11 ms·
I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that
by supernova87a 6y ago
I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit.
There was a story in WSJ like last week about how the Japanese red stamp / seal still survives and is a barrier to them adopting new technology for practical every day speeding up of tasks. And keeps things like faxes around unnecessarily.
Yet sometimes, these old checks are there to prevent maybe the worst case of bugs getting into the system. Maybe?
- rightbyte 6y agoA manual sanity check is ofent nice. Also it makes it easy to override stupid bugs.
- shadowgovt 6y agoOne could argue the internal barriers are unnecessary if "trust but verify" works. In this case, it worked; she was able to play the system until verification identified something was wrong, and now she gets to go to jail over it. (Technical systems often need more stringent protections because "screw around and go to jail" isn't a threat that, say, Facebook can bring to bear).
- 35fbe7d3d5b9 6y agoThe mistake here is messing with the legal system itself. Lots of scams and schemes can fly under the radar, but as soon as you start committing fraud against the court, you're done. Just ask the con artists at Prenda Law how lying to federal judges went: https://en.wikipedia.org/wiki/Prenda_Law https://en.wikipedia.org/wiki/Prenda_Law https://www.popehat.com/tag/prenda-law/ https://www.popehat.com/tag/prenda-law/
- dredmorbius 6y agoUnless you're sufficiently large. The RIAA, Tobacco industry, ExxonMobile, POTUS.
- causality0 6y agoHow many times have people gotten away with something similar without every being discovered, though? It could be very many.
- wizzwizz4 6y agoThere's no such thing as a perfect crime.
- NeutronStar 6y agoHow would you even know that a perfect crime was accomplished. Is it perfect if we know about it?
- manicdee 6y agoPlenty of “good enough” crimes though. No such thing as a perfect crime detection system either.
- causality0 6y agoIndeed. I think most people know of very many things they and their friends and family would've been ticketed or arrested for if an officer had been present and interested. Running red lights, speeding, media piracy, unreported income from side jobs, broken regulations, sharing prescription drugs, etc.
- dredmorbius 6y ago"The secret of a great success for which you are at a loss to account is a crime that has never been found out, because it was properly executed." -- Balzac https://quoteinvestigator.com/2013/09/09/fortune-crime/ https://quoteinvestigator.com/2013/09/09/fortune-crime/
- eru 6y agoI transported Durian on the bus in Singapore about two years ago. I was not found out. (And even my confession here won't get me into trouble.)
- rkagerer 6y agoDid it really work, or was it due to a happenstance: In November, Hillsborough County prosecutors became suspicious when they heard from a state forensic examiner, who had been scheduled to perform a competency evaluation on Landon. The examiner saw a notice in Landon’s court file that prosecutors had dropped charges; the examiner wanted to know if the examination should go forward. How would it have been detected if there were no loose ends like this out there or anyone who cared enough about the case to prompt a double-check?
- 35fbe7d3d5b9 6y ago> Indictments allege Landon also filed an order falsifying a decision of retired Superior Court Judge Gillian Abramson to waive filing fees in a lawsuit she brought against Hillsborough County. And she allegedly filed an order on behalf of a relative to halt guardianship proceedings involving Landon’s child. The loose ends aren't separable from her desired outcomes. They're integral. You can't "tie up the loose ends" while committing these acts of fraud. "Hold on, why'd this case drop off the docket", says the DA. "I didn't file this", says the lawyer. "My ruling is due next week", says the judge. Any one of those would be noticed and questions asked of the court clerk. And they all end in the same place.
- whynaut 6y ago> How would it have been detected if there were no loose ends like this out there or anyone who cared enough about the case to prompt a double-check? > "Hold on, why'd this case drop off the docket", says the DA. "I didn't file this", says the lawyer. "My ruling is due next week", says the judge. That's someone caring enough. The loose ends are entirely separable when discussing hypotheticals.
- throwaway0a5e 6y agoIf her court date were the last day before a holiday weekend nobody would have asked any questions.
- jccalhoun 6y agoYears ago I was working somewhere and instead of getting a supervisor to approve some minor thing we would just put in a supervisor id that was known to people. Eventually, we got caught because that person had quit working there a few years ago and someone saw her code being used to approve things.
- DanBC 6y agoIt's surprising when people casually admit to dishonest behaviour as if it's no big deal.
- rembicilious 6y agoMaybe it’s not a big deal, unless you value honesty above all else. I am not always honest, especially when it’s obvious to me that the other party will only use my goodwill to their advantage. In the case of the parent, I can imagine many scenarios where it is difficult or untimely to get supervisor approval, but failure or delay in doing so results in the employee catching all the heat for it.
- pugworthy 6y agoFair point, but the parent.parent says this was to "approve some minor thing" The risk is that the "minor thing" isn't so minor, especially when the bypassing of the review process becomes routine. I suppose put it this way. Imagine a software developer slipped in smaller code changes and circumvented procedures like QA or code review because they though it was "just some minor thing" Would you find that OK?
- throwaway0a5e 6y agoSomehow I don't think a bunch of retail employees processing returns without the manager's approval is gonna be a big deal. The manager will see the returns regardless of whether they approve them on an individual basis.
- tomrod 6y agoSystem resilliance is valuable. But ossified systems are resilient, simply inert.
- m463 6y agoJust wear a hardhat and carry a clipboard.
- mynameismonkey 6y agoI used to participate in a city-wide water pistol assassination tournament. Skipped the hard hat, got white coveralls from Home Depot, pinned my work id to it, carried a clipboard. Got in everywhere I needed to be, including a heliport and a private boat dock. I forget where I read it, but the phrase "just act like you're supposed to be there" has stuck with me a long time, and paid dividends.
- polytely 6y agoWow that sounds like a ton of fun, could you go into more detail about how that worked?
- deleted 6y ago[deleted]
- Gibbon1 6y agoBrother in law put himself through college working as a plumber at night. Said after that he could go and wasn't afraid to go anywhere.
- clairity 6y agoas a teenager, i remember marveling at a friend who could successfully walk into bars and order drinks. you have to both look the part and play the part (i could do neither). even at places that carded, they wanted to serve you, so the ID had to only provide enough plausible deniability to the bouncer or bartender to credibly claim they were duped into serving you. i'm sure some bartenders secretly got a kick out of the cat and mouse game.
- asdff 6y agoIn college there was a beer delivery service that would even deliver directly to the dorm if you gave that as your address. If you paid with your debit card over the phone, they wouldn't even card you since the beer was already bought and paid for. One time they did check, and my friend lied and said he didn't have his ID with him. Then the delivery guy who was probably only a couple years older than us just asked to see his actual underage ID to prove he wasn't a cop and handed us the beer anyway.
- asdfasgasdgasdg 6y agoI don't know too much about the red seal system, but it doesn't strike me as something that would be very difficult to forge. I model Japanese workers as being pretty meticulous, but it strains credulity to believe they are carefully authenticating such stamps. (How would you even?) I suspect that system is vulnerable to a similar attack to this one, it's just that the risks outweigh the benefits. Which also goes for the situation we're discussing. I've never heard of an attack like this and I doubt it is frequently attempted or succeeds.
- wtn 6y agoThe government of Japan is rapidly abolishing the hanko. http://www.asahi.com/ajw/articles/13789927 http://www.asahi.com/ajw/articles/13789927
- whack 6y ago> once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit. It sounds to me like they are using security-by-obscurity, as well as easily forgeable proofs such as "signatures" or drivers licenses (they're only as secure as your ability to spot a forgery). Hence why anyone who is knowledgable and determined enough, can easily crack the system. If you want to prevent such problems, you could either go really old-school. Require the person filing documents to show up in person, and be personally identified and recognized by someone in-house. Or go really new-school and only accept biometrics or digital paperwork that has been filed using a secure account accessible only by that person. Using an in-between approach, like a signed paperwork that has been given to you by someone you don't recognize, is the worst possible solution.
- WalterBright 6y agoThe usual way to fix these sorts of things is to ensure there are multiple independent barriers to fraud. 2 factor authorization is an example. Double entry bookkeeping is another. Independent audits is another. Separate checks for unusual activity is another.
- eru 6y agoThe latter two explicitly acknowledge that spotting fraud is a probabilistic activity.
- WalterBright 6y agoIf it was certain, one wouldn't need multiple layers of security.
- eru 6y agoYes, definitely. It's just that much of the discussion about controls and checks is often framed in the language of certainty.
- duxup 6y agoThe Hacktober thing seemed to demonstrate this. I apparently was involved with some project on github, got flooded with emails with read me changes. It never ocured to me how available such things are.
- rsync 6y ago"I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit." This was a regular narrative from the days of phone phreaking and toll fraud, etc. Just speaking the correct lingo of a lineman or an operator or a toll office supervisor could allow one to navigate through all the depths of the telephone system. Not just to receive services without charge, but to actually build and teardown circuits, set up test numbers (ANACs), conference calls, etc. It's incredible to think that a few lines of Twiml, or a Twilio function, can create something like an ANAC which was a rare, valuable, and jealously guarded secret 30 years ago ...
- deleted 6y ago[deleted]
- kitteh 6y agoYes. Phone phreaking in the 90s involved a ton of learning the lingo and the ins and outs of the phone company. It was even weirder to go work there later on and found how much that paid off and earned trust with a lot of the older folks there.
- eru 6y agoIt's actually not too different these days in some parts. Eg job interviews for programmers to a large part just test the lingo.
- pseingatl 6y agoGood point--judicial orders contain no security features and are printed on ordinary paper. They long ago did away with the embossed seals, so now copying these are trivial and normally not needed unless a certified copy of the order is required. The article shows surprise at the defendant's cleverness in filing electronically. Not so--in many jurisdictions, electronic filing is mandatory. Pleadings filed by parties have no security features either. In some countries, pleadings have to be filed using special paper that is taxed. The paper has security features and the tax feature is a way both to obtain revenue and discourage prolixity. Now imagine that in the 3141 counties in the US, each with different protocols, it's a wonder this isn't more frequent. Oh and each of those counties has its own system for counting votes. Good luck, USA.
- pnw_hazor 6y agoThe adversarial system used in US courts assumes the other side will discover such frauds and bring them to the attention of the court. I think the frauds that appear to be legal but do not actually involve courts are where more harm is. These are the scams asking people to pay fines or else.
- jimz 6y agoAnd it does, of course, very frequently. The US Court system's problem is not a matter of discovering such frauds and wrongdoing, and in some fields it's almost impossible to get away with this sort of conduct, but overall, there's little avenues of redress. Civil litigation is obviously the biggest area and the best positioned to both catch and remedy the fraud. Some criminal proceedings have similar robust checks, but that is really only on one side - the defense's side. Prosecutors are immune and protections like Batson (racially motivated jury selections justified under pretextual justifications that later are found unreasonable) or Brady (prosecutors hiding evidence favorable to the defense or misrepresenting its existence at all) exist but there's not real accountability outside of personal shame and possibly getting a conviction vacated. Administrative courts are overwhwlemingly immigration courts where the nature of the proceedings ensure that the aggrieved party pretty much is ensured to be unavailable in the legal sense to challenge most of the cases. There's a lot of fraud, waste,a abuse, or other chicanery in the courts and luckily in my experience they're never simply kept hidden without anyone noticing. The problem is always redressability. So much of the system requires discretionary rulings but the laws that dictate how we handle misconduct is heavily skewed in favor of the state if they ar a party and fails to take into account the urgency in resolving these cases that very often it becomes obvious that there's fraud, yes, but there's no redressability, and therefore there's no real punishment. A particularly egregious case of falsifying evidence and using prtextual reasons to elicit false testimony and racially-based jury selections is the US v. Flowers case in the Supreme Court last term. There's a podcast on it, but the decision itself is... excoriating to say the least as to how far and how egregious the conduct was to try to execute an innocent man. It's discovered all right, but there's no punishment. So courts can and do definitely figure out fraud pretty readily, but when it comes to doing anything about it, victims not on the side of the state frequently find it cold comfort.
- ilamont 6y agoI lived in Taiwan in the 1990s when the "chop" (印章) was still alive and well for individuals and institutions. I remember a bank fraud that revolved around a bank employee using a bar of soap to make a copy of the bank's seal to authorize transactions or transfers and used the money for stock market investments which he or she then intended to pay back. IIRC it came to light when the 1997 Asian financial crisis hit.
- bavila 6y ago> I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit. I used to work as a criminal defense attorney, and the job regularly required that I obtain subpoenas from the court in order to mandate a witness's appearance at court. My state courts have a template that subpoenas must follow, wherein you would include the case number, attorney name, witness name, and other basic details. Once the template is completed, you take the original along with a certain number of copies to the court clerk for filing. All the clerks would do is make sure that the case number on the subpoena corresponds to a case that actually exists in the system, and that the names of the plaintiff(s)/defendant(s) are accurate. The clerks never asked me any questions about my role in the case (e.g., whether I was a party to the case, an attorney, or a staff member of the law firm representing a party), nor did they ever ask me to provide any sort of identification. I just give the clerk the papers, they look at the papers, they stamp the original and copies, and then they return the copies to me (which are to be served on the witness and/or opposing counsel). I don't think there's a ton of value someone could get out of obtaining a fake subpoena (other than perhaps issuing your own self a subpoena as an excuse to get out of work, or maybe just to screw with someone), but it was always pretty astonishing to me that anyone off the street can just dump some papers in front of a court clerk and receive a legal order mandating someone's appearance in court--no questions asked.
- sjy 6y agoA similar process exists in Australia. It is a bit strange that the burden is on the recipient to object to an unlawful subpoena. I understand that it’s pretty common for vexatious litigants to issue subpoenas requiring politicians, governors and other public figures to attend court for cross-examination about a perceived injustice, and there is a bit of work involved in arranging for these to be set aside so that nobody ends up formally in contempt of court.
- ThrustVectoring 6y agoSubpoena power is a hell of a lot of leverage, and probably the biggest reason why all these terms-of-service agreements including binding arbitration. Like, if you can convince a small-claims court judge that it is relevant, it's definitely possible to subpoena high-level executives of multibillion dollar companies over a $100 dispute.