January 14, 2018
Ubers Secret Tool for Keeping the Cops in the Dark
In May 2015 about 10 investigators for the Quebec tax authority burst into Uber Technologies Inc.’s office in Montreal. The authorities believed Uber had violated tax laws and had a warrant to collect evidence. Managers on-site knew what to do, say people with knowledge of the event.
Like managers at Uber’s hundreds of offices abroad, they’d been trained to page a number that alerted specially trained staff at company headquarters in San Francisco. When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they’d obtained a warrant to collect. The investigators left without any evidence.
Most tech companies don’t expect police to regularly raid their offices, but Uber isn’t most companies. The ride-hailing startup’s reputation for flouting local labor laws and taxi rules has made it a favorite target for law enforcement agencies around the world. That’s where this remote system, called Ripley, comes in. From spring 2015 until late 2016, Uber routinely used Ripley to thwart police raids in foreign countries, say three people with knowledge of the system. Allusions to its nature can be found in a smattering of court filings, but its details, scope, and origin haven’t been previously reported.

The Uber HQ team overseeing Ripley could remotely change passwords and otherwise lock up data on company-owned smartphones, laptops, and desktops as well as shut down the devices. This routine was initially called the unexpected visitor protocol. Employees aware of its existence eventually took to calling it Ripley, after Sigourney Weaver’s flamethrower-wielding hero in the movies. The nickname was inspired by a Ripley line in , after the acid-blooded extraterrestrials easily best a squad of ground troops. “Nuke the entire site from orbit. It’s the only way to be sure.”
Other companies have shut off computers during police raids, then granted officers access after reviewing a warrant. And Uber has reason to be cautious with the sensitive information it holds about customers and their locations around the world. Ripley stands out partly because it was used regularly—at least two dozen times, the people with knowledge of the system say—and partly because some employees involved say they felt the program slowed investigations that were legally sound in the local offices’ jurisdictions. “Obstruction of justice definitions vary widely by country,” says Ryan Calo, a cyberlaw professor at the University of Washington. “What’s clear is that Uber maintained a general pattern of legal arbitrage.”
“Like every company with offices around the world, we have security procedures in place to protect corporate and customer data,” Uber said in a statement. “When it comes to government investigations, it’s our policy to cooperate with all valid searches and requests for data.”
Uber has already drawn criminal inquiries from the U.S. Department of Justice for at least five other alleged schemes. In February, the exposed Uber’s use of a software tool called Greyball, which showed enforcement officers a fake version of its app to protect drivers from getting ticketed. Ripley’s existence gives officials looking into other Uber incidents reason to wonder what they may have missed when their raids were stymied by locked computers or encrypted files. Prosecutors may look at whether Uber obstructed law enforcement in a new light. “It’s a fine line,” says Albert Gidari, director of privacy at Stanford Law School’s Center for Internet & Society. “What is going to determine which side of the line you’re on, between obstruction and properly protecting your business, is going to be things like your history, how the government has interacted with you.”
About a year after the failed Montreal raid, the judge in the Quebec tax authority’s lawsuit against Uber wrote that “Uber wanted to shield evidence of its illegal activities” and that the company’s actions in the raid reflected “all the characteristics of an attempt to obstruct justice.” Uber told the court it never deleted its files. It cooperated with a second search warrant that explicitly covered the files and agreed to collect provincial taxes for each ride.
Uber deployed Ripley routinely as recently as late 2016, including during government raids in Amsterdam, Brussels, Hong Kong, and Paris, say the people with knowledge of the matter. The tool was developed in coordination with Uber’s security and legal departments, the people say. The heads of both departments, Joe Sullivan and Salle Yoo, left the company last year. Neither responded to requests for comment.
Ripley’s roots date to March 2015, when police stormed Uber’s Brussels office, say people with knowledge of the event. The Belgian authorities, which accused Uber of operating without proper licenses, gained access to the company’s payments system and financial documents as well as driver and employee information. A court order forced Uber to shut down its unlicensed service later that year. Following that raid and another in Paris the same week, Yoo, then Uber’s general counsel, directed her staff to install a standard encryption service and log off computers after 60 seconds of inactivity. She also proposed testing an app to counter raids. Workers in Uber’s IT department were soon tasked with creating a system to keep internal records hidden from intruders entering any of its hundreds of foreign offices. They used software from Twilio Inc. to page staffers who would trigger the lockdown.
The security team, which housed many of Uber’s most controversial programs, took over Ripley from the IT department in 2016. In a letter shared with U.S. attorneys and made public in a trade-secrets lawsuit against Uber, Richard Jacobs, a former Uber manager, accused the security group of spying on government officials and rivals. Jacobs’s letter makes an oblique reference to a program for impeding police raids. A 2016 wrongful-dismissal lawsuit by Samuel Spangenberg, another Uber manager, also references its use during the May 2015 tax authority raid in Montreal.
The three people with knowledge of the program say they believe Ripley’s use was justified in some cases because police outside the U.S. didn’t always come with warrants or relied on broad orders to conduct fishing expeditions. But the program was a closely guarded secret. Its existence was unknown even to many workers in the Uber offices being raided. Some were bewildered and distressed when law enforcement ordered them to log on to their computers and they were unable to do so, two of the people say.
Later versions of Ripley gave Uber the ability to selectively provide information to government agencies that searched the company’s foreign offices. At the direction of company lawyers, security engineers could select which information to share with officials who had warrants to access Uber’s systems, the people say.
Another option was contemplated for times when Uber wanted to be less transparent. In 2016 the security team began working on software called uLocker. An early prototype could present a dummy version of a typical login screen to police or other unwanted eyes, the people say. But Uber says no dummy-desktop function was ever implemented or used, and that the current version of uLocker doesn’t include that capability. The project is overseen by John Flynn, Uber’s chief information security officer.
February 26, 2018
Days After Parkland, Its Business as Usual at a Florida Gun Show 0
by MeDaryl • Cars • Tags: business, businessweek, Congress, culture, Donald John Trump, Florida, Gun Control, guns, Las Vegas, Miami, National Rifle Association, texas
It’s another week after another mass shooting in the U.S., and something finally feels different. In the days following the Feb. 14 school shooting in Parkland, Florida, that killed 17 students and faculty members, a vociferous movement of young people has risen up to say enough is enough. The generation that grew up in the wake of the 1999 carnage in Columbine is demanding new gun restrictions. The teenagers are adding a fresh voice to a gun control debate that has plodded, despite a number of high-profile massacres in the past several months, from the record-setting Las Vegas incident that killed 58 to the shooting a few weeks later at a Baptist church in Sutherland Springs, Texas, that killed 26.
But as students plan protests and schedule a sit-down with President Donald Trump to discuss gun violence, it’s important to remember what they’re up against. Three-in-10 American adults own a gun, and three-quarters of them think that doing so is fundamental to their sense of freedom, according to a 2017 Pew poll. This engrained culture of gun rights was on display over the weekend, where it was business as usual at a Miami-area gun show. Merchants displayed hunting knives, tactical gear, and semiautomatic assault rifles, including the same AR-15 model used by 19-year-old Nikolas Cruz, just an hour north, at Marjory Stoneman Douglas High School, in neighboring Broward County. At the Miami weapons bazaar, parents pushed babies up and down aisles of carefully stacked magazines and ammo; older children played with toy firearms.
Gun shows are a staple in the American firearms community, with several thousand held annually. Gun control activists have called for closing the “gun show loophole,” which allows some gun sellers to perform a transaction without running a background check on the buyer. According to data collected by Pew, the majority of gun owners, 77 percent, advocate ending the loophole, but a proposed bill to do just that found little traction in Congress when it was introduced last March.
Indeed, the state of gun control legislation appears to be divorced from public sentiment. According to the Pew poll, among gun owners, 89 percent support a proposal that would prevent the mentally ill from purchasing a gun, 82 percent support barring those on the no-fly list from buying guns, 54 percent support a federal gun sales database, and 48 percent support a ban on assault-style weapons such as AR-15s. These measures, though, often dissipate in the legislation process. Congress, which promised a bipartisan bump stock ban after the device was used in the Las Vegas shooting, failed to deliver. On Tuesday, Trump signaled a willingness to consider a bump stock ban, directing his attorney general, Jeff Sessions, to draft rules prohibiting the accessories.
In a sign of how hard it will be to change the state’s gun laws, on Feb. 20, Florida legislators voted against an assault rifles ban as students from Parkland watched in the gallery. A similar proposal failed to gain traction in the wake of the 2016 Pulse nightclub shooting that left 49 dead. The state is home to some of the nation’s most lax gun laws and a governor with an A+ rating from the National Rifle Association. Marion Hammer, head of the Florida gun lobby, was involved in the state’s notorious Stand Your Ground law and supported the state’s concealed carry initiative. In a state where concealed carry is popular, the license allows those shopping at a gun show to avoid the three- to five-day waiting period.
At the weekend gun show in Miami, few people wanted to talk on the record, stating they’d been misrepresented in the past in the media. Many simply sighed when asked about the AR-15 first made infamous in the Sandy Hook shooting in 2012. The price tag on one read $449. Asked what it would take to buy one on the spot, a salesman replied, “If you have a Florida driver’s license and a concealed weapons permit, you can walk out with one today.” Short of that, you need to go through a background check and the mandatory waiting period.
Many of the talking points seemed similar. Multiple sellers mentioned that a 19-year-old who wanted to inflict mass casualties could just as easily buy a Ferrari and mow people down by speeding on a busy street. A common refrain was that gun owners are good people in favor of smart regulation but that an outright ban would never work, as there were already millions of guns in public hands.
Robert Geisler, a 34-year-old from Orlando, was working behind the busy, large booth for gun retailer Shoot Straight Florida. Business sometimes picks up after a mass shooting, he said, though this show is always busy. “We’re on pace to do the exact same amount of sales as we did about a month ago when we were here,” he said. The conversation soon turned to the AR-15 and all the misconceptions that Geisler said surround the weapon. “There’s a lot of guns that are like that, that have been out for a long time that shoot just as far and shoot just as fast. It’s gotten a bad name since that Sandy Hook thing,” Geisler said, referring to the 2012 killing of 20 elementary school students and six staff members. “The gun has been around since the Vietnam era, it’s just in the last 25 or 30 years where these kids have been using them in the school shootings.”
“We are a free society,” Robert’s uncle, Scott Geisler, 56, said as he walked over and talked at length about all the reasons why someone might want to purchase an AR-15 for self-defense instead of a simple handgun. “People want some choices,” he said. “They like that look. They grew up with it. They see it, they see it on TV, and they like to own it. It’s a sexy rifle.”
The conversation shifted to a changing society and video games. “Society has changed,” the elder Geisler continued. “The kids have changed. We didn’t grow up playing with all these Game Boys or these PlayStations with shoot’em-up programs and going to schools and shooting up schools, shooting up whatever. We didn’t grow up with that. Now these kids think it’s fun and it’s a toy, and it’s not.” As Geisler spoke, a child played with a toy gun nearby as his mother looked at handguns.
Meanwhile, in the hours after Trump announced the possibility of a ban on bump stocks, prices for the accessories went wild on the resale market. On Gun Broker, a firearms auction website, Slide Fire-branded bump stocks were selling for between $245 and $1,200. The devices usually retail for between $99 and $199.
Read more: https://www.bloomberg.com/news/articles/2018-02-21/days-after-parkland-it-s-business-as-usual-at-a-florida-gun-show