[HN Gopher] FBI held back ransomware decryption key to run opera...
___________________________________________________________________
FBI held back ransomware decryption key to run operation targeting
hackers
Author : lnguyen
Score : 96 points
Date : 2021-09-21 15:34 UTC (7 hours ago)
(HTM) web link (www.washingtonpost.com)
(TXT) w3m dump (www.washingtonpost.com)
| acatton wrote:
| Related: the video "Why The Cops Won't Help You When You're
| Getting Stabbed" https://www.youtube.com/watch?v=jAfUI_hETy0
|
| TL;DW: In the US, the police owes you no protection. See
| https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale...
| shoto_io wrote:
| This is a very general statement. I wonder if it's true?
| tfehring wrote:
| It is. https://www.nytimes.com/2005/06/28/politics/justices-
| rule-po...
| OneLeggedCat wrote:
| That Castle Rock case is sad.
| tw04 wrote:
| That's not at all what it says. It says a restraining order
| isn't grounds for personal protection. Additionally it says
| even if it did grant personal protection there would be no
| monetary compensation for failure to protect. Nothing about
| that has anything to do with whether a law enforcement officer
| has an obligation to act when they see a crime being committed.
|
| > were a mandate for enforcement to exist, it would not create
| an individual right to enforcement that could be considered a
| protected entitlement under the precedent of Board of Regents
| of State Colleges v. Roth; and even if there were a protected
| individual entitlement to enforcement of a restraining order,
| such entitlement would have no monetary value and hence would
| not count as property for the Due Process Clause.
|
| Case in point, the officer assigned to stoneman Douglas was
| arrested for inaction:
|
| https://www.washingtonpost.com/nation/2019/06/09/scot-peters...
| xyzzy21 wrote:
| Actually it IS what it's saying indirectly.
|
| Case law stating that police have ZERO DUTY or LEGAL
| OBLIGATION to protect goes back to the 1850s. This case is
| merely the latest is in literally DOZENS of examples of case
| law saying this.
|
| The Constitution and US case law very literally and repeated
| has said: "Your own protection is 100% ONLY on you"
|
| And honestly this is why the 2nd amendment still is relevant
| and universal to all individuals.
| [deleted]
| cm2187 wrote:
| or rather, why you can't sue them if they fail to protect you,
| which is slightly different. It is still their role to protect
| you.
|
| Kind of like it is a doctor's role to try to cure you but you
| can't sue the doctor if they don't succeed.
| unyttigfjelltol wrote:
| Eh, in the US if a doctor does like none of her peers and
| fails to cure you, yes, doctors do get sued.
|
| The point of the video was police as a fraternity don't have
| any obligation to protect you, personally, absent special
| circumstances. Which, when you get down to it is sort of like
| doctors-- if I have a heart attack across the street from a
| hospital, you know, I'd appreciate them trying to save me but
| unless there is some _special_ circumstance I 'm not
| confident they're required to.
| yonaguska wrote:
| > US if a doctor does like none of her peers and fails to
| cure you, yes, doctors do get sued.
|
| Can you clarify this? Are you saying if a Dr fails to cure
| you, they are opening themselves up to liability, or they
| only open themselves up to liability if they go outside of
| standard protocols and fail to cure you, they are now
| liable?
|
| I was under the impression that neither of these scenarios
| open you up to liability- that medical malpractice is an
| entirely different things. However, I don't know.
|
| Additionally- this seems to create really bad incentives,
| where the liability-free protocols take precedence over a
| doctor's judgement.
| jdmichal wrote:
| If you can demonstrate that a doctor did not follow
| "standard operating procedure" and thereby caused harm by
| not correcting an issue or making it worse, that's a
| pretty solid malpractice case. Which is why things like
| experimental intervention involve contracts and
| disclaimers that you have been informed of the
| experimental nature, not guaranteed to help, blah blah
| blah.
| chmod775 wrote:
| > if I have a heart attack across the street from a
| hospital, you know, I'd appreciate them trying to save me
| but unless there is some special circumstance I'm not
| confident they're required to.
|
| In some countries, especially in central Europe, failing to
| give aid where reasonable can even be a crime. In the US it
| depends on jurisdiction.
|
| https://en.wikipedia.org/wiki/Duty_to_rescue
| [deleted]
| some_furry wrote:
| It their role to protect capital (i.e. private property), not
| people. Protecting people is an occasional consequence of
| that, but when the two are at odds, they almost always side
| against people.
| nickff wrote:
| The police will not help you much when your capital (i.e.
| private property) gets stolen, and will often defend
| thieves against victims trying to reclaim rightful
| property.
|
| The police are there to protect the government against
| threats to stability and the monopoly on the use of power.
| Police are always quick to defend 'their own' (other
| police) and government agencies/agents.
| zingplex wrote:
| > The police will not help you much when your capital
| (i.e. private property)
|
| Most people don't hold much private property apart from
| maybe their house. Pretty much everything else from
| vehicles to toothbrushes fall under the category of
| personal property.
|
| Private property generates capital for the owner without
| the owner performing labour, personal property does not.
| Police will protect the former, not the ladder.
| nickff wrote:
| I was responding to a parent comment which said "capital
| (i.e. private property)", not coming up with my own
| definition or wording, so if you have an issue with the
| semantics, please take it up with them.
|
| That said, the police usually aren't especially
| interested in protecting business assets and property
| from being damaged or stolen either. Ask any business
| manager or owner who has had property damaged or stolen,
| and they will tell you that the police (in most areas)
| don't particularly care.
| suifbwish wrote:
| You can sue anyone for anything if you have the right legal
| team
| WitCanStain wrote:
| Can you sue a doctor if they don't try?
| [deleted]
| cm2187 wrote:
| Grey zone. You can't sue them because they haven't tried
| all the experimental treatments known. You probably can't
| even sue them if it is a misdiagnosis, unless it was
| egregious.
|
| The police equivalent is that you don't expect them to be
| able to intercept every bullet fired everywhere. Particular
| if it is a the risk of their own lives.
| aqme28 wrote:
| I don't like this. To analogize this to a medical problem-- it
| would be severely unethical for a doctor to withhold proven
| treatment in order to study the course of a disease.
|
| The FBI shouldn't continue to victimize for a (failed) chance at
| stopping the perpetrators.
| boomboomsubban wrote:
| It's worse than the analogy as in this case the "disease"
| clearly noticed it was being studied, which could have had
| catastrophic results and leave the disease better at hiding in
| the future.
| carlmcqueen wrote:
| https://www.cdc.gov/tuskegee/timeline.htm
|
| Which has been done before.
| aqme28 wrote:
| Oof good point. You don't want to be compared to the Tuskegee
| Study.
| lvs wrote:
| And was a historic violation of medical ethics with damage
| that reverberates into the present.
| analogdreams wrote:
| I think it's fair to argue we are seeing this in real time
| right now around Covid and refusals by certain hospital systems
| to even let people try something like Ivermectin or other off
| label drugs.
| encryptluks2 wrote:
| I trust our government's tech and hacking capabilities as much as
| I trust politicians to ensure that ISPs are held accountable for
| subsidies and grants.
| Darmody wrote:
| I don't see why the FBI would have bad intentions here.
|
| Everyone in the US, including the FBI and the NSA have in their
| best interest a functioning economy without companies being
| ransomwared to death.
| anshorei wrote:
| The FBI's intentions are getting more funds.
|
| Seeming to be doing something useful is more important to
| that end than actually doing something useful, hence their
| colorful history of creating easy problems to fix and then
| solving them to great fanfare, particularly well-documented
| in the aftermath of 9/11.
|
| It's much safer to find mentally unstable people, surround
| them by undercover agents and get them to incriminate
| themselves than it is to go after actual criminals.
| meowface wrote:
| Intentions don't necessarily correspond very much to
| outcomes.
| aqme28 wrote:
| They didn't have bad intentions, but they might have
| mismatched incentives.
|
| An FBI agent wants to stop criminals and have a big bust
| more-so than they want to generally preserve the economy.
| AlexAndScripts wrote:
| They were trying to do both. The attackers weren't going to
| stop with Kaseya.
| spicybright wrote:
| The FBI doing secret projects without understanding the
| technology behind them?
|
| *shocked pikachu meme*
| AlexAndScripts wrote:
| No, as it says in the article, they understood the tech
| entirely. There is just a trolley-problem-esque debate about
| whether withholding the key to stop future attacks was worth
| it.
| roddux wrote:
| https://archive.is/K9JP3
| sschueller wrote:
| Great but if I actively held something like that back I would
| probably be procecuted as an accomplice.
| AlexAndScripts wrote:
| Working to fix things in the long run. I don't see an issue here.
| aqme28 wrote:
| Unsuccessfully though. In the end this just added harm with no
| benefit.
| AlexAndScripts wrote:
| Yeah, and that's a shame. Hindsight is 20/20.
|
| At the end of the day though, they couldn't have known that
| would happen, and they made the right choice. The Kaseya hack
| was terrible - they were trying to stop that happening again.
| vorpalhex wrote:
| It's unethical to allow harm to fall upon innocent people
| to stop a bad person.
| djoldman wrote:
| This quickly devolves into killing one person to save
| 5... it's a difficult question.
| beerandt wrote:
| More like definitely killing 5 people to maybe catch a
| murder.
| babypuncher wrote:
| It's not that clear cut. This is just a variation of the
| trolley problem.
| AlexAndScripts wrote:
| That's just the trolley problem, as other commenters have
| said. This whole debate is, which is a shame, because it
| means we're unlikely to convince each other.
| aqme28 wrote:
| > they made the right choice
|
| You can't say that definitively. It seems unethical and
| incorrect to me.
| superjan wrote:
| They had to make the choice with the info available at
| that time. And exposing and prosecuting ransomware
| criminals could help to prevent future cases: The
| perpetrators are techies who are not street thugs, they
| could make money with legit work.
| aqme28 wrote:
| I agree with everything you wrote, but I don't see how
| any of it proves that they made the "correct decision."
| AlexAndScripts wrote:
| I suppose its subjective. In my opinion their job is to
| protect a whole nation (and, on a larger scale, the
| West)'s interests in the long run. If that means delaying
| the release of encryption keys in order to prevent future
| attacks, I think that's a worthy tradeoff. And even if
| the tradeoff didn't end up worth it (due to no fault of
| their own), their actions at the time were in my opinion
| entirely reasonable.
| rank0 wrote:
| I am not sure I see a huge issue here. The FBI does similar
| things when investigating any other criminal enterprise.
| Sometimes it's difficult to weigh the short term benefit against
| a potentially larger longer term benefit.
___________________________________________________________________
(page generated 2021-09-21 23:02 UTC)