10 ms·
FBI raids researcher who discovered private patient data on public server (2016)
- code_diego_code 5y agoSome further follow-up and resolution of the case: https://www.databreaches.net/prosecution-drops-five-felony-charges-against-justin-shafer-accepts-plea-to-one-misdemeanor-charge/ https://www.databreaches.net/prosecution-drops-five-felony-c...
- hardlianotion 5y agoThanks for the follow up link. The outcome is depressing and rather disturbing.
- getcrunk 5y agoUnbelievable. Poor guy went to jail! And was raided 2 more times. I actually want to cry
- google234123 5y agoHe sent intimidating messages to an FBI agents wife . That's stepping over some line Edit was wrong about the content of the message to the spouse
- KennyBlanken 5y agoNo. > The factual bases of the government’s bare bones indictment are a handful of public tweets; a Facebook friend request and message sent to a public Facebook account; the following of a public Twitter account;1 and two emails to an FBI Agent – one with a “?” emoji and another inquiring about the status of a report of a patient privacy violation. > The Defendant made no attempt to mask his identity, and the FBI never contacted the Defendant to express any concern or to ask him to stop his communications. Instead they arrested him. > And any claim that he engaged in a sustained course of conduct with a continuity of purpose to cyberstalk or threaten are ludicrous when compared to facts embodied in the case law regarding these statutes.
- Goety 5y agoWow so 8 mo in jail, his life gets ruined, and then they drop the larger charges? Sounds like they just wanted to ruin his life.
- deleted 5y ago[deleted]
- WarOnPrivacy 5y ago> Sounds like they just wanted to ruin his life. When the powerful are embarrassed, ruining lives is only tool in the Federal LEO toolbox.
- adultSwim 5y agoJust look what they did to Richard Jewell
- deleted 5y ago[deleted]
- barelysapient 5y agoI mean, who honestly even wants to 'responsibly' disclose anything like this if they live in the US? The risks of assault rifle toting FBI agents coming for coffee at six AM outweighs any benefit I can think of.
- vorpalhex 5y agoEither be very anonymous or very public.
- deleted 5y ago[deleted]
- shapefrog 5y ago> very public Not working out so great for the St. Louis Post-Dispatch reporter who "hacked" the website by looking at it. https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post-teachers-hack.html https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post...
- worker767424 5y agoSeems safer to sell it on the dark web for some sweet monero and wait for the statute of limitations to expire.
- encryptluks2 5y agoStatute of limitations doesn't always start as soon as something happened. Many times, it only starts once it has been discovered or could have reasonably been discovered.
- deleted 5y ago[deleted]
- cheesecake_luvr 5y agoExposing incompetence and recklessness in government departments and large corporates, or even just any ol' trashy outfit that collects personal data, will make them very angry at being made to look incompetent and reckless.
- brigandish 5y ago> As they handcuffed him, his 9-year-old daughter cried in terror The police in America are well beyond the line of "citizen" police, you have the continental European model of two police forces, civil and military, and it's hard to see that there's much civil, it's more like ordinarily armed military force and a ready-for-war military force. It hasn't helped produce liberty or better enforcement in Europe, I can't see why Americans have allowed it to become their model. This discussion about no-knock warrants/raids[1] has a similar feel, an offence against common law, liberty, and above all, good sense. > I was in my boxer shorts when I heard my mother‐ in‐ law scream. It was a loud, fearful scream. I ran to the window, where I saw three or four men dressed in black with high‐ caliber rifles in my yard approaching my house. > I then heard an explosion, which was the sound of my door being blown open, followed by immediate gun fire. There were loud noises, the sounds of boots, and then more gunfire. > I hit the floor and began to yell, “I’m upstairs; please don’t shoot!” The men in black had me walk downstairs backwards, in my boxer shorts, with my hands in the air. I still can see two high‐ caliber rifles pointed at me. At the bottom of the stairs, they bound my hands, pulled me across the living room, and forced me to kneel on the floor in front of my broken door. I thought it was a home invasion. I was fearful that I was about to be executed. > I could see my mother‐ in‐ law bound, lying face down on the kitchen floor. Payton, my older dog, was lying dead in a pool of his own blood on the other side of the living room. I soon learned that my younger dog, Chase, was dead in a back room, where he had been shot from behind as he ran away. There were perhaps a dozen men in black, just standing around in my living room. I asked for a warrant. They said that they did not have it with them, but one was en route. > For most of the nearly four‐ hour ordeal, I was being interrogated, half‐ dressed in my living room and then in my kitchen. It was surreal. If it can happen to a mayor it can happen to anyone. [1] https://www.cato.org/policy-report/november/december-2008/should-no-knock-police-raids-be-rare-or-routine https://www.cato.org/policy-report/november/december-2008/sh... Edit: formatting
- vultour 5y agoAre you American? This assessment of European police is so wrong I can't fathom how you got it. I've never even seen an armored police vehicle.
- h2odragon 5y ago2016, says "updated May 2021" but apparently not substantially: > The Daily Dot was unable to obtain a copy of the probable cause affidavit by the time of publication, and it may be under seal.
- deleted 5y ago[deleted]
- __m 5y agoAt least they go after people that access their FTP without permission, so it not like they don’t care at all about security /s
- worker767424 5y agoApparently they were using ROT26. Twice as secure as ROT13, they say.
- egamirorrim 5y agowhy repost something so old? I was about to abuse Patterson on Twitter before I realised you'd linked this from the stone age
- Havoc 5y agoAlmost like they’re trying to scare people
- dusted 5y agoThis simply has to stop. Text-book messenger shooting. If anything, law should be reversed, exposing private information online, either unprotected or behind inadequate protection (default user/pass, weak encryption or previously compromised credentials) should be a criminal offense.
- javajosh 5y agoYes well there you go - if you keep putting your boot on the face of the person trying to help you, don't be surprised if people stop trying to help you. I find myself surprisingly in favor of the FBI's actions - good! Attack and destroy researchers and journalists that share their findings in a responsible way! Force it all underground, keep them silent, keep systems from failing a test, keep them from improving, and so let them rot, from the inside, until another presumably healthier system replaces it from the outside.
- hd4 5y agoSimilar outcomes have happened enough times when cybersec people tried to report a security hole that the security community should have noticed the pattern long ago and taken steps which imo would be just to shrug their shoulders in future when they find security holes and think about reporting them for free out of some misplaced kindness towards big business.
- intunderflow 5y agoDon't responsibly disclose, it's not worth the hassle anymore. Unless somewhere has a paid bug bounty program that has a good reputation I just use an anonymous email and send the bug to https://seclists.org/fulldisclosure/ https://seclists.org/fulldisclosure/
- beermonster 5y ago“Many IT guys in the dental industry know that the Patterson FTP site has been unsecured for many years. I actually remember them having a passworded FTP site back in 2006. To get the password you would call tech support at EaglesoftPatterson Dental and they would just give you the password to the FTP site if you wanted to download anything. It never changed. At some point they made the FTP site anonymous. I think around 2010.” So literally this is about anonymous access on a publicly accessible FTP server? I thought before reading the article that maybe he had hacked into it using a weak or guessable unchanged password (which would’ve been required back in 2006). The FBI response seems very excessive to say the least.
- pvaldes 5y agoNo good action goes unpunished
- FourthProtocol 5y agoYeah, no. There's nothing measured in the approach taken by the FBI. Data on a server is not lethal, the FBI's response was. And while sad, I'm not surprised. I spent time at Microsoft and once in downtown Seattle I saw a kid, maybe 9 or 10, kicking a can along on the sidewalk. Police car sees this, siren on, jumps out the car screaming like a banshee at the poor kid to stop. I've travelled. Like, 34 countries, and I've never seen a child treated that way. It was one of the scariest things I've seen, and it made me move back to London. And so whilst disappointed by what the FBI did here, I'm not surprised. Isn't their slogan serve and protect or something?
- xtracto 5y ago> Isn't their slogan serve and protect or something? It is their slogan, which has the same value of a McDonalds or Coke "healthy food" marketing campaign. I think there actually was some kind of ruling in the US where it was ruled that the police in there do not have to serve or protect their citizens. [1] [1] https://mises.org/power-market/police-have-no-duty-protect-you-federal-court-affirms-yet-again https://mises.org/power-market/police-have-no-duty-protect-y...
- crate_barre 5y agoIsn’t this what the ACLU is for? Wouldn’t they take a case like this on pro-Bono?
- WarOnPrivacy 5y agoWacky idea: Stop gifting federal law enforcement services to major campaign donors. Between Henry Schein and the FBI, we'll likely find a financed politician who enabled this abuse.
- CaoTzu 5y agoBe more cynical. It can be morally and legally wrong to persecute the researchers all it wants to be, but historically might makes right and the state has an ever growing monopoly on force; which I have no opinion on as to whether it is good or bad - but it needs to in order to facilitate it's survival in an ever more connected and delicate yet growlingly chaotic world. You live in a world of laws prescribed to you at their discretion. They can and will justify it infinitely and such legal actions are ramping up exceedingly since 2020 when it comes to the researchers. I always wondered when they would come for the researchers, many of whom I find derivative projects of during incident reports. Many of the nation state actor and cybercriminal economy is fueled by the intellectualism of FOSS and university projects. It is only logical to assume Microsoft, Universities and the like don't take much of an approach in hosting such things like write-ups or FOSS cybersec tooling because they can offer the information of the authors on a silver platter to the feds when the time is right. All those inclined to or capable of writing such things could thus be swept up in a targeted persecution from three letter agencies across NATO, forcing them either into labour or giving them fabricated charges at a show trial. You can consider the implications of a "Streisand" but the psychological value of such an event would outweigh any negative implications for such an operation. Most of the security apparatus in the west are dull, but you have to understand how Machiavellian the people who give them the orders are.
- luxuryballs 5y agoWell I guess unfortunately it should be duly noted to disclose such findings anonymously going forward.