
Uber remotely locked down offices during police raids, shutting off computers - Geekette
https://www.bloomberg.com/view/articles/2018-01-12/uber-looks-great-when-the-police-barge-in
======
Spivak
I honestly don't see a problem with this. If it weren't for the fact that it's
a company this this site hates it would be hailed as a marvel innovation
against states that are increasingly cavalier about disrespecting people's
digital rights and privacy. If the police have all the proper warrants there's
no reason they can't seize the locked servers and workstations and compel them
to unlock them after the fact.

To me this just falls under the category of unauthorized access. If my threat
model included people physically present using force to access my sysadmins'
computers I would be implementing the same security with a company-wide lock-
down triggered by a panic button on every machine.

~~~
prklmn
Did you read the article? Please explain why you think it’s unauthorized
access.

>> When the call came in, staffers quickly remotely logged off every computer
in the Montreal office, making it practically impossible for the authorities
to retrieve the company records they’d obtained a warrant to collect. The
investigators left without any evidence.

~~~
tomohawk
Determining authorized access is a process. Processes take time.

Just because some people in uniforms show up at your door and demand access,
doesn't mean that's the entire process. Even if they have a nice piece of
paper from a court, it's just the start of the process.

What if its just a ruse and they aren't really cops? What if they are cops,
but the government is corrupt? What if the warrant was obtained in a faulty
manner?

This sort of measure allows the company to engage with the process in a less
disadvantaged way.

~~~
booleandilemma
It also conveniently gives Uber more time to cover up whatever illegal
activities they may have been up to.

This is the whole point of why police conduct raids:

 _...to use the element of surprise to arrest targets that they believe may
hide contraband or other evidence, resist arrest, be politically sensitive, or
simply be elsewhere during the day._

[https://en.m.wikipedia.org/wiki/Police_raid](https://en.m.wikipedia.org/wiki/Police_raid)

~~~
dwild
How does it give them more time? Shouldn't the goal of seizure is to remove
access to something to someone and remove him the capacity to alter evidence?

If he refuses to comply or try to alter the evidence while complying, sure,
they are guilty and I'm pretty sure there's a legal process for this
situation, but at this point right now if they seized the data, they can no
longer alter it.

------
ejcx
Or with a different spin.

Locking your computers that are no longer in company possession is a common
Enterprise control. They take protecting your data seriously!

If the authorities need the data on the computers the will surely present a
properly scoped warrant!

~~~
otterley
As I understand it, Ripley's purpose is to destroy evidence in anticipation of
a lawfully conducted search. If so, this would likely contravene anti-
spoliation laws in the U.S., among other jurisdictions. See, e.g.,
[http://apps.americanbar.org/abastore/products/books/abstract...](http://apps.americanbar.org/abastore/products/books/abstracts/5190497_chap1_abs.pdf)

~~~
013a
Destroy Evidence is strong phrasing. The evidence still exists, its just no
longer within the scope of the police warrants. My interpretation of the
article is that the information is all stored on Uber's US-based servers and
the tool remotely revokes the satellite offices' connection to the servers,
probably also shutting down the machines so nothing is left recoverable in
memory.

In weaker, but likely relatively accurate words: They're logging all of their
remote users out of Google Drive so the authorities can't access the
spreadsheets there. In essence. That's what I'm reading.

Point being, Uber could still be compelled to present the evidence in court,
and Uber may comply with that compulsion. Does a Canadian warrant give the
Canadian government the right to access information stored on a server in the
United States? The answer to that is an emphatic No. Does it give them the
right to possess an API key which would allow them to access information
stored on a server in the United States? Does this change if it could be
reasonably expected that the information was, at some point, in the ephemeral
memory, not even a hard disk as far as we know, of a computer on Canadian
soil?

I really don't know. We all knew the global power of the internet would begin
to raise questions like this, and our legal framework simply hasn't dealt with
them yet.

~~~
slivym
Well firstly, no cloud storage system works with 0 locally cached data. What
Uber are essentially doing is deleting evidence covered by the warrant by
deleting the local copies. The evidence may exist elsewhere, but that doesn't
mean that deleting the evidence covered by the warrant is any less illegal.

Once the warrant is served, anything done to delete anything off that computer
is obstruction of justice, it doesn't matter what the mechanism of storage is-
whether it's RAM, Hard Disk or floppy disk.

Secondly, the warrant is what compels uber to give access to the evidence,
there's no 'We don't feel like it right now, go to the courts to try something
else'. The ability of the authorities to gain evidence through other legal
avenues provides literally no defence for uber in failing to comply with a
warrant.

------
Dangeranger
If the authorities had a warrant, why wouldn't they just take all the locked
computers with them back for further investigation? Then they would have been
able to have a judge order Uber to unlock the computers for forensics.

Uber's actions are similar to shredding evidence of tax evasion, which in the
case of Arthur Anderson during the Enron scandal, resulted in federal
obstruction of justice charges, and a strengthening of federal powers for
charging of similar actions.[0]

Note: I am not a lawyer, nor a resident of Canada, so I am not sure if my
proposal above is legal within that country. But it would seems to me that
actions similar to the above have taken place in the USA in the case of tax
evasion with probable cause.

[0] [https://blj.ucdavis.edu/archives/vol-5-no-2/document-
destruc...](https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruction-
after-enron.html)

~~~
tonyztan
> "Uber's actions are similar to shredding evidence of tax evasion"

But Uber didn't delete or otherwise destroy the evidence. It locked the
evidence while preserving it, so that it can provide the required amount of
data if / when properly served with a warrant.

~~~
mark-r
The whole point of the warrant was that the government suspected Uber of
hiding evidence. Allowing them to pick and choose the data they unlocked from
the servers would be counter-productive.

~~~
amarkov
In Canada, like in the US, warrants have to be specific about what exactly the
police are looking for. If the warrant really was "give us all your data so we
can see if you're hiding something", that's not legally okay, and I can't
blame them for trying to prevent the disclosure.

------
theonemind
This article doesn't specify exactly the legal problem here. Maybe the article
just lacks key details, like how Uber violated the warrant or the legal
repercussions they could face.

The article vaguely makes it sound like Uber acted within their rights and the
police just don't like that they didn't find a bunch of unlocked computers to
rummage through, by virtue of what it omits. I don't have a problem with that.
If their warrant amounts to a fishing expedition, it actually sounds like
harassment of Uber. A warrant should specify something you have some
likelihood of finding. If the police walked away empty handed and Uber doesn't
face charges for destroying evidence, it seems like they had a bad warrant to
begin with.

------
krick
So, what else this horrible Uber does? Maybe it locks office doors at night so
that random people cannot enter and take whatever they want?

~~~
azernik
More like, putting all documents in their lockboxes (which exist for a good
reason) _when the police show up during normal business hours with a warrant_.

~~~
larkeith
Details on the specific warrants are scarce in the listed article, but if the
police had a warrant for specific data, it seems strange that they would be
raiding satellite locations. Moreover, with a properly scoped warrant, my
understanding is that authorities may seize locked devices and compel Uber to
unlock them.

While I am loathe to defend Uber, these measures appear designed explicitly to
prevent police fishing expeditions, which I am fully in favour of, and to
serve little further purpose.

------
justinjlynn
That's pretty interesting. It must be extremely risky for local employees to
alert the main offices to lock down. I'd imagine obstruction of justice isn't
a crime your average employee would risk.

~~~
WalterSear
Alerting the central offices isn't a crime, and whoever is in the central
offices can vanish behind a wall of bureaucratic malicious compliance.

~~~
Bud
It most certainly is a crime if it's done with foreknowledge of what the
central office will then do, which is clear-cut obstruction of justice.

And from all reports, employees were specifically trained to do this, and they
knew why. Open and shut case.

~~~
FanaHOVA
Are you a lawyer?

------
dhoulb
Seems like a reasonable way to prevent overly-broad fishing by law
enforcement. If they have a warrant they can request information through legal
channels.

The raids are just theatre.

~~~
pyromine
Uber has already been seen to act adversarial to law enforcement, raids are
utilized to try and limit Uber's ability to conceal information. I have no
doubt in my mind that Uber would willingly fail to comply to requests for
information.

~~~
king07828
The mirror image of your argument is just as applicable:

Law enforcement has already been seen to act adversarial to private interests,
remotely logging out of computers is utilized to try and limit law
enforcement's ability to obtain information beyond the scope of a warrant.
There is little doubt that law enforcement would willingly take information
beyond the scope of the warrant and later find a way to use it against them.

~~~
Bendingo
> Law enforcement has already been seen to act adversarial to private
> interests

If enforcing law is seen as adversarial to private interests, then those
private interests are by definition, against the law.

~~~
dta5003
Really? By that logic the private interest of a lot of non-white drivers of
staying alive must be against the law. The time for hero worship and blind
trust is over.

------
AcerbicZero
I'm by no means a fan of Uber, (and I'm not in Canada) but keeping information
from plain sight != hiding evidence.

Come back with a better warrant.

------
rdl
This is exactly what I'd want a company holding my personal data to do. There
are lots of problems with Uber, but this is one of the good things.

------
jxramos
"""The name is an allusion to "Aliens," in which Sigourney Weaver's Ripley
character says "Nuke the entire site from orbit.""""

Oh gosh, what a meeting that must have been with the devs who came up with
this codename. This should go down in Tech History.

~~~
saluki
Actually this is pretty common, I use names from my favorite movies in code
all the time. Star Wars, Harry Potter, etc. Especially when it fits the
project or functionality.

~~~
bbarn
My dog's name is Bishop, same source.

~~~
imrehg
My last laptop was Nostromo, same place of inspiration.

------
imglorp
See also
[https://news.ycombinator.com/item?id=16124165](https://news.ycombinator.com/item?id=16124165)

------
Balgair
Judges that sign off on search warrants will not be happy with this and will
very much want to know what Uber is so concerned about hiding from proper law
enforcement. In essence, judges that sign warrants will smell something very
fishy here and they will not be happy. Uber is, of course, free to piss-off
judges. However, they are not free from the consequences of pissed-off judges.
Uber has also shown that they are just fine with handing employees over to the
mercy of pissed-off judges, something at an individual without a stellar legal
team is unlikely to view as a walk on the beach.

------
sova
Impressive (and stupid) I'm really astonished to laughter by Uber more and
more. They're trying to be a darknet company operating in clearnet... Make up
your mind you shady fellows

------
jbfoo
I really hope some law enforcement agency will someday classify uber as a:
"organized crime group". I don't mean the drivers --- but management is doing
absolutely everything to obsruct law enforncement (for example --- making it
virtually impossible for transport inspection to call Uber vehicles).

------
mr_toad
Article is a bit vague. It doesn’t mention the police (it seems they were tax
inspectors), and although it does say they had a warrant it doesn’t seem
likely that police with a warrant wouldn’t have just seized the machines.

------
booleandilemma
From now on the police should cut power and network access to Uber’s offices
just before they conduct their raids.

------
ProAm
Another article from Bloomberg that speaks on this [1]

[1] [https://www.bloomberg.com/news/articles/2018-01-11/uber-s-
se...](https://www.bloomberg.com/news/articles/2018-01-11/uber-s-secret-tool-
for-keeping-the-cops-in-the-dark)

------
danschumann
So far, I haven't been super against most of uber's law flouting: taxi service
stuff, tax stuff.

However, as they grow, as they get autonomous cars, as they get autonomous
drones, once they get to the point where there could be more serious
consequences, I'd like to see more accountability.

------
534b44a
I really hope justice is served one way or another. This action by Uber feels
really shady to me (much worse than Google's tax evasion loopholes). What
would be the consequences if something like this happened in a European
country such as Germany?

------
trisimix
Hope uber gets banned and lyft takes their spot. My recent trip to canada was
pretty shite using uber.

------
Paul-ish
Couldn't law enforcement cut internet access before the raid to prevent this?

~~~
qbrass
Then you just lock your machines down when there's no internet access.

------
fbru02
Why are governments around the globe so keen in taking down Uber?

~~~
mr_toad
In many cities and countries the taxi industries have successfully ‘captured’
the regulatory authority, and now the regulations mainly exist to restrict
competition.

------
mod
In my opinion it's not your job to willingly provide self-incriminating
evidence. I have no idea if that legally applies to corporations (particularly
in Canada) but this seems like a precaution I would expect every business to
take.

You would hope they wouldn't _need_ to take it, but if I were CEO of a company
I would order the computers shut down even if everything were above-the-book.

Of course, maybe that's why I'm not CEO of a company. Who knows.

~~~
DanBC
(My post is about England. I'm not sure abot other countries.)

That's true if they've just come knocking. But at the point they have warrants
you're risking prison.

Court orders are orders, and they are to be obeyed in full and on time.

~~~
hackits
You've never been through the family court have you?

~~~
DanBC
Here's a reasonably recent document from the President of the Family Court
division in England.

[https://www.judiciary.gov.uk/wp-
content/uploads/JCO/Document...](https://www.judiciary.gov.uk/wp-
content/uploads/JCO/Documents/Reports/view-7-changing-cultures.pdf)

> What I fear is an even greater cause for concern – and it is for me a real
> concern – is something symptomatic of a deeply rooted culture in the family
> courts which, however long established, will no longer be tolerated. I refer
> to the slapdash, lackadaisical and on occasions almost contumelious attitude
> which still far too frequently characterises the response to orders made by
> family courts. There is simply no excuse for this. Orders, including
> interlocutory orders, must be obeyed and complied with _to the letter_ and
> _on time_. Too often they are not. They are not preferences, requests or
> mere indications; they are orders. This principle applies as much to orders
> by way of interlocutory case management directions as to any other species
> of order. The court is entitled to expect – and from now on family courts
> will demand – strict compliance with all such orders. Both parties and non-
> parties to whom orders are addressed must take heed. Noncompliance with an
> order by anyone is bad enough. It is a particularly serious matter if the
> defaulter is a public body. Non-compliance with orders should be expected to
> have and will usually have a consequence: see Re W (A Child), Re H
> (Children) [2013] EWCA Civ 1177.

But you're talking about a parent ignoring court orders, I guess, in which
case this one is more relevant: a mother made false allegations of abuse
against the father, and continued to do so; and removed the child; and
continued to do so; and she did those things after being ordered not to, and
she got a (suspended) prison sentence as a result:
[http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html](http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html)

> The judge had indicated that she was prepared to authorise disclosure of her
> Judgment to the Judge at the Kingston Crown Court, and that if the 1st
> Respondent objected she would be required to make her objections known. On
> 25th January 2016, the judge ordered her judgment may be released to the
> sentencing judge. The 1st Respondent received a four-month sentence,
> suspended for six months on 27th January 2017.

EDIT: And here's a direct link to the cases he mentions at the end of the para
I link above:
[http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html](http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html)

------
pglaskowsky
Misleading headline here on HN; the source article correctly used past tense,
since this system is no longer used. The comments comparing this to
"shredding" and "destroying" evidence are also misleading; Ripley did not
destroy information.

~~~
dang
Ok, we've changed the title to use the article's subtitle.

The submitted title was "Uber remotely locks computers during police raids to
block information access". Since the site guidelines ask submitters not to use
article titles when they're misleading or linkbait, I assume the submitter was
trying to helpfully follow the rules. It's better to use representative
language from the article itself, though, to avoid blunders—and in this case
the subtitle can easily be shortened.

