RE: Soliciting feedback on pre-emptive methods to protect Hive against a malicious court order ...
You are viewing a single comment's thread:
I suspect that activating a deadman's switch, or choosing to relinquish witness votes, would render the witness in contempt of court in many jurisdictions. I have not previously considered legal jurisdiction of witnesses in voting for them, but it may be necessary to limit the number of witnesses subject to any particular legal jurisdiction in order to preclude a consensus being subject to court order in that jurisdiction. Say, no more than 4 witnesses in the top 20 can be subject to the Crown, or US law, or EU law, and etc., for example. This would prevent a court order from being able to compel a fork absent an alliance of jurisdictions, since 4 witnesses cannot fork.
I also suggest that in the event a court, or group of courts spanning jurisdiction necessary to subject a consensus of witnesses to court order, a proposal be activated that reforms the governance mechanism of Hive such that the subject consensus no longer suffices to enact forks.
Some potential mechanisms, which might be activated sequentially as necessary, would be increasing the number of consensus witnesses to 100, or another number that would be required to create consensus;
or eliminating the authority of witnesses to decide to fork, but requiring a proposal to be supported by all witnesses, or a supermajority of all witnesses, or a supermajority of the entire community, or a unanimous vote of the entire community, before witnesses are authorized to fork;
or rotating the specific party(s) controlling a witness node, so even absent lawful authority to fork a specific individual cannot be compelled to fork since their administration of the node isn't of sufficient duration to install subject code.
or yanking the authority of witnesses subject to court order and only allowing witnesses not currently under court order to be in the potential consensus pool, so that they have no choice to relinquish their authority;
or claiming an AI independently acts to make such decisions, and witnesses do not have the authority to tinker with the AI, which only can be granted through a successful proposal by the community entire. This would require courts to order the entire community to vote the proposal to alter the AI, since AI are not subject to court order, not being persons. At the least, it would significantly delay applicability of legal process until jurisdictions resolved on how to proceed with ordering non-persons to act;
or altering the voting mechanism in a way that would create chaotic inability to authorize witnesses to fork, disabling courts from targeting specific parties that possess authority to fork. Instead of stake weighting, we could choose to weight votes by numbers of followers, or number of posts, or number of published words in published posts, reputation, number of people followed, or some rotation or hourly cycle of these and/or other weighting schemes that would preclude courts from determining who to order to do their bidding.
The point of these initiatives would be to not leave the witnesses under court order liable to contempt of court for acting to thwart the court's order, but for their authority to act to fulfill the order to be removed from them without their personal action to do so.
Regardless of what is done to secure Hive from court orders, an Emergency Broadcast System is highly advisable, and whether a canary, a system of canaries, or simply posts describing the emergent situation, absent a gag order accompanying a court order, I cannot see witnesses coming under contempt for informing Hive of the situation. IANAL, however, and legal counsel should be sought to confirm this.
Thanks!
Thanks for the thoughtful comments.
I agree that there might need to be a mechanism that can be invoked by the community in the event a witness ends up in a position where they cannot be the one pulling the plug on their own node.
However, that type of system would need some serious thought, because it could conceivably be co-opted to take down legitimate witness nodes.
An urgent notice to voters asking them to unvote would be preferable, imho, to a system that allowed a third party (not the witness and not the voters) to intervene.
Any action taken by an individual to thwart a court order puts them at risk of contempt.
Certainly very careful planning is necessary to implement any mechanism that can affect governance. Such mechanisms can be only implemented in the event of court orders. If carefully prepared, potential misapplication can be prevented. It is essential IMHO that witnesses who are at risk of being subjected to court orders are indemnified from liability to contempt, and witnesses should absolutely have the ability to veto any scheme they feel is not safe, or is not going to be effective. Given that prior involvement of witnesses in any such scheme, their security should be adequately assured.
Since we are discussing legal matters, it is necessary to consult competent counsel. @apshamilton is such competent counsel, and so I tag him here to seek his consideration.
Absolutely!
I wonder if there could be some sort of poison pill that can be tied to receiving payment as a witness.
What I mean by that is that you are required to declare an alternative account and you are required to immediately declare whether or not you are subject to or potentially subject to a court order.
As soon as that court-order field is switched to “Yes” the delegation to the alternative account is executed, by the underlying code (i.e. by one of the subsequent witnesses).
Or maybe switching that status to “Yes” simply causes your node to be skipped until a certain percentage of the voters reaffirm you as a witness, or maybe that action gives the remaining witnesses the power to collectively vote to initiate the delegation.
Could a court hold someone in contempt for merely informing a business partner that they are subject to a court order or may soon be?
The simple solution to this is for the witness that has been targeted by any legal proceedings to activate the dead man switch BEFORE any formal legal Court order is made.
This should be easy because the law is very slow and the deadman switch could be activated by phone in less than a minute.
Except in case of ex parte proceedings (where the targeted side is not there or given notice) the witness will have plenty of notice.
Even in the unusual case of an ex parte order, immediate activation of the dead man's switch will undermine the Court's jurisdiction over the witness and the fact that the witness is not actually 'in Court" makes a contempt of Court finding both legally problematic and practically difficult to enforce.
These sorts of orders are generally civil orders not criminal and don't have any international standing.
So the targeted witness can flip the dead man switch and legally leave the jurisdiction for good measure.
Hereabouts, in the United States of Shamerica, contempt orders enable jurists to indefinitely jail the subject until they agree to comply with whatever order of the court they are found in contempt of. I'm unaware of anyone that has been held captive more than a year in this way, but there's literally no limit I know of.
In the OP above, the court order was enforced the day the order was issued. I think you're probably right, that acting prior to such an order is the only way to avoid being held in contempt.
Thanks!
Damn. This along with Civil Asset Forfeiture really flies in the face of the whole land of the free stuff...
What about the provision that no more than 4 witnesses from a given jurisdiction can be in the top 20? I think that precludes a court order from any given jurisdiction being able to compel of fork, since 4 witnesses cannot force a fork.
Thanks for the suggestion.
This type of brainstorming is exactly what I was hoping to encourage.
Whereas it takes 17 out of the top 20, a coordinated governmental attack would be so improbable and, whereas government actions are very slow as @apshamilton mentioned, I think some prudent but simple countermeasures would suffice.
Also, limiting jurisdictions would require witnesses to declare their jurisdictions, which would actually aid a malicious government in identifying and targeting witnesses to attack.
This would require all witnesses to disclose their location or jurisdiction, as potentially any witness can get in the top 20 in a matter of one block (3s).
I hadn't realized this brainstorming, and appreciate the consideration.
This is the most important point, IMO.
The proposed mechanisms does protect the blockchain itself, but does not protect the witness. For example, the "whack-a-mole switch" being irrevocable makes it impossible for a court order to determine the un-deployment of the switch. In the other hand, the court order can just punish the witness that does use the switch, encouraging him to NOT pull the switch.
These mechanisms will be used by witnesses that trust that "the system" (the courts, the government, the FBI, whatever) wouldn't be able to punish him, eg someone that does not have physical assets at all and is currently living in a country without extradition agreements. But what about a witness living in his home country and not willing to be arrested due some bogus judicial decision like "Oh you pulled the switch? You disrespected the court order and now you'll be arrested for 20 years, say goodbye to your wife and kids".
What I'm wanting to say is: not everyone is willing to throw away their lives just to defy "the system". The blockchain can't depend on the willingness of witnesses to sacrifice themselves for "the greater good". @apshamilton said that "the targeted witness can flip the dead man switch and legally leave the jurisdiction"; but what if they aren't willing to leave the jurisdiction due a plethora of valid personal/business reasons?
The community need a mechanism that's 100% independent from the targeted witnesses himself, so everyone else can pull the plug without the witness intervention (and possibly incriminating himself and exposing himself to legal punishments).
Although I agree that "the community" needs a way to deal with this, there is already a mechanism for that, which is for individuals to withdraw their votes.
It doesn't hurt to have a both-and solution -- where the witness can pull the switch (which will be very fast, but might not be advisable for the witness, depending upon the legal situation), but also where the community can pull the switch (which will admittedly be slower).
I am very hesitant, though, about any sort of mechanism wherein other witnesses could implement such an action on their own accord, because that merely sets the stage for another attack vector.
I would much more strongly favor a mechanism that provides for rapid notification of the voters themselves, rather than something that allows third parties to intervene.
Perhaps this includes both a public and private notification protocol. The public notification could be something like @brianoflondon is already proposing, which you can comment about here.
A private Layer 2 notification system could allow concerned individuals to sign up (in advance) for SMS and/or email notifications under certain conditions (such as a witness 'distress call').
Such notifications could be triggered by some action by third parties (e.g. majority vote by the other top-20 witnesses) because it is merely a notification, and thus would not be a potential attack vector.
While notification is clearly a need, it is obviously not going to result in instant action by the community, and witnesses may be legally unable to flip a switch.
Because of these realities, it seems to me that code should provide a mechanism that disables witnesses under court order. Hive cannot abide such external interference. There are clearly mechanisms external parties could deploy that are fully competent to destroy Hive, and the extant example(s) of such external entities imposing such interference on the same day courts ruled show that awaiting the community response cannot suffice.
Indemnification of witnesses from potential liability for instigating such a mechanism may require some association of witnesses to jurisdictions enabling surveillance, or a blanket surveillance mechanism of all potential jurisdictions presenting a credible threat of court orders that may impact Hive.
In any case, I cannot envision any mechanism that potentially indemnifies witnesses absent surveillance of jurisdictions, whether specified as relevant by witnesses (potentially anonymously?), or a blanket mechanism. Obviously, the latter would be a more monumental undertaking, and require more substantial expense and expertise to effect. However, any such surveillance would require considerable expense, effort, and expertise to successfully achieve.
Yes, but we do need to be careful that we do not create a 'solution' that results in a more dangerous attack vector. Code that responds to a court order would, imho, make it far more easier for a malicious government to wreak havoc, because then all they need to do is identify entities and issue court orders, regardless of their enforceability.
So, automating such a mechanism could be potentially disastrous.
I still default to mechanisms that speed up the actions of the individuals involved rather than those that allows a third party to intervene.
You mean a kill switch?
I note the danger of enabling third parties to trigger impacts on Hive governance, and appreciate your concern. However, I cannot see how to indemnify witnesses from court orders without such a mechanism, because if they themselves act to impede the court's order, at least in US courts I reckon they could be liable for contempt.
Perhaps this is a risk witnesses just have to accept, since enabling external actors to affect Hive governance is indeed unacceptable.
That is my current position.
As @apshamilton stated here, the risk to any witness facing a potential court order seems to be fairly low, because of how slowly the courts operate.