Top
Best
New

Posted by firefax 10 hours ago

DHS is using obscure law to snoop on journalists, non-profits, unions(www.theguardian.com)
358 points | 62 comments
softwaredoug 9 hours ago|
> In several cases, the DHS has withdrawn a 1509 summons after it was challenged in court and before a judge could rule on its legality. That may be a deliberate strategy to avoid having a judge rule on the legality of the summons.

They have a toy, they’re increasingly abusing it, then trying to dodge from it being taken away.

The thing is nobody has to comply with 1509 summons, DHS has to go to court to enforce it. A lot of the fault is on a company that complies without just ignoring it.

hackyhacky 8 hours ago||
> The thing is nobody has to comply with 1509 summons, DHS has to go to court to enforce it.

You're not wrong, but companies such as Google make business decisions, not moral decisions. It's far easier and cheaper for them to comply, while there is basically no incentive for them to fight the summons. Especially given the current administration's proven record of taking retaliation against anyone who stands in their way.

If you want companies to behave in the interest of the general public, you need to create an incentive structure that supports that.

buzer 8 hours ago|||
Wouldn't the affected individual be able to sue the provider at least in some cases? From what I understand e.g. Stored Communications Act might allow suing T-Mobile in this case, at least if the individual isn't covered by binding arbitration. And possibly even government under 18 U.S.C. §2712.

Of course then it's up to judge to determine if the request was valid or not.

coldtea 5 hours ago||
>Wouldn't the affected individual be able to sue the provider at least in some cases?

And lose time and money, which they also likely don't have?

buzer 5 hours ago||
Both SCA and 18 U.S.C. §2712 can grant punitive damages and attorney fees. So there might be lawyers who would take it on contingency, and in this kind of case some non-profit could also have interest in litigating the issue.

And as this is something that has already happened there isn't much else the person in question can do. Third parties always have option to just disclose information to whoever asks it, at most you can hold them accountable for it later if it was unlawful. And what accountability exactly means depends on what laws exists. If you want some real accountability for the people/companies involved in these kinds of decisions then get Congress to pass such laws (however impossible it might be).

mmooss 6 hours ago||||
The OP contradicts your theory:

"In Fort’s case, Google did not comply with the summons for any of the accounts. The company responded to the DHS by saying it had not offered evidence of how it was related to a customs investigation."

> companies such as Google make business decisions, not moral decisions

The world is more complicated than that; they make both kinds of decisions and many decisions aren't clearly in one basket or the other. Humans don't biologically change to amoral creatures when they pull into the office parking lot (despite theories to the contrary or attempts to encourage it), nor are they absolved of human responsibility when doing things for which they are paid.

hackyhacky 3 hours ago|||
> human responsibility

Not sure what this means. I think you meant to write "fiduciary duty": the company's board have an affirmative legal obligation to act in the interest of stockholders, regardless of moral impact.

SR2Z 55 minutes ago||
I don't know why people keep repeating this. The board of a company must act in the interests of shareholders but the interests of shareholders go beyond just "make as much money as possible."

It's entirely possible to still satisfy those requirements by building a sustainable and moral company. The shareholders get to vote, if they don't like it they'll make that clear.

hackyhacky 15 minutes ago||
> The board of a company must act in the interests of shareholders

I think you don't understand what this phrase means. In a publicly-traded company, "the interest of the shareholders" does not mean "whatever the shareholders want"; it means "whatever is best for the company." That means money.

It may be possible to be both profitable and moral; but if it isn't, the fiduciary duty obligates corporate officers to choose the profitable path rather than the moral one.

The easy way of looking at this is that there beyond complying with the law, there is no general obligation for companies to behave morally, but there is a general obligation to behave profitably. So it's not hard to see why they make they choices they do.

> It's entirely possible to still satisfy those requirements by building a sustainable and moral company.

It is, but it's a lot easier to be not sustainable and not moral.

schubidubiduba 5 hours ago|||
The system in which those companies exist is explicitly designed though to strip away any humanity or moral qualms as much as possible. Dividing it on the shoulders of many people, making nobody in particular feel responsible for the damages themselves. Gaslighting employees into thinking they are doing the "lesser evil" or something. Just following commans of their boss.
parineum 3 hours ago||
> The system in which those companies exist is explicitly designed though to strip away any humanity or moral qualms as much as possible.

Citation needed.

ajross 59 minutes ago||||
> You're not wrong, but companies such as Google make business decisions, not moral decisions. It's far easier and cheaper for them to comply

From the space between the lines in the article, it seems pretty clear that Google denied the request, and its employees were the source for the claim being reported at all. Yes, they absolutely could be evil in principle. They appear to have been good in practice.

And in times of extremis like this, maybe it's important to call out those little victories and find allies where you can. Even if you happen to be a HN Apple stan.

michaelt 6 hours ago|||
> there is basically no incentive for them to fight the summons

Ehhh, seems to me a cloud provider that wants to back up my documents, communications, photos, passkeys etc has a very strong business case for ensuring the data is as safe with them as they would be in my own home.

loloquwowndueo 4 hours ago||
Sweet summer child.
15155 7 hours ago||
> They have a toy, they’re increasingly abusing it, then trying to dodge from it being taken away.

This isn't uncommon - this is how NY deals with any compelling case involving their infringing gun control statutes. If a defendant has money and no other meaningful charges, they tend to just dismiss and moot the issue rather than risk a finding of unconstitutionality.

smalltorch 7 hours ago||
Perfect thread to drop tmailplus. It's for journalists who can't rely on centralized systems.

Become your own tiny infra

https://gitlab.com/here_forawhile/tmailplus

skybrian 9 hours ago||
Apparently in this case, T-Mobile caved and Google didn't:

> The DHS also sought and obtained six months of phone records for Fort from T-Mobile, which included records for more than 10,000 calls and text messages. Fort was not notified the government was seeking the records until mid-July, when government lawyers produced them to her lawyers. Fort’s lawyers wrote in a filing this week they were “stunned” to see the government had unilaterally been able to obtain a log of her communications after a judge had warned them about obtaining records about a journalist.

...

> In Fort’s case, Google did not comply with the summons for any of the accounts. The company responded to the DHS by saying it had not offered evidence of how it was related to a customs investigation.

> A Google spokesperson said the company reviews each request for data it gets to ensure it is legal and pushes back when it is too broad or doesn’t follow the correct process.

edot 9 hours ago|
[flagged]
xoa 8 hours ago|||
>Since when were private companies part of the Judicial Branch?

What part of GP's quote from the article gets you to "private companies are part of the judicial branch"? The judicial branch wasn't involved there, only the executive. All of us, private individuals or organizations, have the right to challenge any requests by the executive branch (and by the same token, unless forbidden by law we can also just voluntarily go along with its requests). The judicial branch can then rule on who is right. If the executive wants to force it then it can go to the judicial branch up front and get an actual for real warrant. If it wants to bypass judicial review, then it doesn't have the same legal force either.

Here, it asked T-Mobile and Google for a bunch of stuff on a journalist. T-Mobile said sure. Google said no, come back with a warrant.

>I don’t remember that part of the Constitution.

Might want to reread if it's been awhile for you.

edot 8 hours ago||
I get what you're saying, but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?
xoa 8 hours ago|||
>but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?

No, unless you're arguing that the government should be barred from even making voluntary requests at all? I'm not sure I'd agree with that either though, there's plenty of times where a government request really is just an honest "request" for pure info, like a poll or survey or something on how a program is working and any feedback participants want to give. Though of course it's also easy to see how things like 3rd party doctrine have expanded in effect over time and gotten badly abused, particularly in combination with other levers government has. Perhaps that doctrine should be abolished and the government shouldn't be able to make "voluntary requests" for anything that'd touch on a criminal or civil investigation (so they'd still be able to ask for surveys and the like), but that'd require some careful consideration. Or maybe there are some reasonable limits in terms of data automatically and unavoidably collected (like cellular location) vs data voluntarily shared.

Regardless however, if the government wants to compel somebody to comply, well that's literally what a warrant (or court order) is for right? If the government chooses not to involve a judge in a request for data that'd require a warrant to force, then yeah of course the private party they're asking gets to decide whether to voluntarily go along with that or not. That's the trade.

michaelt 6 hours ago||
> No, unless you're arguing that the government should be barred from even making voluntary requests at all?

IMHO the third-party doctrine is an area where legislators ought to be passing laws to broaden constitutional protections, in suitably nuanced way, to keep up with the times. In the modern age, people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.

The idea that fourth amendment protections apply to physical mail, but not to e-mail [1] doesn't really make much sense.

Unfortunately this is the sort of thing change that really needs to come from legislators, and the legislative process isn't very effective at the moment.

[1] except for the 0.1% of people who self-host their own e-mail server in their own home

2legit2quit 6 hours ago||||
> ...but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?

This is assuming the first pass is before a judge. They're circumventing this by going straight to the companies, as noted by the following blurbs:

> This time, DHS utilized a different method that didn’t require approval from a judge, only a sign-off from a DHS official.

and

> It also instructed the recipients of the summons to keep it secret.

In most cases, a company's legal team will attempt to validate the legality of a request because, if they just acquiesce, it becomes a legal problem for them to turn over data without that validation of legality - which can have financial repercussions.

In those cases, the government most often will not (and cannot) step in to save them from the financial blowback (i.e.: the government got what it wanted; it's not their problem, now).

PretzelPirate 8 hours ago|||
Company legal departments should absolutely review requests and make sure they're legal before handing over data.

If they suspect the request isn't legal, they can refuse it, and then it can be escalated to a judge.

Are you suggesting that every request should go through a judge before it gets sent to a company? That would be great, but even then, different judges interpret laws differently, so a company will still do a legal review before deciding whether or not to comply.

noir_lord 8 hours ago||||
An extremely cosy relationship between large corporations and a government.

I've seen this somewhere before and I can't quite put my finger on where I saw it.

JumpCrisscross 7 hours ago||
Note that the DHS budget ($100bn) is sufficient to provide healthcare to every uninsured child, and about half (EDIT: a third) of what it would cost to provide universal healthcare to every American under 18 at the CMS average rate.

At the end of the day this sort of wastefulness eventually attracts attention.

some_random 6 hours ago|
Medicare alone costs $1.21 Trillion, I find that extremely hard to believe.
JumpCrisscross 6 hours ago||
> Medicare alone costs $1.21 Trillion

To cover 70.5 million seniors [1]. $17k per senior.

“Per person personal health care spending for the 65 and older population was $22,356 in 2020, over 5 times higher than spending per child ($4,217) and almost 2.5 times the spending per working-age person ($9,154)” [2].

80 million under 19 [3] at that rate comes to about $400bn. And most efficiency estimates would take at least a third off that when we eliminate redundant billing processes.

Given 6% of children lack health insurance, we could cover them for about $24bn. Less than Trump’s war in Iran has cost [4].

[1] https://data.cms.gov/summary-statistics-on-beneficiary-enrol...

[2] https://www.cms.gov/data-research/statistics-trends-and-repo...

[3] https://www.cms.gov/data-research/statistics-trends-and-repo...

[4] https://www.aecf.org/blog/uninsured-children-in-america

iJohnDoe 1 hour ago||
This is like UAE and North Korea behavior.

If you have to spy on these particular groups then you know you’re doing something wrong.

inigyou 9 hours ago||
Use small platforms where possible. Oh wait, small platforms get sanctioned as terrorist organisations. I've been thinking I need to get my own IP range, but that requires exposing a lot of personal information.
noman-land 5 hours ago|
They just removed ownership reporting requirements. Feel free to start an anonymous company and buy an IP block.
inigyou 5 hours ago||
Hm true but I'm not in the US (and if I was I'd have much bigger problems). Maybe I have to register a company in my country that owns one in the US. But I wouldn't want the US to have power over my IP assignment, that defeats the point. Even if it was a US company registering with RIPE, the US government would have a veto by deleting the company.

There may be other uses for an anonymous US company though.

0xbadcafebee 1 hour ago||
“It’s outrageous conduct on so many levels. It’s hard to know where to begin,”

Do they not get that we live under an authoritarian regime? The regime doesn't care about the law. They have been installing their own people at every level of government for years, taking over parts of the government, and granting themselves new powers. When eventually every powerful person in government is part of the regime, it won't matter what the law says. This isn't hyperbole, this is how they have been operating for 1.5 years.

This is what the beginning looks like. The end looks like Germany 1942.

wolfcola 6 hours ago||
ah, but the boot is off of a16z’s neck, so it’s all worth it!
antonvs 5 hours ago|
Joke’s on them, Andreesen has no neck.
inigyou 9 hours ago||
I'm surprised they still need a law.
kingkawn 44 minutes ago|
They are disgusting pigs and the sooner the public sends them to political hell the better
More comments...