Live data from Hacker News

France threatens GrapheneOS with arrests / server seizure for refusing backdoors

mamot.fr

261–270 of 399 posts

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#261
post #6

Google Translate link: https://translate.google.com/translate?tl=en&hl=en&u=https:/... Additional context: https://grapheneos.social/deck/@GrapheneOS/11557599710445618... https://grapheneos.social/@GrapheneOS/115583866253016416 https://grapheneos.social/@LaQuadrature@mamot.fr/11558177594... https://grapheneos.social/@GrapheneOS/115589833471347871 https://grapheneos.social/@GrapheneOS/115594002434998739

Summarized translation:

Following the propaganda of the ministry of interior, several articles were published in press about GrapheneOS, which is described as a solution for criminals because it allows to hide things.

La Quadrature du Net [similar to the FSF with regard to defending users' rights] argues that the purpose is of course not cybercrime, but to secure and protect the privacy of its users.

The head of the anticybercrime brigade of Paris threatens of suing the developers of GrapheneOS if connections with organized crime were to be found.

The government has repeatedly tried to extend cyber-surveillance previously. They are trying to use a law designed to fight drug traffickers in order to enforce backdoors in services that use cryptography, such as Signal or WhatsApp, without any success for the moment.

---

So, it's a threat before having a proof. They also mention the arrest of Pavel Durov, who was arrested because Telegram failed to answer legal requests, which was then constructed as complicity with criminals using Telegram, but that's obviously a very different case.

But of course, if they succeed in forcing backdoors, criminals will just use other ways to communicate (doesn't matter if they are legal or not because, well, they are criminals...) or tricks; for instance, back in the day when (analog) phone calls could be wiretapped, they were already using code words. They could use e.g. steganography tomorrow.

But we will be left with backdoors that are an unacceptable compromise on security and privacy. This is a recipe for dystopia considering that far-right parties are getting stronger in Europe, including France.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#262

Earlier quoted context omitted.

You know I didn't use to understand libertarians, but after years of watching boundaries being overstepped again and again I think I see the appeal of burning it all down and living in a cabin in the woods. Like, in Europe we already live in a completely safe society in historical and geographic terms, what more do you fucking want? Security is beyond a laughable excuse for things like chat control. Power tripping el…

I agree with your overall sentiment, except: "Like, in Europe we already live in a completely safe society in historical and geographic terms" Russia. Putin.

I'm talking about our society internally, not potential external attacks on it. It's reasonably high trust and crime is rare outside a few outlier cities. We could not be further from warranting these sort of fascist style crackdowns. Ironically yes we could be spending funding used for domestic surveillance and bureaucracy on buying more Himars.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#263

Earlier quoted context omitted.

The honeypot run by the FBI was closed source and that's why they could do it. while this is open source, which would make it much harder.

Wouldn't be hard to hide a backdoor in a multi million line codebase ...

Unless you think the same backdoor is hiding in AOSP, you can just check the diff and some extra lines for context.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#264
post #97
post #63

The linked article from Le Parisien (a big French billionaire-owned newspaper) is quite nuanced. It gives the police's view on narco-trafic crime, but also Graphene's take : "Criminals and traffickers also use knives." This organization, which is not a company but a foundation, emphasizes that its solution is used by ordinary people who dislike how apps and operating systems handle their data. It adds that if crimina…

One thing though is - knives, fast cars and cash aren't built with deliberate motivation of thwarting the law enforcement and criminal investigations. GrapheneOS and its systems are - you can walk through history and see that they're deliberately working on systems that defeat law enforcements efforts of collecting data from seized devices and tracking criminal networks. This is a massive difference - even for knives…

I think your point is that there is evidence that the intention of some or all of the developers and/or the organization as a whole is to make law enforcement more difficult. You go on to argue that this intention fundamentally alters how society, or at least law enforcement arms of government, should view this technology. Specifically, I take your argument to be that law enforcement should or will treat them as accomplices to some degree of the crimes they enable.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#265

Earlier quoted context omitted.

I've been saying this for years: the more power you have the higher standard you should be held in. In most societies on the planet it's the other way around.

Everyone agrees with this obviously but it's like saying that we should be able to levitate or live in utopia. It's almost a law of nature that the types that become powerful are not your most savory individuals and will use the power to reinforce their positions.

It's a law of nature that they will _try_.[0] That's why people should always have ways of defending themselves, whether it's with courts or guns.

[0]: This is not a figure of speech - many anti-social traits which result in NPD, ASPD and their subclinical versions[1] are genetic. There is literal evolutionary pressure to exploit others.

[1]: Meaning the trait is sufficiently pronounced to be harmful to others but not enough to be harmful to the person having it so it's not diagnosed as a disorder.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#266
post #34

Earlier quoted context omitted.

Of course the likes of Apple and Google are complying with lawful orders from the governments of countries they do business in. Businesses that don't generally cease operating in said country. LavaBit was a highly visible instance of a business shuttering itself instead of complying with such lawful orders.

That's also the ploy of basically every VPN provider out there. They say they don't store or give out data, but they still adhere to lawful requests. That necessarily includes requests from countries where they legally offer their service, even if their HQ is in some country with lax legal frameworks. It also means, if there is a legal way to coerce them into recording your data or handing it over, they will do so. h…

They also mentioned they only respond to court orders (ie. not just because the cops asked nicely), will try to appeal as well. That's better than most ISPs, who would either give up data without a court order, or won't bother appealing.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#267
post #71

I think your devices should have government-mandated backdoors if and only if you are a public servant. I don't understand why private citizens are held to higher standards of conduct than politicians and cops.

Isn’t it already the case?

Politicians are routinely ordered to surrender their communication to justice to audit what they do. Missing texts from Von Der Leyen is at the heart of Pfizer-gate after all.

I don’t really know what to think about this to be honest. I don’t think it’s entirely black and white and I find it surprisingly easy to play devil advocate.

Remember that the US government has an insane level of access to private communications via all the post 9/11 laws, how cosy it is with the main tech companies and we know they do a lot of these spying unofficially and with little oversight since Snowden.

Meanwhile, France is struggling with an unprecedented level of organised crime activity with the amount of violent crimes reaching worrying level. We are talking murders involving automatic weapons in broad daylight in the middle of the streets of France second largest city. Two weeks ago, the young brother of a famous anti-drug activist was murdered by a hitman while shopping.

There has been a huge increase in the quantity of cocaine being smuggled from South America triggering intense gang competition for the control of deal points and the mean in place to tackle the issue increasingly look vastly undersized. Limiting the discussion to it being authoritarian measure is refusing to acknowledge the very real challenge police currently face.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#268
post #86
post #78

Earlier quoted context omitted.

It is in third post in the thread: https://mamot.fr/@LaQuadrature/115581775986937247 > Interviewed, she warns that she will “not stop pursuing publishers if links are discovered with a criminal organization and they [GrapheneOS] do not cooperate with justice.”

Did "links" mean "a criminal organization is involved in the project" or "a criminal organization is using the technology"?

It's not clear what they mean by that in the threats they've made in multiple places but it's clearly a threat, and they're already lying about us. Therefore, we're leaving France including leaving OVH and not hiring people in France without them relocating first. Our most sensitive infrastructure is local but we don't want a state taking over our website and network services. We don't trust France and OVH to respect rule of law and human rights at this point. It's not a safe country for open source privacy projects and French companies cannot be trusted to even host a static website without hijacking it for French law enforcement.

French law enforcement is conflating companies making products with GrapheneOS code with GrapheneOS itself. They're presenting it as if those companies are working with us and that we're responsible for their actions selling devices using our code. Most of those are using forks of GrapheneOS with features we don't have which are repeatedly incorrectly referred to as being GrapheneOS features. GrapheneOS users can read the many articles and see many references to non-existent features. They similarly refer to non-existent distribution methods and marketing which are actually about these products they're conflating with us. Since they're conflating products and actions by other people with ours, that makes their threats very concerning.

GrapheneOS doesn't even currently bundle an end-to-end encrypted messaging app as we don't have our own and leave choosing third party apps up to users. We plan to make an RCS app with MLS to replace people using Google Messages via sandboxed Google Play but that's no different than what Apple and Google are working towards providing earlier. Even if Chat Control was already the law, we don't have Signal or a similar app bundled with the OS and don't currently distribute a hardened build via our App Store despite plans for it. We do distribute the sandboxed Play Store and Accrescent via our App Store which have end-to-end encrypted messaging apps available...

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#269
post #71

I think your devices should have government-mandated backdoors if and only if you are a public servant. I don't understand why private citizens are held to higher standards of conduct than politicians and cops.

> if you are a public servant. I don't understand why private citizens are held to higher standards of conduct than politicians and cops. Last time I checked, politicians and cops are private citizens... Wherever you stand on this, I can't understand the justification for this "one rule for thee" position.

> You cant understand why the people with a monopoly on violence and force have higher scrutiny? -- @retr0rocket

Replying here to this seemingly flagged/dead comment (not sure why it was flagged - a very reasonable question).

I fully support higher scrutiny of public officials & cops, but this frankly isn't that. First & foremost, the problems you're describing are systemic, not individual. Monitoring a cop's phone isn't going to reduce police violence if the system isn't accountable - this is essentially the "bad apple" argument. The entire system needs drastic reform: backdoors won't solve any real problems here.

Secondly, independently of the levels of reform needed, at an individual level we're talking workplace conduct, reporting, protocols & transparency -vs- dystopian privacy invasion. There's a very broad spectrum here long before we reach the need for extremes.

Lastly, you need to look at the systems doing the monitoring of politicians' & cops' phones in this hypothetical scenario: if those systems contain the same systemic corruptions (which they inevitably do), the entire argument for oversight is moot.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#270

Earlier quoted context omitted.

> they could, by eg signing a malicious OS update They successfully argued in court that being forced to insert code the government wanted would be equivalent to compelled speech, in violation of the first amendment. As the Feds often do, they dropped the case instead of allowing it to set a precedent they didn't want.

> They successfully argued in court that being forced to insert code the government wanted would be equivalent to compelled speech This isn't true, they never "successfully argued in court". There was never any judgement, and no precedent. They resisted a court order briefly before the FBI withdrew the request after finding another way into the device.

There wasn't judgement because the Feds dropped a case that would set a precedent they wanted to avoid.

Since there is longstanding legal precedent that corporations are people and code is speech, forcing a corporation to insert code that the US government demands is a violation of the first amendment.

Post reply on HN