Yahoo! Sends Another Man To Jail


That was the story in Next Week, and this man does not get too much sympathy.

The date was June 3, 2005.  The location was the Miramar Building along bustling Nathan Road in Tsimshatsui.  At around 7pm, a PCCW female worker saw two paper boxes in front of the store.  She went up and saw a cardboard with the words: "PLEASE DO NOT MOVE.  YOU'LL BE RESPONSIBLE FOR ALL CONSEQUENCES."  She recognized the import of the message and notified the police immediately.

The police came quickly, assessed the situation and decided that there was a chance of a bomb.  Hong Kong is one place that takes possible explosives very seriously on account of the 1967 disturbances.  All pedestrian and vehicular traffic along Nathan Road was stopped, and all shoppers and workers were evacuated.  This led to massive traffic backups in one of the busiest parts of the city.  At around 930pm, the explosive disposal squad was in place to defuse the bomb.  A robot was sent up and used a water gun to break open the box.  Fortunately, there was no bomb inside, just two bricks.

The investigators then looked at the piece of cardboard.  It read like a note from a disgruntled ex-employee of PCCW.  There was an email address:  Based on this and other information (note: there was a web page URL that is blurred out in the magazine photo), the man was arrested.  He has been tried and found guilty of threatening behavior.  The judge said: "In the 21st century of our times, there are numerious incidents of violence, attacks and bombings around the world.  To make the people of Hong Kong live in a state of constant fear is a serious crime."  Magistrate Rickie Chan Kam-cheong, sentenced the man, Yip Tsz-ming, to 12 months' probation, saying it was more important to offer the "socially inept" man help than send him to jail.

This brings up back to my previous post Yahoo! and the case of Shi Tao.  I predicted that it would be highly unpopular.  Indeed it was, but not in the sense that everyone attacked it.  It was unpopular because nobody wants to deal with the three options that were realistically opened to Yahoo!.

The first option is for Yahoo! to cooperate with every properly documented request from the local law enforcement agencies without asking for the reasons.  Here is Yahoo! co-founder Jerry Yang's own explanation: 

"To be doing business in China or anywhere else in the world we have to comply with local law.  I will not put our employees at risk.  When it comes to seeking information on our users, we have a very clear-cut set of rules that any government has to engage with us through court documents, legal documents and legal procedures.  We get a lot of those very day around the world.  We get hundreds of those in the US, we get hundreds in Europe, we get a lot of them in China.  We do not know why they want information.  We're not told what they look for.  If they give us the proper documentation and a court order, we give them things that satisfy our privacy policy and the local rules."  

So that was how Shi Tao got caught.  This option is apparently considered immoral according to the current popular wisdom.  

The second option is for Yahoo! to refuse each and every request from the Chinese law enforcement agencies.  If the case above had occurred in China, Yahoo! will just have to turn the request down.  Fortunately, there was no real bomb in this case but it could easily have been The Fuzhou Bus Explosion.  With due respect, Yahoo! does not have any legal or moral grounds to stand on if and when that happens.  And it is only a matter of time before that happens.  Before that happens, the Chinese government should rightly shut down Yahoo! and arrest the responsible officials for obstruction of justice.

[For your reference, you should note that is obliged to show a copy of its ICP permit (see here) linked from its home page, like all other ICP's.  The operating entity is physically located in Beijing.  If the police, court or prosecutor needs to serve a warrant, this is where they go.  The ICP permit is subject to review each year.  Furthermore, within's conditions of use is this one: 我们需要听从法庭传票、法律命令或遵循法律程序 (translation: "We must obey court warrants, legal orders or otherwise observe legal procedures").  You will not find a company anywhere in the world that will say: "We do not obey court warrants, legal orders or observe legal procedures."]

This leaves the third option, which is a mixture between the first two options.  This is hinted by Philip Bowring in Yahoo's mess of pottage: "Assisting in tracking murderers, suicide bombers and drug smugglers is not the same as handing over providers of what in most countries would be legitimate news to which the public had a reasonable right."  Of course, we would all like to see a responsible corporate citizen assisting in legitimate law enforcement on one hand and rejecting suppression of human rights on the other hand.  But my challenge in that previous post was how to design and implement such a system in China.

If several hundred requests come into Yahoo! every day, how would they know which is which?  As Jerry Yang said, "We do not know why they want that information.  We're not told what they look for."  So in order to tell which is which, Yahoo! will have an in-house Chief Privacy Officer, who will demand the law enforcement agency to produce the full evidence, explain the purpose of the inquiry and then he/she will play God/Supreme Court Justice and render a decision in his/her Infinite Wisdom.  Routinely, this CPO will have to make several hundred potentially life-and-death decisions every day.  Now who wants that Chief Privacy Officer job, with all the pressures and the legal and moral liabilities?

For example, the CPO may look at the cardboard piece above and the two bricks and decided that this was a prank and therefore refused to cooperate.  What if the guy then goes out and sets off a Oklahoma City-style truck bomb next to kill hundreds of people?  The company will probably go bankrupt with the ensuing lawsuits, and the CPO will go to jail if he/her does not jump off the roof overwhelmed by guilt before then.

In the case of Shi Tao, the law enforcement may simply reveal that the a person at the requested IP address is suspected of having sent a state secret document overseas via the Yahoo! email account on a specific date.  There is no personal identification because the purpose of the request for the IP information was precisely to detect this unknown subject.  Would you think that the CPO will then demand to read the state secret document before deciding?  Is the CPO a good judge?  And does the CPO know how to deal with a genuine national secret (such as the date and detailed plans of the invasion of Taiwan)?  I submit to you that Option 3 is not a good idea and corporate employees should not be making these types of decisions.

As I said before, I expect stone silence to this post, because the world is enjoying Yahoo!-bashing too much.

AddendumA Cooler Look at Yahoo in China.  Bruce Einhorn, Business Week, September 21, 2005.

A similar argument as in Option 2 is provided here:

The authorities went to Yahoo and said they were doing an investigation and needed information -- information that Yahoo was legally obliged to provide.

It's important to note that Yahoo had no information about the details of the probe. According to comments made by Yahoo co-founder Jerry Yang at a conference in the Chinese city of Hangzhou on Sept. 10, the authorities didn't reveal to Yahoo the allegation or the alleged criminal's identity.  "We did not know what they wanted information for," Yang told reporters. "We are not told what they look for. If they give us the proper documentation in a court order, we give them things that satisfy local laws."

Should Yahoo have refused to cooperate anyway? Suppose you work for Yahoo in Beijing, and one morning the cops arrive in your office and say that they need you to hand over some information. They don't tell you the details of the case. For all you know, the security forces are investigating a spammer.

That's not implausible. After all, spamming has become a major problem in China, and lots of junk e-mail that clutters the inboxes of Internet users in the U.S. come from or are routed through computers in China.  Or maybe the inquiry is about someone whom authorities suspect of peddling child pornography over the Net. Or a terrorist using e-mail to plan an attack. You just don't know. Should you refuse to cooperate anyway? Should Yahoo have a "just say no" policy, refusing to provide any information to the Chinese police, period?

This article leaves a hanging question.  Do you have the answer?  I don't.