Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Banks hit with millions in fines for using Signal and WhatsApp

cnbc.com

Post reply on HN
Print view View original

51–60 of 247 posts

Re: Banks hit with millions in fines for using Signal and WhatsApp

#51

Post by denimnerd42 »

Zak wrote: post #26
WinstonSmith84 wrote: post #11

Earlier quoted context omitted.

Also security. WhatsApp end-to-end encryption or even better, Signal where messages can't be replicated to any other device is more reassuring than a custom implementation ... But it looks like this lawsuit is exactly about the opposite, that messages cannot be accessed and reviewed easily. It's also easy to understand why banks prefer using secured applications like Signal when discussing secret deals rather than ta…

Signal is not designed for situations where an intended recipient is intentionally aiding an eavesdropper. It does not prevent an intended recipient from making copies of messages via the regular clipboard even with disappearing messages turned on, and even if it did, could not stop someone from taking a video of their screen.

that’s different than cryptographic proof someone sent the message. anyone can fake the above.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#52

Post by TimTheTinker »

loeg wrote: post #38
veave wrote: post #25

Earlier quoted context omitted.

It's a bit weird that even though they can communicate person-to-person, where records won't be kept, they are supposed to keep records of electronic communication.

The weird step for me is the expansion of regulatory authority from published memos, to all written communication like texts and chats. I get it and don't really object to the end result, but it seems like the law should be updated to match what society desires to be regulated, rather than just relying on a generous interpretation by regulators.

I wonder if handwritten notes, post-its, or marks on whiteboards are also subject to regulatory authority.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#53

Post by 1MachineElf »

qwerty456127 wrote: post #23
richbell wrote: post #20

Earlier quoted context omitted.

As per the article, the issue is that employees were using encrypted messaging apps for work purposes. This is strictly forbidden by regulations, or at least failing to preserve your communications is.

I see... This sounds reasonable for some environments. But I doubt the banks are going to differentiate these, they will probably just ban private messengers altogether.

As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this.

These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc.

Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like:

1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court.

2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective.

3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank?

4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!)

It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#54

Post by ajross »

pipo234 wrote: post #2

Are US bank employees prohibited from discussing financial matters using anything but official channels (email, paper?) per se OR is this about using other channels and failing to preserve records of the conversations ?

No, that's just what the outrageous clickbait headline[1] fooled you into thinking.

The banks aren't being fined for using Signal or WhatsApp or any particular technology, they're being fined for failing to keep records of regulated communication they're required by law to present for auditing. Obviously if you use tools that don't keep records, you need to find a way to save it yourself.

[1] Bad in the CNBC original, but actually truncated here on HN to remove the explanatory clause. The original reads "Banks hit with $549 million in fines for use of Signal, WhatsApp to evade regulators’ reach"

Re: Banks hit with millions in fines for using Signal and WhatsApp

#55

Post by JohnFen »

loeg wrote: post #38
veave wrote: post #25

Earlier quoted context omitted.

It's a bit weird that even though they can communicate person-to-person, where records won't be kept, they are supposed to keep records of electronic communication.

The weird step for me is the expansion of regulatory authority from published memos, to all written communication like texts and chats. I get it and don't really object to the end result, but it seems like the law should be updated to match what society desires to be regulated, rather than just relying on a generous interpretation by regulators.

> it seems like the law should be updated to match what society desires to be regulated

This absolutely happens. Usually, however, the regulators are interpreting the law in a way that the legislators agree with. In those cases, there is no need for new legislation.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#56

Post by JohnFen »

wpietri wrote: post #31
Sunspark wrote: post #8

Earlier quoted context omitted.

Such a waste of time trying intently to regulate and control communication. People will just get a second private device that is not managed by the organization, and if there is a mutually beneficial advantage to doing so, the other party will do the same as well. This has been going on forever, I remember when they kicked up a huge fuss when they found out that people were doing direct pin-to-pin messages on the bla…

> Such a waste of time trying intently to regulate and control communication. It's not an overall waste of time, because the goal is to reduce the enormous wastes caused by fraud, crime, and other malfeasance. I know somebody who worked at a bank. The bank had a mandatory vacation policy: you had to be 100% gone for at least two solid weeks every year. When outsiders heard about this, they were often indignant. Who i…

> When outsiders heard about this, they were often indignant. Who is the company to tell me how I spend my vacation?

They're the employer and get to set reasonable conditions for employment, that's who they are.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#57

Post by developer93 »

ativzzz wrote: post #44
wpietri wrote: post #31

Earlier quoted context omitted.

> Such a waste of time trying intently to regulate and control communication. It's not an overall waste of time, because the goal is to reduce the enormous wastes caused by fraud, crime, and other malfeasance. I know somebody who worked at a bank. The bank had a mandatory vacation policy: you had to be 100% gone for at least two solid weeks every year. When outsiders heard about this, they were often indignant. Who i…

Is this one of those cases where it ends up causing death by regulation? Take the pharmaceutical industry in the US. One reason it's so expensive for them to operate is the massive amount of rules and regulations that surround their work and cause them to hire tons more highly skilled personnel in order to meet those regulations just to get work done. Now all those rules exist because someone did something bad and th…

I'm always cynical when I hear arguments like this, I feel like it's the profit motive which is more to blame. They need to justify those prices somehow, and reducing payouts to shareholders or C-levels would be unthinkable.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#58

Post by Sunspark »

loeg wrote: post #24
pipo234 wrote: post #2

Are US bank employees prohibited from discussing financial matters using anything but official channels (email, paper?) per se OR is this about using other channels and failing to preserve records of the conversations ?

So the law as written regards keeping records of inter-office memoranda, but the regulators have cheerfully expanded the scope of this to include essentially all communication by bank employees (except maybe phone calls).

No, it includes calls now. Traditional calls over copper telephone lines are not recorded, but digital calls over MS Teams or whatever are recorded and kept for review.

You still need a secondary device if you want to have a private conversation.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#59

Post by everybodyknows »

EGreg wrote: post #30
mihaic wrote: post #21

Earlier quoted context omitted.

Why risk lying about something like this? It makes no business sense, and I can't imagine the Facebook employees being so loyal as not to spill the beans here.

Really? Then explain this: https://newatlas.com/computers/facebook-not-secretly-listeni... And this: https://www.pcmag.com/news/facebook-app-caught-activating-ph... And this: https://www.wired.com/story/whatsapp-facebook-data-share-not... And of course this: https://www.propublica.org/article/how-facebook-undermines-p...

Buried in the Propublica piece (2021) is the ELI5 of the fundamental uncloaking mechanism:

>WhatsApp reviewers gain access to private content when users hit the “report” button on the app, identifying a message as allegedly violating the platform’s terms of service. This forwards five messages — the allegedly offending one along with the four previous ones in the exchange ...

This may not have much to do with the more specific abuse case of criminal financial conspiracies.

Re: Banks hit with millions in fines for using Signal and WhatsApp

#60

Post by Jcampuzano2 »

FirmwareBurner wrote: post #5

Ha, in Europe WhatsApp is even used by doctors and teachers to discuss patient/student matters, and even some government offices use it. It's wild how entrenched it is in every aspects of society, from social to business. Goes to show you how far good UX, simplicity and ease of use can take you.

Same practically everywhere in South America. You basically could not survive without using WhatsApp due to its prevalence.
Post reply on HN