Schneier on Security

Clive Robinson • November 28, 2017 8:12 AM

@ BF Skinner,

You are still with us 😉

I was just talking about you a couple of days ago, and up you pop B-)

How are,the pigeon feet, nicely fried?

Clive Robinson • November 28, 2017 9:41 AM

@ AlanS,

The list is longer than the guest list at a greatful dead concert, would you care to shorten the search?

Clive Robinson • November 28, 2017 1:45 PM

EU to ask Uber Questions

It looks like the EU will take an official look at Uber.

If they set up a taskforce Uber could be looking at a lot of pain as other Tech Giants with dodgy behaviour have found,

https://www.theregister.co.uk/2017/11/24/eu_data_protection_watchdogs_to_investigate_uber_data_breach/

Clive Robinson • November 29, 2017 1:48 AM

@ hmm,

Yep, they’re hosed.

No they are not, it might look bad but it’s about proving intent after the alleged fact[1].

There is nothing wrong with a business using secure ephemeral communications as part of a non disclosure project. No more than holding engineering chats over a water cooler or coffee machine in a seperate secured kitchen or conferance room on a high value IP design project.

All secure ephemeral communications actually does is alow the same ability we assume on face2face to be range extended, nothing more (and actually less technically).

In fact things like pattent law require that sort of behavioir as does the various forms of privilege in most jurisdictions world wide.

Arguably this case is about such a high value IP, but also in many important respects it is also about an individuals right to work freely (something that effects us all that the press etc are not talking about).

The key thing on such projects is to have policy documents signed off by senior managment explaining the “mandated use” of such technology. As,

1, A standard company document for those who “sign on” to do such a task.

2, At the begining of the project.

3, After some event that caused or potentialy caused a loss of high value IP or other non disclosure data.

Such documents usually come in two parts, a “statment” that referes to a “policy”. The former is a page or two and rarely if ever changed, the latter could be many volumes and changed frequently as needs arise or circumstances change. What goes in both parts is what you pay a team of experts the big bucks for (and no I’m not hanging out a shingle here, this blog likewise has rules).

Importantly there are good reasons (ie a defence) to taking such actions to protect high value IP etc. Because not doing so can lead to share holders suing the senior managment for being negligent etc[2].

Thus the important thing is when such a policy document was put in place and why and what processes it implements. Not that it was done, or carried out, or what an involved individual supposes long after the fact were the reasons.

As I’ve also pointed out on the odd occasion the only thing a judge is interested in is the piles of paper. Likewise the words that becomes paper (testimony) and facts that have become paper (evidence) only after certain rules have been followed (look up the “tribunal of fact” and “opinion”).

The problem with civil suit is that the rules and laws of hearsay realy don’t apply any more they have been so whittled away. Thus the requirment of proving a burden prior to admission of evidence in court has effectively gone and it’s become a public mud slinging contest.

But as I’ve indicated on this blog before judges are not disinterested parties when it comes to electronic discovery. They take a few moments to scribble a note in the court record, and suddenly one of the parties is hit with a “begger thyself” rights stripping action. The judge is on the clock so cares not.

There are ways to structure projects and their processes with High Value IP to avoid all of these issues, what you need is a team of experts to come in and give the training and importantly set the paper trail and processes[3] like “clean room oracles” up correctly before you start. And I’m guessing from the little said Uber did not do this as well as they should have.

As I keep pointing out the technology is agnostic to use… it’s determaning the “intent” of the individual “Directing Minds” good or bad that is the real issue[1].

So what we will see now is teams of overly paid legal sharks all on the clock swimming in little circles “painting pictures with words”, to try to set a scene thus point of view to move forward from, and thus they hope a good payday if not victory.

If Uber have put the paperwork and processes in place adiquately then Alphabet will have a tough time. If not then Uber will have a tough time. Either way all the legal bodies present including the judge are on the clock, and the judge like any good critic is being well paid to watch the show. Such is the litigation game, because that is what it is, in effect little different to “Late night televised poker”… Other than it’s office hours and the stakes on the table are more than some countries GDP, or the modern day equivalent of a King’s Ransom.

The person I would not want to be right now is the security bod who if the press are correct has apparently flapped his gums both verbally and in writing, if not inconsistantly. He is about to enter a rather savage game that makes throwing a Christian to the lions look like a childish past time in comparison, and they can be oh so much nastier in civil court than criminal, where atleast a few rules remain… His credibility is going to be key to this part of the case and there will be people looking and talking and digging and second guessing every fact of his life from first diapers/nappies to what he last ate, with shrinks talking about what that might suggest his sexual prefrences, motivations, etc are doing a human “SWOT”.

I won’t comment on his future life prospects but now his name is out due dilligance by any prospective employer will put this mess as an addendum to his C.V.

My advice to anyone with a connection to Uber currently on their C.V. Is think about a way to do damage limitation fast… Because the level of mud being thrown would bury an angel let alone a saint.

[1] https://www.americanbar.org/content/dam/aba/administrative/litigation/materials/2014_sac/2014_sac/best_practices.authcheckdam.pdf

[2] The argument logic dictates should be asked of Alphabets legal bretheren after first establishing they actually do communicate are,

2.1, Do you use such technology Y/N.

2.2, Are you aware of the Ed Snowden and other whistle blower documents Y/N.

And if the answer is No to either of them,

2.3 Are you admitting in court as an officer of the court to being grossly negligent and breaching privelage with your clients and the court Y/N?

Sadly most judges will not alow it but you get the picture.

[3] Processes like “clean room oracles”. The purpose of which are to prevent knowledge contamination. For instance in patent law there is a big difference in “unintentionaly infringing a patent” and “Knowingly infringing a patent” thus reading a patent can be seriously injurous to your health in a Catch 22 way. Likewise reading an engineering journal or conferance papers or book might give you insight to a technique or process that you might not otherwise have got. The problem is the person writing such a article, paper or book might not say that information is say patented, then again they might indirectly by saying who they work for in some way. The idea of a clean room is that one team does reserch and extracts knowledge from it. The knowledge goes into the clean room and is “vetted” by a different –often legal– team, if they pass the knowlege as clean then it can be passed to the cretive/design team in effect by the equivalent of a Greek Delphic Oracle.