16 ms·
The statements about this being "unfixable" are utter nonsense. If someone claims to be from a particular law enforcement agency it is trivial to just call up
by riskable 5y ago
The statements about this being "unfixable" are utter nonsense. If someone claims to be from a particular law enforcement agency it is trivial to just call up said police department and ask to speak to that person. If no one answers or the person can't be reached you don't approve the request.
The only thing that's "unfixable" about this is that it's not something you can automate. You need an actual human being to perform the verification step(s).
- rosndo 5y agoHaha. It’s also trivial to create a fake police department in some small town, set up google maps entry etc… What then? What about when you operate internationally and have to accept requests from 100+ jurisdictions?
- comrh 5y agoGet the police department phone number from the town's government and not google maps.
- rosndo 5y agoAnd how do you identify the real government for some small town? There are many that don’t even have websites. Contact the state government to ask? There’s a good chance nobody will be able to provide the answers you seek on short notice.
- Forgeties79 5y agoIf you're in a community that's so small it has no online presence for their government, then chances are you already know who to call anyway.
- voxic11 5y agoSo google gets one of these requests and supposedly its from a police force in a small town that has no government website. How do they know who to call to confirm?
- l33t2328 5y agoThe secretary of state for that state can provide that information.
- cortesoft 5y agoOnly in the United States. There are almost two hundred countries in the world. What if the request comes in from Kiribati?
- coospep 5y agoIf you give them days, weeks or perhaps months to come up with a response. Sure. Not going to work internationally anyway.
- verve_rat 5y agoYou are being intentionally argumentative, and not in a devil's advocate, let's explore all the consequences of the topic at hand kind of way. You are engaging in bad faith, please stop it.
- Forgeties79 5y ago[flagged]
- rosndo 5y agoThat’s really not the case. What is “bad faith” about suggesting that the secretary of state probably isn’t going to rapidly solve this problem for you? It’s not even about being a “devils advocate”, the balance of probabilities rests squarely on the side of this being far more difficult than many commenters here try to make it out to be. I think it is you who is engaging in bad faith.
- rosndo 5y agoI’m really confused as to how this relates to what is being discussed here.
- Forgeties79 5y ago>And how do you identify the real government for some small town? There are many that don’t even have websites. This was the question I responded to. I'm not sure how else to explain it?
- coospep 5y agoWe are talking about fake law enforcement requests sent to big internet companies. Do you think these bigcos have presence in McMullen, AL?
- 3np 5y agoSomehow there were ways to get this done before websites existed. I do not believe that those channels for government no longer exist. If they choose to make themselves impossible to locate offline, this is on them. If all else fails, government-to-government should still be viable, and then the local government will take it from there.
- coospep 5y ago> Somehow there were ways to get this done before websites existed Ah yeah, because fake subpoenas didn’t work before the internet existed? > I do not believe that those channels for government no longer exist. If they choose to make themselves impossible to locate offline, this is on them. Who says they ever existed? Back in the pre-internet days the situation was just worse. Even the federal government can’t manage this, just look at misissuances of .gov domain names.
- astura 5y agoI'm not sure there was ever much verifying before websites existed. Just less fraud. Back in the NES days Tengen called the United States Copyright Office and told them they needed the technical details of the NES lockout chip to defend themselves in a copyright lawsuit. The Copyright Office faxed over the requested information. Except it was social engineering, there was no copyright lawsuit. Tengen used that proprietary information to build their own cartridges without paying the NES licences costs.
- jltsiren 5y agoContacting the state government should be the right choice (but it may not be in practice). In many countries, every public official has the legal duty to direct you to the relevant authority if you contact them with matters outside their duties. That's a sensible requirement, because citizens should not have to be familiar with the internal administrative structures of government agencies.
- logifail 5y ago> And how do you identify the real government for some small town? There are many that don’t even have websites (Sorry to have to ask) but are there [m]any towns in the USA without telephones?
- rosndo 5y agoWhere do you intend to find the numbers to call? There are towns in the US where the local government consists only of a couple of people who may only do local government work for a few hours a week. There are towns with essentially no online presence, you could easily create your own fake local government, police and whatever you’d like.
- logifail 5y ago> There are towns in the US where the local government consists only of a couple of people who may only do local government work for a few hours a week How does anyone authenticate anything allegedly issued by such small parts of local government? "Not very quickly" is presumably one part of the answer?
- rosndo 5y agoIn the real world these documents are usually not authenticated, perhaps beyond trying to get a person on the phone by googling the issuing authority. It’s actually a pretty novel idea that companies should be prepared to deal with fake court orders, etc. In theory it’s supposed to be the job of law enforcement to prevent this, but of course that is also essentially impossible. If the federal lawmakers wanted the federal government to undertake the herculean task of making all these documents verifiable and traceable, they could of course do that. Are they likely to do so? No. Also, there’s an important detail that is largely being ignored in this conversation: How many hours of paralegal time can we expect companies to spend verifying legal requests concerning accounts that don’t belong to paying customers?
- logifail 5y ago
- voxic11 5y agoSo every major technology company will need to figure out the real contact details of every town government (how do you propose they will they do this?) and then when they receive one of these "life or death situation, you must respond immediately" requests they are supposed to call up the town, get the number for the police department in the town (hopefully the police department isn't shared between multiple towns or this could get confusing) and then call up the police department to confirm that they are the ones who sent the request? I guess I don't see the value the town government contact details is providing here. If you have some way of figuring out the real contact details for every town why wouldn't that same mechanism work for figuring out the real contact details of every police department?
- mywittyname 5y agoSomeone will sell this information. West Law / Lexis Nexis already provide a lot of this kind of thing (contact info for judges and people in various government agencies).
- voxic11 5y agoI wasn't able to find this information on West Law or Lexis Nexis, do you know what term they use to describe this category of information?
- tiahura 5y agoAccurint
- mywittyname 5y agoTry Judicial Profile.
- joelkevinjones 5y agoIn the United States, does <area code> 555-1212 not work anymore? It certainly seems to: https://www.businessinsider.com/555-phone-number-tv-movies-telephone-exchange-names-ghostbusters-2018-3 https://www.businessinsider.com/555-phone-number-tv-movies-t... https://www.nationalnanpa.com/number_resource_info/555_numbers.html https://www.nationalnanpa.com/number_resource_info/555_numbe...
- jahewson 5y agoCreate a fake small town?
- idontwantthis 5y agohttps://en.wikipedia.org/wiki/Agloe,_New_York https://en.wikipedia.org/wiki/Agloe,_New_York
- mariojv 5y agoFantastic story, it's hilarious that the "town" popped up on Google Maps for a bit.
- jelly 5y agoIt's not trivial. But regardless, you're saying the hacker should submit data to Google and also answer a telephone call, both of which increase the risk of getting caught later. The aim should be to stop or mitigate the misuse of EDRs, not to cure the underlying problem of social engineering.
- Apocryphon 5y agoAh, the fake blade runner station in Do Androids Dream of Electric Sheep?
- xhkkffbf 5y agoYes, the call back mechanism is a pretty good one but it has limitations too. It requires the switchboard operator at the police station to be trustable. Indeed, that human needs to actually pick up the phone. In many cases, the 911 line is the only one that's routinely answered.
- skybrian 5y agoIf it's really an emergency then calling the 911 line seems justified?
- throwawayboise 5y agoHow do you call 911 in aother city? AFAIK, 911 calls always go to the local dispatch center.
- AnimalMuppet 5y agoArea code, then 911. And often, the 911 dispatcher asks "What city?" as the very first thing they say.
- lostcolony 5y agoRequire police stations to register their callback number for EDRs. Require a response before releasing information. You still have the issue of vetting each police station, but you can do that once before the EDR comes in. Then when the EDR comes in, you call that number, confirm the details. It can still be hacked, but not nearly as easily as a random officer's email account.
- bell-cot 5y agoI'm thinking that the number of "Gun to victim's head; we need secrets from $Corporation_Name now!!!" situations which a typical small police dept. would actually experience, even over a decade, is ~ZERO. And the chance that a small police dept. would have the skill set, familiarity with the procedure, etc., so that they could correctly request the right data, from the right part of the right corporation, is about the same. SO - move the power to make such requests up to (say) State Police departments, or even somewhere in the DHS. Those guys have (or should have) sufficient resources to secure their e-mail, staff call-back phone lines 24/7, etc. And in the other direction, they should be far better able to vet alleged local police officers who contact them with emergency requests.
- aqme28 5y agoTrivial for someone who is suspicious and cares, sure. But that is not _prevention_ by any stretch. People still get phished via email every single day. I wish I could rely on something more robust than just the services I use being extra careful.
- verve_rat 5y agoSure, but the point is the process at the company receiving the request for data should change. They should verify the requesting entity. Then if the people processing these requests don't follow that process, then that is a different problem. But as it stands now, those people can follow the process to the letter and we still get the wrong outcome.
- giantg2 5y agoIn theory you could automate it, but that would require a different architecture. It's honestly pretty stupid that email is being used for this instead of having a secure portal which could include things like RSA hard tokens, or even just passwords with 2FA would be a step up. Nothing is fool proof, but this sort of stuff is common with other sensitive information like finance.
- ryukafalz 5y agoHonestly, email would do the job too, if it was signed email. I’m pretty sure the largest deployed PKI system is the US federal government’s - it really feels like we should be able to deploy something for law enforcement agencies. (And in fact that’s what the legislation mentioned at the end of the article appears to do.)
- giantg2 5y agoDoes that actually fix the issue if they've compromised the security of the email server using real or generated accounts?
- ryukafalz 5y agoThe email server typically does not contain key material. If you’ve ever interacted with the military or related contractors you may recognize this card: https://www.cac.mil/common-access-card/ https://www.cac.mil/common-access-card/ That’s a smart card, containing a certificate that can be used to sign email, be used as a client cert for web access, etc. Now, it has moved the problem to some extent, in that now you have to secure the CA that’s issuing these certs.
- giantg2 5y agoI'm a little familiar with CAC cards from years ago. I don't believe they were using them to sign emails at that time. Thats different than the signing process I was familiar with. That would work.
- 5y ago
- mrmanner 5y agoIt could also be “fixed” by deciding that the risks associated with government not getting data that could help stop an ongoing crime is less severe than the risks associated with these data leaks.
- sbarre 5y agoWho makes that decision?
- mrmanner 5y agoThe lawmaker or the voters, depending on how you look at things.
- verve_rat 5y agoAnd also the companies in question. They are responding to non warrant requests. As I understand it there is not legal obligation to do anything on their part. It is a public perception thing. The companies (probably rightly) think the public will react badly to headlines about "Little kidnapped girl could have been saved by Google, but they didn't care" more so than the current article we are discussing.
- lazyier 5y agoUs. By not using shitty systems to host our data as well as actively combatting laws and regulations that require backdoors or cross-platform compatibility. I don't want my conversations to be "cross-platform compatible" with Facebook. Thank you very much.
- diamondo25 5y agoRequire PGP signed requests, and you should have more guarantee?
- g_p 5y agoThe problem would be establishing a web of trust of which PGP keys are valid, who still is "law enforcement", and whether they're on gardening leave or have retired etc. There's too many (US) law enforcement bodies to make a centralised system work, as you'd need to get a certificate authority managing every individual officer's status for every one of these (small and large) agencies, and handle onboarding and offboarding. In other countries there are more formal structures for these request through verifiable channels, with standard operating procedures in place. The question is whether the companies are adopting a lowest common denominator model (a false but assumed valid US request can request any user's data) or not, as that might start to make it a more global concern, and get it on European data protection regulators' radars.
- technofiend 5y agoThere is already a FedPKI and it's already the Department of Justice's job to track law enforcement, is it not?
- SkittyDog 5y agoNo, I don't believe it's the DoJ's job to track law enforcement. There is some Federal-level recordkeeping of crime statistics... training... intelligence sharing. Could you explain what you mean, or give some examples?
- jandrese 5y agoHow do you verify the PGP key for a random LEO? The web of trust is a total failure for general use verification, it only solves the special ultra-paranoid use case. Key distribution has always been the weak point of PGP.
- 5y ago
- IncRnd 5y agoThe real fix is to require a warrant without these loopholes. Judges can be available on a moment's notice for these sorts of issues.
- Miner49er 5y agoAre we sure it's not trivial to fake a warrant?
- wmf 5y agoYeah, it's the same issue. You'd have to call the court back to verify the warrant.
- lazyier 5y agoIf it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity. Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated. If they can't be bothered to answer the phone then it's not important.
- chipsa 5y agoHow do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?
- AviationAtom 5y agoI think the article kind of hit on a good system: - FBI is CA? -- Issues hardware PKI to local departments --- Only PKI-signed EDRs are processed without manual phone verification
- wmf 5y agoThen local cops with poor security get hacked...
- Polycryptus 5y agoThis could work for domestic requests, but the one example of this I've seen in the wild (and this was mentioned in the original post) involved a request (supposedly) coming from police internationally. Though, requests from foreign police are more likely to be handled with scrutiny, so maybe forcing more manual verification (and identification of the proper process in the first place) aren't bad things.
- bleuchase 5y ago> The statements about this being "unfixable" are utter nonsense. It’s not unfixable. It’s broken by design.
- sharken 5y agoAlready the part where an EDR can override any safeguards is broken. If it's that important, then you need to design a safer system and pay the cost of doing so. Anything else is leaving the front door wide open for hackers.
- tehwebguy 5y agoThis would be a good step. Others have brought up problems with this but another one is that companies get paid by police agencies to provide these data in response to records requests, they are incentivized to not rate-limit these responses.
- baxtr 5y agoAbsolutely. This is “just” another control measure that needs to be (a) made aware of (b) implemented stringently throughout organizations. Most people don’t realize how boring cyber prevention often is.
- hitpointdrew 5y agoYup, came here to say this. Look up the number (don’t trust any number provided in the email, actually go look it up) and pick up the phone. Very effective and simple solution.