurd. Maybe Signal feels they need the publicity.

Re: Grand jury subpoena for Signal user data, Central District of California

#172

Post by md_ »

motohagiography wrote: post #144
md_ wrote: post #135

Earlier quoted context omitted.

This is one of those posts that sounds truthy because it makes a bunch of broad assertions. ;) Legal systems are peopled by people. Just like other systems. Unlike many other systems, the American legal system is in fact highly distributed—so it's hard to say things like "The System is out to destroy you"; individual agents of that "system" might have different, misaligned, or antagonistic goals. Much of this is by d…

A semantic argument about the scope of a synecdoche doesn't address the substance of whether Signal should underestimate the intent and consequences of a clumsy looking subpoena. Partisan and other exceedingly bad actors in a system necessarily have even better special protections than good ones, because they're the ones a system has to defend to defend the legitimacy of itself. Ask any union or profession that behav…

Sometimes a cigar is just a cigar.

Re: Grand jury subpoena for Signal user data, Central District of California

#173

Post by md_ »

true_religion wrote: post #141
md_ wrote: post #135

Earlier quoted context omitted.

This is one of those posts that sounds truthy because it makes a bunch of broad assertions. ;) Legal systems are peopled by people. Just like other systems. Unlike many other systems, the American legal system is in fact highly distributed—so it's hard to say things like "The System is out to destroy you"; individual agents of that "system" might have different, misaligned, or antagonistic goals. Much of this is by d…

Signal seems secure from the outside, but is it? A judge won't simply take their word for it that they don't have the data, they'll make the order and see if anything turns up. What if there's a misconfigured logging server that has information that can be used to identify users? Well then that's now going to be given to the government and if Signal tries to turn it off they'll be liable for destruction of evidence.…

Judges taking their word for it is exactly what happens when you respond to a subpoena. That’s literally how it works.

Re: Grand jury subpoena for Signal user data, Central District of California

#174

Post by md_ »

infogulch wrote: post #129
auiya wrote: post #90

It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…

If I may restate this slightly: > Subpoenas are the only mechanism by which prosecutors are able to test the waters to confirm/deny whether they can demand production of this data I think many people fail to appreciate the importance of setting a precedent in the courts. Maybe this is because our legislators have been shirking responsibility for decades and pushing what should be their work off onto the executive and…

This doesn’t make any sense to me.

There’s no precedential issue here. Law enforcement can and routinely do demand such data, and in the case of other services they receive it. The only news here is that Signal can’t produce much of it because they don’t have it.

Signal is in fact complying with the subpoena. They’re not challenging anything in court.

Re: Grand jury subpoena for Signal user data, Central District of California

#175

Post by jedberg »

My fear with Signal being so giddy about what they don't have is that it will convince Congress to make a law forcing them to collect the data they don't have, the laws of math be damned.

I worry that Congress with just make them liable if they are requested to produce location data and are unable to do so, for example.

Re: Grand jury subpoena for Signal user data, Central District of California

#176

Post by mike_d »

roflc0ptic wrote: post #46
mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

The structure of grand juries makes it so that the defense is unable to mount a defense. The fact that grand juries often result in indictment has vanishing little relevance for whether or not it’s a fishing expedition. Further, no one is saying it is a fishing expedition. It’s a request for information that Signal isn’t designed to be able to answer. You’re also just speculating about the nature of the crime, but sa…

> You’re also just speculating about the nature of the crime, but saying it confidently, like, oh, this is definitely true. You don’t know.

HSI is a fairly narrowly scoped law enforcement agency. I've dealt with multiple agents over there, and at one point considered joining when I wanted to get out of computers. But feel free to call the press office and ask if you don't want to believe a random on the internet.

Re: Grand jury subpoena for Signal user data, Central District of California

#177

Post by Lendal »

jedberg wrote: post #175

My fear with Signal being so giddy about what they don't have is that it will convince Congress to make a law forcing them to collect the data they don't have, the laws of math be damned. I worry that Congress with just make them liable if they are requested to produce location data and are unable to do so, for example.

As a Signal user it does not make me happy either that they seem to enjoy thwarting law enforcement for its own sake. I'm not a criminal. I just enjoy privacy and good software. I don't enjoy thumbing my nose at the justice department when they're just trying to do their job protecting citizens from criminals.

Signal, just follow the law and quit acting so happy whenever your software helps a criminal get away with criming. It's not a good look.

Re: Grand jury subpoena for Signal user data, Central District of California

#178

Post by ygjb »

wolverine876 wrote: post #171

While I generally support Signal's mission, let's not get too taken in by their own PR and its triumphal tone, however satisfying it may be to thumb one's nose at the powerful. (People tend to trust the PR they like and distrust PR they don't like - let's think critically about of all of it.) Based only on this post and the Cellebrite hack, Signal appears overconfident, taken with their own press clippings, and makin…

Several security teams do this. Project Zero and it's various researcher have been thumbing their noses at software companies for a long time.

The Cellebrite hack is not a shocking thing, similar demonstrations have been done for other digital forensics, IDS/IPS systems, and others over the last 20 years (longer?).

This notion that directly, and clearly calling out your adversaries deficiencies is unprofessional or a risk is kind of asinine, whether it's another business like Cellebrite, or ongoing government overreach in support of mass surveillance, or specific cases of investigation.

Failing to call them out leaves room for to imply agreement with their tactics and practices.

Re: Grand jury subpoena for Signal user data, Central District of California

#179

Post by ygjb »

ygjb wrote: post #178
wolverine876 wrote: post #171

While I generally support Signal's mission, let's not get too taken in by their own PR and its triumphal tone, however satisfying it may be to thumb one's nose at the powerful. (People tend to trust the PR they like and distrust PR they don't like - let's think critically about of all of it.) Based only on this post and the Cellebrite hack, Signal appears overconfident, taken with their own press clippings, and makin…

Several security teams do this. Project Zero and it's various researcher have been thumbing their noses at software companies for a long time. The Cellebrite hack is not a shocking thing, similar demonstrations have been done for other digital forensics, IDS/IPS systems, and others over the last 20 years (longer?). This notion that directly, and clearly calling out your adversaries deficiencies is unprofessional or a…

That said, the Cellebrite hack scratched an old-school itch that hasn't been in awhile in a time when in person security cons where some of those demos happen haven't been happening :)

Re: Grand jury subpoena for Signal user data, Central District of California

#180

Post by kube-system »

ben_w wrote: post #155
xeromal wrote: post #139

Earlier quoted context omitted.

They're just going to call up an expert like they do with every industry.

The expert in question being the company which made it, because software isn’t a commodity like steel [0] where any two manufacturers are making basically interchangeable stuff. [0] I assume. I don’t do steel.

There's proprietary stuff in the steel business, and there's stuff that everyone knows. Same with software. The way end-to-end encryption works is common knowledge. Some of the same people here who know that Signal doesn't have this data are the same people who are those experts.
Post reply on HN