Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This headline is clickbait. The issue is banks not preserving records, something that the rules are ABUNDANTLY clear on.


The full headline is "...to evade regulators’ reach", which is much clearer.


I had a problem with including the full headline because only so many characters could be used in the title of the post.


You could have used

"Banks fined millions evading regulation with Signal & WhatsApp"

News headlines have rules they use to make for shorter sentences.

They'd probably write

"Banks fined millions, delete records, use E2E apps"


Here's a link to the actual press release: https://www.sec.gov/news/press-release/2023-149

It makes no mention of evading regulation. This fine is for a failure to retain written communications. Which is impossible to do for some of these communications channels.


Not retaining written comms is evading regulations - "retain written comms" is one, and using Signal/WhatsApp is evading it.

Nobody working in banking is unaware of the written comms rules. Nobody using Signal or WhatsApp in that context is unaware they can't retain written comms. Can you prove intent? Probably not. Is it clear as daylight why this happened? Uh, yes.

And so the SEC hits them where it hurts at least a little bit, in the wallet.

Also, if you pay attention to the banking space... this is pretty much the usual cast of characters. There's absolutely no surprise.


Keep on carrying water for the NSA. We can live in a total surveilace world just by triggering you with "banks are bad."

People use iMessage/Signal/WhatsApp for myriad reasons: some good, some bad. There's no evidence in this case that any of what was said was in furtherance of a crime. The crime they've been fined for is that people--just people--were talking in totally normal communications channels, and their employer has failed to scrape one end of their E2E communications and save it to show to the SEC whenever it asks.


If you are working in banking, you know you are supposed to archive comms. If you then knowingly don't archive, you are deliberately sidestepping existing regulations.

That's a much stronger issue than "if you've got nothing to hide, you don't need secrecy" nonsense that I suppose your NSA comment is supposed to refer to. Nobody is making that argument here.

As for "it's just people talking" - what else do you suppose a "archive all communications" regulation refers to?

And sure there's no evidence. Hence my "can you prove intent" statement. But if it's a regulatory violation that other banks have already been fined for, years ago, and you still sidestep the regulation, there's a strong question why you keep sidestepping it.

If you don't like that, you might not want to work in a space with regulatory oversight.


You support heavy handed and intrusive violation of the privacy of all people who work in the financial sector. You support big brother. Sugar coat it all you want, but you're the one who is cheering on the NSA to de-network encrypted platforms that depend on network effects for our protection


You might want to acquire reading skills.

I am talking about business communications in a regulated sector.


If you think that's what you're talking about, then go actually learn what happened. As it is, you're just being the NSA's "useful idiot" by trumpeting their agenda without realizing what you're supporting.


Signal and WhatsApp messages are trivial to retain - my company Hadrius does exactly this.


Intent is harder to prove.


What do you think we should assume about your communications on encrypted channels? This entire thing is yet another federal effort to criminalize encrypted communications, and it even works on the HN crowd. All they have to say is "big banks bad" and people here go from freedom fighters to government pawns.


This has nothing to do with encryption. Banks are free to encrypt their communications. But they need to keep communication logs and make the plain text available to regulators in certain circumstances.


It's end to end encryption, as in, there are ends on each side where it is decrypted, usually for the humans to read. At the ends the records should have been maintained, the regulations aren't incompatible with E2E.


I'll respond to all three of you: yes it is difficult to retain all potentially work-related communications that take place on your employees' personal devices, so the alternative is to retain all communications.

It is absolutely incompatible with E2E encryption to mandate a third party access to one of the Es for surveillance purposes.


That's not what is happening here.


Banks fined millions for using chat apps to evade regulators


That makes sense. The title character limit seems to be a cause of frequent confusion.


It does and the limit makes it come off as clickbait-y which I don't like.


Personally, I sympathize. Rewriting headlines here (when necessary) can be tough; it isn't a given that the optimal one will reveal itself.


The real issue is that there are just fines, which sound like a lot of money but it’s a small cost of doing illegal or shady business for banks.


one that can be pushed on to customers, too.

can't push jail on customers...


The title is not clickbait. WhatApp is known for being encrypted. Context provides the reasons why....this issue is not new.


... and the records couldn't be preserved if the employees are using Signal and WhatsApp?


Correct. Neither Signal nor WhatsApp is integrated into any corporate messaging system, so the communication flowing through those apps, is neither archived nor discoverable.


How does that differ from a simple SMS message - afaik SMS isn't integrated in any corporate messaging system either...


Four levels of government and an ISP having an easily searched and/or subpoenae'd copy of the message...?

What forum is this?


RCS are end to end encrypted.


Actually forgot this made it anywhere!

Any idea on the % adoption rate? Couldn't easily find it.


~40% according the 'trust me bro' source from large NA operator.


Thank you.


not sure why you are being downvoted. in many cases sms is not approved for client communications for exactly this reason


SMS is integrated in to the corporate messaging system on work mobile phones at banks (+ all calls recorded).


Yes, they are. Well beyond banks - it's a SOX compliance question for any publicly traded company.


The headline isn't clickbait enough. Banks are using encrypted messaging to avoid leaving evidence.


For many institutions SMS and iMessage are not approved platforms for records retention, it doesn't really have anything to do with being E2E


It's still not clickbait. It's an honest headline, and a good one because it draws in the reader as is the point of a headline. Headlines are not supposed to replace the article which seems to be the real problem this thread has. The headline would still not be clickbait if they were fined for using sms and the article said "fined for using sms."




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: