DEA regularly mines Americans' travel records to seize millions in cash - <AUTHOR> http://www.usatoday.com/story/news/2016/08/10/dea-travel-record-airport-seizures/88474282/ <comment><USER2> There is no world where this practice could pass constitutional review. What they are doing is called out as unconstitutional in no less than _three_ (!!!) different amendments. At this point in time, the supreme court should be buckling under the weight of requests to review this practice, and have it struck down as un-American.

"The right of the people to be _secure in their persons_ , houses, papers, and effects _against unreasonable searches and seizures_ , shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized" \- Fourth Amendment

"No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, _nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation._ " \-- Fifth Amendment

"The right of the people to be secure in their persons, houses, papers, and effects,[a] against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized" \- Fourteenth Ammendment

<comment><USER3> > _There is no world where this practice could pass constitutional review._

And yet, civil asset forfeiture has been sanctioned by SCotUS.

If we're ever going to change this kind of crap, indignation and, "But, but, but ... nuh-uh!" are _not_ the places to start.

<comment><USER4> The language of the constitution is pretty clear. So what this says to me is that the Supreme Court is not enforcing the constitution.

While these thefts are disturbing, this lack of accountability from the Supreme Court will ultimately lead to much worse crimes.

<comment><USER5> The problem for you is that the supreme court has the final say on what the constitution means.

So for you to say "Supreme Court is not enforcing the constitution" doesn't make a lot of sense. They get to say what it means, so they are "enforcing" the constitution almost by definition. (this is probably not a great word to use since they rely on other branches, like the executive, to enforce things. They can order stuff to happen, but they have no way to actually make it happen themselves).

You may mean "I don't like the interpretation they've given or i think it's wrong". That's okay too, what you do in that case is very simple: Congress passes a law to overrule the supreme court, or the country pass an amendment to do it. This has happened numerous times before.

They are in fact, 100% accountable in this regard. They take responsibility for their decisions, and pretty much everything from their ability to hear certain cases to almost every ruling can be overruled by either new laws or amendments.

They happily let that happen, and that is the form of review and accountability you get in our system of government :)

<comment><USER6> > Congress passes a law to overrule the supreme court, or the country pass an > amendment to do it. This has happened numerous times before.

But then the Supreme Court gets to interpret that law also. I don't see how you could possibly more clearly state what the previously quoted amendments already state.

Since it already failed(or succeeded, depending on which side you're on) in it's interpretation of the 4th/5th/14th amendments, I have zero confidence it would properly interpret any other amendment or law addressing the issue.

</comment></comment></comment></comment></comment><comment><USER7> The most ridiculous part of these stories to me is that the ending was repeatedly "you got us, we can't prove this money is from illegal sources, but we're only returning part of it." It's like they are trying to return the minimum amount to make it no longer worth the victim's effort. Definitely doesn't inspire confidence that this done in good faith.

If this were an article USA today was writing about Mexico it probably would have just gone out and called it corruption. I am certainly convinced from these cases it is a massive abuse.

<comment><USER8> > The Justice Department agreed in May to return half the money, without > explanation.

That's about the ugliest thing in the entire story. It makes total sense if you're trying to defuse legal proceedings by making them not worth the price, and no sense at all if you're trying to freeze money from drug traffickers.

</comment></comment><comment><USER9> > Federal drug agents regularly mine Americans' travel information to profile > people who might be ferrying money for narcotics traffickers — though they > almost never use what they learn to make arrests or build criminal cases.

> Instead, that targeting has helped the Drug Enforcement Administration seize > a small fortune in cash.

So, they're basically the Sheriff of Nottingham, or the old Central European robber barons.

<comment><USER10> > DEA units assigned to patrol 15 of the nation's busiest airports seized more > than $209 million in cash from at least 5,200 people over the past decade > after concluding the money was linked to drug trafficking

So was it drug money or not?

<comment><USER11> It's easy for them to conclude, with no due process. They just say so, take the money, and leave you having to file suit and fight the government to get your own money back.

Asset forfeiture is more of a travesty than money "laundering" being a crime is.

The sicker part is that it's just admitting that their justice system is so broken that they wouldn't be able to get convictions against these "criminals" otherwise.

<comment><USER12> > Asset forfeiture is more of a travesty than money "laundering" being a crime > is.

I'm not sure why it's a travesty that it's illegal to conceal the source of illegally-earned money.

<comment><USER13> Because "nor shall any person... be deprived of life, liberty, or property, without due process of law...". 5th Amendment to the Constitution. Unless you think "due process" == "Because I said so", it is both legally and morally a travesty.

<comment><USER14> Civil forfeiture has considerably more procedural protection than "because I said so"; which is not to say that certain applications of it are not deeply problematic, but hyperbole is not helpful in discussing them.

<comment><USER15> > Civil forfeiture has considerably more procedural protection than "because I > said so";

Not at all...

It goes something like this "We found this $10K in a car on a known drug route with out of state plates, prove it's not a drug money." The issues is that it's really hard to prove your money is innocent if, say, you'd been working a job and saving cash (don't trust the banks) for 10 years and are moving across the country.

<comment><USER14> > It goes something like this "We found this $10K in a car on a known drug > route with out of state plates, prove it's not a drug money."

Except, not, because the government bears the burden of proving that it _is_ drug money, assuming you assert a claim that the funds should not be subject to forfeiture. ( _If_ they meet that burden and you wish to keep the money _anyway_ by invoking the innocent owner principal, you have the burden of proving that you were not involved in the illegal conduct that made the money subject to forfeiture or acted to end it as soon as you became aware, though.)

> The issues is that it's really hard to prove your money is innocent

No, though there is a legitimate issue that it may be difficult to afford decent representation to do a good job of countering the government's attempt to prove your money guilty if, you know, the government's just seized your life savings.

(This is actually related to the reason I am inclined to think that the right to publicly-provided counsel ought to apply in any legal case pursued against an indigent defendant by the government, whether or not it is a criminal case.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> So, anybody discussing decriminalizing drugs and proposing they are a medical issue instead can count on the fact that he/she is threatening the livelihood of _both_ the dealers and the "enforcement" agency???

(and be appropriately wary)

<comment><USER17> Throw in police unions, the private prison industry, the surveillance industry, criminal lawyers, ...

<comment><USER18> And the criminals. It's much less profitable if you pay taxes and can't kill your competition.

<comment><USER19> Parent already mentioned "the dealers".

</comment></comment></comment></comment><comment><USER20> > "We won't release that information without a subpoena," American Airlines > spokesman Ross Feinstein said.

Just because Ross said something, doesn't make it true.

> And a police dog smelled drugs on the cash

There is so much wrong with that assertion

1) Dogs are trained to find money

2) Most cash is cocaine contaminated [1]

3) A dog indicating is not proof of anything [2] usually nothing more than what the handler wants to happen

[1] [https://en.wikipedia.org/wiki/Contaminated_currency](https://en.wikipedia.org/wiki/Contaminated_currency)

[2] [https://nevergetbusted.com/2014/07/20/university-study- trick...](https://nevergetbusted.com/2014/07/20/university-study-tricked- certified-police-dogs-to-false-alert-200-times/)

</comment><comment><USER21> From a Latin American perspective, the US deals with corruption in a very interesting way.

* Here in Latin America the police extorts corruption and you know that it is illegal but good luck complaining. In the US they just legalize the extortion.

* Here in Latin America it is illegal to bribe a politician but everyone does it. In the US they just legalize lobbying and corporations financing campaigns.

So, to avoid corruption, the US just makes it legal?

<comment><USER3> Well, by definition, corruption is illegal. So if you make the behavior legal, in specific, defined circumstances, then it's not corruption any more. Magic!

</comment></comment><comment><USER22> It seems the NSA analysts can wake up in the morning and reassure themselves "hey, at least we're not DEA agents".

</comment><comment><USER23> Note that the DEA is probably, in some cases, using information obtained by the NSA and shared with the DEA. See also: parallel construction, [https://www.techdirt.com/articles/20140203/11143926078/paral...](https://www.techdirt.com/articles/20140203/11143926078/parallel- construction-revealed-how-dea-is-trained-to-launder-classified-surveillance- info.shtml)

The war on drugs has wreaked havoc on our country by providing huge incentives for the criminally-minded to act as they do. And yes, I'm referring to all of the criminals involved.

<comment><USER4> The brilliant thing (For them) about this is they don't need the hassle of parallel construction if they're not building a case-- they can just use the NSA information to steal the money, and then never file charges, and thus never have to justify to a court how they acquired the knowledge that the money would be there.

The NSA gets a cut, I'm sure.

<comment><USER24> The NSA doesn't need the paper-trail of a cut, and at any rate the cut would be small potatoes to them.

</comment></comment></comment><comment><USER25> Why hasn't this been successfully fought by the ACLU? What issues are keeping this legal for so long?

</comment><comment><USER26> It is my sincere hope that in my lifetime a Whistle Blower cripples the DEA and exposes a profiteering, disturbing agenda that so many seem to sense is at the belligerent, Constitution-ignoring soul of the organization.

</comment><comment><USER27> Law enforcement is the biggest and most dangerous gang in America.

</comment><comment><USER28> At its core, the problem is that the DEA has a monetary incentive to seize cash, since it can keep the cash for its own use. What if that were no longer possible, and all money confiscated by government agencies are incinerated under external supervision, if cash, or sent to the monetary equivalent of /dev/null (buying 0% Treasury perpetuities, perhaps) if electronic.

</comment><comment><USER29> The easy solution to this (from the perspective of the criminal) is to just move the money via a cryptocurrency (traded for cash privately) and it seems completely idiotic to me that this hasn't occurred yet, there is basically zero risk of LE compromise.

I'm also rather surprised that I'm the first person to even mention it here, since this is basically a solved problem.

<comment><USER30> Is it that easy to trade $50,000 of a cryptocurrency for regular currency without leaving an ugly papertrail? I guess theoretically you can have a clean accomplice that does it for you on the regulated exchanges and hands you the cash, but I'm not sure how well that works for evading LE.

<comment><USER29> Well, you can do that, or you can try to establish a complete shadow economy on the blockchain, where both buyers and sellers use the crypto as a currency, and it only gets exchanged for cold hard (more troublesome) cash at the "leaves" which are ostensibly much smaller and more invisible amounts

</comment></comment></comment><comment><USER4> The tighter their grip, the more value will slip thru their fingers into bitcoin.

</comment><comment><USER31> I count on this so I can buy cheap Outside Lands tickets from cash poor drug dealers that "had something come up"</comment>


Wayne Gretzky and the Mysteries of Athletic Greatness - <AUTHOR> https://www.newyorker.com/sports/sporting-scene/wayne-gretzky-and-the-mysteries-of-athletic-greatness <comment><USER2> Although there are many in my circle of friends that are apathetic to sports, I can't help but be drawn into the idea of "superhuman" feats and statistical outliers that always seem to permeate major sports.

We live in an era where being a 40 year old quarterback is not only possible but can play at top 1%. An era where an NBA player who entered after highschool has played for more than 15 years and has not had a major injury despite playing nonstop and has single highhandedly put a no name basketball team on the map. An era where not one but _two_ of the greatest soccer players have played and peaked at the same time.

And all this is happening as teams hire more Post Docs in Stats and Math to find the secret sauce that makes teams great or find ways to break the game in their favor.

If you like Wayne Gretzky I suggest you look up interviews regarding the work ethic and impressive mental skills of other top players like Kobe Bryant and Cristiano Ronaldo, these guys are geniuses in their field but are absolute work horses with incredible discipline.

<comment><USER3> I like to play sports (participate). I dont care to watch them - unless its my kids. For me, I think of great sports people like other top tier predators on the planet. Sure, they can be exciting to watch, but its just entertainment no? Do I (or we as humans) stand to learn something important from them?

<comment><AUTHOR> I think there's something that can be learned from witnessing excellence in any area - writing, coding, music, sports...seeing the processes, discipline, out-of-the-box thinking, teamwork, etc. that lead to a great outcome can transfer over into other fields. Yes, sports are mainly for entertainment (and a series of never-ending cliches) but are also a microcosm of life.

That being said, I agree that you'll learn much more from reading books, taking a course, etc. than sitting down and watching sports for the equivalent amount of time.

<comment><USER4> >you learn more about sports from reading than watching

I'm not sure that's true, game tapes - if strategically cut together - can be very effective in teaching strategy and individual techniques for sports. Video games can also be very effective in this regard. This works because it activates mirror neurons when you imagine you're doing the thing you're watching.

<comment><AUTHOR> To clarify, I meant you'd learn more (in a general sense) from activities other than watching sports.

If you're looking to build expertise in a given sport, I agree that watching it is probably one of the best ways to do so.

</comment></comment></comment></comment></comment><comment><USER5> One of the things that doesn't get talk about enough or at all in these kinds of conversations is the support system that gets built around these "greats".

For example if a team believes they have an amazing talent they're much more likely to spend money to surround them with other great/good talent on and off the ice/field/court.

The "tanking" strategy being employed by a lot of teams the past decade or so is more evolved version of this. Teams will basically lose on purpose to stock up on high valued draft picks for years then pay for high end coaches and veterans of the sport once they believe they have enough talent.

I believe this can also be applied outside of sports like education with private tutors, etc.

<comment><USER6> "Tanking" is a strategy that is talked about ad nauseam by sports radio gas bags, but is not likely to be an actual tactic being employed by organizations.

<comment><USER5> What makes you think that? The NBA team 76ers for example would severely limit the number of minutes their high value draft picks played during the "rebuilding/tanking" seasons. The team even has a meme about it.

[https://www.dictionary.com/e/slang/trust-the- process/](https://www.dictionary.com/e/slang/trust-the-process/)

</comment></comment></comment><comment><USER7> LeBron James has a similar ability to recall plays, [http://www.espn.com/nba/story/_/id/11067098/lebron-james- gre...](http://www.espn.com/nba/story/_/id/11067098/lebron-james-greatest- weapon-brain)

</comment><comment><USER8> No doubt Gretzky was great, but part of his greatness was the way hockey was played at the time - his greatness was as much a product of the rules as it was his passion for hockey.

He was a hockey "hacker", he exploited (intentionally or not) all sorts of rules that forced the NHL to update them. Today's game seems to be fairly well guarded against this, though it does still happen (they had to rule against the 1-3-1 defense recently, for example). And teams are now very well aware of superstar players and will shut them down very quickly (eg. Sydney Crosby basically getting beat up any time his skates touch the rink).

It's a better game now, but a shame that we probably won't see hockey superstars for a while.

<comment><USER9> Watching McDavid or Crosby on the ice, live, makes it very clear that they are still absolutely in a class of their own. I think these types of players are so good that they change quicker than the game can adapt. Crosby had some trouble in his earlier years, but not anymore.

<comment><USER8> Oh no doubt! They are good, and fun to watch. But in Gretzky's best season, he scored 212 points. The closest anyone has gotten _recently_ has been Ovechkin at 112. The game has changed, you couldn't get a Gretzky again.

<comment><USER9> Fair enough, that does make sense. It's hard to understand how much the game has changed until you watch an older game from the 80's, it's a different flow entirely.

On an unrelated note, I am lucky to have some very cherished memories of sneaking down after bedtime and being welcomed onto my father's lap to watch Wayne Gretzky and the Oilers play. Sports can have a bad rap in tech communities, but I'll never forget the feeling of excitement (and warmth) watching those games in the dark.

</comment></comment></comment></comment><comment><USER10> The Mundanity of Excellence: An Ethnographic Report on Stratification and Olympic Swimmers came up yesterday [https://news.ycombinator.com/item?id=18442600](https://news.ycombinator.com/item?id=18442600) . It has interesting things to say about greatness. I wonder if what separates the very best of the best (e.g. Gretzky) from the best (professional Hockey Players) is analogous to what separates the best from everyone else. Or if it's just a matter of degree, not qualitatively different.

</comment><comment><USER11> Similar edge case in cricket is Bradman. Most great cricket batsmen Test batting average is around 50-60 and Bradman's average is 99.94

[http://stats.espncricinfo.com/wi/content/records/282910.html](http://stats.espncricinfo.com/wi/content/records/282910.html)

<comment><USER12> When I was a kid growing up in Australia, the Australian Broadcasting Corporation (ABC) always described its mailing address in each state as "PO Box 9994 in your capital city".

Years later, I discovered this number was assigned in homage to Sir Donald Bradman's batting average.

Less well known is the ABC's national telephone number 13 9994.

</comment></comment><comment><USER13> Gretzky was also Robin Thicke's babysitter, though not so great at it

[https://www.google.ca/amp/s/www.sportsnet.ca/hockey/nhl/supe...](https://www.google.ca/amp/s/www.sportsnet.ca/hockey/nhl/superfan- alan-thicke-wanye-gretzky-trade-hockey-montreal/sn-amp/)

</comment><comment><USER9> Interesting coincidence, I just had lunch in the booth next to Wayne. He's a kind person.

</comment><comment><USER14> Most impressive Gretzky stat may be Bernie Nicholls scoring 150 pts (70 goals) while on Gretzky's line.

<comment><USER15> Good point. Perhaps the only player the hockey gods were as kind to as Nicholls was Kevin Stevens when he broke the 100 point level twice in the early 90's while playing on a line with Mario Lemieux and Jaromír Jágr.</comment></comment>


Ask HN: how can I generate youtube style id? - <AUTHOR>

Given sample URL: http://www.youtube.com/watch?v=xqvObyU2ITs, any availabale algorithm to generate youtube style video id (xqvObyU2ITs)? Thanks!<p>-Jack <comment><USER2> def generate_code(len = 5)

      (1..len).map { (("a".."z").to_a + ("A".."Z").to_a + (0..9).to_a)[rand(62)] }.join

end

<comment><USER3> That rocks dude.

</comment></comment><comment><USER4> Here's a very quick and dirty one for Ruby:

require 'zlib'

base = "whatever"

salt = "whatever"

Zlib.crc32(base + salt).to_s(36)

This will generate 6-7 character strings. Not sure how likely collisions are, but they should be rare enough that a simple check/regenerate should work.

</comment><comment><USER5> First thought is that they're generating a globally unique video ID number and base-62 encoding it to keep the URL shorter. Maybe not though?

You could do that easily by just base-62 encoding your table's auto-generated primary key.

</comment><comment><USER3> Or, using C with /dev/urandom: <http://alan.dipert.org/post/84526522/random- strings-with-c>

</comment><comment><USER6> What's wrong with starting with '0' for the first item and incrementing up from there? Guaranteed uniqueness.

<comment><USER7> a) impossible to do in a distributed fashion, b) may leak information about your operations to competitors. of course, OP may not care about these things.

<comment><USER6> I understand (b), and in fact I considered it a potential weakness, but why does (a) matter if you're selling from a single site? Even if you got multiple simultaneous orders, storing the last license generated in a DBMS should make it multiprocess-safe.

</comment></comment></comment><comment><USER8> uh, in python:

      import string, random
      ''.join(random.sample((string.letters+string.digits), 12))

I hope that's what you were asking for. If not, you might want to clarify your question.

<comment><USER9> On morning's light, that won't do what you think. random.sample() gives you a unique sampling. No character will be repeated. try this instead:

        alphanum = string.letters+string.digits
        ''.join([alphanum[random.randint(0,61)] for i in xrange(12)])

<comment><USER8> You're quite right; I should have caught that.</comment></comment></comment>


CryptoSeal (YC S11) Shutting Down Private VPN - <AUTHOR> https://privacy.cryptoseal.com/ <comment> mike-cardwell If you're gonna publish something with a PGP signature. At least make sure it's valid:

      mike@glue:~$ wget -q -O - https://privacy.cryptoseal.com/ | gpg --verify
      gpg: Signature made Mon 07 Oct 2013 12:38:07 BST using DSA key ID D2E0301F
      gpg: BAD signature from "Ryan Lackey <email@example.com>"
      mike@glue:~$

<comment><USER2> sigh, I think it got screwed up when someone put it on the website. And I'm currently in Asia for a conference and don't have my keys (intentionally...).

it still meets the xkcd definition of a secure pgp message, at least.

<comment><USER3> I guess you didn't know about the fold command, either...

cat my-aspergers-unformmatted-text-file.txt | fold -s > readable.txt

<comment> mike-cardwell Useful to know. Thanks.

</comment></comment></comment></comment><comment><USER4> We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.)

Amazon said they didn't want anything powered by FreeBSD in AWS. There are currently negotiations about running on a larger instance that supports the HVM, and avoids the 'Windows tax', but there are significant usage fees for that tier (today that´s the cluster compute and M3 instances) as well.

We _could_ release a variant of the AMI as a "public" AMI. It wouldn't be in AWS then, but it would be available. If your account is new enough, it would allow a completely free VPN service on Amazon's "free tier".

It would also allow people to setup their own VPN service (OpenVPN and IPSEC are both fully supported.) Hosting on top of EC2 isn't perfect (there are possible key recovery attacks from others hosted on the same infrastructure), but, correctly configured, Law Enforcement would need more than a pen register order to obtain anything beyond the enclosing IP packet data. Since, in theory, you would be your own provider, the FBI (or an equivalent in other EC2 zones) would have a higher burden to install even a pen register.

My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.

<comment><USER5> > My question is: should we bother? Anyone with sufficient clue could setup a > linux instance to do the same thing.

You indeed could setup some basic stuff this way, but I wouldn't recommend it as a long term strategy. The way that our privacy product was built protected users from a variety of issues. I also wouldn't recommend using AWS for this till you can install your own trusted hypervisor and encrypt memory/disk/etc.

<comment><USER6> You can run on bare-metal providers like SoftLayer, which allows you run your own trusted hypervisor or OS. This, as you said, isn't currently possible on AWS.

Incidentally, PrivateCore has a trusted, remotely-attested hypervisor that encrypts memory and runs on providers like SoftLayer: [http://www.privatecore.com](http://www.privatecore.com)

<comment><USER5> PrivateCore has some very cool stuff, I think they're one of the only solutions available right now.

</comment></comment></comment></comment><comment><USER7> To the founders of CryptoSeal. When you first set up, did you consider _not_ being a US headquartered company? If so, what were the overriding factors that made you stay US-based?

I ask because in a recent blog post from Silent Circle (a secure comms company), they explicitly state "we are not a U.S firm" [1]. I'm beginning to think any company that wants to offer security products like this has to place their Global HQ outside the US's legal jurisdiction. I doubt it solves all the problems but it probably helps to some extent.

[1] [http://silentcircle.wordpress.com/2013/10/16/one-heck-of- a-y...](http://silentcircle.wordpress.com/2013/10/16/one-heck-of-a-year- silent-circles-first-anniversary/)

<comment><USER2> There are multiple concepts of jurisdiction.

It does very little good to just "incorporate offshore" and still have US operations, US principals, etc.

If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught.

While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US.

The silent circle guys are basically _all_ US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.

<comment><USER8> As far as I know, US citizens can't be ordered to violate laws when they operate in foreign countries. If they receive compliance letter requesting them to use foreign company with servers located in that country to break those laws, they can point out that it's outside US jurisdiction.

<comment><USER2> There would probably be an argument about "instrumentality", and the US person sitting in the US would be in an exceptionally uncomfortable position.

</comment></comment></comment></comment><comment><USER9> Come to Iceland. Law is on your side here and the infrastructure is coming along.

<comment><USER2> Iceland, Switzerland, New Zealand, Hong Kong, and a few other places do look really interesting (and Switzerland and Hong Kong have pretty good infrastructure). Investigating a few more as well.

One consideration, though, is that we're all US citizens, and so even if we set up a Hong Kong company with Hong Kong servers, we'd be at risk to US court orders or any civil/criminal action. So for US citizens, the only real solution is technical controls, or legal/legislative reforms in the US.

<comment><USER10> Im from NZ. NZ is not a good place to trust your private data.

The NZ government has no hesitation in breaking whatever laws it needs to in order to satisfy US requests.

<comment><USER11> See also: Kim Dotcom raids, GCSB amendment bill.

</comment></comment></comment></comment><comment><AUTHOR> I was just trying to sign in to my account, as I was greeted with this:

" _CryptoSeal Privacy Consumer VPN service terminated with immediate effect_

With immediate effect as of this notice, CryptoSeal Privacy, our consumer VPN service, is terminated. All cryptographic keys used in the operation of the service have been zerofilled, and while no logs were produced (by design) during operation of the service, all records created incidental to the operation of the service have been deleted to the best of our ability.

Essentially, the service was created and operated under a certain understanding of current US law, and that understanding may not currently be valid. As we are a US company and comply fully with US law, but wish to protect the privacy of our users, it is impossible for us to continue offering the CryptoSeal Privacy consumer VPN product.

Specifically, the Lavabit case, with filings released by Kevin Poulsen of Wired.com ([https://www.documentcloud.org/documents/801182-redacted- plea...](https://www.documentcloud.org/documents/801182-redacted-pleadings- exhibits-1-23.html)) reveals a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device. Our system does not support recording any of the information commonly requested in a pen register order, and it would be technically infeasible for us to add this in a prompt manner. The consequence, being forced to turn over cryptographic keys to our entire system on the strength of a pen register order, is unreasonable in our opinion, and likely unconstitutional, but until this matter is settled, we are unable to proceed with our service.

We encourage anyone interested in this issue to support Ladar Levison and Lavabit in their ongoing legal battle. Donations can be made at [https://rally.org/lavabit](https://rally.org/lavabit) We believe Lavabit is an excellent test case for this issue.

We are actively investigating alternative technical ways to provide a consumer privacy VPN service in the future, in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure) without compromising user privacy, but do not have an estimated release date at this time.

To our affected users: we are sincerely sorry for any inconvenience. For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection, as well as a refund of your service balance, and free service for 1 year if/when we relaunch a consumer privacy VPN service. Thank you for your support, and we hope this will ease the inconvenience of our service terminating.

For anyone operating a VPN, mail, or other communications provider in the US, we believe it would be prudent to evaluate whether a pen register order could be used to compel you to divulge SSL keys protecting message contents, and if so, to take appropriate action."

</comment><comment><USER12> With every shut down in a similar vein, I weep and fear for the future.

<comment><AUTHOR> It may sound strange for me as a European to be saying this, but I worry that the second stage of this will be a massive exodus of talent and startups out of the US.

<comment><USER13> This would probably be a good thing. Right now the internet is way too US driven and focused. A more balanced, global distribution of talent would be far more beneficial.

<comment><USER14> I agree. And it might ease some of the pricing issue too. There are many plans for cloud services outside the US but there's usually a lack of know-how and competitive functionality/pricing.

A current example:

Clio, a cloud provider for lawyers, recently started to offer a server location in Ireland in order to comply with European privacy laws [1]. The price, however, is about 60% higher than in the US …

Price comparison:

US = 49 USD/month = about 36 EUR [2] EU = 49 GBP/month = about 58 EUR [3]

[1] = [http://www.goclio.com/blog/2013/10/clio-online-practice- mana...](http://www.goclio.com/blog/2013/10/clio-online-practice-management- platform-launches-in-europe/) [2] = [http://www.goclio.com/signup/](http://www.goclio.com/signup/) [3] = [http://www.goclio.co.uk/signup/](http://www.goclio.co.uk/signup/)

<comment><USER15> The cost issue is probably because they're using Linode instead of AWS.

<comment><USER14> What could be the reason for using Linode instead of AWS's European data center?

<comment><USER15> Just personal preference I'm guessing. They probably went live US side with Linode, and their DevOps is probably already built around Linode's API/environment, so it was easier to just spin up new gear in Linode EU vs AWS EU.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> A VPN is just an access control mechanism for network services; it is for network service privacy. If you're worried about the privacy of your data, you should be using technology to protect your data at rest, such as PGP.

</comment><comment><USER17> Perhaps I'm being daft, but I'm struggling to see the connection between SSL certs ( per the Lavabit scenario ) and a VPN service.

Didn't they have an IPSec cert for each individual subscriber?

If not.. I wouldn't have wanted to go anywhere near them if they were using one keypair for _all_ traffic.

Public-facing websites are usually dependent on a single server cert because they can't easily provide a separate client cert for everyone who visits. A private, subscription-based service should not be using that model and thus should not have encountered the 'Lavabit Paradox'.

Neither should Lavabit, but I digress.

<comment><USER2> The problem is a pen trap order, which is a very low legal bar, far lower than probable cause, can be applied to any single customer. Since we couldn't implement that effectively, we would be forced to give all of that customer's raw traffic to the government. It's entirely likely they would also compel an entire node or even the entire system if they felt that was more effective for their purposes in any way.

If the bar set to do this were at search warrant level (probable cause of criminal activity), that would still kind of suck, but the bar for pen traps being so low by comparison totally invalidates our security model.

All US providers (including "foreign" providers with US principals or US operations) are vulnerable to this specific problem right now.

There are technical ways to deal with this, but it would take months to implement, and no one has done it before. I've got a bunch of talks scheduled for conferences over the next year on how to implement exactly this (and am working on the tech for it), but it's not going to be instantaneous. We didn't want to be in the position of screwing over even one customer in the interim.

Until that stuff is in place, my recommendation is to use a non-US VPN provider. There, you're still at risk to local search warrants, but those are a relatively high legal standard in some jurisdictions. The problem in the US is that the lavabit case implies a much lower legal standard to effectively compel all traffic.

It'll probably be a year or two before this plays itself out in the courts. Hopefully 6-9 months for a much stronger technical solution. I'm actually working with some pretty kickass legal people on v2.

(as always, I Am Not A Lawyer; I Am Not Your Lawyer; This is not legal advice; Consult an attorney licensed in your jurisdiction for specific legal advice in your particular case.)

<comment><USER18> _I 'm actually working with some pretty kickass legal people on v2._

Can you say who they are? I'm looking for legal advice in this area as well (and I'm not a competitor to CrytoSeal in any way). Our service is currently in Australia (only), but I'm an owner, based in the US, and by design we also aren't able to support a pen trap order without the same problems you've encountered.

It's sucks when crypto best-practices are, effectively, either illegal or useless.

<comment><USER2> Law students and their professors; I don't think my "bro deal" with them is transferable, sadly. (we're trying to get law review and/or conference papers out of it, too)

The whole thing is quite unsettled right now, and unique to every case. I'd probably contact EFF. If I were looking for someone to pay, Marcia Hofmann is now a commercial option, and she's probably the best in the world.

<comment><USER19> Please consider also looking for a criminal defense attorney with significant experience defending people in federal court. When it hits the fan and you get a court order and are being threatened by federal prosecutors, lawprofs don't do you much good. You need someone who has experience fighting back.

Here's a criminal defense attorney who makes the case for this better than I could: [http://blog.simplejustice.us/2013/10/03/lavabits-levisons- re...](http://blog.simplejustice.us/2013/10/03/lavabits-levisons-really-bad- call/) [http://blog.simplejustice.us/2013/08/31/why-hackers-dont- win...](http://blog.simplejustice.us/2013/08/31/why-hackers-dont-win-too- often/)

<comment><USER20> Ouch. The first post seems especially unfair.

 _...they are screwing up the world for the rest of us, for everyone.. Choices being made by the tech-savvy and law ignorant are creating the precedents, while destroying themselves, that form the foundation for computer law going forward. We may be saddled with bad law for decades..._

The point seems to be: when a random computer person provides a service, and that service is targeted by federal prosecutors, and idiotic judges use the opportunity to cripple civil society, it's the random computer person's fault. Are lawyers and judges simply vengeful automatons, whom any citizen should expect to destroy civilization if given any opportunity? Maybe others in the jurisprudential profession could help defend society from their colleagues?

<comment><USER19> You've missed the point big time. They screw things up when they pick inexperienced lawyers whose inexperience costs them their cases. If they pick experienced lawyers who lose despite their experience, then no one is blaming them.

The context is important here: Levison was initially defended by a small business lawyer who was only 4 years out of law school. That was truly a boneheaded decision and may very well be why Lavabit crumbled so quickly.

<comment><USER20> Well sure I see that point: one should hire good attorneys. If one cannot afford good attorneys, one is boned. That doesn't seem profound. (Not particularly _just_ either, but whatever.)

My previous comment was thinking more generally. Society has in the past successfully weathered innovations in technology and commerce without the legal profession running amok. Often innovators were not "connected" enough to hire the best legal representation, if they did so at all. What's different this time?

<comment><USER19> > Well sure I see that point: one should hire good attorneys. If one cannot > afford good attorneys, one is boned. That doesn't seem profound. (Not > particularly just either, but whatever.)

The author addressed this ad nauseam in the comments. In particular, see:

[http://blog.simplejustice.us/2013/10/03/lavabits-levisons- re...](http://blog.simplejustice.us/2013/10/03/lavabits-levisons-really-bad- call/#comment-84105)

> My previous comment was thinking more generally. Society has in the past > successfully weathered innovations in technology and commerce without the > legal profession running amok. Often innovators were not "connected" enough > to hire the best legal representation, if they did so at all. What's > different this time?

I don't think technological innovation has ever had the potential to disrupt existing power structures as much as the Internet and cryptography. I'm not sure what you mean by "legal profession running amok," but if you mean bad court decisions and draconian government legal theories, that's nothing new. We're only starting to see this in the context of technology because of the aforementioned clash between technology and government power.

<comment><USER20> _I don 't think technological innovation has ever had the potential to disrupt existing power structures as much as the Internet and cryptography._

That's a bold statement. You don't think the cotton gin and improved looms contributed to the numbers of people enslaved in the antebellum southern USA? You don't think the railroads and telegraph contributed to the settling of the West? You don't think the rise of manufacturing, which pulled multitudes of (black and white) Southerners north, changed both the South and the Midwest?

 _I 'm not sure what you mean by "legal profession running amok," but if you mean bad court decisions and draconian government legal theories, that's nothing new._

Let me preface this by saying that I'm not comparing Lavabit to Dred Scott in terms of the _degree_ of injustice the two parties suffered. Mostly I just don't know a great deal of legal history and this historical "worst case ever" is what came to mind. However, I have never seen the unfortunate Mr. Scott _blamed_ for the infamous _Dred Scott v. Sandford_ decision. So, bad court decisions: not new. Blaming the victims of those decisions: new.

Mostly it just speaks to an audacious sense of _entitlement_ on the part of any attorney who upon news of a fresh new legal outrage, immediately excoriates the victims of our federal Department of Injustice. When he says a society without Lavabit is better than a society in which Lavabit doesn't have him (or a similarly experienced and wise litigator) on retainer, that is self- serving. He is fundamentally no different than the feds, because he also wants the legal profession to act as a check on all innovation. The slight cosmetic difference is that he wants to be the one running things, because his judgment is better than that of the feds.

Of course we mustn't fall victim to the classic _is /ought_ confusion. When in legal trouble, it's best to be well-represented. However, when any developer who wants to help people maintain a modicum of privacy and dignity is automatically in legal trouble, we all have legal trouble.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> What I don't understand is why I didn't get a notification of the shutdown. As a paying customer I shouldn't read about it on HN. I used the service primarily to shield myself in hotels/coffeeshops, but I know the NSA can get to me if they want to and I don't really care.

I appreciate the high ground CryptoSeal is coming from, but from a customer standpoint I don't think this was done well.

<comment><USER22> If they let you know then the government knows and CryptoSeal runs the risk of the government compelling them by force of FISA court order to stay in business, turn over all customer data, and don't say anything about it.

<comment><USER23> Have any companies ever been compelled to stay in business? How does that even work, especially if the company (not sure if its applicable in this case) is losing money at the time? Does the government subsidize all of the operations at that point? Can they compel people not to quit their jobs in this case too?

<comment><USER24> "'I could be arrested for this action,' Ladar Levison told NBC News about his decision to shut down his company, Lavabit LLC, in protest over a secret court order he had received from a federal court that is overseeing the investigation into Snowden."

[http://investigations.nbcnews.com/_news/2013/08/13/20008036-...](http://investigations.nbcnews.com/_news/2013/08/13/20008036-lavabitcom- owner-i-could-be-arrested-for-resisting-surveillance-order)

</comment></comment></comment></comment><comment><USER25> If they were serious about running a privacy startup, they would move out of the US. Better luck next startup guys.

</comment><comment><USER26> Https://simple-vpn.com, why deal with us companies for security services?

<comment><USER27> [http://www.simplevpn.net/](http://www.simplevpn.net/) ?

<comment><USER26> No, actually [https://simple-vpn.com](https://simple-vpn.com), it's paid for with BTC for those who really care about anonymity and privacy. Seems like the service got hackernewsed though. :)

<comment><USER27> Ah that explains the 502 :)</comment></comment></comment></comment>


Artificial Intelligence and the Resurgence of Physiognomy - <AUTHOR> https://undark.org/article/facing-facts-artificial-intelligence/ <comment><USER2> _In his paper, Kosinski said the computer was zeroing in on certain physical features of the face consistent with prenatal hormone theory (PHT), which suggests that gay people are so because they were exposed to differing levels of androgens in the womb. "The faces of gay men and lesbians had gender- atypical features," the scientist wrote, "as predicted by the PHT." Kosinski argues that prenatal hormone theory is "widely accepted" as a model for the origin of homosexuality._

Did they control for the actual contents of the photos? For the position and expression on the faces? Nope!

 _Yet even Kosinski admitted that the computer might be picking up something besides immutable facial features. His algorithm, for example, posits that gay men are more likely to wear glasses. "Many wondered why faces with glasses are considered by algorithm to be more likely to be gay," Kosinski said. "It might be something else in the face that's also correlated with having glasses."_

This sounds like a classic case of the "Neural Net Tank Urban Legend", which was discussed here recently [0].

[0]: [https://news.ycombinator.com/item?id=15485538](https://news.ycombinator.com/item?id=15485538)

\</comment><comment></comment><comment>--

 _Jonathan Frankle, a Ph.D. student at MIT who served as the staff technologist at Georgetown University's Center on Privacy and Technology, said we often don't know how these sorts of algorithms work. Unlike ordinary code, a neural net involves nodes that are interconnected, with processes happening in parallel. A neural net isn't just executing a set of instructions in sequence; instead the nodes are talking to each other, giving feedback to each other. There really isn't any way to trace how it makes its decisions — one can't look at a single line of code or subroutine. It's effectively a black box._

I hate this. It's wrong. You absolutely can trace the execution of a neural network in its decision making. It might be hard to understand, but there's nothing stopping you from looking at node activation patterns.

There is also a whole class of techniques for extracting some kind of meaning out of these black-box-type classifiers. See LIME [1] and older technique called "partial dependence" [2].

[1]: [https://github.com/marcotcr/lime](https://github.com/marcotcr/lime)

[2]: [https://github.com/bgreenwell/pdp](https://github.com/bgreenwell/pdp)

<comment><USER3> Or, you know - gay people just tend to wear glasses because it's fashionable. Network effects and everything.

PS: before I get slammed for over-generalising - that is more of an meta- ironic statement

<comment><USER4> Have a meta-ironic upvote (downvote).

</comment></comment></comment><comment><USER5> Reminds me of the anime "Psycho Pass". It's set in the not-so-distant future where everyone is monitored and assigned a "crime coefficient". Without giving too much away, the system starts to show its weaknesses when a criminal is able to murder people and commit crimes without being detected by the system.

</comment><comment><USER6> The shape of an eyebrow does not indicate an extrovert, at least not with any better accuracy, than a Human interviewer can achieve with five minutes of conversation. And then there is the question whether introvertedness is even a disqualifying trait in a sales representative. A good team will probably have both introverts and extroverts at some ratio.

Yes, it's "bad science". But it's also bad business. It's the same with genetics: As soon as we have a full understanding of risk factors and beneficial traits, and we're far from that, people competing for a job would probably all have multiple "bad" and multiple "good" qualities, which cancel out much of the benefits of testing in the first place.</comment>


Build your own Terminal using Qt - <AUTHOR> https://donniewest.com/build-your-own-minimal-and-scriptable-terminal <comment><USER2> I'm embodying an archetype here, but I can't resist.

The use of QTermWidget makes this almost entirely an exercise in building a hello-world Qt app and very little about building a terminal. That is all very well if you are looking to learn Qt—which is by no means an unworthy aim—but I wouldn't use the adjective "minimal" to describe any Qt app, no matter how short its main().

If you are actually looking for a minimal terminal, whose source code is intelligible and readily customizable, look no further than [https://st.suckless.org/](https://st.suckless.org/)

<comment><USER3> Good suggestion! I found st a joy to read. Only a couple of C files, few frills and a straightforward coding style. I can see what the suckless folks are getting at.

Slightly OT here but I was thinking about what a suckless UI system would be like - one without excessive layering and as few moving parts as possible. I'm fairly sure it should be possible by avoiding truetype fonts and using the framebuffer directly. That would preclude ubiquitous animation but smooth scrolling and dragging is perfectly doable even with a single buffer.

<comment> racer-v What would be the win in avoiding TrueType? Seems like we could easily convert any TTF files to PostScript Type 1 if there were an advantage to be gained.

<comment><USER3> This might be a misconception but I was under the impression that truetype fonts are a complexity and security minefield. In particular I noticed an st developer complaining (on the mailing list, probably) about the lack of a suckless font library when I concluded that it might be better to just do without them.

<comment> racer-v Sounds like a noble endeavor. From [https://suckless.org/project_ideas](https://suckless.org/project_ideas)

 _Suckless font rendering library_

There is libdrw in suckless now, which still uses xft and fontconfig. Fontconfig and xft are ugly and require too much internal knowledge to be useful. The next logical layer in Linux evolved as pango and cairo. Both of course added HTML formatting and vector drawing. This is not needed to simply draw some text somewhere. And this is what a suckless font rendering library should do: Give it a font string and render at some position the given font without having to care about font specifics.

</comment></comment></comment></comment></comment><comment><USER4> > Build Your Own Minimal Terminal

> we'll be installing qtermwidget

I'm guessing the author meant visually minimal, rather than minimal footprint.

</comment><comment><USER5> I thought this would be about building the minimal input parser and line printer, instead you just _import_ the terminal from Qt and be done with it. This is not minimal by any stretch of imagination.

</comment><comment><USER6> This has nothing to do with building terminal code. This is just a Qt tutorial that has just 1 widget and does nothing special besides the general init stuff for the widget.

</comment><comment><USER7> Does anyone else wish to use Ctrl+C to copy selected text from their terminal? And, Ctrl+V to paste?

I miss the Command key. Here is a work-around:

      # setxkbmap -option ctrl:swap_lalt_lctl

I map all of the Alt keys using AutoKey when in the Terminal so that they type the equivilent Ctrl key, and all of the Ctrl keys mapped so that they do what I expect. For example Ctrl+C types Ctrl+Shift+C which in the Terminal I am using will copy selected text to the clipboard.

<comment><USER8> What about Ctrl+Alt+c and Ctrl+Alt+v? These work on rxvt.

<comment><USER7> I would probably map Ctrl+C to Ctrl+Alt+c and Ctrl+V to Ctrl+Alt+v, if I was using rxvt.

</comment></comment></comment><comment><USER9> When I was using `xmonad`, I built a VTK terminal into the WindowManager. The whole implementation was just several lines in Haskell, using its wrapper for VTK.

</comment><comment><USER10> It is Qt, not QT!

<comment><USER11> It's also Arch Linux, not Archlinux. I guess it's hard to keep track of all the names in software nowadays.

</comment></comment><comment><USER12> Love to see Qt in a tutorial in HN; fond memories.</comment>


Better-initramfs: initramfs supporting SSH, lvm, luks, raid, uswsusp and more - <AUTHOR> https://github.com/slashbeast/better-initramfs <comment><USER2> If you look for 'kitchen sink included' currently maintained, and supported by redhat,debian and others, look for dracut: [https://mirrors.edge.kernel.org/pub/linux/utils/boot/dracut/...](https://mirrors.edge.kernel.org/pub/linux/utils/boot/dracut/dracut.html)

If you look for really FAST and streamline solution (one binary), check this post: [https://michael.stapelberg.ch/posts/2020-01-21-initramfs- fro...](https://michael.stapelberg.ch/posts/2020-01-21-initramfs-from-scratch- golang/)

<comment><USER3> Dracut works pretty well. I managed to get it to auth me with sshd using an ed25519 key stored on my yubikey. I then use gpg-agent in dracut to decrypt my keyfile and use that to unlock the root partition, which then boots and kicks me out of ssh. It's a pretty clean answer for a fully encrypted home server.

Of course, it doesn't encrypt /boot, but I keep a separate USB stick for that and put it in the server when it needs a reboot.

<comment><USER2> Can you share (blog? github?) more details (ideally whole dracut module :) about your implementation?

<comment><USER3> I haven't posted it anywhere because it's a bit of a mess, but here you go: [https://pastebin.com/ZfkM2zkU](https://pastebin.com/ZfkM2zkU)

I'm not proud, or smart, but it works. Systemd is used for networking to make it simpler.

I based it on this: [https://github.com/gsauthof/dracut- sshd](https://github.com/gsauthof/dracut-sshd)

I should probably package it up with all the config options you'd need to specify drive and keyfile location and all that, but I'm a terrible member of the community and haven't actually done it yet.

The real trick that took me a long time to figure out was invoking "cryptsetup luksOpen" with my mount.sh script and then using "systemctl stop systemd- cryptsetup@nvme0n1p3_crypt.service" to get the thing to keep booting. I still don't really understand the tty ask password stuff in systemd, but this seems to work fine.

You just ssh in and run ./mount.sh and it decrypts/mounts/boots.

</comment></comment></comment></comment><comment><USER4> I'm working on something similar, specialized just for PinePhone:

[https://www.youtube.com/watch?v=ZL1GREqoqx8](https://www.youtube.com/watch?v=ZL1GREqoqx8)

So far it serves as a boot menu. But given that it's a full Linux kernel running, I expect it will also support OS installation over WiFi or flashing over USB mass storage, and some basic HW tests, sshing in, and encrypted rootfs unlocking, etc.

<comment><USER5> Thank-you for your work. Bits like this will help make the PinePhone be a fine phone.

</comment></comment><comment><USER6> How about no initramfs? The Kernel can even boot from encrypted raid volumes as EFISTUB or even more complicated setups without any further need for user space software.

On non-critical devices which can be booted via USB in a case of emergency (like laptops or desktops) initramfss are kind of pointless and just unnecessarily prolong the boot time.

As long as you statically compile in the ext4 (or whatever FS) support every needed kernel module can then be loaded regular boot.

<comment><USER7> Even if you boot kernel with EFISTUB or whatever way you decide, you still need something that will mount encrypted storage before you can switch to /sbin/init.

</comment></comment><comment><USER8> Hm, last updated 3 years ago and depends on the unmaintained Aboriginal Linux.

<comment><USER7> Devel branch updated on 2019-10-19 and uses Alpine Linux as sysroot.

</comment></comment><comment><USER9> tuxonice! Long time no see. It used to be so reliable, a shame that it was rejected from the mainline kernel. I still have issues with suspend/hibernate in Ubuntu.

<comment><USER10> I don't remember when it was exactly, but there was a point a couple years ago where some kernel developer looked at the hibernate code and realized it was basically garbage and redid it.

Ever since then, I haven't had any problems. Previous to that, I couldn't get hibernate to work on my Thinkpad at all.

I believe the core issue is the original writer tried to get too fancy with the data serialization and it was getting corrupted somewhere along the way. So then it would go to resume from hibernate, find garbage data, and freeze up.

</comment></comment><comment><USER11> Does it support Debian-style initramfs shell scripts?</comment>


Ozzy Knows Best - <AUTHOR> http://www.pbs.org/cringely/pulpit/2008/pulpit_20080404_004650.html <comment><USER2> Sounds like "A Young Lady's Illustrated Primer"...</comment>


Law school applications are collapsing - <AUTHOR> http://www.lawyersgunsmoneyblog.com/2012/12/law-school-applications-are-collapsing <comment><USER2> Surprised to see this make the front page...

The basic fact is that only half of the 45,000 or so law graduates each year will even get jobs as lawyers. I disagree with many that the ABA should clamp down on accreditation. The AMA did that in the last few decades, and while that guaranteed solid employment prospects for medical school graduates, it also led to skyrocketing salaries and medical costs. I think the medical profession has more goodwill capital to spend with the public in this regard than the legal profession, and any such move would be a very bad idea.

However, I do support measures to increase transparency and make educational loans harder to get. In-state tuition at the University of Michigan in 1990 was $6,830 per year (about $11,700 in today's dollars). It is now over $48,000/year.

Now, the teaching of law has not changed since Harvard Law School was founded in 1817. You get a bunch of students in a room. You make them read cases from a casebook. You grill them in front of the class on their comprehension of the cases. It's not a high-tech process, but it works, and can be extremely cheap. There is no reason tuitions need to be 4x higher than they were just 20 years ago. The soaring cost of legal education is really the perfect example of how incredibly dysfunctional our higher education system has become. At least with engineering or medical school tuitions you can point to the expense of lab equipment, etc. Not so with a segment of academia where students are taught the same way they have been for two centuries.

<comment><USER3> > I think the medical profession has more goodwill capital to spend with the > public in this regard than the legal profession, and any such move would be > a very bad idea.

There's also the fact that our demand for healthcare is enormous, because we all get sick, it's a fact of life that's not gonna change very soon.

But the demand for lawyers is completely cultural. Where I am, the amount of lawyers per capita is _one tenth_ of what it is in the US, there's no innate demand for lawyers, so if they start to price themselves too high, demand will fall as people and communities and businesses figure out ways to accomplish the same things as before, but without lawyers.

<comment><USER2> > But the demand for lawyers is completely cultural.

I don't think that's the case. People think that the U.S. has a lot of lawyers because we're a "litigious society" but I've never seen evidence suggesting that Americans are more likely to sue than other sorts of people.

I think the demand for lawyers is more structural than anything else, and there are a lot of dimensions to this. First, the amount of conflict rises proportionally with the number of interactions between people. This means larger societies have more (superlinearly more) conflict than smaller ones, more active economies have more conflict than less active ones, and heterogenous societies have more conflict than homogenous ones.

Second, different countries use different mechanisms to accomplish the same tasks. The U.S. is at one extreme--we use private litigation to handle things like employer/employee disputes that might in other countries be handled by a complaint to some sort of board. Litigation is, by design, the way to challenge most government action. In the regulatory regime, we skimp on government enforcement of things like financial or enviromental laws, and write in "citizen suit provisions" to allow private enforcement.

Third, the demand for lawyers depends on the structure of the economy. An economy based on financial services, which can result in expensive and complex disputes, needs many more lawyers than one based on agriculture.

Fourth, the number of lawyers in a country isn't directly proportional to the amount of conflict within the country itself. A country that hosts numerous multi-national corporations will have many lawyers working on disputes that actually arise in other countries. Moreover, a country with a sophisticated legal system will be asked to resolve disputes that only have a tenuous connection to the country. The U.S. is also a net exporter of legal services, in conjunction with its export of financial services. American firms do work for Brazilian companies doing IPOs in Brazilian markets. The reverse is never true.

An example of an (industrialized) country that has 1/10 as many lawyers per capita as the US is Finland. Can you compare the US with Finland? The US has 133 Fortune Global 500 companies, Finland has 1. The US has 9 cities as large or larger than Finland. The U.S. is extremely heterogenous. Finland is extremely homogenous. The US has to alter its laws to limit the number of foreign cases coming into New York City's courts (a city 4x as large as Finland). An American (or sometimes UK) firm is involved in some way in nearly every major IPO that happens in one of the world's large financial markets. How many Finnish firms are involved in American IPO's? Etc.

<comment><USER4> _> >I don't think that's the case. People think that the U.S. has a lot of lawyers because we're a "litigious society" but I've never seen evidence suggesting that Americans are more likely to sue than other sorts of people._

USA: 5805 Suits per 100k people (cf. next highest - UK/England @ 3681 per 100k) - [1]

[1] [http://www.law.harvard.edu/programs/olin_center/papers/pdf/R...](http://www.law.harvard.edu/programs/olin_center/papers/pdf/Ramseyer_681.pdf)

<comment><USER2> That by itself doesn't mean much. E.g. two multi-national companies have a dispute, it'll almost certainly get filed in the U.S. instead of somewhere else. That doesn't mean Americans are more likely to sue.

<comment><USER4> you could spin it whatever way you want until the cows come home, but the data does show that on face value Entities in the US are more prolific with litigation than Entities in other nations.

Saying that 2 multi-nationals are going to duke it out in the States over the rest of the world may or may not be true - (Are a major percentage of multi- nationals headquartered in the US? If they are lodging action in the US, is it because it is easier?)

But I would tend to think that _300 Million americans_ and their individual actions are going to be greatly more influential on the total case load and per capita case load in the US than the approximately _70,000 multinational companies_ \- which would be like a drop in the ocean against the individual litigations.

<comment><USER2> You make a very good point about the relative volume, you're right that individual actions are going to overwhelm the number of international business disputes (multi-nationals tend to file in the US if they can, even if they are not headquartered here, because it's has the most well-developed legal system).

That said, number of cases still does not mean that people are litigious in the sense of resorting to lawsuits instead of other available means of dispute resolution. E.g., car collisions are a huge source of litigation. The US has 3.4x as many motor vehicle deaths per capita per year as the U.K. (and presumably, many more collisions too) because of our highly suburban structure. So if we have more motor vehicle/insurance lawsuits, it doesn't necessarily mean it's because we're quicker to rely on litigation. Employment litigation is another big one for regular people. Here in the US, if you think you were fired unfairly, there is no administrative agency that'll handle the dispute. If you think you were fired because of race you can complain to the EEOC, but either way the dispute will end up in court.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> There's a good reason for this: law school is a terrible deal for the vast majority of applicants and potential applicants. Paul Campos's book _Don't Go To Law School (Unless)_ (which I wrote about here: [https://jseliger.wordpress.com/2012/11/11/dont-go-to-law- sch...](https://jseliger.wordpress.com/2012/11/11/dont-go-to-law-school- unless-paul-campos/)) is one of the more comprehensive examples I've seen, although I'm sure the book mentioned is good too.

The really bizarre thing is that 60K people are still deluded enough to apply.

<comment><USER6> For a lot of people I know who've gone to law school, I'm not sure it's entirely a delusion. I think the situation is that they find themselves a couple years out of college and still unable to put their BAs in a Humanities field (another area for which supply has greatly outpaced demand) to use. So they're already saddled with a debt they can't really service, and they've already got the B word in their heads. And along comes a really attractive proposition: If you double down on it by going back to school, you catch an immediate break because you get to immediately stop paying your student loans, and wont have to start again until after you've graduated. And sure, after that you'll have even more debt, but there's also a decent (maybe not great, but decent) chance that your new degree will let you land a sweet job that lets you pay them off much more easily and have plenty of money to spare. And even if you only land an OK job, hopefully it'll still be enough to keep your loans covered. . . and if it isn't, hey, no harm no foul. You're already thinking about the B word right now, so even if it turns out you can't handle all the new debt you've taken on it's not like you'll be any worse off than you are now.

Posed that way, I'm not sure what the students are doing is terribly irrational or delusional. What's crazy is the irrational credit system that enables/encourages this kind of thing to happen.

<comment><USER7> Sidenote: The B word is irrelevant here as you can't bankrupt your way out of student debt. You're stuck with it forever.

But otherwise I find your arguments compelling, and an accurate model of how my humanities friends were thinking when they applied/got into law schools.

<comment><USER6> It's difficult - more difficult than for other kinds of debt - but not impossible.

[http://www.bankruptcylawnetwork.com/what-is-the-brunner- test...](http://www.bankruptcylawnetwork.com/what-is-the-brunner-test-for- dischargeability-of-student-loans/)

</comment></comment></comment></comment><comment><USER8> Not too surprising: university enrollments tend to crash following job-market crashes in a sector, with a lag of a few years. Look at what happened to CS enrollments after the dot-com crash, for another example [1]: by the time the lowest point was reached, they were down ~50% from the peak, and some schools saw a >75% decline in CS majors, leading the department to be eliminated at some smaller schools. (It's picked up again lately, though enrollments are still not back up to the peak years.)

[1] Chart from the CRA, though note that this is charting number of degrees _awarded_ rather than freshman enrollment, so has about a 4-year pipeline lag. Hence, the downturn starts in 2004-05 rather than 2000-01: [http://www.cra.org/govaffairs/blog/wp- content/uploads/2011/0...](http://www.cra.org/govaffairs/blog/wp- content/uploads/2011/03/2009-10_undergrad-CS-production.png)

</comment><comment><USER9> As a recent law graduate: Finally. I had no idea what people who started in law school in 2011+ were thinking. They went to law school at a time when almost every month a major publication wrote an article about terrible job prospects and rising tuition. Law school is by and large a scam.

</comment><comment><USER10> And this is a problem? Hopefully these potential law school candidates have found more productive avenues to devote their professional lives.

</comment><comment><USER11> _Now comes word that applications in this admissions cycle appear to be in something like free fall. As of December 7th, they are down 24.6% from the same time last year, while the total number of applicants has declined by 22.4% year over year. These numbers suggest that law schools will have a total of somewhere between 52,000 and 53,000 applicants to choose from in this cycle, i.e., slightly more than half as many as in 2004, when there were 188 ABA accredited law schools (there are 201 at the moment, with an emphasis on "at the moment").

To put that number in perspective, law schools admitted 60,400 first year JD students two years ago_

\-- The Key Data

</comment><comment><USER12> Finally! I was wondering when it would sink in how unrewarding this path could be.

<comment><USER13> It depends on what you mean. I am a law student now, and while my perspective may shift when I graduate, I have had some tangential involvement in projects that that help people, that is extremely rewarding.

Financially, the market as a whole looks less secure and perhaps less lucrative than it was in the past, but that matters less for people not driven mostly be finances and the compensation for some of those graduating ahead of me is not unlivable.

<comment><USER12> It's the not getting a law job at all part that blows. In Ontario, it's a 4 year Bachelors plus 3 years of law school... that's a heavy price to pay, mainly in money but also in time. The job better be financially rewarding to some extent.

No I'm not talking about spiritually or intangibly rewarding. I'm talking about whether the huge investment ends up being wasteful and an unnecessary burden.

</comment></comment></comment><comment><USER14> Original article on Professor Paul Campos' blog:

[http://insidethelawschoolscam.blogspot.com/2012/12/applicati...](http://insidethelawschoolscam.blogspot.com/2012/12/applications- to-law-school-are.html)

</comment><comment><USER15> Technology that simplifies looking up case-law, and that combs through discovery, has greatly reduced the number of lawyers needed.

It's a profession dealing with text/knowledge. Easy to digitize.

<comment><USER2> > Technology that simplifies looking up case-law, and that combs through > discovery, has greatly reduced the number of lawyers needed.

[Citation needed]

It's not really the case that demand for lawyers is lower (recession aside). It's that the growth in demand for lawyers is lower than it has been. Remember, we're dealing with derivatives here: the number of new jobs available for new graduates is the derivative of overall legal demand.

I don't think technology has had much to do with it, except within certain segments (mainly document review). As technology has evolved, expectations have risen. Yes, you can get on Lexis and quickly look up the case law on an issue, instead of heading over to the library and poring through books, but countering that is the fact that now you're expected to be on top of the absolute latest precedent. It's not enough to give the definition of some element out of a legal encyclopedia. Gotta make sure you review all the cases that touch on the topic to make sure nothing adds a wrinkle that your opponent might bring up.

Similarly with document review. Yes, predictive coding will blow through thousands of documents a second, but back in the day you could just interview some people to get the story of what happened. Now you're expected to review every e-mail everyone sent within the relevant time period. Even with technology, someone has to piece those e-mails together into a coherent narrative.

What really happened is that during the 1970's and 1980's, the corporatization and financialization of America caused demand for legal services to explode relative to GDP. We seem to have hit a plateau in that process in the late 1990's and 2000's, which has caused the growth in demand to stagnate, and indeed dip in the recent recession.

<comment><USER16> I don't have a great citation to hand, but one of the key offerings of Autonomy is software which does exactly that - combs through discovery documents, reducing the number of lawyers needed.

[http://www.autonomy.com/content/Customers/verticals/legal/in...](http://www.autonomy.com/content/Customers/verticals/legal/index.en.html)

<comment><USER2> Autonomy makes predictive coding software, which uses Bayesian algorithms to identify potentially relevant documents in a corpus. But the situation doesn't quite fit the usual "technology eliminating the need for people" narrative. Yes, now you don't need as many document review attorneys, but 15 years ago, you didn't need those people anyway, because there weren't huge amounts of e-mail to review. Technology created a huge temporary spike in the volume of documents and thus the need for document review attorneys in the late 1990's and 2000's, and technology has now eliminated a substantial amount of that demand (but not all), but that doesn't really explain longer-term (20-30+ year) trends within the profession.

Also, prediction: when everyone has Google Glass, the discovery demands will explode again until someone invents software that figures out what is happening in a video.

</comment></comment></comment></comment><comment><USER17> My Anti-virus software flagged this link as a malicious URL.

<comment><USER18> It is about lawyers, guns and money. I would flag it malicious as well!</comment></comment>


Alabama tornado creates Mechanical Puzzle - <AUTHOR> http://www.youtube.com/watch?v=c_RVjyFpqrI

<comment><USER2> I'm not sure crowd-sourcing this problem to youtube was the best idea, but I like his humility. I pushed it to my twitter/facebook to give it the viral- nudge.</comment>