55 comments

[ 2.9 ms ] story [ 120 ms ] thread
I trust our government's tech and hacking capabilities as much as I trust politicians to ensure that ISPs are held accountable for subsidies and grants.
I don't see why the FBI would have bad intentions here.

Everyone in the US, including the FBI and the NSA have in their best interest a functioning economy without companies being ransomwared to death.

Intentions don't necessarily correspond very much to outcomes.
They didn't have bad intentions, but they might have mismatched incentives.

An FBI agent wants to stop criminals and have a big bust more-so than they want to generally preserve the economy.

They were trying to do both. The attackers weren't going to stop with Kaseya.
The FBI's intentions are getting more funds.

Seeming to be doing something useful is more important to that end than actually doing something useful, hence their colorful history of creating easy problems to fix and then solving them to great fanfare, particularly well-documented in the aftermath of 9/11.

It's much safer to find mentally unstable people, surround them by undercover agents and get them to incriminate themselves than it is to go after actual criminals.

Working to fix things in the long run. I don't see an issue here.
Unsuccessfully though. In the end this just added harm with no benefit.
Yeah, and that's a shame. Hindsight is 20/20.

At the end of the day though, they couldn't have known that would happen, and they made the right choice. The Kaseya hack was terrible - they were trying to stop that happening again.

> they made the right choice

You can't say that definitively. It seems unethical and incorrect to me.

They had to make the choice with the info available at that time. And exposing and prosecuting ransomware criminals could help to prevent future cases: The perpetrators are techies who are not street thugs, they could make money with legit work.
I agree with everything you wrote, but I don't see how any of it proves that they made the "correct decision."
I suppose its subjective. In my opinion their job is to protect a whole nation (and, on a larger scale, the West)'s interests in the long run. If that means delaying the release of encryption keys in order to prevent future attacks, I think that's a worthy tradeoff. And even if the tradeoff didn't end up worth it (due to no fault of their own), their actions at the time were in my opinion entirely reasonable.
It's unethical to allow harm to fall upon innocent people to stop a bad person.
It's not that clear cut. This is just a variation of the trolley problem.
This quickly devolves into killing one person to save 5... it's a difficult question.
More like definitely killing 5 people to maybe catch a murder.
More like killing 1 to probably save 5. They aren't going to stop at Kaseya.
That's just the trolley problem, as other commenters have said. This whole debate is, which is a shame, because it means we're unlikely to convince each other.
This is not a trolley problem. The trolley problem has two assured outcomes - both leading to harm - and requires active intervention to choose the lower harm.

This has definitive harm for a potential gain against future potential harm, versus stopping an active harm at no direct real cost. It's a bird in hand versus two in the bush.

You can't use people in wagers like that.

Related: the video "Why The Cops Won't Help You When You're Getting Stabbed" https://www.youtube.com/watch?v=jAfUI_hETy0

TL;DW: In the US, the police owes you no protection. See https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale...

or rather, why you can't sue them if they fail to protect you, which is slightly different. It is still their role to protect you.

Kind of like it is a doctor's role to try to cure you but you can't sue the doctor if they don't succeed.

Can you sue a doctor if they don't try?
(comment deleted)
Grey zone. You can't sue them because they haven't tried all the experimental treatments known. You probably can't even sue them if it is a misdiagnosis, unless it was egregious.

The police equivalent is that you don't expect them to be able to intercept every bullet fired everywhere. Particular if it is a the risk of their own lives.

Eh, in the US if a doctor does like none of her peers and fails to cure you, yes, doctors do get sued.

The point of the video was police as a fraternity don't have any obligation to protect you, personally, absent special circumstances. Which, when you get down to it is sort of like doctors-- if I have a heart attack across the street from a hospital, you know, I'd appreciate them trying to save me but unless there is some special circumstance I'm not confident they're required to.

> if I have a heart attack across the street from a hospital, you know, I'd appreciate them trying to save me but unless there is some special circumstance I'm not confident they're required to.

In some countries, especially in central Europe, failing to give aid where reasonable can even be a crime. In the US it depends on jurisdiction.

https://en.wikipedia.org/wiki/Duty_to_rescue

> US if a doctor does like none of her peers and fails to cure you, yes, doctors do get sued.

Can you clarify this? Are you saying if a Dr fails to cure you, they are opening themselves up to liability, or they only open themselves up to liability if they go outside of standard protocols and fail to cure you, they are now liable?

I was under the impression that neither of these scenarios open you up to liability- that medical malpractice is an entirely different things. However, I don't know.

Additionally- this seems to create really bad incentives, where the liability-free protocols take precedence over a doctor's judgement.

If you can demonstrate that a doctor did not follow "standard operating procedure" and thereby caused harm by not correcting an issue or making it worse, that's a pretty solid malpractice case. Which is why things like experimental intervention involve contracts and disclaimers that you have been informed of the experimental nature, not guaranteed to help, blah blah blah.
You can sue anyone for anything if you have the right legal team
It their role to protect capital (i.e. private property), not people. Protecting people is an occasional consequence of that, but when the two are at odds, they almost always side against people.
The police will not help you much when your capital (i.e. private property) gets stolen, and will often defend thieves against victims trying to reclaim rightful property.

The police are there to protect the government against threats to stability and the monopoly on the use of power. Police are always quick to defend 'their own' (other police) and government agencies/agents.

> The police will not help you much when your capital (i.e. private property)

Most people don't hold much private property apart from maybe their house. Pretty much everything else from vehicles to toothbrushes fall under the category of personal property.

Private property generates capital for the owner without the owner performing labour, personal property does not. Police will protect the former, not the ladder.

I was responding to a parent comment which said "capital (i.e. private property)", not coming up with my own definition or wording, so if you have an issue with the semantics, please take it up with them.

That said, the police usually aren't especially interested in protecting business assets and property from being damaged or stolen either. Ask any business manager or owner who has had property damaged or stolen, and they will tell you that the police (in most areas) don't particularly care.

What if the ladder is rented out to do-it-your-selfers, is it then private property?
(comment deleted)
That’s not at all what it says. It says a restraining order isn’t grounds for personal protection. Additionally it says even if it did grant personal protection there would be no monetary compensation for failure to protect. Nothing about that has anything to do with whether a law enforcement officer has an obligation to act when they see a crime being committed.

> were a mandate for enforcement to exist, it would not create an individual right to enforcement that could be considered a protected entitlement under the precedent of Board of Regents of State Colleges v. Roth; and even if there were a protected individual entitlement to enforcement of a restraining order, such entitlement would have no monetary value and hence would not count as property for the Due Process Clause.

Case in point, the officer assigned to stoneman Douglas was arrested for inaction:

https://www.washingtonpost.com/nation/2019/06/09/scot-peters...

(comment deleted)
Actually it IS what it's saying indirectly.

Case law stating that police have ZERO DUTY or LEGAL OBLIGATION to protect goes back to the 1850s. This case is merely the latest is in literally DOZENS of examples of case law saying this.

The Constitution and US case law very literally and repeated has said: "Your own protection is 100% ONLY on you"

And honestly this is why the 2nd amendment still is relevant and universal to all individuals.

(comment deleted)
I don't like this. To analogize this to a medical problem-- it would be severely unethical for a doctor to withhold proven treatment in order to study the course of a disease.

The FBI shouldn't continue to victimize for a (failed) chance at stopping the perpetrators.

It's worse than the analogy as in this case the "disease" clearly noticed it was being studied, which could have had catastrophic results and leave the disease better at hiding in the future.
I think it's fair to argue we are seeing this in real time right now around Covid and refusals by certain hospital systems to even let people try something like Ivermectin or other off label drugs.
This is SOP for the FBI. They've also gotten caught leaving a CSAM distribution network running after gaining control of it, for the same reason.
Great but if I actively held something like that back I would probably be procecuted as an accomplice.
The FBI doing secret projects without understanding the technology behind them?

*shocked pikachu meme*

No, as it says in the article, they understood the tech entirely. There is just a trolley-problem-esque debate about whether withholding the key to stop future attacks was worth it.
I am not sure I see a huge issue here. The FBI does similar things when investigating any other criminal enterprise. Sometimes it's difficult to weigh the short term benefit against a potentially larger longer term benefit.