8 ms·
The real fix is to require a warrant without these loopholes. Judges can be available on a moment's notice for these sorts of issues.
by IncRnd 5y ago
The real fix is to require a warrant without these loopholes. Judges can be available on a moment's notice for these sorts of issues.
- Miner49er 5y agoAre we sure it's not trivial to fake a warrant?
- wmf 5y agoYeah, it's the same issue. You'd have to call the court back to verify the warrant.
- lazyier 5y agoIf it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity. Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated. If they can't be bothered to answer the phone then it's not important.
- chipsa 5y agoHow do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?
- otterley 5y agoThe court's own website usually has contact information that can be independently verified. This isn't that difficult a problem to solve.
- sodality2 5y agoDo courts all have domains under a government subdomain?
- willcipriano 5y agoAll the courts that would issue these types of warrants will be easy to find. This isn't the sort of thing you do over a traffic ticket or shoplifting. It's not the court you go to when your neighbor owes you fifty bucks. These are murder and kidnapping cases. The people processing these warrants today are likely already on a first name basis with the clerks of these courts. Think about it, how do you validate any court order? Why is this only a problem now? I think it's beacuse they want to side step the judicial oversight process. Keep that intact, as the constitution requires, and this issue disappears.
- kenniskrag 5y agoDo not forget that it is world wide. The gov has next to a signature a feature called apostille.
- deleted 5y ago[deleted]
- chipsa 5y agoLocal-ish courthouse for me only has a contact info for regular business hours. So if not in business hours, then what? There's ~3200 counties (or equivalent) in the US. There's no way to be on a first name basis with the clerks of each county courthouse, let alone if you have a big county with multiple different types of courts. As for how you validate court orders now? You largely don't. That's why it's possible to use fake court orders to take down true but unpleasant information: https://www.cnet.com/news/privacy/forged-court-papers-are-being-used-to-force-negative-stories-off-of-google-results/ https://www.cnet.com/news/privacy/forged-court-papers-are-be...
- willcipriano 5y ago
- IncRnd 5y agoPeople were able to do this for years prior to Google's existence. I'm sure a social media company can determine how to find a court without Google.
- grepfru_it 5y agoEvery court has a phone number, you can lookup the court independently and call the main line to get routed to the appropriate party
- verve_rat 5y agoUse a phone book?
- qbasic_forever 5y agoFaking a warrant is a felony, perhaps even a federal one that would get the FBI involved I assume. You'd have to forge an official court document, forge a signature of a judge, etc. That has _serious_ consequences and prison time vs. faking a "data request" that might be entirely digital with no physical document or signatures, etc. Not saying it can't happen or won't happen, but a criminal has to be seriously determined and ready to risk a long prison sentence to fake a warrant.
- macksd 5y agoI feel like I've been seeing a lot of comments lately to the effect of, "no - that would be illegal!" Yeah, we are talking about criminals who are already breaking one law. Often criminals who, in the very nature of their crime, are hard to identify. But then, even if they're not overtly breaking the law with a simple request for information, debt collectors and car warranty salesman are notorious for sending letters that will imply they are your financial institution, the letter was sent by your account manager, etc. IRS impersonators will tell people that jail time is imminent. I can imagine someone could create something that looks to a non-lawyer (who's afraid and not paying attention) like it's basically warrant signed by someone who's basically a judge, but just doesn't outright say that. You'd still need to verify - hey is this person actually a judge, and did this person actually sign that as a warrant?
- qbasic_forever 5y agoYes, which is why just set the bar at responding to any request for any data with "Sorry we do not respond to requests for data that aren't court ordered warrants. Please come back with a warrant we can verify." The problem here is that companies have a policy of trusting some government email address for little one-off, no warrant needed requests. Don't have that policy.
- rosndo 5y ago> Please come back with a warrant we can verify The problem is that it might not be easy to verify a real warrant, but that’s not grounds for noncompliance.
- stingraycharles 5y agoAll of which makes me wonder, and this being HN, wouldn’t it make so much sense of law enforcement agencies start signing these kind of requests with verifiable public keys? It seems like such a trivial problem from a technology point of view, it makes me believe it’s mostly an organizational problem.
- mcbutterbunz 5y agoI agree that it does seem like a trivial problem that is mostly organizational. There are nearly 18,000 police departments in the US. Standardizing anything across a subset these and getting approval from the judicial system just seems like a nightmare. This seems like one of those issues that is solved only when someone is murdered and a law is written after their name.
- ozfive 5y agoLet's add Blockchain to this so warrants are verifiable on a private Blockchain.
- ozfive 5y ago/s
- istjohn 5y agoAt the very bottom of the article: 8<-------------------------------------------- The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology. “Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill. The Digital Authenticity for Court Orders Act would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content. 8<--------------------------------------------
- deleted 5y ago[deleted]
- rosndo 5y agoThis isn’t a fix. Warrants are easy to fake, not necessarily easy to verify.