12 ms·
Hack of 251 Law Enforcement Websites Exposes Personal Data of 700k Cops
- sebazzz 6y agoThis isn't right. Group behavior should not affect individuals in this way.
- boomboomsubban 6y agoI don't disagree, though it's worth noting that the CIA seems to engage in the same practice. https://news.yahoo.com/secret-trump-order-gives-cia-more-powers-to-launch-cyberattacks-090015219.html https://news.yahoo.com/secret-trump-order-gives-cia-more-pow...
- LargesseBargess 6y agoI'm not sure the CIA counts if this was used as a whataboutism argument by someone. Cyberwarfare is in legit contention as a space for state actors to work against each other. The police hack seemed like a hacktivist thinking doxxing cops was the way to support BLM when it could very easily ruin people's lives without a fair audit/trial.
- boomboomsubban 6y agoBy this logic, if the BlueLeaks hacks have something to do with Russia you would find them acceptable.
- handedness 6y agoThe fact that state-level actors are doing this kind of thing is all the more reason to foster a domestic culture of refusing to be manipulated by it. Otherwise, we'll wind up in a place where relatively small digital ad buys by foreign actors can create years-long mass hysteria.
- thereisnospork 6y agoWhy shouldn't it? Putting on a uniform assumes responsibility for the positions and actions of the represented organization - here the various police forces and unions of the United States. Police officers aren't being judged or punished for the color of their skin, creed, religion, or sexuality but their choices. I find it hard to stomach the idea that people shouldn't be judged for the organizations they choose to represent.
- sebazzz 6y ago> Police officers aren't being judged or punished for the color of their skin, creed, religion, or sexuality but their choices. No, many police officers are now being punished for being police officers. You would just be doing your job properly - no racist actions anything unjust - and now these details leak out. Yes there are police officers which are racist, I don't have data so I won't say few nor many, but there are. That doesn't justify this.
- RangerScience 6y ago> being punished for being police officers. Some of the logic is that bad police behavior is widespread enough that every "good" cop works closely enough with at least one "bad" cop, and yet via observation of outcomes, does not correct that bad cop's behavior (or doesn't correct it enough). They're thus complicit AKA bad cops themselves, and thus there are _no_ good police - everyone is sufficiently tainted. The Godwin's Law version of this logic at work elsewhere is the German saying "if there’s a Nazi at the table and 10 other people sitting there talking to him, you got a table with 11 Nazis." The folk wisdom encoding "a few bad apples spoil the bunch". Doesn't matter if they were good apples going in, they're all bad apples now: the bunch is spoiled. (Not expressing an opinion on the correctness of this thinking, just explaining what I know of it)
- CodeAndCuffs 6y agoThere are 700000 cops in America. I can name maybe 200. I've personally worked with maybe 50. I investigated 1, and could find no evidence of crime, though he realistically was likely committing some. Out of 700000 cops I guarantee some are the scum of the earth who should be locked away forever. I don't know where they are. I can't effect that It's like getting mad at the manager or an applebee's in Chicago because the waiter spit in your food at an olive garden in Seattle.
- RangerScience 6y ago"Should" is a funny word. Seems to be used mostly when one's ideas about how reality "should" work come up against how reality "does" work; from orbital procession to the photoelectric effect. "Should" is an opportunity many don't take to go "huh, that's funny" and learn something about reality. "Group behavior should not affect individuals in this way" according to what principles and theories? It does - so, which of those principles and theories are wrong or incomplete? What other forces are at work? Are any of these factors the sort that can be effected by human civilization design, or do they arise from things we can't meaningfully effect? If they're designed, what're the Chesterton's Fences around them?
- iRobbery 6y agoI start every git commit with "Should ..." :-)
- RangerScience 6y agoTrue tho innit? "These code changes _should_ result in these functionality changes, _if_ I have reasoned and programmed correctly, and haven't missed anything."
- tehjoker 6y agoI wonder if LEOs say that about gangs. If you think this is controversial today, the southern police evolved from slave catchers. If you think that cultural history is irrelevant today, I have a confederate flag to sell you. (Not really, I don't actually collect flags from white slavocracies.) https://lawenforcementmuseum.org/2019/07/10/slave-patrols-an-early-form-of-american-policing/ https://lawenforcementmuseum.org/2019/07/10/slave-patrols-an...
- deleted 6y ago[deleted]
- opwieurposiu 6y agoIf you are getting paid by tax dollars then your personal data is a matter of public record. It is vital for prevention of corruption for the public to know where the tax dollars actually go.
- devtul 6y agoWhen you say personal data, what do you include in that specifically?
- throwaway29102 6y agoIf you work for the State of Iowa, your name, department, title, and salary are printed in the newspaper at least once a year.
- akaktsn 6y agoDang that is wild. Didn't know that.
- tingletech 6y agosame for UC employees, but we set up a web site so the FOIA/CPRA requests don't have to be made https://ucannualwage.ucop.edu/wage/ https://ucannualwage.ucop.edu/wage/ It has our UC police in it too.
- av_engr 6y agoIncluding address and phone number? Doesn't that also enable public workers to be target of harassment?
- opwieurposiu 6y agoCould this be a problem? Yes, naturally. But the good of preventing government corruption outweighs the bad in this case. There are existing laws against harassment that provide recourse.
- canada_dry 6y ago> the sites were running VBScript, using Microsoft Access databases. Why doesn't this surprise me?
- vsareto 6y agoSomeone had a talk at the DEFCON blue team village about police software and how trivial it was to find something. I think it was like database creds in a DLL and apostrophes in fields causing errors (likely SQLi). I can't remember if it was something they ran in the patrol vehicles or at precincts.
- Answerawake 6y agoLinecon was terrible in this last convention(my first). Missed out on so many things I wanted to see because Linecon just got out of hand. I guess it is to be expected. :/ CCC being a conference of just ~10k allowed event goers to experience much more.
- charwalker 6y agoWell it was secure when released with support for XP and Vista business.
- ideals 6y agoI didn't realize Twitter and Reddit were suppressing discussion of the blueLeaks data. It's an interesting position to take. If you can discussion of all leaked data dumps do you draw the line when it is about state actors? Can you discuss Equifax hack, that is about personal information as well, but was done by state actors?
- wyxuan 6y agoDiscussion is okay. Twitter and Reddit will allow you to post this link. Doxxing (which posting the denial of secrets link that is discussed could be construed as) is not okay. if you linked a pastebin containing all the info from equifax it would be taken down for example.
- rndgermandude 6y agoWikileaks actually redacted a lot of (personal) data to protect people (tho some people like to claim again and again they did not). BlueLeaks, it appears, does not, and contains home addresses and other personal information of cops. Create transparency, investigate and show police misconduct? Great! Put cops and their families at risk? Nope!
- throwawayway9 6y agoCops put countless minority and other less-privileged persons lives at risk every single day. Worlds smallest viola.
- anonymousiam 6y agoThe Julian Assange "poison pill" link was posted on Twitter, and later the password to the archive was also posted. This provided FULL UNREDACTED versions of all the leaked info.
- throwawayway9 6y agoCould you please enlighten us about this "poison pill" link?
- upofadown 6y ago>For example, the Northern California Regional Intelligence Center has 29,114 accounts, and each one includes a full name; rank; police department or agency; email address; home address, ... So that means that anyone with access to the system can get the home addresses of all their co-workers that also have accounts on the system? Why would all this personal information be associated with an account of this type? This isn't an HR database.
- GaryNumanVevo 6y agoHonestly that's the most interesting part (at least until people sift through the data more) of this story. Why the heck are they storing sensitive data on what appears to be a CMS for e-commerce site?
- driverdan 6y agoHome addresses aren't considered sensitive information. If you own your home that information is public. Cops read people's addresses (and SSNs) out over the radio all the time for anyone to hear. I'm not saying I agree with this, privacy should be protected better, but that's the US.
- mschuster91 6y ago> Home addresses aren't considered sensitive information. I wonder what will happen once the first protesters line up at cop houses or pranksters bombard them with spam and fake pizza orders. Not that I'd condone wasting pizza, but in many cases change only happens when the people in power have problems.
- 5555624 6y agoHome addresses are "Public PII" under 2 CFR § 200.79 - Personally Identifiable Information (PII), as opposed to "Protected PII." A lot of places don't make the distinction. (We do a semi-annual PII Audit and don't make the distinction.)
- GaryNumanVevo 6y ago
- tomcam 6y agoDespicable. I assume the hackers were willing to expose their own addresses?
- XMPPwocky 6y agoI assume the police were willing to shoot rubber bullets at themselves?
- bigwavedave 6y agoOh please, of the hundreds of thousands of police officers who've done far more for the good of their society than you have, you're saying 100% of them deserve to be doxxed. That would be like saying "because x% of software engineers are pedophiles with child porn that they share around with others on their secret servers, all 100% of them are disgusting and deserve the mercy of the mob because they can't seem to fix the problem."
- mountainboot 6y agoSoftware engineers don't rally to defend their coworker pedophiles. There is no thin binary line.
- XMPPwocky 6y ago> Oh please, of the hundreds of thousands of police officers who've done far more for the good of their society than you have, you're saying 100% of them deserve to be doxxed. Where did I say this?
- meroes 6y agoDoes it seem a little disjointed between the article's content (exposing overuse and misuse of Fusion centers via a hack) and the headline/inline focus of "700,000 Law Enforcement Officers Exposed"? Almost like they were allowed to run the article but editor didn't like the angle or something.
- SiempreViernes 6y agoYeah, my impression is that they haven't found anything interesting except shitty security of a widely deployed web app.
- pnutjam 6y agoTFA says this could compromise user's password. I worked for a City and handled the police dept. You could go far by just using username as password... Nobody wanted to hear about security.
- thephyber 6y ago> Nobody wanted to hear about security. System/network security. I guarantee physical security would get someone's attention at a police department. The police in my family are paranoid and have even broken lesser laws to increase their own physical security. I suspect this mismatch is because police (like average consumers) don't know the impact of a network security breach. It's a failure of imagination. Hopefully BlueLeaks helps to change this.
- LordKano 6y agoI have a philosophical problem with leaking people's personal information but I admit that I'm curious. I want to see what's in this data.
- throwawayway9 6y agoIt's definitely worth the torrent, especially to see how slow many LE agencies are with keeping up with the technical times.
- LordKano 6y agoI may or may not have the torrent downloading right now. At this rate, it may or may not be finished some time tomorrow.
- p_j_w 6y agoIt's not just their personal information, though. Go to the "Suspicious Activity Reports" section of the linked article. It's... eye opening.
- anonymousiam 6y ago"After the BlueLeaks data was published, Twitter has permanently suspended the DDoSecrets Twitter account, citing a policy against distributing hacked material. Twitter has also taken the unprecedented step of blocking all links to ddosecrets.com, falsely claiming, to users who click that the website may be malicious." Funny that Twitter had no problem with the Wikileaks dump from Bradley/Chelsea Manning.
- cairo_x 6y agoMore interesting is why choose these shitty providers? https://blog.12security.com/darkness-at-noon-01-waxtitan/ https://blog.12security.com/darkness-at-noon-01-waxtitan/
- tinus_hn 6y agoPerhaps this will teach them their username is not an appropriate password. But probably not.