5 ms·

Are we sure it's not trivial to fake a warrant?

• wmf 5y ago
  Yeah, it's the same issue. You'd have to call the court back to verify the warrant.
  • lazyier 5y ago
    If it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity. Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated. If they can't be bothered to answer the phone then it's not important.
    • chipsa 5y ago
      How do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?
      • otterley 5y ago
        The court's own website usually has contact information that can be independently verified. This isn't that difficult a problem to solve.
        • sodality2 5y ago
          Do courts all have domains under a government subdomain?
          • willcipriano 5y ago
            All the courts that would issue these types of warrants will be easy to find. This isn't the sort of thing you do over a traffic ticket or shoplifting. It's not the court you go to when your neighbor owes you fifty bucks. These are murder and kidnapping cases. The people processing these warrants today are likely already on a first name basis with the clerks of these courts. Think about it, how do you validate any court order? Why is this only a problem now? I think it's beacuse they want to side step the judicial oversight process. Keep that intact, as the constitution requires, and this issue disappears.
            • kenniskrag 5y ago
              Do not forget that it is world wide. The gov has next to a signature a feature called apostille.
              • deleted 5y ago
                [deleted]
            • chipsa 5y ago
              Local-ish courthouse for me only has a contact info for regular business hours. So if not in business hours, then what? There's ~3200 counties (or equivalent) in the US. There's no way to be on a first name basis with the clerks of each county courthouse, let alone if you have a big county with multiple different types of courts. As for how you validate court orders now? You largely don't. That's why it's possible to use fake court orders to take down true but unpleasant information: https://www.cnet.com/news/privacy/forged-court-papers-are-being-used-to-force-negative-stories-off-of-google-results/ https://www.cnet.com/news/privacy/forged-court-papers-are-be...
              • willcipriano 5y ago
                Your local courthouse may not even do jury trials. It doesn't do the sort of cases that require 3AM emergency warrants. If it's that important it can go in front of a district or federal judge, otherwise it can wait for business hours. Local police departments don't need the ability to engage a global surveillance apperatus at the drop of a hat. Stuff like that can be ran up the chain first.
                • rosndo 5y ago
                  > It doesn't do the sort of cases that require 3AM emergency warrants You will be in trouble if you ignore a real warrant on this basis. Your lawyers will probably tell you that it’s better to just take the risk of possibly complying with a fake warrant.
                  • 5y ago
          • salawat 5y ago
            They do not! And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system. Even more fun would be the process of jurisdictional verification. All of which I'm sure the "Officers" would be more than happy to leave you be with your electronics and whatnot long enough to verify, right? Longer I'm alive, the more insane our system seems to me on a daily basis. Not sure if it's just cognitive decline or rapidly amplified cynicism as I dig into the signalling nightmare that is the interface between the executive and the judiciary system.
            • otterley 5y ago
              > And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system. Name one court that signs warrants to service providers that can't be verified by spending 5 minutes doing some basic research, or that has a LEO office serving such warrants that also can't be verified.
              • salawat 5y ago
                So you go look up warrants on a regular basis? The topic at hand isn't whether a lawyer or a court officer can, but whether EVERYONE can in a timely manner such that if a police officer or LEO (or someone impersonating one, since we're talking zero trust) can be told to go sod themselves by a layman. Fundamentally this is a signal/info propagation problem. Processes take time.
                • otterley 5y ago
                  The people who process these requests, particularly at the large companies that possess such data, are typically dedicated to the task and possess the specialized knowledge needed to do so. They have often developed significant relationships with the law enforcement community.
                  • salawat 5y ago
                    Do you know them? Do you have a connection that you could entrust with giving you a positive or negative answer as to whether the armed man with no sense of humor in the cop uniform outside is the real deal? I don't. Hell, even if I had a lawyer on hand, I doubt the lawyer would go "hold up.. checking the registries, yup it's legit"; rather they'd tell you to cooperate then maybe challenge outcomes down the road when the paperwork catches up. For most, the answer is they take it on faith anyone usurping that authority would have such a shit ton of bricks dropped on them, no one would be stupid enough to do it. Obviously, that logic is showing it's age. Frankly, if I were the courts/LE and found out this was going on, there'd be a new Public Enemy #1. Trust is too important.
      • IncRnd 5y ago
        People were able to do this for years prior to Google's existence. I'm sure a social media company can determine how to find a court without Google.
      • grepfru_it 5y ago
        Every court has a phone number, you can lookup the court independently and call the main line to get routed to the appropriate party
      • verve_rat 5y ago
        Use a phone book?
• qbasic_forever 5y ago
  Faking a warrant is a felony, perhaps even a federal one that would get the FBI involved I assume. You'd have to forge an official court document, forge a signature of a judge, etc. That has _serious_ consequences and prison time vs. faking a "data request" that might be entirely digital with no physical document or signatures, etc. Not saying it can't happen or won't happen, but a criminal has to be seriously determined and ready to risk a long prison sentence to fake a warrant.
  • macksd 5y ago
    I feel like I've been seeing a lot of comments lately to the effect of, "no - that would be illegal!" Yeah, we are talking about criminals who are already breaking one law. Often criminals who, in the very nature of their crime, are hard to identify. But then, even if they're not overtly breaking the law with a simple request for information, debt collectors and car warranty salesman are notorious for sending letters that will imply they are your financial institution, the letter was sent by your account manager, etc. IRS impersonators will tell people that jail time is imminent. I can imagine someone could create something that looks to a non-lawyer (who's afraid and not paying attention) like it's basically warrant signed by someone who's basically a judge, but just doesn't outright say that. You'd still need to verify - hey is this person actually a judge, and did this person actually sign that as a warrant?
    • qbasic_forever 5y ago
      Yes, which is why just set the bar at responding to any request for any data with "Sorry we do not respond to requests for data that aren't court ordered warrants. Please come back with a warrant we can verify." The problem here is that companies have a policy of trusting some government email address for little one-off, no warrant needed requests. Don't have that policy.
      • rosndo 5y ago
        > Please come back with a warrant we can verify The problem is that it might not be easy to verify a real warrant, but that’s not grounds for noncompliance.
• stingraycharles 5y ago
  All of which makes me wonder, and this being HN, wouldn’t it make so much sense of law enforcement agencies start signing these kind of requests with verifiable public keys? It seems like such a trivial problem from a technology point of view, it makes me believe it’s mostly an organizational problem.
  • mcbutterbunz 5y ago
    I agree that it does seem like a trivial problem that is mostly organizational. There are nearly 18,000 police departments in the US. Standardizing anything across a subset these and getting approval from the judicial system just seems like a nightmare. This seems like one of those issues that is solved only when someone is murdered and a law is written after their name.
  • ozfive 5y ago
    Let's add Blockchain to this so warrants are verifiable on a private Blockchain.
    • ozfive 5y ago
      /s
  • istjohn 5y ago
    At the very bottom of the article: 8<-------------------------------------------- The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology. “Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill. The Digital Authenticity for Court Orders Act would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content. 8<--------------------------------------------
• deleted 5y ago
  [deleted]