seiferteric
8 months ago
I wonder how these "office raids" would work for remote first companies that don't have much of an office presence and with little or no physical documents and everything being stored in the cloud somewhere.
Algent
8 months ago
That's basically what happened when they tried (twice I think ?) to raid Uber offices in France, their boss pressed a kill switch and everything went down in seconds. It completely blocked the investigation.
Afterward Uber helped Macron campaign who then ordered National Financial Prosecutor's office to "stop bothering them" so I don't think anything new happened since.
Edit: Some sources in below replies for infos on both. Turn out I'm wrong for 2nd part it started earlier than his campaign.
stuaxo
8 months ago
That sounds so illegal, it's crazy there aren't consequences for that.
EDIT: Article on the kills switch https://www.theguardian.com/news/2022/jul/10/uber-bosses-tol...
0cf8612b2e1e
8 months ago
If you are a little person in the USA, I believe that would be spoliation of evidence.
telotortium
8 months ago
I don’t think any of these kill switches involved deleting data, just temporarily removing access of systems in the affected office.
0cf8612b2e1e
8 months ago
Not a lawyer, but let’s say the cops were searching my house. If I threw the keys to my unbreakable safe out the window, such that they could never be found, I doubt a judge would care for the distinction. That the evidence exists but cannot be accessed is still going to find you in contempt.
svieira
8 months ago
Now let's say that instead you threw the keys to your unbreakable safe to your friend across the Atlantic Ocean. And you say that you didn't know that the people entering were cops. And your friend won't give the keys back. The evidence may exist, you cannot access it, neither can the police. The court has no jurisdiction over your friend and you have no authority to force your friend to give you the keys back.
At that point, whether you are in contempt or not depends on the answer to the question "did you know that the cops were entering to look for evidence before you threw the keys?" Whether the judge holds you in contempt or not is a function of the free choice of the judge and is not related to the answer to the first question (though whether or not the judge should hold you in contempt is a function of what the judge believes about what you believed).
user
8 months ago
tonygiorgio
8 months ago
If it were keys to a safe that existed outside of the warrant requirements (in another country in fact), then it would likely not be illegal. The regulators would unlikely be able to legally access that safe anyways without extra due process, so it’s mostly about protecting against unwarranted access.
telotortium
8 months ago
The keys still exist and are accessible. What the kill switches does is make a fishing expedition harder. If the police knew of the existence of a specific document, or even all documents pertaining to certain terms, they could issue a targeted subpoena which Uber would have to comply with (at least in the US).
mewse-hn
8 months ago
That metaphor doesn't seem directly applicable to cutting off cloud access.
If we're trying for a metaphor that would be a similar situation pre-digitization, the cloud servers containing business documents could be considered head office, and the office being raided would be the branch office. The branch office would continually be communicating with head office for their operations, and that communication would be shut down during the raid.
This isn't a great metaphor because the "head office" has become sort of stateless and ephemeral with digitization, but that's part of the interesting question the OP was posing, how does law enforcement collect evidence when that evidence is hosted on cloud servers in nebulous datacenters?
eastbound
8 months ago
By creating a law for seizing the IT system of a company. “Provide everything”, and if we later find that any other document existed back at that time, then it’s contempt of court.
telotortium
8 months ago
In the US such a law would likely be declared unconstitutional by the fifth amendment due to being overly broad:
“””
United States v. Bridges, 344 F.3d 1010 (9th Cir. 2003)
There was probable cause to search the defendant’s office based on the information in the application that documented his efforts to provide illegal tax advice to various clients, including undercover agents. The search warrant in this case, however, was overly broad. It listed, among the items to be seized, “All records . . . documents . . . computer hardware and software . . .” Though this list was detailed, it was too expansive. There was simply no boundary to what could be seized. In addition, the warrant did not specify the crimes that were the subject of the search (nor did the warrant incorporate the application) so there was no limitation in that manner. Though the application was detailed, the warrant was not. All evidence should have been suppressed. (No discussion of Leon).
“””
https://casetext.com/analysis/search-and-seizure-particulari...
stevekemp
8 months ago
What about if you're within 100 miles of a border?
gruez
8 months ago
>By creating a law for seizing the IT system of a company
There's already "a law for seizing the IT system of a company", it's called discovery or a subpoena.
fossislife
8 months ago
As long as no police has confiscated (in most countries this involves the police man touching it, I bet) the equipment you can break it or make it inaccessibility however you like. It's your stuff, after all.
shiroiushi
8 months ago
>Not a lawyer, but let’s say the cops were searching my house. If I threw the keys to my unbreakable safe out the window, such that they could never be found, I doubt a judge would care for the distinction.
What if the safe was never in your house at all, but it was in a foreign country across an ocean? And when the cops showed up, you simply threw the keys across the ocean too?
If the cops know of something particular in the safe, then maybe the judge could find you in contempt for not producing that thing when ordered by the court, but otherwise, I don't see how they have any legal leg to stand on.
jjallen
8 months ago
This is like not giving them the password to your phone which I thought was protected at least in the US. They’re both literally keys.
onlypassingthru
8 months ago
Your password is sort of protected. A judge can hold you in prison for contempt for refusing to provide a password but there is an 18 month jail limit, at least in federal court.[0]
[0]https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
atmosx
8 months ago
> I doubt a judge would care for the distinction.
If the judge receives a call from the ministry of justice, they will care a great deal about the distinction.
izacus
8 months ago
This theorycrafting is cute, but in reality you've mixed up corporate entities and yourself as a person in a criminal case.
And if a corporate entity finds a way to openly defy a national government, it tends to happen that those governments find a way to change the law (they're the ones making it, right? :P) for that defiance to become punishable by other parts of those governments which can sanction the corporation, prevent their operations within the country or even throw people in jail.
AnthonyMouse
8 months ago
You're conflating two different things here.
One is, what does the law say? Did they violate it? Is it illegal for a foreign subsidiary to temporarily shut off access to a branch office? How would we like this to work? Policy arguments about law enforcement vs. due process and government overreach.
The other is, politics. If the local government is captured by a cartel of taxi medallion holders who don't like Uber, the government is going to find a way to screw Uber, regardless of whether Uber is complying with existing law. But then it's politics and Uber is a multi-billion dollar corporation, so they have the option to capture the government themselves.
Of course, that leaves the meta argument. Maybe deciding what should happen based on the second method is worse than the first, so how do we prevent that from being what happens?
izacus
8 months ago
No, what I'm saying is that governments aren't compilers you mess around with at will when you're as big as Netflix. The fact that something might be illegal is a changeable state by that very government if they decide a corporation has been jerking them around too much. Something being legal right now is a temporary state.
Did you miss all the screaming of US corporations in relation to EU Acts like DMA? Those changes are exactly what happens when you start to think that law and people behind it are separate.
throwawaymobule
8 months ago
Even if you do it before you could have known you were being served a warrant?
IIRC, they did it in the US too.
justapassenger
8 months ago
[dead]
spellbaker
8 months ago
Ok I'll bite... wtf
lokar
8 months ago
Nothing uber does is crazy anymore
NBJack
8 months ago
Not by comparison to Uber at least. 'Historical' documentaries about it are going to be wild. And probably on Netflix.
fragmede
8 months ago
If you haven't seen superpumped or read the book and are interested in Uber's story, it's worth a read/watch, though it's dramatized for tv.
lokar
8 months ago
I meant they have redefined the bar for crazy to be so high no one will ever cross it. They are the GOAT for crazy.
DoctorOW
8 months ago
History is written by the winners sadly enough.
exe34
8 months ago
you'd think a judge could order you to provide the documents and then jail you for contempt of court until you do?
golemotron
8 months ago
The alternative, giving them a password that gives them read/write access to sensitive systems, would be insane. Subpoena for particular data.
atoav
8 months ago
You are aware of the fact that tax evasion means these companies are freeloading on the tax money the rest of us (including: you) are paying? Especially in the case of uber which is essentially using public infrastructure to make their money having them pay taxes should be normal.
I agree that customer data needs to be protected, but it is bold to assume that is the case at all with these powerful corporate entities: if they lie to the state when filing taxes what makes you believe they are ernest when it comes to the protection of their users privacy?
Maybe it is a weird ideology I am holding here, but the more powerful an entity is, the more transparent it should become — nowaday we got this completely reversed with poor people being naked in front of the state and big corps literally fooling everyone.
Edit: some also seem to think the state is the behemoth that jumps on the poor little companies here. To that I just have to think about the account of the German public prosecutor Bäumler-Hösl (of wirecard fame) where she told about a raid on a bank where she and 4 collegues were opposed by 130 (!) company lawyers.
AnthonyMouse
8 months ago
> if they lie to the state when filing taxes
In general this is not what they do. What they do is read the tax code carefully and structure their operations in such a way as to minimize taxes, e.g. because tax is paid on "profits" (revenues minus expenses) so they shift more expenses into jurisdictions with high tax rates etc., causing "profits" to go down in those jurisdictions and up somewhere else.
Then they don't pay any taxes in the jurisdictions with higher tax rates and politicians go on TV and complain about the companies following the laws that the politicians enacted. Because if they actually fixed the laws, the taxes would be paid based on the extent to which the company does business in that jurisdiction, and then companies could only avoid taxes by not doing business there (costing the country jobs) or, for taxes associated with local sales, by raising prices there. Neither of which the politicians actually want to do, so instead they pass laws that allow companies to avoid taxes and then complain about it when the companies do it.
haccount
8 months ago
The law was always there to step on the little man, the VIPs always had it easier. Stop thinking too much about it.
atoav
8 months ago
nah I think we need systemic rules that help the little man while making it harder the bigger an entity grows.
gruez
8 months ago
[flagged]
atoav
8 months ago
Corporations are not people, any law who treats them as such has been perverted IMO.
aaronax
8 months ago
Thinking the systems that a company has are so sensitive that the company is basically above the law is the insane thing.
It is just a company--a group of people granted certain rights. They have databases...fancy filing cabinets. Just because the company is famous shouldn't preclude their filing cabinets from being searched (presuming legal processes are used and not abused).
gruez
8 months ago
> They have databases...fancy filing cabinets. Just because the company is famous shouldn't preclude their filing cabinets from being searched (presuming legal processes are used and not abused).
That analogy doesn't work, because the "filing cabinets" are actually sitting somewhere else, possibly in another country/continent. It's not obvious that authorities in one country has authority over documents stored in another country.
aaronax
8 months ago
I think it is not crazy to think that if the contents are used from some country then intentional obstruction of justice stuff like kill switches or dropping VPN connections should be treated as intentional obstruction of justice. AKA reality of use matters more than "location" of data.
valval
8 months ago
I and many others think the government should have 0 business in my filing cabinet. That difference in world view might be what makes this topic more complex than you seem to think.
Terr_
8 months ago
[Not parent poster] So even the most heinous act of violence become unprosecutable when the suspects/accomplices have moved all remaining evidence into a magically inviolable filing cabinet?
No? Then the world is a lot more complex than property rights trumping everything else.
valval
8 months ago
I think it’s very hard to say, and it just gets harder the more I think about it (like many things tend to).
On one hand, if the condemning evidence can’t be provided by someone other than me, should the case be prosecutable?
On the other hand, any sentient human can come up with examples of cases where it might be reasonable to search my belongings for evidence; multiple independent witnesses point to me being guilty of murder and investigations have otherwise stalled. Or anything of the sort.
What if all the independent witnesses are not independent? What if I’m not the guy, but just a lookalike? What if I’m being set up by the authorities?
The easy thing to do here is to say well okay SOMETIMES it’s okay to search one’s belongings but not for like any silly reason or anything like it has to be a real serious one. Then it’s just a matter of where to draw the lines, and who should get to decide.
I like the more absolute stance I made earlier; the government shouldn’t have any business in my personal belongings. Some crimes will go unpunished and that’s a price I’m willing to pay.
pyrale
8 months ago
Uber has a history of serving falsified data to the justice, though. Their offices are raided because they can’t be trusted with a subpoena.
golemotron
8 months ago
The real issue is that technology has rendered office raiding useless. People are welcome to explore alternatives.
pyrale
8 months ago
> People are welcome to explore alternatives.
For companies that deliberately obstruct justice work? Have the board and a healthy amount of executives serve 20 years in a high security prison, seize the assets and investigate their investors' due dilligence process. Gather proof with infiltrated workers.
Tech leaders need to learn that criminal conspiracy is not part of a good business plan. If they start using mafia tactics, so can Justice.
dh2022
8 months ago
You can give them read access tokens that expire every couple of hours....
golemotron
8 months ago
The problem is deeper than that. When a physical space is raided, its scope is obvious. Digital spaces don't have that characteristic. There can always be hidden indexes.
MichaelZuo
8 months ago
Yeah it's hard to see how any French official would have authority to conduct searches 10 meters beyond French borders, let alone over all of Uber's computers located in dozens of other countries.
wang_li
8 months ago
Hard to see how a company can imagine it can do business in a country and not follow that country’s record keeping laws and be subject to criminal and civil statutes in that country.
MichaelZuo
8 months ago
How is this relevant to Uber's files and computers located in other jurisdictions?
jraph
8 months ago
If you do business in France, you are accountable in France. Your problem to provide the asked documents if it's the law to provide them. That you are using computers elsewhere to store stuff should not be any relevant.
You shouldn't really be able to have it both ways, should you?
MichaelZuo
8 months ago
Uber's files and computers located in French territory are of course accountable to French authorities, but that's simply not the case for those located in other jurisdictions…
Unless there is some international law or treaty mandating that?
jraph
8 months ago
Authorities might not be able to seize computers and files in another country, although I think interpol can get involved in tax fraud or tax evasion matters.
Preventing access to your accounts during an audit is quite fishy, especially for an onsite audit without warning which, in France, is supposed to happen only if the authorities have doubts that you could make some evidences disappear. During an audit, the CEO is supposed to provide the documents, the inspectors are not supposed to access your files themselves I think.
(So blocking access for security reasons is bullshit, to answer someone else, the right thing to do is to have all the pieces in order for when an audit happens anyway)
MichaelZuo
8 months ago
Unless it’s legally mandatory in such a way that superior authorities can’t overrule it, then it doesn’t seem to matter? (such as the President, appellate courts, etc…)
Clearly in this case Uber got a superior authority to do so, and in any future case that will still be a likely possibility.
wang_li
8 months ago
It's not a matter of what's located in France. It's a matter of what documentation about your company requires you to keep. Regardless of where the computers you use are physically located if you can't produce the required documents you get to be fined, be shut down, and/or go to prison. No company gets to play the game of "we're doing business in Uzbekistan but our accounting servers are in Sealand so we don't have to file any taxes or provide any other records." Not only is the idea absurd, anyone who thinks that is congenitally stupid or stupid by choice.
MichaelZuo
8 months ago
Attempted insults only decrease the credibility of the writer… anyways I didn’t claim Uber is supplying less than the legally required amount of paperwork?
Nor is it likely.
All the accounting, insurance, banking, regulatory, etc… paperwork legally necessary for even a large company in France can easily fit in a set of binders that fit in a single bookcase.
So it’s literally possible for all of it to be ready and available for inspection before anyone even touches a keyboard. And in fact that was the case for every company in France pre 1960s.
jraph
8 months ago
[flagged]
tokinonagare
8 months ago
If a company is doing business here, the actual location of file is irrelevant.
Also when the government is really motivated, he can arrested the founders or executives directly (Pavel Durov). Which is what they should do to Netflix execs if they are doing business illegally.
gruez
8 months ago
>Also when the government is really motivated, he can arrested the founders or executives directly (Pavel Durov). Which is what they should do to Netflix execs if they are doing business illegally.
You're in favor of holding executives hostage to demand access to data? If they actually did something illegal, they can be arrested/tried for that, but arresting executives as a means to coerce companies into doing stuff is a total perversion of the rule of law.
izacus
8 months ago
> You're in favor of holding executives hostage to demand access to data? If they actually did something illegal, they can be arrested/tried for that, but arresting executives as a means to coerce companies into doing stuff is a total perversion of the rule of law.
Turns out that witholding data as a company executive is outright illegal, so yeah, we're in favor of it and they can get arrested and charged for for it.
gruez
8 months ago
>Turns out that witholding data as a company executive is outright illegal, so yeah, we're in favor of it and they can get arrested and charged for for it.
Except in this case it's not the executive that has the data. The data is sitting on some cloud server somewhere, and the executive no longer has access because the CISO got wind of the raid and locked his account. If you're holding the executive, you're not holding the executive because he's refusing to cooperate with a warrant, you're holding the executive as a hostage so HQ would turn over the document.
account42
8 months ago
So?
If executives don't want to sit in jail due to their company's shady tactics they can just not approve those tactics.
Alternative would be to shut the business down completely until they cooperate.
gruez
8 months ago
>they can just not approve those tactics.
You think the VP of Uber France was involved in the approval of global IT policies regarding locking accounts when there's a raid?
sealeck
8 months ago
> You're in favor of holding executives hostage to demand access to data?
This is a very emotional way of saying "you're in favour of enforcing contempt of court rulings against people who try to obstruct the judicial process".
gruez
8 months ago
See my other reply: https://news.ycombinator.com/item?id=42057072
it's not clear whether the executive has the ability to turn over the documents.
sealeck
8 months ago
The executive has the power to instruct other employees to do things.
nerdbert
8 months ago
What if it is illegal to withhold the data during an investigation? Isn't the executive then committing a crime?
gruez
8 months ago
See my other reply: https://news.ycombinator.com/item?id=42057072
multjoy
8 months ago
The executives are the company.
avidiax
8 months ago
That sounds like a pretty poor precedent when e.g. Russia or China raids the local office of a social media company to get data on a dissident.
Dracophoenix
8 months ago
This situation already happened with X/Twitter when the Brazilian Supreme Court attempted to compel Elon & co to disclose the social media accounts of alleged rioters. Unfortunately, it seems few people learn from even recent history.
MichaelZuo
8 months ago
Irrelevant according to who?
nicce
8 months ago
> Afterward Uber helped Macron campaign who then ordered National Financial Prosecutor's office to "stop bothering them" so I don't think anything new happened since.
Isn’t that kinda definiton of corruption?
Algent
8 months ago
I do need to correct myself, look like "friendship" started before his election: https://www.euronews.com/2023/07/18/a-privileged-relationshi...
Pretty crazy to support a business designed to never pay tax. This bring nothing beside "precarious employment".
grecy
8 months ago
Woah, slow down there citizen.
It’s been rebranded to “lobbying” and “campaign contributions”. Much cleaner. Better optics.
lm28469
8 months ago
Ahahahah you fool, don't be ridiculous, in civilized western countries we call it lobbying
hulitu
8 months ago
No. Corruption is when the others are doing it. /s
sensanaty
8 months ago
How the hell can any of what you just described be legal?
Do you have any articles about this? Because this is insane if true.
barrenko
8 months ago
It kinda sounds like you can't raid Uber / Netflix without hackers, Ghost in the shell type raid. Which is probably the future of raids.
andylynch
8 months ago
This is one of the prime threat models for things like encryption of data at rest on servers
user
8 months ago
YetAnotherNick
8 months ago
Why should it be illegal? Isn't it akin to "right to remain silent"? Why the need to present any information to police unless it is asked by court. Assuming that they didn't delete the data, just moved it to somewhere safe where it couldn't directly be taken away.
We had a raid in one of my previous company due to copyright violation due to a user uploaded content. Authorities came in to take in all the codebase, reports and even employee devices. Basically once given court permission, police would try to collect all the unrelated things which could be taken in the permission, so that they could extort you later.
LunaSea
8 months ago
It can be destruction of evidence, which is illegal.
_bin_
8 months ago
Denying access to data that could still be specifically subpoenaed isn't destruction of evidence, it's a normal security measure. They still have the warrant to search everything in the office, but not the right to use those computers to access uber's entire worldwide infrastructure.
I have no idea what french law says about it but I think it's morally fine and don't care that uber did it.
dh2022
8 months ago
I think this is an example of law lagging technology. A warrant gives the police the right to inspect and seize contents of a safe inside a house. Similarly, the law should be updated so that a warrant gives the police the right to inspect and seize contents of local computers. Local computers surely have valid certificates that allow the computers to connect to the mothership, right?
dmurray
8 months ago
Does a search warrant for your house give the police the right to search your car, if they found your car keys in your house? What about your neighbour's or your employer's car - perhaps on the other side of the world - if you happened to have those keys? To compel you not to tell your employer to change the locks, so the seized keys won't work?
These seem like closer real-world analogies for what exactly a warrant to search someone's computer should entitle the police to do.
pjerem
8 months ago
Your analogy doesn’t work. Your neighbor is not you.
$COMPANY is $COMPANY all around the world and if $COMPANY wants to do business in $COUNTRY (which is not an obligation, they choose to), then yes, they have to entirely cooperate with $COUNTRY.
If they don’t want to, they can still do business elsewhere.
AnthonyMouse
8 months ago
> $COMPANY is $COMPANY all around the world
This is the thing which is not the case. The subsidiary in the US is nearly always a different company than the one(s) in Europe. They'll have different management and different lawyers etc. Sometimes they even have different owners, e.g. because one of them is a joint venture with some other company, or a franchise. And they have to be different, because different countries have different laws and those laws often conflict with each other. So the subsidiary in the US follows US law and the one in France follows the law in France.
You could try to make it otherwise, but it's pretty obvious what would happen then. Companies couldn't formally operate in multiple countries because their laws are incompatible, so instead there would be a straw front company in any given country that nominally isn't owned by the conglomerate, but is effectively just reselling their product/service in that country for an additional margin that only pays the salary of local management. To prevent this you would have to ban companies from having foreign suppliers, which is not very practical.
And since countries know that's what would happen, they allow foreign subsidiaries to be regarded as separate entities even if they have shared ownership, instead of demanding the charade.
pjerem
8 months ago
In absolute, I agree with you. But personally if I had to chose between tax evasion (permitted by those schemes) and having less multinational companies because it’d be more difficult… well, my country was doing pretty okay before multinationals and is not doing okay since every taxes are evaded.
Well Netflix is nice and all but I prefer social security and teachers in school.
AnthonyMouse
8 months ago
Federal revenue as a percent of GDP:
https://fred.stlouisfed.org/series/FYFRGDA188S
Basically flat since the end of WWII, significantly lower before the war. At the height of the New Deal, less than half of what it is now. And that's in the face of significant growth in real GDP per capita. Probably not a dissimilar story in most other Western countries.
The problem isn't in the amount of taxes being collected, it's in where the money is going.
user
8 months ago
Dylan16807
8 months ago
I don't think a warrant to search an office should let them use the keys they find there on a company truck five miles away, either. Despite being the same company. (If it's in the parking lot then it's a maybe.)
_bin_
8 months ago
Not necessarily. Depending on how the org's set up, the system may be permissioned to access too much stuff. I think justice systems should lean less on a general warrant - too much of a fishing expedition - and instead focus on subpoenas specifically related to their area of investigation. E.g. if they seize the CEO's computer on accounting or tax concerns, I sincerely doubt they showed a judge probable cause to seize, I don't know, new product designs. As such they should not be able to access them.
sidewndr46
8 months ago
The point you're making is valid, but also exposes a common theme in litigation against big tech. It's pretty common to hear something like "company XYZ used data ABC to train a model about their users and is court ordered to delete it". It's unlikely that anyone in the justice system has even the slightest clue how to ascertain if this actually happened and certainly no way to prove it has been deleted. The court gives the order, the company says they have complied, & everyone pretends to go back to the way things were before hand.
sidewndr46
8 months ago
let me just extrapolate this out a bit for you. I live in the US (yes I visited France once long ago, it was nice). I use Uber. My phone is an Android phone running Uber's app.
Can a French prosecutor use Uber's systems to deliver a malicious payload to my phone to gather evidence? If so, is Uber required to assist them in this task?
BolexNOLA
8 months ago
I just have a hard time believing that any of us could get away with that.
_bin_
8 months ago
Wasn't half of the concern with the arrest of Ross Ulbricht figuring when they could get him with his computer unlocked, without time to lock/wipe it? They'd have a pretty hard time proving destruction of evidence if 1. they didn't know for sure evidence was on that specific computer and 2. it was destroyed rather than just that the decryption key was removed from memory.
Regardless, the government violating an individual's rights doesn't mean we should yell at uber, it means we should yell at the government.
chollida1
8 months ago
These two issues are very far apart.
Ross could argue he forgot his password to unlock the data in a single users case.
In the corporate case it would be hard for Uber to argue that the entire company now has no access to any of the subpoenaed data.
BolexNOLA
8 months ago
Yeah that doesn’t really shift my opinion lol If I activated a kill switch to wipe my local computers when the FBI entered my house I can’t even imagine the hell I’d reap, let alone that my data would be safe because it’s scattered on servers in other countries.
Also we can claim whatever we want but that doesn’t mean it’ll protect us in court.
staticautomatic
8 months ago
Unless it wasn’t destroyed, in which case it might be interring with an investigation, which is probably also illegal in France.
Algent
8 months ago
It's definitely interference/obstruction at least of the raid itself yeah, but looking at the text and not being a lawyer I have a feeling it may be extremely hard to prosecute for something more substantial than a fine low enough for a french exec have it a as a guaranteed expense (bn€ in tax fraud vs a few k€ in fine). The law does also mention prison but it's not the kind of stuff that ever end up being applied for fiscal related cases.
krisoft
8 months ago
> I have a feeling it may be extremely hard to prosecute for something more substantial than a fine low enough for a french exec have it a as a guaranteed expense
I know nothing about French law, but this whole thing gives me “organised crime” vibes. In many jurisdictions the punishment dramatically increases when a crime is commited as an organised group whose purpose is to commit said crime. As i said i know nothing about French law so i don’t know if the same concept is present there, let alone if the letter of the law would fit the situation.
But yeah i agree with you they won’t care unless they are sitting in a cell with the chance of sitting a lot more in a cell.
chollida1
8 months ago
Because the government already has a warrant to obtain this evidence(they can't raid the office otherwise) and you as the company pushing this button are failing to turn over that evidence.
charlieyu1
8 months ago
I guess locally encrypted files in my computer is a problem as well then
alexey-salmin
8 months ago
In many jurisdictions it actually is a problem
ExoticPearTree
8 months ago
[flagged]
echoangle
8 months ago
You have a right to not help them, but you can’t actively destroy evidence. Do you think it would be fine to begin burning documents once the police comes to you office?
ExoticPearTree
8 months ago
Funny, but you actually can. It is their job to prove that whatever you destroyed was the evidence they were looking for.
electrozav
8 months ago
And if raids are court ordered?
dh2022
8 months ago
I assume when the office was raided there was a warrant that would give police the right to inspect and seize property...
spacemanspiff01
8 months ago
My impression was that they were trying to get remote access to ubers US servers/infrastructure/data?
Might be wrong...
sensanaty
8 months ago
Presumably the French police aren't randomly deciding on a Tuesday for no reason to check the company for proof of them being tax cheats without some court somewhere requesting it, but even if they were, we're talking about a company here, not a person. A person has the right to remain silent, it doesn't make sense for a company to have that same right.
And the 2nd half just reads like pure corruption to me, they paid off some politician (who just so happens to wield the most power in the whole country) to pressure him to get them to stop their investigation into their illegal acts? In what universe could that 2nd sentence be construed as anything other than slimy, corrupt behavior?
YetAnotherNick
8 months ago
> And the 2nd half just reads like pure corruption to me
Why did you conclude that?
There were some user uploaded pirated content in our platform. As far as I know, some media company won approval by some judge for a raid to discover the extent of piracy. It's just in the police rulebook to get everything during the raid where there could be pirated content, including employees laptops.
sensanaty
8 months ago
Sorry, I meant the 2nd sentence of the OP, where they mention Uber paying off Macron.
ipaddr
8 months ago
[flagged]
reaperman
8 months ago
I don't understand the Mr. Peanut reference.
hulitu
8 months ago
[flagged]
Izikiel43
8 months ago
That’s so interesting, probably a good move for them, it’s not their job to make governments lives easier
Muromec
8 months ago
Sounds like obstruction of justice or what not
jokoon
8 months ago
do you have a source for the "kill switch"?
intelVISA
8 months ago
Some Saturday morning cartoon villain behavior, lol.
s_dev
8 months ago
I'd imagine you'd get done for not being tax compliant. At least in Ireland you have to able to show all tax accounting for the last four years on request by Revenue. If you can't produce this and all the files 'have gone missing' or 'we can't find the cloud keys' I'd would expect to be fined out of existence and ordered to cease trading immediately. So that would be worse that getting dragged through the courts while you pay lawyers to figure out to mitigate any fines or sentences passed down. I think it can even result in prison time for the CEO and other company officers.
dylan604
8 months ago
I'd expect it to something along the lines of "sorry Mario, but the princess is in a different castle" bit of shell game. "no no mister Revenue man, we have that information you want, but it's in a different office".
avianlyric
8 months ago
This is why companies are required to have registered addresses. As far as the law is considered, that address is where all your records can be accessed, and requested from.
If the state turns up at that address, and you tell them they’re at the wrong address, then the directors start becoming liable for fraudulent behaviour.
s_dev
8 months ago
There is only so much you can play whack a mole -- virtually nobody 'cheats' the taxman. There are plenty of legal loopholes etc. if you are smart enough to use them.
If you aren't -- you'll find the enforcement end of the tax authorities in ANY country are pretty efficient. Even in third world countries where many services are falling down the tax authorities will be a well oiled machine as the stability of the entire country rests on the government even corrupt ones to collect taxes.
eastbound
8 months ago
Accounting audits are done by the FISC agency in France. But those are just audits, not raids. This raid was ordered by a judge, which can probably be seized by FISC if they believe that the documents they have are falsified.
beeboobaa3
8 months ago
sure but politely demanding some documents is not the same as raiding an office
_ink_
8 months ago
There was an interview with Anne Brorhilker, who used to be state's attorney and was investigating in CumEx cases. She stated that it is a huge pain, because you always need to ask the foreign agencies for assistance, which you sometimes simply won't get.
It was a good listen. At first she needed to go empty handed, but then teamed up with competent tech guys. After that the smug faces stating, that the amount of data would be to much to handle for her little department quickly turned into concerned faces.
tenacious_tuna
8 months ago
That sounds fascinating, do you happen to have a link? (I'm getting a lot of German results, which unfortunately I don't have the fluency to parse to find the 'right' one.)
_ink_
8 months ago
Here you go: https://logbuch-netzpolitik.de/lnp500-zombiecalypse-im-grune... (it's in German, tho)
tenacious_tuna
8 months ago
that's fine! I can handle translating an individual page (or interview) if I've high confidence it's the right/relevant one, just parsing search results is harder cross-language (for me, anyway).
thanks much!
chmod775
8 months ago
Here's a direct link to the transcript if you haven't found it yet: https://logbuch-netzpolitik.de/lnp500-zombiecalypse-im-grune...
_ink_
8 months ago
Nice!
> Tim Pritlove: Okay, zweiter Bildungsweg. Welches Instrument haben Sie denn gespielt?
> Anne Brohrhilker: Klavierung, Pferdflöte.
Oh, AI transcribed. Nevermind.
junto
8 months ago
Holy crap that’s an interesting interview. Genuinely hilarious comment from that CIO as well. I knew nothing about this case before. Thanks for sharing.
diggan
8 months ago
> everything being stored in the cloud somewhere
Sounds like it would make it easier for law enforcement. They no longer need a warrant against/for the company they're investigating, just the place where their data is stored. Get the warrant, raid the place and grab the drives, then continue the investigation. Done the right way, the company under investigation wouldn't even notice it.
SirMaster
8 months ago
Grab the drives from the cloud?
Isn't most data in the cloud heavily distributed and broken into shards across many racks and drives and such? And encrypted so is useless outside of the custom block storage system employed by the cloud provider?
They would need to decrypt and assemble the shards to get usable data out.
I have no clue how they would even know which drives out the tens of thousands to grab, and they would also have other customer's data on them.
kube-system
8 months ago
They'll just get a warrant to search the live system as it is powered on rather than take a cold drive.
https://leb.fbi.gov/articles/featured-articles/executing-sea...
Or in China, just take the entire data center. https://www.theregister.com/2018/01/11/icloud_china_goes_to_...
Hikikomori
8 months ago
It's simple, just grab all of S3.
oceanplexian
8 months ago
The data is stored on a server in another country where the warrant isn’t worth the paper it’s printed on. Now what?
crossroadsguy
8 months ago
That is why countries are increasingly demanding (and mandating) those data (of citizens and business done there or that involves that nation or its citizens) to be stored inside their borders.
seiferteric
8 months ago
That's why I wonder if these raids are really more for show, can't they do this pretty much already?
belter
8 months ago
Completely for show since they even make press releases about it.
And its sad to see the atrocious quality of the BBC article. Even high school students learn that a journalistic piece, should make sure it touches the Five Ws of good journalism...
https://en.wikipedia.org/wiki/Five_Ws
The Hollywood Reporter has much better quality reporting including context: https://www.hollywoodreporter.com/business/business-news/net...
scarface_74
8 months ago
First the data is stored in another country. Second are they really going to raid and take the drives at an AWS data center that has other customer’s information? How will they know which drive to take?
gruez
8 months ago
>First the data is stored in another country.
Plus you can engage in some jurisdiction arbitrage where all the documents pertaining to country A is stored in country B, and all the documents pertaining to country B is stored in country A.
> Second are they really going to raid and take the drives at an AWS data center that has other customer’s information?
You can also ask AWS to produce the files/documents for you.
scarface_74
8 months ago
And those files are hopefully encrypted at rest and probably using a customer managed key…
gruez
8 months ago
>using a customer managed key…
Not an AWS expert but how does that even work? Does AWS connect to your HSM remotely? Or is a cloud HSM that's also hosted by AWS?
scarface_74
8 months ago
(Source: I am a current high level employee at a third party AWS consulting company and former employee at AWS working in the Professional Services department)
I actually was imprecise with my wording.
A customer managed KMS key is any key that you make instead of using an AWS provided key. AWS still has the means to theoretically decrypt the data.
I am actually referring to a customer managed KMS key where you import your own key material
https://docs.aws.amazon.com/kms/latest/developerguide/import...
There is also CloudHSM
https://aws.amazon.com/cloudhsm/faqs/#:~:text=AWS%20CloudHSM....
I don’t know how far “AWS doesn’t have access to your keys go” when it comes to a government subpoena.
I do know that if anyone accesses anything on your account from AWS, all sorts of internal alarm bells go off at AWS and it would still show up in your CloudTrail logs.
I’m sure there is something that allows internal AWS employees to access your account in unauthorized ways. But I never heard about it in 3.5 years working there in the Professional Services department.
grapesodaaaaa
8 months ago
Data stored in another country: are their reciprocal prosecution agreements with that country?
Raiding AWS: call Amazon, provide subpoena, Amazon can either give access to the account or provide copies of data. This would only allow access to non-customer encrypted data.
I played with encryption schemes and obfuscation pretty heavily for a long time, but at the end of the day companies operate within the legal frameworks of the countries they reside in. If you don’t cooperate, you could end up in jail anyway.
I think the conclusion I’ve come to is that you have to play by the rules. If you don’t like them, is it really worth falling on the sword for a corporate entity?
isodev
8 months ago
It depends on the type of business. In the EU, VAT registered companies are usually mandated to have a physical location and local representative within the country of operation. So you can be remote all you want, as long as your company and fiscal representative can be reached at a physical location.
ExoticPearTree
8 months ago
Yes, but you can hire anyone as an administrator and promise them a whole of money if they end up having issues with the law.
I would hire homeless people to “run” the company.
betaby
8 months ago
In Canada hire indigenous people as owner to save on taxes / get preferential treatment. See ArriveCAN (non-)scandal.
isodev
8 months ago
A homeless person wouldn’t qualify as they don’t have a fixed address which is mandatory.
Ultimately, if you really have bad intentions, you find a way. It’s a question of risk and responsibility if you want to put yourself in such a position or not.
ExoticPearTree
8 months ago
Actually, in many countries, homeless people have IDs with their last address on. Having a home and having an ID with an address on it are two different things.
rty32
8 months ago
I don't know how it works in other countries, but in the US you likely still need to provide a real address for many purposes (tax, immigration if applicable, etc)
The police could just find the correct targets and raid their home instead.
EVa5I7bHFq9mnYK
8 months ago
I have a virtualmailbox.com address - all my banks, the IRS, state voting commission and USCIS (immigration authorities) are all perfectly fine with it.
aspenmayer
8 months ago
Wouldn’t your identity documents required to open a bank account show a residential address?
EVa5I7bHFq9mnYK
8 months ago
Can't say for sure. I opened all my bank accounts while still having a proper residential address, but after relocating to another country changed the address to a virtual one, no one said a word.
crest
8 months ago
If everything is synchronised to third party could storage an "office raid" can be as easy as getting a court order telling the cloud provider to make a snapshot of everything stored available to the police.
spwa4
8 months ago
Is there a product allowing for client-side encrypted mounts? Or just use a SAAS outside of the country that doesn't allow for exporting any data under any circumstances?
playingalong
8 months ago
The whole point (or at least the main point) of the tax paperwork is to be able to produce them to tax investigators. If you don't want to share anything, then it's easier not to do the accounting. Which I guess is severally illegal globally.
HelloNurse
8 months ago
Being unable/unwilling to produce mandatory records is fraud. Technical measures to be unable to produce records (e.g. offshore and encrypted archival) are evidence of criminal intent and possibly separate crimes.
spwa4
8 months ago
So why did every company in the world start auto-deleting emails ~10 years ago? I don't believe many people were sued for fraud. These days cloud services have auto-delete based on time functionality?
It's called "object lifecycle management", because I guess fraud was too catchy.
izacus
8 months ago
You mean the auto-deletion that DOJ considered as deliberate destruction of evidence in Google case? [0]
Or are you talking about deliberate destruction of accounting records, which are required to be held by the relevant law of the governments?
[0]:https://www.legaldive.com/news/doj-google-spoliation-hangout...
gruez
8 months ago
Usually tax laws have a cut-off date. You don't need to keep records forever, but you do need to keep them around for a few years.
spwa4
8 months ago
Strange, because that sounds reasonable but the reasoning doesn't actually work, does it?
Either "the law" can be trusted, and there's no point to deleting data after a cut-off date, or the reverse is true and you're no worse off getting caught deleting data.
I believe the law actually provides a middle ground. You're liable for tax fraud for X years, but you're allowed to delete the data after Y years. Since X > Y you make it much harder for the tax office to sue you if you delete data. Plus make it pointless for them to use their other investigative powers against you, which is in reality more important, especially for smaller firms.
Muromec
8 months ago
It's not the game you can win against the government
nerdponx
8 months ago
If you can get access to someone's laptop with SSO login access to the cloud storage (or their email inbox and Slack messages), then you have what you need.
aspenmayer
8 months ago
IIUC email messages on cloud services older than 180 days don’t even require a US warrant(!) anyway.
https://www.eff.org/deeplinks/2013/05/update-email-privacy-l...
https://en.wikipedia.org/wiki/Electronic_Communications_Priv...
cynicalsecurity
8 months ago
What a funny naive thinki. Cloud services don't protect from the official authorities. Unless you want to go to jail.
croes
8 months ago
They just demand the data per warrant and if you don’t deliver you go to jail for obstruction of justice
gruez
8 months ago
How does that work if it's a cloud system and you're denied access because the IT admin from another continent locked you out? Are you going to keep the executive around as a hostage in hopes of getting them to release the files?
croes
8 months ago
Why should the IT guy lock you out if you want to access your data?
gruez
8 months ago
Because you hit a kill switch hours earlier, or (more innocently) sent a slack message to your CISO that some "scary men" showed up at your doors.
croes
8 months ago
And how do you explain the police why the IT guy does that?
It’s pretty obvious to them and would be counted as obstruction of evidence
arccy
8 months ago
yes? that's why countries require human presence
red_trumpet
8 months ago
Is that true? I'm not a lawyer but AFAIU, you don't have to provide incriminating evidence against yourself?
bogeholm
8 months ago
It’s more or less the dictionary definition of ‘subpoena’ eg. [0]:
> under penalty (you shall bring with you)
[0]: https://www.merriam-webster.com/dictionary/subpoena%20duces%...
croes
8 months ago
The IT guys aren’t the ones under investigation.
oceanplexian
8 months ago
It doesn’t. Especially with multinationals, and doubly so as crypto gains adoption. Hence why the governments of the world are in a panic. Decentralization is a huge threat to bureaucracy since their tools of intimidation and control are less effective.
immibis
8 months ago
Multinationals yes, crypto not really. The problems with crypto are just an extension of the existing "war on drugs" that has never really succeeded at anything besides justifying why lots of tax money should be spent murdering citizens.
badpun
8 months ago
The authorities asks for access to these online documents? Similarly to how they ask to access to physical documents (they don't break down doors and break locks on file cabinets). If the personel of the company does not disclose some of the online documents, and these documents come up later (e.g. because they are referenced in some of the documents that did get disclosed), the people who did it get charged with tampering with an tax investigation.
asveikau
8 months ago
What do you think "the cloud" is? I'm reminded of an old meme, "the cloud is just someone else's computer". They could raid a data center and seize machines. They could also subpoena data they are looking for.
lowkey_
8 months ago
You'd likely be seizing a bunch of other innocent people's data too, then, no?
As an American, I'd be really surprised if we let that happen. I looked and found it apparently happened once, in 2009 in Texas: https://www.cio.com/article/278564/data-center-when-the-fbi-...
It resulted in another company essentially being shut down, and suing for their data back. Crazy. There has to be a better way of doing that digitally (I assume there is, these days, and we won't see something like this again).
asveikau
8 months ago
The idea that running stuff in the cloud will protect you from a criminal investigation is totally absurd.
lowkey_
8 months ago
I wasn’t thinking about that at all and don’t think it would -
I was mentioning how things have moved to the cloud these days, and what the implications are for innocent unrelated parties’ data, given that the cloud involves this overlap of data on one device.
user
8 months ago
user
8 months ago
grecy
8 months ago
What if those machines are on another continent?
Etheryte
8 months ago
I mean, that would be way easier for the government agencies, no? Just send a subpoena to the service providers, they hand over all the data and you're done?