Yahoo! and the case of Shi Tao

I checked around the blogosphere and hoped that someone will be the 'bad' guy for once.  But no, so it falls upon me once again to the 'baddie.'  I do not want to be in this position, but nobody else seems to want to say what seems to be the obvious.  This is going to be highly unpopular and I don't want to be in the hot seat, but somebody has got to do it.  Simply put, everybody else takes the viewpoint of Shi Tao, but someone has to sit in the Yahoo! seat and tell that perspective.

Let us get the case of Shi Tao out of the way.  You can check my post here way back on May 1, 2005: The Case of Shi Tao.  I think that it is bloody ridiculous that Shi Tao should get a jail sentence for doing what he did.  It was not national secret; it was known policy and quite stupid at that.  I can repeat that until my voice turns hoarse.  That is not the purpose of this post.  The focus is on Yahoo! and how it supposedly enabled Shi Tao to be arrested.

It is also illuminating that this story has been around for months already.  As you note, my post was done on May 1, 2005, and all the information was basically already known.  The world didn't seem to care all this time.  Now that Reporters Without Borders came out with a press release naming Yahoo!, everyone is indignant and Google News has hundreds of reports.  If Yahoo! was not named, most people would not have cared about this Shi Tao person.  This is an example of Naomi Klein's No Logo paradigm -- the bigger the brand, the harder they fall.  Lost somewhere are the exact circumstances of what is in Shi Tao's email; I will repeat -- it was not national secret; it was known policy and quite stupid at that.

Obviously, by now, the starting point of all this is the Reporters Without Borders press release and then propagated through Associated Press and others.

The text of the verdict in the case of journalist Shi Tao - sentenced in April to 10 years in prison for “divulging state secrets abroad” - shows that Yahoo! Holdings (Hong Kong) Ltd. provided China’s state security authorities with details that helped to identify and convict him, Reporters Without Borders said today.

“We already knew that Yahoo! collaborates enthusiastically with the Chinese regime in questions of censorship, and now we know it is a Chinese police informant as well,” the press freedom organisation said.

“Yahoo! obviously complied with requests from the Chinese authorities to furnish information regarding an IP address that linked Shi Tao to materials posted online, and the company will yet again simply state that they just conform to the laws of the countries in which they operate,” the organisation said. “But does the fact that this corporation operates under Chinese law free it from all ethical considerations ? How far will it go to please Beijing ?”

Reporters Without Borders added : “Information supplied by Yahoo ! led to the conviction of a good journalist who has paid dearly for trying to get the news out. It is one thing to turn a blind eye to the Chinese government’s abuses and it is quite another thing to collaborate.”

What precisely was introduced into the evidence?  From China Digital Times, here is the exact statement:

Evidence 2: Yahoo Holdings (Hong Kong) Ltd. provided the following evidence of user information: at 23:32:17, April 20, 2004, the following IP 218.76.8.201 corresponded to the following user information: telephone number 0731-4376362. The work unit of the user is Contemporary Business News of Hunan province, the address of the user is second floor, building 88, Jianxiang New Village, Kaifu District, Changsha City.

Before a campaign is launched by the blogosphere to castigate Yahoo!, I wish to ask you to consider certain ramifications.  Yet another bone-headed boycott campaigns is only going to destroy the credibility of any legitimate outrage.  If I have to set up some background, this is analogous to the Internet censorship issue.  Yes, there is true outrage about suppression of freedom of speech.  But the answer is not to say that no censorship whatsoever shall be allowed at all.  There are in fact legitimate reasons for some things to be censored (for example, child pornography is universally abhorred).  That argument was made in this post: Hinano Mizuki: The Case for Internet Censoring in China).  If you ignore those legitimate concerns, you will just look bone-headed.  I don't know how to do it, but there has to be some form of selective censorship.

Now I shall argue the Shi Tao-Yahoo! case by analogy.  You don't like the fact that Yahoo! provided the information to the Chinese security apparatus to arrest Shi Tao.  But do you insist that Yahoo! must NEVER EVER provide any information whatsoever to the Chinese judiciary?  I suggest that if you insist this to be the case, you lose -- both to the security apparatus (who will shut your company down) as well as in public opinion (who will think that you are a bunch of morally depraved air-heads).

Let us say that you insist that a company like Yahoo! shall NEVER EVER provide the IP information of its email users to the Chinese government.  NEVER EVER, and it is etched in stone and not to violated under any circumstances.  I shall now construct a hypothetical case:

A certain Chinese middle-class couple has an 8-year-old daughter.  One day while going to school, the little girl was kidnapped by unknown parties.  Then an email was sent from youhaveaniceday@yahoo.com.cn to the father:

We have something of yours.  Prepare to have 10 million RMB available within 24 hours or else we will give it back to you piece by piece.

The parents do not have anything like that kind of money, and this must have been a case of mistaken identity.  The family contacts the police, who goes to yahoo.com.cn and ask for the IP of the sender.  Yahoo! replies:

It is our company policy not to disclose that information in order to protect the privacy of our customers.

Twenty-four hours later, another email comes in from youhaveaniceday@yahoo.com.cn.

You can find the first piece in a box in the alley behind the McDonald's restaurant on Second Street.  Prepare to have the funds or else we will give you another piece in 24 hours.

In that alley, the police finds the right arm of the little girl.  The police goes back to yahoo.com.cn and asks for the IP for the sender.  Yahoo! replies:

It is our company policy not to disclose that information in order to protect the privacy of our customers.

Twenty-four hours later, another email comes in from youhaveaniceday@yahoo.com.cn.

You can find the second piece in a box behind the alley behind the bus depot on Northern Street.  Prepare to have the funds within 24 hours and this is our final statement.

In that alley, the police finds the left arm of the little girl.  The police goes back to yahoo.com.cn and insists on getting the IP for the sender.  Yahoo! replies again:

It is our company policy not to disclose that information in order to protect the privacy of our customers.

One day later, the police finds the head of the little girl in a box behind the police station and an armless, headless body of the little girl floating in a lake.

The news about what happened gets out.  Three things may happen:

• The principals at Yahoo! are arrested for aiding and abetting in a heinous crime, and Yahoo! is shut down by the government.  Do you think that the world will feel sorry for Yahoo!?
• If the preceding didn't happen quickly enough, a massive consumer boycott takes place and the Yahoo! brand will be dirt.
• But even before all that, a spontaneously organized mob shows up and burns the Yahoo! office building to the ground.

This is a purely hypothetical example, but I don't see anyone really defending the sacrosanctity of consumer privacy under this set of circumstances.  Conclusion: There will be instances in which Yahoo! must provide that information on behalf of public interest.  We are talking about moral depravity otherwise.

Maybe this one example is too extreme.  It is easier to list any number of other real-life examples.  For example, someone uses a yahoo.com.cn account to spam the whole wide world in China to solicit funds to help the poor victims of Hurricane Katrina in the name of the Red Cross.  Millions of RMB in donations pour in, but the police believes that this was a scam because the Red Cross is not running such a campaign.  They ask yahoo.com.cn for information to track down the sender.  Should Yahoo! say "It is our company policy not to disclose that information in order to protect the privacy of our customers"?  If yahoo.com.cn refuses to yield, then they will become the email service of choice for criminals.

[Addendum:  South China Morning Post.  Bogus Red Cross site lures donors.  By Benjamin Wong.  September 13, 2005.

Fraudsters taking advantage of the Hurricane Katrina relief efforts are posing as the Red Cross in order to lure donors into revealing their credit card details, it was revealed yesterday.  The Hong Kong Red Cross said last night that fraudsters claiming to be the American Red Cross were sending bogus e-mails encouraging people to make donations through their website.

The fraudsters, claiming to be authorised by the "Chairman of the Republican National Committee", sent out e-mails using the address donate@redcross.org, which has the same domain name as the American Red Cross.  Recipents are encouraged to make donations at the fraudsters' website - www.naturalkorea.kr/bbs/Katrina - which had copied the layout of the Red Cross homepage.

"The correct address of the official website of the American Red Cross is www.redcross.org," a spokesman for the Hong Kong Red Cross said.  "It is suspected that someone is making use of the fake website to get the personal particulars and credit card information of donors for other purposes. Police are now investigating," he added.

Is www.naturalkorea.kr obliged to yield the information about the user 'Katrina'?  Or must it protect that user's privacy?] 

The next question is this: Under what circumstances must Yahoo! provide that information?  On one hand, it is clear that they should do so if that information is critical to saving the life of a little girl.  On the other hand, Yahoo! should not have provided the information to allow the persecution of people like Shi Tao.  Who is to decide?

Most judicial warrants appear in a written document in a terse form.  I'll make up an example: 

"Pursuant to Executive Order #14536 from the Public Prosecutor's Office of Beijing, People's Republic of China, on this 8th day of September in the year 2005, you are requested to provide the IP information for the sender email account haveaniceday@yahoo.com.cn on August 31, 2005 between the hours of 7pm to 11pm to the destination nothavinganicedayatall@sohu.com."

There is usually no other evidence involved, precisely because this is an investigation and there is no reason for the whole wide world to know that so-and-so is the subject of an investigation that may lead nowhere.  You will not find the name of the subject nor what he/she may have done.   The whole point is that the police do not know and are trying to find out.  The request is also very precise.  A request such as "all IP addresses  for haveaniceday@yahoo.com.cn between January 1, 2003 and September 8, 2005" is a fishing expedition and no judge should permit such a warrant, but of course such a request may be appropriate for a person such as Mohamed Atta, the leader of the 9/11 terrorists.  Would you not want to know everyone that Atta had contact with?  Apparently, Hotmail had no problem yielding the information to the FBI when asked.

At the Hangzhou Internet Conference, Yahoo!'s Jerry Yang said the following (Washington Post):

Speaking at an Internet conference in this eastern Chinese city, Yahoo's co-founder, Jerry Yang, said his company had no choice but to cooperate with the authorities.

"To be doing business in China, or anywhere else in the world, we have to comply with local law," Yang said, responding to a question about his company's role in the case. "We don't know what they want that information for, we're not told what they look for. If they give us the proper documentation and court orders, we give them things that satisfy both our privacy policy and the local rules."

"I do not like the outcome of what happens with these things," Yang added. "But we have to follow the law."

Yang's explanation drew spirited applause from many in the mostly Chinese audience -- made up of several hundred Internet executives and investors, who represent some of the better-educated and wealthier people in the country.

Do you believe that Yahoo! wishes or ought to be the ultimate arbitrator instead?  Do you think that the company ought to require the government provide all its evidence, and then have their employees consider those evidence fairly and in totality and make a case-by-case decision as to whether Yahoo! shall provide that information?  In a country with more than 100 million Internet users, Yahoo! may get dozens or hundreds of such judicial warrants per day, and these cases may be urgent matters of life-and-death.  And this is not just Yahoo! but every company (e.g. MSN, Sohu.com, Sina.com, 263, or a mom-and-pop operation) that provides email services.  Consider the kidnapping case above.  Even when shown the text of the emails, the Yahoo! employees may decide that the information is inconclusive (what is that 'piece' of something?) and decline; in retrospect, though, after the body shows up, it is clear that they misjudged.  Who wants to deal with the consequences, both for the company and for the mental health of those employees personally?

Therefore, I submit that Yahoo! should in fact submit to any judicial demand to produce that information in accordance with local laws, because a corporation and its employees are in no position to decide the legitimacy of any evidence.  If the account was from yahoo.com (based in the United States), you may have a lame excuse; but Shi Tao was sending it from a yahoo.com.cn account and that is a lot harder to wriggle out of.

Additional Link:  The Third Way For Yahoo  February 10, 2006.

We will now move on to the next point: the judiciary arm of the Chinese government cannot be trusted to be acting in good faith.  Sometimes, they act in good faith (as in the hypothetical case of the kidnapped girl or the Hurricane Katrina fund scam); other times they act in extremely bad faith (as in the case of Shi Tao).  The long-term solution is to have an independent judiciary that can distinguish between these two extremes as well as judging anything in between.  It does not exist right now, but let us see what it might look like.

It is natural to refer to the United States and its separation of powers between the executive, legislative and judiciary branches.  When the executive branch (e.g. the Federal Bureau of Investigation) wants to have a wiretap on a "person of interest", it must have the approval from a judge who will listen to the evidence and make a decision strictly according to the law and not influenced by any political calculations.  Great, in theory!  But has any one of you actually looked at any data?  Such data are not available at the individual case level (ironically, in the name of protecting individual privacy), but there are aggregate data.  The following data table is something that I use to challenge people to come up with a suitable statistical model.

There is a piece of legislation known as the Foreign Intelligence Surveillance Act (FISA) under which it describes how surveillance can be granted by application (source: Electronic Privacy Information Center).  There are the outcomes from the year 1979 to 2004.  If you can believe it, there were exactly only 4 rejections during the entire 25 years period.

Do you think that this is a rubber-stamp system?  It sure looks and smells like one.  Anecdotally (upon information and belief), I can also tell you how this system works.  Usually, the judge gets only a few minutes to listen to a verbal presentation or a couple of pages in writing from a Federal agent, and must make an immediate decision.  That will be a tough call.  There are many judges within a jurisdiction who can approve the applications (note: there is no reason why everything ought to stop because one judge is on vacation).  In time, the FBI agents learn which judges are friendly and which judges give them a hard time.  So which judge do you think that they will go to for their next application?  Why were there four rejections in 2003?  Could it be that some newbie FBI agent did not know what to say or whom to ask?

But that is getting far afield of the story.  The fact right now is that the judiciary system in China is imperfect.  In the interregnum, Yahoo! has three choices:

• Refuse all requests from the security apparatus, and thus aid and abet criminals
• Fulfill all requests from the security apparatus, and thus enabling the arrest of dissidents like Shi Tao
• Set up an internal judiciary committee and review each request on a case-by-case basis (assuming that accurate and sufficient information is provided)

If I can make this clear before anyone initiates a boycott-Yahoo! campaign: the challenge is to design a system in the context of the Chinese situation that permits legitimate access to that kind of information from Yahoo! and other email service providers (such as a kidnap case) while not permitting inappropriate applications (such as suppression of dissension) of that system.  I don't know the answer.  I only know that a boycott-Yahoo! campaign will only show that its proponents are air-heads.  I repeat, AIR-HEADS!

In the interim, you may think that you should recommend Chinese citizens to use a free email services that has no nexus inside China and can therefore turn down any extraterritorial judicial demand.  I ask you to also consider whether an email service provider such as Hotmail will refuse a Scotland Yard request to provide the information on the 7/7 London suicide bombers because they must protect the privacy of those people.  And you must remember that this service is probably complying with any warrants from the USA government so they are not protecting the privacy of all consumers in any absolute sense.  In the hypothetical case of the kidnapped girl, that overseas service is enabling a criminal to go undetected.  Meanwhile, all you are waiting for is that one huge tragedy to destroy that service inside China, and it will be a huge propaganda victory for the bad guys, who will use it to justify their policy.  You will allow them to justify what they are doing with all the Chinese email services.