News for hackers. Stuff that matters.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by code_duck on Friday April 05, 2019 @04:34PM (#19586743)
Isn’t it your duty to protect the privacy of your data and your customers regardless of who is requesting data? I thought companies like Twitter and Google routinely rebuffed requests for information from government agencies and opposed restrictive rules, e.g. in China, and are praised for it. The concept of resisting government requests for information is well established.

If the police called and asked for my customer list, I’d check whether they had that authority and many other issues before turning it over. I think we had an article on here earlier about ‘second order thinking’ that would cover that... getting an invasive request from the government, and fulfilling it regardless of consequences because you want to ‘help’ or consider them to be like Mom and Dad is first order thinking.

I’m no expert, but it seems increasingly common to have state laws that oppose or are stricter than federal laws, and you do have to be aware of all laws for your jurisdiction down to the county and city. Especially in any voluntary action, you have to consider whether it violates other laws or duties, and if they weren’t legally compelled to do this t was voluntary.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by bloudermilk on Saturday April 06, 2019 @04:28AM (#19589858)
> The concept of resisting government requests for information is well established.

Well established for whom? For many poor Americans, the thought of resisting a local PD seems impossible, let alone a federal agent who comes knocking. Try to imagine being on your night shift at a rural Motel 6 when a few strange individuals start waving badges, making requests, maybe threatening to escalate things if you don't play along. Maybe you would have the courage to stand up to them, but I think a lot of people would fall to the pressure and abide by the request. One big difference is privilege.

I believe ICE should be responsible for illegally attaining this information. They should also bear the cost of educating the Motel 6 workforce on their rights to resist requests from law enforcement agencies.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by nathan_long on Tuesday April 09, 2019 @12:12PM (#19616160)
> I believe ICE should be responsible for illegally attaining this information. They should also bear the cost of educating the Motel 6 workforce on their rights to resist requests from law enforcement agencies.

Totally agree. A hotel worker would be a hero for refusing to comply with an illegal request, but it's not reasonable to expect them to know what's legal or not here.

Citizens should be able to assume that those who enforce the law also obey the law, and when that's found not to be true, the agencies should be in deep trouble. Without law abiding law officers, the whole system falls apart.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by code_duck on Saturday April 06, 2019 @05:43AM (#19590032)
Well established for companies who safeguard vast amounts of consumer data such as google and twitter, as I said.

Right, ‘The hotel said at the time that the practice was implemented "at the local level without the knowledge of senior management."‘

Obviously, if you are working at a motel and law enforcement enters and start demanding things, you -contact your supervisors-. Not sure how ‘privilege’ is involved, other than having the education or training to understand this. It’s possible that the individuals involved at the motel were not coerced and participated enthusiastically.

Of course ICE should also be obligated to follow the law and not encourage others to break it. However, it’s up to Motel 6 to train their employees, protect customers’ privacy and enforce their own policies.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by nojvek on Saturday April 06, 2019 @10:01AM (#19590747)
It’s hard to keep up with laws. ICE is very much a bully, just like TSA is. They can make your life miserable for a while until you get yourself a lawyer (which most people can’t afford, and can’t lose time).

But then who’s gonna police the police ?

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by code_duck on Saturday April 06, 2019 @04:05PM (#19592718)
It would be interesting to know how ICE obtained it. Did they, in fact, threaten or trick the motel staff or management? I would think that the staff is not personally in legal jeopardy from refusing to comply. I think most people would know that, too. Passing it on to higher-ups would surely be proper corporate protocol, and wouldn’t they be the ones to suffer legal jeopardy or harassment, not Joe Night Clerk?

Edit: checked into this. An older story has more details https://www.washingtonpost.com/news/post-nation/wp/2018/01/0...

“ICE agents, who are tasked with arresting people who are not legal residents for deportation, would be given a guest list from the hotel’s receptionist, along with a form to sign confirming the lists’ receipt. The roster included information such as guests’ driver’s license number, room number, date of birth and license plate number.”

an article linked within the earlier one says even more. https://www.phoenixnewtimes.com/news/motel-6-calling-ice-und... It appears to be a voluntary practice and they may even sell/be compensated for the list by ICE.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by ProAm on Friday April 05, 2019 @05:08PM (#19587061)
> I thought companies like Twitter and Google routinely rebuffed requests for information from government agencies and opposed restrictive rules

They say this but look at AT&T and room 641A and the NSA.[1]

[1] https://en.wikipedia.org/wiki/Room_641A

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cromwellian on Friday April 05, 2019 @06:46PM (#19587745)
Guilt by association? AT&T is a completely different kind of company than SV tech companies.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cheez on Friday April 05, 2019 @08:27PM (#19588341)
https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

The documents identified several technology companies as participants in the PRISM program, including Microsoft in 2007, Yahoo! in 2008, Google in 2009, Facebook in 2009, Paltalk in 2009, YouTube in 2010, AOL in 2011, Skype in 2011 and Apple in 2012.[22] The speaker's notes in the briefing document reviewed by The Washington Post indicated that "98 percent of PRISM production is based on Yahoo, Google, and Microsoft".[1]

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by estebank on Friday April 05, 2019 @09:09PM (#19588507)
The implication being that all those companies were cooperating and not being inadvertently tapped. This is not a given and from what I've seen the later seemed more likely, without discounting the existence of companies that do cooperate on an ongoing basis.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cheez on Saturday April 06, 2019 @10:51AM (#19590997)
The documents identified several technology companies as participants in the PRISM program
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by willstrafach on Saturday April 06, 2019 @03:02PM (#19592416)
> participants

To avoid giving the wrong impression to folks, it is worth noting that ‘participating’ means they produced requested communications on an ongoing basis pursuant to orders from a judge.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cheez on Saturday April 06, 2019 @03:46PM (#19592628)
Thank you for clarifying. To clarify further, this is the FISA (secret) court that Will is referring to that also ended up rubber stamping surveillance of a political campaign.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cromwellian on Saturday April 06, 2019 @05:42PM (#19593180)
Apples and oranges. PRISM was not these companies giving Carte Blanche access to data, it was narrow to specific government warrants for specific individuals per later media reports, and nothing like the Motel 6 or AT&T issues. It sounds to me like PRISM = “I have a warrant for individual XYZ, please zip up all their account data and deliver it electronically somewhere for the FBI”

A separate program, MUSCULAR targeted dark fiber inter-data center links against companies which suggests that the tech companies were not handing out backdoors as they were accused of by Greenwald/Guardian reporting.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cheez on Saturday April 06, 2019 @10:11PM (#19594349)
I don't really see how it's different aside from semantics.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cromwellian on Sunday April 07, 2019 @06:44AM (#19596003)
The root of this thread was that then tech companies routinely rebuff requests and the example of AT&T was given and Motel 6 was referenced.

There’s a big difference between “show me your warrant” and “oh, the government asked nicely? I’ll give you the data as a favor”

It’s not just semantics. There’s a huge difference between being compelled and being a willing participant who doesn’t push back.

What evidence do you have that the tech companies don’t rebuff or push back on requests that don’t have the full force of the courts behind them?

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by cheez on Sunday April 07, 2019 @06:51AM (#19596019)
No way to know since warrants are approved by secret courts. I'm going to guess zero pushback.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by lugg on Friday April 05, 2019 @08:35PM (#19588376)
No, reread the parent, you're missing context.
Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by tyingq on Friday April 05, 2019 @09:32PM (#19588575)
"Isn’t it your duty to protect the privacy of your data and your customers regardless of who is requesting data?"

The article says "after several locations gave information on thousands of guests to Immigration and Customs Enforcement without warrants"

Sounds like ICE got the info from the night manager or similar. I can see why a motel night manager might feel like they didn't have a choice in the matter. Motel 6 is still rightly on hook, but ICE knew better than to route the request to Motel 6 HDQ.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by toyg on Friday April 05, 2019 @09:35PM (#19588597)
> I thought companies like Twitter and Google routinely rebuffed requests for information

Some, maybe. Definitely not all. Google reportedly has a system to let authorities access GMail. Similarly, Microsoft has been cooperating from pre-antitrust times, let alone now. And these are the richest companies in the world, with market caps in the hundreds of billions; they can afford to pay legions of top-level lawyers for decades-long litigation. Motel 6 in comparison is small beer; they were sold for less than 2$bn a few years ago.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by evgen on Saturday April 06, 2019 @06:01AM (#19590067)
Large internet companies have a system that manages the process for LEO access, but your implication that they offer a "here's your login creds, grab whatever data you want" system is incorrect.

Google probably receives more subpoenas per hour than most companies receive over their entire lifetime, so of course they have a portal for handling such requests and managing the process.

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by Ntrails on Saturday April 06, 2019 @04:30AM (#19589866)
If the police called and asked me whether i'd seen [person fitting description] at my motel, i would answer honestly. If they had a name, i would check records. Want yesterdays cctv? No problems. I wouldn't care if they had a warrant, it is a totally reasonable set of things for them to ask for.

Complete customer lists are a data gathering exercise, not a query to investigate a 'lead'

Re:Motel 6 to Pay $12M after Improperly Giving Guest Lists t... by deytempo on Friday April 05, 2019 @07:51PM (#19588152)
The solution is to encrypt all the logs and “lose” all the keys