This comment doesn't add anything to the discussion. Even young judges expect to have access to information needed to make decisions; that is key to the judicial process.
> Even young judges expect to have access to information needed to make decisions; that is key to the judicial process.
Yes but how they get access is important. A judge could order someone who has critical information to be tortured, but at least in democratic societies, most wouldn't. Of course the ramifications of using torture are clear, technically illiterate people might not understand the risks of banning encryption.
Maybe I should have elaborated, maybe I shouldn't have assumed, but I think most people on the younger side of age brackets would understand that WhatsApp is not the ONLY way to have encrypted conversations.
Why is Facebook applying different standards to different countries? In Saudi Arabia, they outright disable encryption to placate the government, so why not Brazil (not that I argue for weaker encryption, but the double standards are mysterious)
I think (s)he's referring to the generic issue that businesses want to be in a given market for the reason of making money, not that they got bribed/paid off.
Is this what you're referring to? This deosn't indicate that they're disabling encryption, but that they're blocking all calls to Saudi numbers. A different issue.
Can you explain why that is true? If a superior judges keep striking the order down, doesn't a precedent get set that prevents a lower court judge from issuing a similar ruling again?
A precedent upper decision doesn't prevent a lower judge from issuing a similar ruling again until it becomes law. Brazil's legal system is based on the civil law principle, not on common law as in the US and some other countries.
Brazil do not follow (broadly) the stare decisis system in witch low instance judges must follow precedent upper decision.
In special repetitive cases, the Supreme Court can edit some enunciates called "súmulas vinculantes" that bind every branch of power (except legislative) to follow their statement but that's a exceptional measure.
As of today, there's only 55 "súmulas vinculantes".
This is exactly why people build services such that they themselves don't have access to user data, because anything you have access to you can be compelled to produce (by a jurisdiction that has power over you, or that you let have power over you because you want its business more than your users' trust). WhatsApp is feeling the pain here because they're popularizing end-to-end encryption, and jurisdictions are trying to test the boundaries and push back. As long as there are only a few such applications and services, blocks like this will remain feasible.
We need a whole generation full of such applications and services, all of which have no access to user data, so that jurisdictions get used to the idea that user data is owned by the users, and that there's no point in going after the service. And with enough such essential services woven into everyday life, it'll become less feasible or politically acceptable to attempt to block them.
Consider the very short list of countries that block Google, or YouTube, or Wikipedia, and what properties those countries have in common, versus the much larger set of countries making attacks on encryption right now. Consider the expected length of a political career in a reasonable country for someone who tried to block YouTube, versus the disturbing lack of backlash against attacks on encryption. We need to make attacking encryption a political third-rail.
How many commercial services should just be have just been open internet protocols in the first place?
If email was created today it would be one company and they would call it a platform. More than one company is trying to co-opt email in to their own app and do just this. May be it would be totally free at first but gradually exposure would decrease and eventually companies would have to pay to ensure that their customers saw their messages. If a gag order was attached with the backdoor, no debate would even happen.
This isn't an anti-business rant. Every tech company today has benefitted tremendously because of open standards - from Linux powering servers to http to the peering among internet providers. What if every free piece of the pie came at a cost?
There are a lot of funded tech companies right now creating free services in an attempt to grow their platforms as large as possible. Then, when they hit the critical mass of the network effect they either start charging or do something to cash in.
This means that the next generation of tools not only have the potential to "tax" the next generation of businesses for every little piece they have, but it also brings immense cross-border regulatory exposure increasing the risk of broken dependancies. What a different story it would be if the headline read "Brazilian judge orders mobile carriers to block the internet." We would all laugh.
The overwhelming majority of email is in cleartext, and the overwhelming majority of email users vulnerable to phishing and impersonation, precisely because email is an open federated standard. We wouldn't be having this conversation about email, because the prosecutor would have read it already.
The laughably tiny adoption of GPG, and even TLS between SMTP servers for that matter, should make it abundantly clear that voluntary extensions aren't good enough. A federated system which respects peers' "freedom" to not react adequately to a changing threat profile is somewhere between irresponsible and actively malicious to its end-users.
I, for one, celebrate the death of open standards like email in favor of mechanisms that can actually be improved (i.e. by forcing people to upgrade on pain of being locked out of the network) in response to new developments in security.
Do you (or does anyone) know if WhatsApp/Facebook have a contact log available for each user? I thought this was visible to the service end despite the use of e2e encryption on the contents of messages, but maybe I misunderstand the protocols they are using.
Do you (or does anyone) know if WhatsApp/Facebook have a contact log available for each user? I thought this was visible to the service end despite the use of e2e encryption on the contents of messages, but maybe I misunderstand the protocols they are using.
The judge is explicitly asking for a backdoor [0]:
> We are only requesting disabling cryptography and intercepting data, mirroring messages real time in one of the ways suggested by the Ministério Público [1] - in addition to forwarding the messages received by the user but not yet encrypted; in other words, the exchanged messages must be forwarded in real time before encryption is implemented, in a manner similar to phone tapping.
(This is a direct quote from the court order.)
This is ridiculous. Judges shouldn't have the power to force software authors to install backdoors. Nobody should. What's next? Outlawing encryption?
They'd probably respond, "Easy, you pass a law saying that anyone who uses such-and-such kind of math shall be punished with fines or prison." I get what you're saying, but I think they might miss the point.
Plenty of countries outlaw certain uses of words, which is not much different.
Here's the problem. We can talk tech all we want, but you have to reduce modern politics down to a catch-phrase that makes your opponent look stupid. You make anyone who tries to ban encryption embarrassed and make others call them stupid. Hell, pull out the card deck and say they're trying to ban a card trick. Logic is so long dead in politics that you got to go for the emotional gut. Bonus, if you can phrase stuff in such a way to make them unpatriotic too.
I'll go be sick in the corner now from writing the truth of it.
I also found it interesting that Facebook's lawyers (which appears to be from https://www.zwillgen.com/) asked for:
> If possible, please provide responses in English as that will significantly improve our ability to analyze and process your request in a timely manner.
> 1. Is this a criminal matter?
> 2. What organization is conducting the investigation (Federal Police, Civil Police, Prosecutor’s Office)?
> 3. What is the nature of the crime being investigated (corruption, drug trafficking, gun violence/homicide, child exploitation, terrorism, etc.)?
> 4. What are the specific WhatsApp accounts that are the target of this legal process (including all applicable country codes)?
>
> 5. What data are you requesting for each of the targets listed above?
I wonder if this was only to keep internal statistics.
Yep - and they've asked for this in English, something the judge complained about.
I think I'm with the judge on this one. I found this really lazy and of bad taste on Facebook's part. The firm representing Facebook won't afford a translator for one of their top 3 countries (I'm guessing) in number of Whatsapp users? Really?
Try reading the parent comment of this thread - I wrote it, and I explicitly condemn the judge.
Doesn't change the fact Facebook lawyers are in the wrong when it comes to this specific issue (and, of course, that doesn't mean the judge is right about everything else).
I would fire a lawyer so hard if they just casually asked the court of a foreign nation to provide responses in English like that. Such arrogance. What better way to turn them against you?
You conduct business in the language of the land. If you don't speak it, hire someone who does to translate for you.
FB cannot afford to lose its Brazilian Whatsapp market share, I am guesstimating over 50% of its users in South America are from Brazil? Furthermore, integrations of Whatsapp to businesses (with or without a legal API) are already happening so there is high pressure to rollout a business oriented API and make the billions back, I am sure Brazilian numbers are key in the projected revenue stream. Given this, I dare to predict FB will just lift encryption for Brazilian users and blame it on their legal system. In the end, the average internet user couldn't care less about privacy; in fact, in developing countries users are much more concerned with saving money with free SMS and calls.
Absolutely this. They've already lost people to Telegram with the repeated blockings. The third question in the Telegram FAQ is 'How is it different from WhatsApp?' [1]. The feud between WhatsApp and Telegram, with the former blocking the latter's links, is well-documented [2]. Both of these apps are available on Android, Windows Phone, and iOS, and since Windows Phone has a higher-than-usual (relative to North America) share in Brazil, this is relevant.
We know the court order is abusive and will be voided by an appeal in a few hours, so nobody cares. While it is blocked we may use telegram or resort to plain old SMS.
The problem is that a Judge here in Brazil cannot be fired based on the number of reformed decisions.
I wonder what security threat or investigation could be so large as to warrant stifling the communication of large parts of the population. A classic case of a state gone haywire and not serving its people anymore.
Yes, the judge is asking for a backdoor, but Whatsapp was not blocked just for that reason. They were blocked also because they are playing a game with brazilian justice. Whatsapp Inc. claims is based outside of Brazil, so answer court orders in english and ask for more information about the process (that is confidential).
And Facebook Brasil just claims is another company. But the counter court order that removed the block the other times was filled by Facebook Brasil.
So Facebook Brasil + Whatsapp are obviously on an arrogant position with very unprofessional response to the court orders. If a proper brazilian lawyer was hired to properly react to the court orders I doubt that any of the 3 blocks would ever have happened, moreso because they have strong technical and ethical reasons on their side. At a minimum there would be a long judicial dispute.
Even the judge that overruled the other block stated that Whatsapp didn't act the proper way while dealing with the previous court order.
WhatsApp might have the HN crowd sympathy on this, but they brought these issues to themselves by being unprofessional on their response to brazilian justice.
This is ridiculous. If that was the case the responsible parties should be charged with contempt. Blocking the service "out of spite" has no legal grounds. Furthermore, no judge claimed what you claimed as the reason. They asked for access to data WhatsApp has no access to, and then blocked the service when they didn't get it.
And that tends to make Brazilian judges quite angry and thus they do the only thing they can do. Which happens to be blocking WhatsApp (the only real weapon that works against WhatsApp they have)
They don't operate in Brazil, just like other millions of websites. Do you think every single website that wants to serve content to someone in Brasil should have a subsidiary in the country?
Having written a letter to the Brazilian Congress about (almost) this very issue (in connection with the CPI-Cibercrimes inquiry), I think some Brazilians may be surprised to know that the U.S. does not require ISPs to block connectivity to third-party foreign Internet sites that facilitate violations of U.S. laws, directly violate U.S. laws, or ignore U.S. court orders, as long as the ISPs themselves have no relationship with the sites. In fact, a proposal to begin doing so in copyright cases, known as SOPA/PIPA, was extraordinarily controversial in the U.S. and was effectively defeated. The U.S. legal system generally appears to accept that ISP blocking of third-party connectivity is simply not an available remedy, even in "clear" cases of legal violations.
That means that it is not universal or obvious that this kind of blocking would be practiced or accepted. (For example, if a Brazilian company ignored a subpoena from a U.S. court, there would not be a legal basis for the U.S. court to order ISPs to prevent Americans from accessing that company's services.)
Some portion of Brazilians think it is "obvious" that a government would never allow its citizens to access Internet services that allow or commit violations of local law, or are simply not subject to local jurisdiction at all. But it's not obvious at all.
They arrasted an ex-president and jailed a lot of people for "alleged delaying of investigation" in the weeks and months preceeding the coup detat that we had here. To be fair, every employee or director involved in the whatsapp crime should be in jail.
The argument is: do not deal with the justice system as you deal with customer support.
Disrespect court orders have consequences. This is not the government being "revengeful", it is the government enforcing the law.
> And Facebook Brasil just claims is another company. But the counter court order that removed the block the other times was filled by Facebook Brasil.
The name "Facebook Brasil" makes me wonder: what's the relationship between Facebook (the USA company), Facebook Brasil, and Whatsapp? Does anyone here know the details?
Everybody seems to be assuming that "Facebook Brasil" and "Facebook (parent company of Whatsapp)" are the same, but is that really the case? And how does that affect the jurisdictional questions involved in these cases? The decision mentions a law that says that foreign companies that have one "agência, filial ou sucursal" in Brazil are considered as having domicile in Brazil, but would that affect a different subordinate of the same parent company? Does it depend on which kind of subordinate it is?
there are big advantages to having a *-brazil version of your company if you do significant business in brazil so it's pretty common to make a little spin off just for operating there.
My understanding is that Facebook Brasil and Whatsapp Inc really are different companies. And Facebook Brasil should not necessarily represent Whatsapp Inc interests.
This is exactly the claim of Facebook Brasil legal team.
> WhatsApp might have the HN crowd sympathy on this
I'm not sure Whatsapp has everyone's sympathy here; not mine at least. If I live in democratic country X where the law says Y, then I want my government to uphold that law in my country. If company Z refuses this, banning company Z from the country as a last resort seems like the right course of action.
Now if the majority of said country's citizens does not like law Y because it causes trouble for company Z, then they have to make that known. That's democracy as far as I know.
I'm quite firmly on Brazil's side, though I can see Whatsapp's point as well.
I agree, but this judge hasn't done this. And every time this Judge has acted its been overturned by a higher court. They've arrested an foreign citizen, seized funds for a separate company (albeit a subsidiary of the parent company), and misused another law to try and block access of it. All trying to get access to something Whatapp shouldn't have, and would hurt its global value if it implemented.
As for democracy ~96% of Brazilians with access to a smartphone use WhatsApp as their primary method of communication. There was a fair bit of outrage in Brazil. Though I may personally be more aware of it as its the those with smart phones were the people I heard the most from.
Do you mean that they claim they are based ouside of Brazil? I guess from the context that that's what you meant, but unfortunately "based out of" means "based in." I know, crazy language we have.
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
You imply that Brazilian authority extends overseas, over the entire Internet.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
Edit:
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system:
http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.
There is no data. WhatsApp just passes the encrypted communication from your phone to another phone and that's it. It doesn't hold it.
The first couple times that WhatsApp was blocked in Brazil, the reason was that they denied access to certain logs.
This time, they explicitly mention they want encryption to be turned off and demand WhatsApp to reply to Brazilian requests in Brazilian terms. The problem is that WhatsApp, as stated before, do not operate in Brazil as has exactly zero obligation to answer Brazilians court orders.
Now it's time for the country to discuss, as are many other places in the world, where does the right to investigate crimes by prying into someone or some groups communications begins and where does the right to privacy of the population ends.
The Supreme Court judge who suspended the block argued that it violated basic rights of the people, which is good, but already there is talk of a political project to establish what those in power all over the world want: access to communications and access to the ability to punish those who don't obey, the later in the form of an obligation for the companies involved to have an arm in Brazil.
"There is no data. WhatsApp just passes the encrypted communication from your phone to another phone and that's it. It doesn't hold it."
That's not true. If the user receiving the message is not online how is the message supposed to be delivered? Obviously the server holds it until the user comes online. So yes, there is data.
When the Recipient receives a message - they alert WhatsApp that the message has been received which can then alert the Messenger that the message has been sent. If it comes back with a failure, the Messenger will attempt to send the message again in `${Time}` until it sends. The message itself never has to hit WhatsApp's servers.
Not only the judge is asking for a backdoor, she also claims technical limitations shouldn't put a company out of the rook for capturing on user's communication. That would mean that Brazilian people are not allowed to produce secure communication software.
I never had any sympathy for Watsapp, and still have none. But I can't have any for this judge either. Good thing the Supreme Court already overruled her.
It may well be that responding in Brazilian Portuguese or via a Brazilian lawsuit would have weakened their case that they do not have a presence in the country.
And yes, it's also possible that it's just an arrogant law firm (always a possibility), but it's also possible that their counsel advised them specifically not to retain a Brazilian-speaking attorney, or sworn translator into Brazilian Portuguese (who typically would have some ties to the country).
Another possibility, frankly, after the last time ended up with one of their executives arrested for contempt of court, is that Facebook/WhatsApp may not have wanted to risk the freedom of some poor freelance translator in Brazil, who risked being hauled off to jail for having his name on the translation (required for legal translations in most countries).
> WhatsApp might have the HN crowd sympathy on this
Not mine. But Brazilian courts, with their over-arching powers, have even less sympathy; Brazilian bureaucracy, with their disregard for individual freedom, have even less sympathy; and lawmakers, with their disdain for those without as much command of the laws, the least of all my sympathy. That someone is not doing their every bidding - oh, I'm sorry, not treating them "the proper way" - is something that must be hard to muster. I guess their contempt made them blind to what makes sense and what doesn't.
Brazil doesn't get a free pass in something no one else in the civilized world is asking for.
In this case the lawmakers did the right thing, but the lower court chose to ignore the law. That's why the decision was quickly overthrown after appeal.
As to whether Judge Daniela Barbosa acted wrongly, the Supreme Court has just rejected the lower court's decision, as they have every time thus far for WhatsApp bans.
But I hope that at least part of the conversation can be brought back to the issue of encryption in Brazil. This case is simultaneously also about whether encrypted communications are okay in Brazil, because the Brazilian government wants a company abroad to put backdoor features into their software. That means that no Brazilian may have secure communications without backdoors.
I cannot imagine that Brazilians trust their government anymore than Americans. I propose that any government will always be able to lift any privilege (aka right) in the legitimate or illegitimate pursuit of its interests, but that the citizen should not voluntarily forfeit their ability to secure themselves, especially with something as non-violent and social as communication security.
Also, even when a government is legitimately pursuing its interests in determining the criminality of a citizen, if Brazilian prosecution is anywhere near as hostile and adversarial as the US, then the Brazilian individual ought not voluntarily yield themselves to government investigation, even if they are innocent or righteous.
If WhatsApp gets summoned to Sharia court in Saudi Arabia over a case of suspected extramarital sex, do you think they should humor them and play along?
It is unrealistic to expect WhatsApp to 'correctly respond' to every little despot's 'court orders' worldwide.
Every little despot's 'court orders' exept for court orders from the most despotic court in the world: The United States Foreign Intelligence Surveillance Court.
They may very well ignore brazilian justice. It is their choice.
What they can't do is to ignore brazilian justice and continue to operate in the country.
Pelo amor de deus cara! Who looses here is the Brazilian public where WhatsApp use is ubiquitous. This is like the reciprocal visa requirements that Brazil imposes on US visitors(making it harder for Americans to spend their dollars in Brazil). This is the Brazilian Government wanting to flex their muscles in front of the Gringos while the public suffers yet again from Ivory tower policies totally disconnected from reality on the ground.
I remember WhatsApp was blocked once in Brazil for refusing to hand out data on a drug smuggler... Taking into account Brazil is an oversized drug cartel, yes, doing that was "to be disconnected from reality".
The flipside is to slowly criminalize everyday activity. I've seen that trend in the US (apart from the decriminalization of marijuana, which I'm still surprised by).
As an example, here in Georgia you can theoretically be ticketed for going too slow and too fast at the same time; traffic law says don't impede the flow of traffic, even if said traffic is going 20+ over the limit. So if you're going 5 over and everyone else is going 20 over, you're at risk of getting both tickets.
I realize that traffic infractions are not what most consider crimes, but it scales to misdemeanor and even felony offenses as well. "Show me the man and I'll show you the crime."
It's exactly what this is. Trying to show off and make people bend over backwards.
Sad that it usually works with less fortunate people and companies that can be swallowed by a mountain of bureaucracy and undecipherable legalese. That a company is standing up for it should be cause for celebration.
That's not entirely true. OK, the Brazilian government can block them of being a legal entity in Brazil, but they can't block an international web-service. Unless Brazil is now like China and North Korea and want to control every citizen internet use. This is totally against net-neutrality discussions and ethics I ever read.
Sure they can. Insomuch as they already don't operate "in" Brazil, but traffic to and from WhatsApp international servers does originate and terminate in Brazil.
Unless WhatsApp traffic is explicitly denied at the ISP level (this order) their packets can float all over Brazil without say-so. That's the Internet, baby.
Reductio ad absurdum is a valid argument form, not a fallacy. It's an alias for proof by contradiction. If you think it's inapplicable in this case, explain why, but don't expect quoting the name to have any effect on people.
To me, the most eyebrow-raising part is "[...] além do encaminhamento das mensagens já recebidas pelo usuário e ainda não criptografadas [...]" (page 4, rough translation: "and also the forwarding of messages already received by the user but not yet encrypted"). Do they believe that the messages are encrypted only after being received either by the user or by a central server? I get the feeling that they think that the encryption is done by a central server, and that the messages can be intercepted there before the encryption (while in reality, they're probably encrypted by the sender's phone, so intercepting would mean pushing a software update).
is it fair to assume that all other messaging apps operating in Brazil that have not been blocked have cooperated with the government and installed backdoors ? does anyone have more information on this ?
Brazilian here
http://jota.uol.com.br/justica-rj-determina-novo-bloqueio-wh...
"Em verdade, o Juízo requer, apenas, a desabilitação da chave de criptografia, com a interceptação do fluxo de dados, com o desvio em tempo real em uma das formas sugeridas pelo MP, além do encaminhamento das mensagens já recebidas pelo usuário e ainda não criptografadas, ou seja, as mensagens trocadas deverão ser desviadas em tempo real (na forma que se dá com a interceptação de conversações telefônicas), antes de implementada a criptografia."
So, a judge required Whatsapp to put a backdoor to realtime wiretap some users before the payload is encrypted. I personally dont think Whatsapp should comply.
Whatsapp isnt secure, anyway, the default config is to store all the messages and the key on icloud or google. Also, the server knows your contact list, (and bans you if you dont sync), and someone could tap your wifi to get your contact list.
The judges here are annoyed that the lawyers requested info that is under a gag order, and that they answered in English, and that Facebook, who has a local office plays dumb and insists that "Whatsapp is out of my jurisdiction" when Brazil has the 2nd bigger userbase of the app. They are hitting them where it hurts - blocking 7 billion usd of their assets.
http://link.estadao.com.br/noticias/empresas,justica-brasile...
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system:
http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.
She got more annoyed with the arrogante attitude of whatsapp's director. He didn't answer her in the local language. He could have been jailed for delaying investigations.
It's funny how HN didn't care when judges and the supreme court broke several laws in support of a parlamentary coup d'etat. And it's sad to see so many brazillians not defending the best interests of their country here in HN.
130 comments
[ 17.5 ms ] story [ 656 ms ] threadYes but how they get access is important. A judge could order someone who has critical information to be tortured, but at least in democratic societies, most wouldn't. Of course the ramifications of using torture are clear, technically illiterate people might not understand the risks of banning encryption.
http://oglobo.globo.com/rio/juiza-agredida-no-bep-ganhou-ape...
Unfortunately, tech-related ignorance is common across ages and genders.
EDIT:
http://www.ibtimes.co.uk/whatsapp-blocking-encrypted-calls-s...
Is this what you're referring to? This deosn't indicate that they're disabling encryption, but that they're blocking all calls to Saudi numbers. A different issue.
There's an expectancy that we(I'm Brazilian) can understand and live with the consequences of Encryption, as any other democratic state.
But, in Brazil, Judges have a lot of power and they can make "undemocratic" decisions witch will be overruled by the superior instance.
https://en.wikipedia.org/wiki/Civil_law_(legal_system)
https://en.wikipedia.org/wiki/Common_law
Brazil do not follow (broadly) the stare decisis system in witch low instance judges must follow precedent upper decision.
In special repetitive cases, the Supreme Court can edit some enunciates called "súmulas vinculantes" that bind every branch of power (except legislative) to follow their statement but that's a exceptional measure.
As of today, there's only 55 "súmulas vinculantes".
Also, the judge requested that "messages in the server that still haven't been encrypted" be handed over.
It just shows the complete lack of understanding of how it works by the judge.
We need a whole generation full of such applications and services, all of which have no access to user data, so that jurisdictions get used to the idea that user data is owned by the users, and that there's no point in going after the service. And with enough such essential services woven into everyday life, it'll become less feasible or politically acceptable to attempt to block them.
Consider the very short list of countries that block Google, or YouTube, or Wikipedia, and what properties those countries have in common, versus the much larger set of countries making attacks on encryption right now. Consider the expected length of a political career in a reasonable country for someone who tried to block YouTube, versus the disturbing lack of backlash against attacks on encryption. We need to make attacking encryption a political third-rail.
If email was created today it would be one company and they would call it a platform. More than one company is trying to co-opt email in to their own app and do just this. May be it would be totally free at first but gradually exposure would decrease and eventually companies would have to pay to ensure that their customers saw their messages. If a gag order was attached with the backdoor, no debate would even happen.
This isn't an anti-business rant. Every tech company today has benefitted tremendously because of open standards - from Linux powering servers to http to the peering among internet providers. What if every free piece of the pie came at a cost?
There are a lot of funded tech companies right now creating free services in an attempt to grow their platforms as large as possible. Then, when they hit the critical mass of the network effect they either start charging or do something to cash in.
This means that the next generation of tools not only have the potential to "tax" the next generation of businesses for every little piece they have, but it also brings immense cross-border regulatory exposure increasing the risk of broken dependancies. What a different story it would be if the headline read "Brazilian judge orders mobile carriers to block the internet." We would all laugh.
The laughably tiny adoption of GPG, and even TLS between SMTP servers for that matter, should make it abundantly clear that voluntary extensions aren't good enough. A federated system which respects peers' "freedom" to not react adequately to a changing threat profile is somewhere between irresponsible and actively malicious to its end-users.
I, for one, celebrate the death of open standards like email in favor of mechanisms that can actually be improved (i.e. by forcing people to upgrade on pain of being locked out of the network) in response to new developments in security.
> We are only requesting disabling cryptography and intercepting data, mirroring messages real time in one of the ways suggested by the Ministério Público [1] - in addition to forwarding the messages received by the user but not yet encrypted; in other words, the exchanged messages must be forwarded in real time before encryption is implemented, in a manner similar to phone tapping.
(This is a direct quote from the court order.)
This is ridiculous. Judges shouldn't have the power to force software authors to install backdoors. Nobody should. What's next? Outlawing encryption?
[0] http://jota.uol.com.br/justica-rj-determina-novo-bloqueio-wh...
[1] https://en.wikipedia.org/wiki/Public_Prosecutor%27s_Office_(...
A question to ask politicians "How do you outlaw math?".
Plenty of countries outlaw certain uses of words, which is not much different.
I'll go be sick in the corner now from writing the truth of it.
I also found it interesting that Facebook's lawyers (which appears to be from https://www.zwillgen.com/) asked for:
> If possible, please provide responses in English as that will significantly improve our ability to analyze and process your request in a timely manner.
> 1. Is this a criminal matter?
> 2. What organization is conducting the investigation (Federal Police, Civil Police, Prosecutor’s Office)?
> 3. What is the nature of the crime being investigated (corruption, drug trafficking, gun violence/homicide, child exploitation, terrorism, etc.)?
> 4. What are the specific WhatsApp accounts that are the target of this legal process (including all applicable country codes)? > > 5. What data are you requesting for each of the targets listed above?
I wonder if this was only to keep internal statistics.
I think I'm with the judge on this one. I found this really lazy and of bad taste on Facebook's part. The firm representing Facebook won't afford a translator for one of their top 3 countries (I'm guessing) in number of Whatsapp users? Really?
Insensitive and foolish move on Facebook's part, sure, but come on. Let's put things in context here...
Doesn't change the fact Facebook lawyers are in the wrong when it comes to this specific issue (and, of course, that doesn't mean the judge is right about everything else).
You conduct business in the language of the land. If you don't speak it, hire someone who does to translate for you.
[1] https://telegram.org/faq
[2] http://techcrunch.com/2015/12/01/whatsapp-is-blocking-links-...
The problem is that a Judge here in Brazil cannot be fired based on the number of reformed decisions.
As a french man once said, Brazil is not a serious country.
And Facebook Brasil just claims is another company. But the counter court order that removed the block the other times was filled by Facebook Brasil.
So Facebook Brasil + Whatsapp are obviously on an arrogant position with very unprofessional response to the court orders. If a proper brazilian lawyer was hired to properly react to the court orders I doubt that any of the 3 blocks would ever have happened, moreso because they have strong technical and ethical reasons on their side. At a minimum there would be a long judicial dispute. Even the judge that overruled the other block stated that Whatsapp didn't act the proper way while dealing with the previous court order.
WhatsApp might have the HN crowd sympathy on this, but they brought these issues to themselves by being unprofessional on their response to brazilian justice.
"Out of spite" is ridiculous indeed, but I sustain my guess that if a proper brazilian lawyer had addressed the case, no block would ever be ordered.
(I am having a No True Scotsman[1] kind of a reaction to this phrase, with a side serving of Kafka[2].)
[1] https://en.wikipedia.org/wiki/No_true_Scotsman
[2] https://en.wikipedia.org/wiki/The_Trial
Their lawyers answering the judge's court order are from this american firm: https://www.zwillgen.com/
That's not how the internet works.
That means that it is not universal or obvious that this kind of blocking would be practiced or accepted. (For example, if a Brazilian company ignored a subpoena from a U.S. court, there would not be a legal basis for the U.S. court to order ISPs to prevent Americans from accessing that company's services.)
Some portion of Brazilians think it is "obvious" that a government would never allow its citizens to access Internet services that allow or commit violations of local law, or are simply not subject to local jurisdiction at all. But it's not obvious at all.
blocking whatsapp because they are being uncooperative with Brazil's legal system is completely fair.
> They asked for access to data WhatsApp has no access to, and then blocked the service when they didn't get it.
Are they required to be able to provide such data when asked if they want to operate in brazil?
Did they respond to the request in a reasonable fashion?
No, WhatsApp is not subject to the judge's jurisdiction. They do not have to cooperate, respond in reasonable fashion or anything.
The power of law has limits.
http://www.conjur.com.br/2016-jul-19/stf-derruba-decisao-jud...
The name "Facebook Brasil" makes me wonder: what's the relationship between Facebook (the USA company), Facebook Brasil, and Whatsapp? Does anyone here know the details?
Everybody seems to be assuming that "Facebook Brasil" and "Facebook (parent company of Whatsapp)" are the same, but is that really the case? And how does that affect the jurisdictional questions involved in these cases? The decision mentions a law that says that foreign companies that have one "agência, filial ou sucursal" in Brazil are considered as having domicile in Brazil, but would that affect a different subordinate of the same parent company? Does it depend on which kind of subordinate it is?
This is exactly the claim of Facebook Brasil legal team.
WhatsApp is a Delaware Corporation based in the USA, with no operations in Brazil.
I'm not sure Whatsapp has everyone's sympathy here; not mine at least. If I live in democratic country X where the law says Y, then I want my government to uphold that law in my country. If company Z refuses this, banning company Z from the country as a last resort seems like the right course of action.
Now if the majority of said country's citizens does not like law Y because it causes trouble for company Z, then they have to make that known. That's democracy as far as I know.
I'm quite firmly on Brazil's side, though I can see Whatsapp's point as well.
As for democracy ~96% of Brazilians with access to a smartphone use WhatsApp as their primary method of communication. There was a fair bit of outrage in Brazil. Though I may personally be more aware of it as its the those with smart phones were the people I heard the most from.
Thank you, sir.
Do you mean that they claim they are based ouside of Brazil? I guess from the context that that's what you meant, but unfortunately "based out of" means "based in." I know, crazy language we have.
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
You imply that Brazilian authority extends overseas, over the entire Internet.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
Edit:
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system: http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.
The first couple times that WhatsApp was blocked in Brazil, the reason was that they denied access to certain logs.
This time, they explicitly mention they want encryption to be turned off and demand WhatsApp to reply to Brazilian requests in Brazilian terms. The problem is that WhatsApp, as stated before, do not operate in Brazil as has exactly zero obligation to answer Brazilians court orders.
Now it's time for the country to discuss, as are many other places in the world, where does the right to investigate crimes by prying into someone or some groups communications begins and where does the right to privacy of the population ends.
The Supreme Court judge who suspended the block argued that it violated basic rights of the people, which is good, but already there is talk of a political project to establish what those in power all over the world want: access to communications and access to the ability to punish those who don't obey, the later in the form of an obligation for the companies involved to have an arm in Brazil.
That's not true. If the user receiving the message is not online how is the message supposed to be delivered? Obviously the server holds it until the user comes online. So yes, there is data.
The only data that needs to be stored by WhatsApp is `Sent` and not the message itself, which can be stored locally by the Messenger.
[Messenger] <--> [Sent Succesfully?] <--> Recipient
When the Recipient receives a message - they alert WhatsApp that the message has been received which can then alert the Messenger that the message has been sent. If it comes back with a failure, the Messenger will attempt to send the message again in `${Time}` until it sends. The message itself never has to hit WhatsApp's servers.
I never had any sympathy for Watsapp, and still have none. But I can't have any for this judge either. Good thing the Supreme Court already overruled her.
And yes, it's also possible that it's just an arrogant law firm (always a possibility), but it's also possible that their counsel advised them specifically not to retain a Brazilian-speaking attorney, or sworn translator into Brazilian Portuguese (who typically would have some ties to the country).
Another possibility, frankly, after the last time ended up with one of their executives arrested for contempt of court, is that Facebook/WhatsApp may not have wanted to risk the freedom of some poor freelance translator in Brazil, who risked being hauled off to jail for having his name on the translation (required for legal translations in most countries).
Not mine. But Brazilian courts, with their over-arching powers, have even less sympathy; Brazilian bureaucracy, with their disregard for individual freedom, have even less sympathy; and lawmakers, with their disdain for those without as much command of the laws, the least of all my sympathy. That someone is not doing their every bidding - oh, I'm sorry, not treating them "the proper way" - is something that must be hard to muster. I guess their contempt made them blind to what makes sense and what doesn't.
Brazil doesn't get a free pass in something no one else in the civilized world is asking for.
But I hope that at least part of the conversation can be brought back to the issue of encryption in Brazil. This case is simultaneously also about whether encrypted communications are okay in Brazil, because the Brazilian government wants a company abroad to put backdoor features into their software. That means that no Brazilian may have secure communications without backdoors.
I cannot imagine that Brazilians trust their government anymore than Americans. I propose that any government will always be able to lift any privilege (aka right) in the legitimate or illegitimate pursuit of its interests, but that the citizen should not voluntarily forfeit their ability to secure themselves, especially with something as non-violent and social as communication security.
Also, even when a government is legitimately pursuing its interests in determining the criminality of a citizen, if Brazilian prosecution is anywhere near as hostile and adversarial as the US, then the Brazilian individual ought not voluntarily yield themselves to government investigation, even if they are innocent or righteous.
It is unrealistic to expect WhatsApp to 'correctly respond' to every little despot's 'court orders' worldwide.
How does one even measure that? Is it measured in units of polpots or what?
They may very well ignore brazilian justice. It is their choice. What they can't do is to ignore brazilian justice and continue to operate in the country.
No, really, this has always been the means, we are going after "criminals" and once that is possible, then it's everybody else.
As an example, here in Georgia you can theoretically be ticketed for going too slow and too fast at the same time; traffic law says don't impede the flow of traffic, even if said traffic is going 20+ over the limit. So if you're going 5 over and everyone else is going 20 over, you're at risk of getting both tickets.
I realize that traffic infractions are not what most consider crimes, but it scales to misdemeanor and even felony offenses as well. "Show me the man and I'll show you the crime."
http://www.cato.org/policy-report/januaryfebruary-2010/crimi...
It's exactly what this is. Trying to show off and make people bend over backwards.
Sad that it usually works with less fortunate people and companies that can be swallowed by a mountain of bureaucracy and undecipherable legalese. That a company is standing up for it should be cause for celebration.
Unless WhatsApp traffic is explicitly denied at the ISP level (this order) their packets can float all over Brazil without say-so. That's the Internet, baby.
To me, the most eyebrow-raising part is "[...] além do encaminhamento das mensagens já recebidas pelo usuário e ainda não criptografadas [...]" (page 4, rough translation: "and also the forwarding of messages already received by the user but not yet encrypted"). Do they believe that the messages are encrypted only after being received either by the user or by a central server? I get the feeling that they think that the encryption is done by a central server, and that the messages can be intercepted there before the encryption (while in reality, they're probably encrypted by the sender's phone, so intercepting would mean pushing a software update).
So, a judge required Whatsapp to put a backdoor to realtime wiretap some users before the payload is encrypted. I personally dont think Whatsapp should comply.
Whatsapp isnt secure, anyway, the default config is to store all the messages and the key on icloud or google. Also, the server knows your contact list, (and bans you if you dont sync), and someone could tap your wifi to get your contact list.
The judges here are annoyed that the lawyers requested info that is under a gag order, and that they answered in English, and that Facebook, who has a local office plays dumb and insists that "Whatsapp is out of my jurisdiction" when Brazil has the 2nd bigger userbase of the app. They are hitting them where it hurts - blocking 7 billion usd of their assets. http://link.estadao.com.br/noticias/empresas,justica-brasile...
Wouldn't they also have a contact log for each user?
That plus the contact list is a pretty nice chunk of data for use by their parent company.
And also, it would surely be useful for law enforcement. Has it been shared with the courts?
US government sues uses SCA to request data held overseas by an American company. Court rules that US government under SCA has no jurisdiction to request data held overseas, even if by an American company.
In this case, WhatsApp does not operate in Brazil. They do not have a legal entity in Brazil. A Brazilian judge has exactly zero jurisdiction over WhatsApp.
Sure, it is in the judge's power to blackmail the company by ordering other companies to block it. But the judge still has zero authority over WhatsApp.
The correct way for the judge to proceed would be to use the Mutual Legal Assistance treaty between the US and Brazil to request the data through the US Government and judicial system: http://www.state.gov/documents/organization/106962.pdf
From Art. I, assistance shall include:
(f) executing requests for searches and seizures;
Which would be subject to US laws, therefore, probably wouldn't happen.