jimz

World's most sophisticated hacker who happens to be in a jurisdiction who do not respond to provocations and operate out from behind the GFW illegally, and at the same time, never broke ranks even with the wealth and being in a remarkably well-resourced perch to defect.

The FBI and other federal agencies engaged in law enforcement routinely use appeals to authority and expertise they do not have and create set-piece situations that almost in every case involving more than one defendant sets up a circular firing squad situation where the most guilty is at an advantage of simply pleading guilty and cooperating first, or otherwise they'd dump it off via the AUSA down to the state level if they can, or blame China, Russia, NK, Iran, or Israel, countries that do not extradite their own citizens on request and rarely if ever do so unless it's done so on their terms. Blockchain tracing ultimately still needs the connection between the chain and off-chain ID and there's no surefire way to even ascertain with something that isn't a mere heuristic with an error rate unacceptable in criminal court and would fall apart if there's competent defense counsel, which the FBI have, in the one case where on-chain evidence was going to be used, actually went full Chewbacca and created a two year delay mid-trial and then pulled Chainanlysis' "expert" off before cross examination. The company has the balls to brag as if the courts have validated their method in whole, when in reality the court have long understood what clustering is and so that part is of course admissible evidence, but it also doesn't get you to the purported end - attribution. If one can use a strawman as a sales tactic, this would be exactly that. The attribution aspect have never been allowed to be properly examined in the criminal context. The "reactor" is merely a database, and in the small bit of direct examination the chainalysis employee claimed that every time he queried the database the correct rate was some absurd, Robert-Mugabe's-election-number figure that is higher than the DOJ's conviction rate when they were still credible and actually higher than the CCP's official conviction rate in a fake criminal justice system where due proceess doesn't exist and they give leeway because claiming to be 99% correct is absurd. Of course, they've never been tested in the same situation and still haven't, and if the industry mouthpiece is basically hiring sales and not legal, which is basically what every company in the Blockchain Association has been doing, rent-seeking to be Wall Street 2.0 on top of free merged pull requests and open source software. Tracing on chain is all well and good for shits and giggles but Department of Treasury went and sanctioned a smart contract thinking that it was an EOA address that belongs to a person as if etherscan was never checked beforehand tells you all you need to know.

They had a bad case against Tornado Cash since the ultimate demand would require the devs to somehow predict the actual identities of those that interact with their contracts - which in many cases isn't even a human. It's telling that when the 5th Circuit and the one judge in that circuit who knows anything about process and technology through sheer luck got on the panel and wrote a clear rebuke of how federal investigators failed at doing any due diligence, and for once, the feds did not attempt to do an end-run or even ask for en banc hearing of the issue, but simply made up a completely different issue to pursue (building the front end) which is not a crime. The feds can't match the IP/in house firms in renumeration and can't even match public interest or federal defenders in hiring out of tech competent law grads when it comes to having a moral high ground. They have so much resources so that they can hire contractors, but can't vet the contractors. Being able to fall back on coercion covers up a lot of incompetence. The Atomic Wallet 'hack' was almost certainly not a NK job as they have claimed, for example, and they relied on some dude on twitter's hunch (notably the first thing one learns that is never evidence if presented in court) and a post-hoc heuristic that is indistinguishable from a copycat or a third party's infrastructure to make the attribution. People with poorly thought out opinions are all over the place on Twitter, but this permission slip to "make mistakes". Also, they're part of the system of funding provided to your local police so they are better funded now than before 2020. Check their work under all circumstances, and plea bargains should not be considered as evidence of actual guilt since coercion and BS is as common as actual cases backed by properly collected evidence that builds a procedurally sound case.

It's not an option for everyone, and just being American will result in difficulties in getting bank accounts and access financial rails overseas thanks to FACTA. Countries that do not have a history of compliance/cooperation are generally countries you don't want to go to and also, likely can't actually stay in. For the past 100 years or so there's no terra nullis one can simply escape to and be allowed to live with any degree of comfort and acceptance. Realistically though, even the places that offered the illusion of safety are not really safe now. Not to mention that the fact that any part of the pipes is even visible is in a meta sense part of the safeguards actually working. If you go to Hong Kong, Singapore, Dubai, etc., they've simply had time to learn how to run authoritarianism as normal. The reaction to such a scheme indicates that in the US this is still aberrant. Elsewhere this is quotidian and assumed to exist even when it doesn't really because of the inability for any individual person not in a privileged position to even begin to understand what state capacity actually exists, or doesn't exist.

There is at least still the ability to recognize tyranny when it arrives that exists in the culture here. People have the option of playing jurisdictional arbitrage with their data. ICE isn't part of the actual judiciary and even the DOJ loses cases - routinely, now, under this admin, a mindblowing change from the gears that exercised discretion to keep its reputation under all circumstances.

The case that revealed all this abuse of authority is a relatively minor and poorly chosen set of facts that the government has a real possibility of taking to trial and lose on. What ICE is doing is authoritarian drag compared to pretty much everywhere else that has the capacity to have such agencies in the first place. ICE is genuinely incompetent because all this is new to them, because it's both unlawful and culturally unacceptable, and running a surveillance state is not reflexively easy to most people. They don't know how to prioritize, how to cover things up whether the authority exists or not, and how to even properly police themselves. They don't know how to passively let information reach them and instead everything is loud and noisy and leaves paper trails and frequently ineffectual. What's important is maintaining that reflex about how all this is fundamentally unacceptable in every sense.

If you actually did the tasks in the way they deem correct, at least for immigration and white collar criminal defense, you will get detaind/arrested, and removed in the first case, and the second case you will snitch. It assumes that the state is correct. In reality the state, especially in the initial phase, are never correct on all aspects. You also can't only plan on snitching because what evidence exists and what evidence is admissible and what evidence is admissible but can be used in your advantage are all unknowns. Half of the bench tests on "covering your own ass" basically, and also, seems to have not taken the Loper Bright decision into account, which changes administrative law and how it is adjudicated and appealed entirely, for good or ill.

I don't know the other fields well enough, but if all your clients end up needlessly detained or admit to things they have a valid defense for, eventually people will notice. It's not exactly the two major sins that will definitely get you disbarred - stealing money and screwing client while representing them - but it's definitely at least incompetent. They seem to not understand that common law jurisdictions are fundamentally different from civil ones, and also, there's quite a bit of difference between how the system evolved in each country. Or that in China what's printed is basically more like a manifesto, since it's almost entirely run by the bureaucracy and personal relationships, and lawyers that aren't foreign-trained and work for foreign firms aren't considered prestigious since the courts are essentially entirely for show.

They need to get like, one jurisdiction, one area in that jurisdiction, and specifically the kind of sub-sections in that area down pat. But they can't train on real material so they will never be able to do so. Their banner testimonials come from non-lawyers and that says it all.

The prize is that you're the only person in the room with the expertise in the area when it comes to writing regulations.

People are already doing that, and have frequently lost track of the fact that it does not mean that they have gained any skill or knowledge, nor do they have an actual way ot ascertaining whether when there is a correct answer the processes used, which they do not understand, is able to reliably reach it, especially edge cases.

Sometimes the outcomes are comical. I just received an automated email from ElevenLabs saying that its automated systems have detected that I may be using its services to create voice versions of materials that harm children. I had it prepare audio versions of several books and academic papers about moral panics that conjured up out of nothing... about harm being done to children. At least that's what I assume. Either that or somehow I had an API key leak from my on-premise homelab, but the usage recorded would mean that they are basing a semi-conclusion based on a tiny sample. I have no distributed any of the outputs, I own the books and have access legally to the studies, because I have a background in the humanities. I also have no children, which ElevenLabs better not know, although how studies of moral panics can cause any harm in children of any kind is literally unimaginable. It's a waterfall of potential errors summed up in a vague email. My API key and the web interface works just fine regardless.

It's one thing if this is a product in beta, but this is their production model. Harming children is a serious accusation except the legal concept impossibility and the admission that this was not an actual lawyer (like I am) but some effective form letter hedging the vaguest of accusations made by some model lacking the ability to discern substance and meta-substance makes it frankly hilarious, and wildly irresponsible. I realize that by academic credentials I'm out of my lane but by experience I am certainly not, and they should recognize when they should stay in their lane and not just run Jev and think it's fine and dandy when done unsupervised (I presume).

Also, AGI is by definition asymptomtic surely, since there would be no way to benchmark it in a manner that isn't asymptotic. We're nowhere close to that. But we're so far from that, it's comical that people who clearly have zero idea of either the technical or conceptual aspects of basically a piece of software that is very good at quickly bruteforcing the correct or acceptable next token to be anything more than that. Even with some serious training and many hours spent on vast.ai I've yet to have created a version of a frontier model that is actually "good" at hacking in my own homelab setting. Although the the time stock Fable 5 missed a favicon shell on a basic jar (turned out they nerfed the hell out of it, this is why I only pay for the massively discounted tokens from Chinese proxies if I'm using American models or sometimes the freebies if you figure out how to get onto linux.do or similar sites). If anyone reading this is a high school English teacher, please inform your class (assuming the homeric stuff is still being taught) that there's no upside of being Cassandra but the record itself, and that should be enough.

State capacity has always been the bottleneck for authoritarian regimes. China can't keep track of who is even a citizen or not in many cases simply because having a national database doesn't get rid of the birthday problem + the limited number of common surnames + the administrative state's limited capacity to process data that until recent decades came in handwritten + a unsurprising amount of petty corruption that adds up. If you start with bad data there's no magic bullet. And the data is always bad to start with. The spectre of "birth tourism" only works on the Chinese side because through quotidian corruption someone without Chinese citizenship can be made into one by a civil servant of sufficient rank, which is also why it's not a real problem - not enough people actually have that level of connection within the bureaucracy. The US by definition cannot have an accurate database of even who's a citizen - thanks to repeated changes in citizenship laws from the 60s through the 90s that was then frozen around 9/11 as well as the lack of a coherent system that is accurate, immutable, and can act as an oracle. Home births were not just a western thing (although it certainly happens more often on a per capita basis out here, I'm in Nevada). SSNs are not indicators of citizenship, nor are driver's licenses. I spent most of my 20s in NYC where none of my friends who grew up in the city had a driver's license and the state DL/ID wasn't REAL ID compliant until after I left. We only have vaguely reliable data from Texas but ICE, the presumptive arbiter of documentation validity (not part of their mandate), has an error rate of 1% that they admit to, but that's after immigration court and appeals and administrative actions ameliorated their error rate down to 1%. At this point we are removing US citizens and rendering them stateless almost casually, almost as policy.

AI is trained on these flaws. These aren't flaws that can easily be fixed. The ramifications can be significant. Garbage in, garbage out. Records, however official, are wrong all the time. I have an entry in my "criminal record" from a clerical error that is attached to no charges but 4 days in LA County Men's where I had a seizure, which can be interpreted as the record being correct but incomplete or a giant screwup. What sort of process would it take to fix this if the AI decided on the latter? It doesn't affect me, but someone less privileged? Absolutely it will have consequences. Worst of both worlds indeed. People routinely forget that LLMs ARE NOT PEOPLE. Mistakes get compounded. Biases if not caught in time get baked in. There are multiple AI safety dialogues that should be happening but you wouldn't know it from the media, and it's the wrong one that is front and center. You can rotate keys, you can roll out patches, you can't open up the corpus and use a scalpel and cut out the errors and omissions and biases, and the latter aren't logged.

We don't have enough people who possess professional expertise in widely varied fields that nevertheless intersect in the conversation. This might be because there aren't many people that fit the descriptor, but these are the blindspots. Anyone talk to Orin Kerr lately?

The 4th Amendment in practice, as really any law, cannot preemptively stop the bad practices of actors working in bad faith. It's remediative, as in, the evidence it collects at least in theory cannot be admitted as evidence in court. If you look at indictments, informations, any initial charging document, you'll see at least some if not a deluge of blatantly inadmissible or dubiously obtained pieces of information that makes up probable cause. This is a feature of the system, and also why you don't plead guilty on the information alone (in state and federal felony practice I've seen 1 person plead guilty on the indicting information, he was pro se, this was 2013). Superseding indictments frequently look nothing like the original. Call it cynical, or pragmatic, but in 20% of the states - including some of the larger states like New York, Washington, Michigan, Ohio, Wisconsin etc. - it's not merely allowed and common for cases to end up with a plea that contains charges that have no factual basis linkable to the allegations first presented because we know what the game is and it's not about justice or public safety, it's about retribution, on someone lower on the totem pole. The evidence becomes secondary because the system incentivizes it. The 4th Amendment of course covers more than that, and if we simply reverted the interpretation back to the text we'd be doing much better.

Sadly it has been whittled down and have not caught up with tech - it's a lagging indicator at best. Things like the third party doctrine, automotive exception, pretext stops, etc. are things that should enrage anyone who cares about the most fundamental rights we have not just as Americans but as people, individuals, private persons, who are fundamentally equal to each other if not in circumstance but at least in substance. The courts sometimes even mis-states their own doctrine and usually in favor of the state. Why is there no good faith exception the other way? Any idiot can see that the plain view doctrine opens a pandora's box. We don't need the NSA for our rights to be handwaved away, that's already done.

The NSA does not testify in open court, and we can only speculate what they are able to really launder down into the criminal justice system. But considering that the state of the 4th Amendment have already made the system extremely coercive with limited recourse in so many "exceptions" that are no where near the intent of the framers of the Constitution and frankly tilts the ice more than any crooked lower league Russian Hockey match, it's likely not even necessary for them to jump in most of the time.

I suspect that the greater influence they exert is through the military-industrial complex in its modern day form. We're the only country that can just waltz in and invade.. what, 7, 8 countries? Has anyone been to China lately and have the connections to assess the state of their military and economy with clear eyes? Do people see the laundering of BS national security concerns into reputable papers and conspiracy rags alike? It's usually innocuous sounding, but no small part of the economic quagmire comes from the continued funding, justified by the agencies that are the constituency with a vested interest, of this pit of unaccountable money. We'll be paying for it either way, because not enough people care, unfortunately.

A very odd real example is how Sony went backwards with passkey compatibility on their apps. It's I think what happened when they tried to have a single OIDC setup instead of multiple (PSN was a totally separate setup for the longest time and had it solved, but other parts of Sony, on a separate system, was almost wholly incompatible. The merging of the two made it impossible for their current webkit implementations to detect passkeys in say your 1password when it was working like a charming for years on PSN). This kind of stuff happens but to put it into production when it's almost immediately obvious that they screwed up is pretty wild.

The VRP is a wholly manufactured and in the long-term, unsustainable model to begin with. It's the most duct/duck-taped solution that, with a virtually entirely tech-illiterate police force, can work under the interpretation of the CFAA prior to the van Buren decision in 2020. In practice it's easily ludicrously inefficient and requires trust that simply can't exist. In fact the tech-illiteracy is so profound that even post van Buren, which fixes some of the most glaring problems Orin Kerr has spent his career screaming into the void on with the CFAA, a law drafted 6 years before the web came about but with such vague and broad language and it manages to cover, at this point, almost anything (see also: wire fraud, money laundering statutes, the Mann Act aka the White Slave Traffic Act of 1910 and on the flip side, how RICO primarily serves as a tool of coercion because in practice if you take it to trial the charge will not stand, but a host of more minor but still overwrought and expansive felonies will do the job). It's the stopgap of stopgaps and the fact that it at any point had any buy-in was a minor miracle. I once submitted a bug report only to find that no, the company's intent was to defraud its users, and they simply put the (entirely unenforceable but are you going to test that? I've defended a federal criminal case and didn't lose - hung jury - and that took so much that it was almost a pyrrhic victory but it also without a doubt ruined any political aspirations of the AUSA. Anything less than that and it's pointless.) clause that they are indeed attempting to defraud you, and you just have to take it, in laymen's terms, into their ToS, without notice. Same company also has an working admin key in their production apk for their Algolia cluster and guess who isn't reporting it? There's no point. To quote Yates in his prime, "No likely end could bring them loss/Or leave them happier than before."

The correct way to address this had always been to modify or entirely get rid of the CFAA and start from scratch with a framework that actually works, that isn't punitive, that make some sense, that did not come into existence thanks to Ronald Reagan's admiration for the uncanny realism in the 1983 film WarGames. But we have a constituency now that relies on the inefficiency machine for their living and their votes will be in their self-interest, security be damned. The best people have been sent on a fool's errand for generations. The incentive structures are entirely misaligned now. I published a PoC last weekend that indirectly but pretty clearly shows that the FBI was relying on an anonymous twitter's account's assertions, none of which were going to be admissible in court in the alternate universe where that matters, to avoid saying "I don't know" by blaming North Korea, something that someone with open source tooling that existed back then, who have never taken a STEM course past 11th grade AP Stats, whose terminal degree is a JD, could whip up and test in under an hour, probably shorter except my home lab with the GPU was occupied. We go through the motions but really, those with power are relying on the inherent imbalance of power and well, lying, essentially, to keep order. How is that sustainable?

The whole model needs to go but it likely never will and that's perhaps the real legacy of Reagan and our moribund power structure. Looking at the payout rate in hackerOne's heyday, why would anyone ever report anything to the companies? My assumption is that people who have any rationality are doing just that. Most data breaches are never disclosed officially but at best passed in rumors. I have no hard evidence that I can disclose, but the least leaky operation is a one-man operation and attorney-client is forever.

By the way, your AI benchmarks in the legal realm aren't tested on criminal matters because how do you benchmark two probablistic systems that are both subject to the prisoner's dilemma and imperfect information? If they did the score would likely be low. You'd need to build out so much back-knowledge just to set up any scenario that really any answer is "it depends" is not a joke but the best answer. Any suggestion that we simply take the status quo as is and run with it cannot be taken seriously. It's a foolish system made by clueless men who hit the lottery and didn't even see the ticket until years after. It was then exacerbated by politically ambitious AUSAs who do not care about getting the right person behind bars but someone behind bars. Fast forward 30 years and this is the state of things. Your sophisticated defenses may have been thoroughly hand-reversed years ago but to dodge the DMCA the source was put somewhere like Gitee instead of Github. I'm not sure if you can finish the signup flow without a Chinese ID at this point, but a decade ago you can, at least. Those are outliers too, but outliers in charity. Good luck with the rest. I'm not being cheeky: just because there's a vulnerability does not imply knowledge to how to maximize its impact. Data breaches are put in the open frequently because of petty feuds and a failure to recognize the importance of the data. After all, China does not run on private credit, and hence, your identity being stolen there is virtually meaningless, as meaningless as you having next to the biometric ID card data of all of their citizens. Like harm, value is contextual, and constructed so that it's framework dependent, and we at least know the frameworks that exist broadly. And what you don't know, well, you don't know.

And less than a decade later we have multiple devices that are effectively fitbits for your genitalia, for both sexes. How times change.

Because they kind of did what you described and the reason the data never surfaced is either because it's too valuable or too worthless

There's no English-language article that can fully capture the system because it's a moving target to begin with, and anything official is vague on purpose (to be fair, much of the legislation in the US is too, except the Constitutional backstop and co-equal judiciary does not exist in China). The official messaging is always targeted and curated with a specific audience in mind and how much truth is contained within varies. The best way to describe it without turning it into an essay is that it's "aspirationally market-driven" system that is not defined by a fixed and consistent ideology but rather the constraints of the capacity of the administrative state to control the parts of the economy that is legible to the state. It's not a free market except for the black market, but the black market is frankly huge if nothing else to compensate for the state asserting not just a monopoly on the use of violence but also the monopolistic determinator of morality, which the people are less willing to buy into, but that disconnection itself creates an opportunity for arbitrage. That is the relationship dynamic that have retained some degree of stability, but everything else is effectively subject to change on a dime without notice. The party will never accept openly that it is capitalistic and in some sense that's not even a lie, but what the state is able to impose and what the people actually do are very different things. As the state excludes 99% of the population writ large from politics, full stop (you are either born into it, or you're not eligible to participate, with some narrow exceptions that occasionally pop up), there's not much of a ground-level appetite for dogma and doctrines. Instead you end up with a pragmatic, descriptive market that exists differently within and without, and just like the socialism label being basically symbolic, same goes for capitalism.

People have been talking about late capitalism in the west for a century. The Chinese state would argue that we cannot be in late capitalism because we're actually in the first stage of socialism, and the people would wonder how we got to late capitalism when they never got to experience early or middle capitalism. But really the only thing we know that definitively does not work is implenting Marxism and Marxism-Leninism and Maoism and its offshoots as doctrine. Whether that means that the default is a prescriptive version of capitalism is, well, open to debate, and probably too simplistic.

So they take the playbook of the least competent administration and think that's the way to go? Not to mention that Spain is not a common law country and how the US conceptualizes both the methods and definitions and even the law itself differs quite a bit. Tech companies have in house counsel, but they are not, by large, familiar with criminal law. At least in the US, they focus on civil litigation, IP, Lanham Act matters, in addition to contracts, licenses, and that sort of thing. It's a completely different world and Orin Kerr's writings are much more instructive. He's at Berkeley and probably the leading legal mind at the intersection of tech, policy, and crime.

I average 1 DMCA notice received a year and I've counter-noticed every single one except one. I'd like to be in federal court. I have experience, my law school friends owe me favors and many are interested in the subject matter, and my response does represent an invitation to file in the appropriate venue. None have done so. The one I did not write back, frankly, I couldn't. It came from outside counsel hired by the New York Times that alleges not one single correct assertion and also, accidentally admits to intentionally committing a crime themselves. It took nothing down (It was sent to Github) and accomplished nothing. There's nothing to respond to if their remedy requested is imaginary.

That's how you want to fight your "cyber battles"? Better get used the phrase "corpus delicti".