4 ms·

Social engineering this is trival. Lookup for a phone will likely be on their website. The threat actor could compromise the website just as they did for the e

Social engineering this is trival. Lookup for a phone will likely be on their website. The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate. There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)

gjs278 5y ago
throwaway81523 5y ago
Back in the day you could get national phone directories on cd-rom. So the crooks would have had to compromise the phone book or the cd. Idk if those cd's still exist. Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.
rib3ye 5y ago
Creating a national db of validated police department phone numbers seems like the easiest problem to solve in this chain of issues. What’s on the EDR form?
- manquer 5y ago
  It will have to be international, and law enforcement is loosely police. Even in the U.S. there are tones of depts which are law enforcement and not police .
dvtrn 5y ago
Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate. You know who probably would be in a better position to know? Your corporate counsel. Chances are pretty high they not only know who to contact, they probably have additional contacts that your 'tech support' staff do not in the nearby agencies and beyond, not to mention having the actual knowledge on the response mechanisms that said agency requires for compliance with requests for corporate data. Which forces me to ask this question: I understand that as technologists we probably have an abundance of confidence in the knowledge and skills we possess in our domain, so why are tech support staff even 'handling' legal requests at all? The only "handling" they should be doing is "handing" whatever evidence or materials that have been requested directly to the company's legal counsel, who should have been the party liaising with the 'requestor'.
- manquer 5y ago
  You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ? . Also in my experience counsel who practice civil and corporate law have very little experience with law enforcement. Companies don't generally keep lawyers who practice criminal law inhouse .
  - dvtrn 5y ago
    You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ? To an extent, yes as a matter of fact, or at minimum a Registered Agent. Because in almost all of those 200 Jurisdictions, for a majority of business types (including Corporations) a Registered Agent is required by law for exactly this purpose: to receive and help your company properly respond to legal requests. https://www.upcounsel.com/registered-agent https://www.upcounsel.com/registered-agent Similarly, an Authorized Agent for your business is empowered to respond to such inquiries https://www.upcounsel.com/authorized-agent https://www.upcounsel.com/authorized-agent
    - manquer 5y ago
      That would be if you have actual physical presence in those countries. If you are online that is not feasible. Also having an general counsel for your place of business, is not same as having an firm 24/7 on call.
      - dvtrn 5y ago
        I concur. You will note that I said “for a majority of”, not “all”. Even online businesses still, if they intend to register as a business entity and enjoy all that comes with registering a business, like business tax ID or EIN, they must register with a jurisdiction. Also note where I said having an attorney “or at minimum a Registered Agent” So I’m not sure what is being rebutted here.

gjs278 5y ago

throwaway81523 5y ago

Back in the day you could get national phone directories on cd-rom. So the crooks would have had to compromise the phone book or the cd. Idk if those cd's still exist. Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.

rib3ye 5y ago

Creating a national db of validated police department phone numbers seems like the easiest problem to solve in this chain of issues. What’s on the EDR form?

manquer 5y ago
It will have to be international, and law enforcement is loosely police. Even in the U.S. there are tones of depts which are law enforcement and not police .

dvtrn 5y ago

Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate. You know who probably would be in a better position to know? Your corporate counsel. Chances are pretty high they not only know who to contact, they probably have additional contacts that your 'tech support' staff do not in the nearby agencies and beyond, not to mention having the actual knowledge on the response mechanisms that said agency requires for compliance with requests for corporate data. Which forces me to ask this question: I understand that as technologists we probably have an abundance of confidence in the knowledge and skills we possess in our domain, so why are tech support staff even 'handling' legal requests at all? The only "handling" they should be doing is "handing" whatever evidence or materials that have been requested directly to the company's legal counsel, who should have been the party liaising with the 'requestor'.

manquer 5y ago
You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ? . Also in my experience counsel who practice civil and corporate law have very little experience with law enforcement. Companies don't generally keep lawyers who practice criminal law inhouse .
- dvtrn 5y ago
  You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ? To an extent, yes as a matter of fact, or at minimum a Registered Agent. Because in almost all of those 200 Jurisdictions, for a majority of business types (including Corporations) a Registered Agent is required by law for exactly this purpose: to receive and help your company properly respond to legal requests. https://www.upcounsel.com/registered-agent https://www.upcounsel.com/registered-agent Similarly, an Authorized Agent for your business is empowered to respond to such inquiries https://www.upcounsel.com/authorized-agent https://www.upcounsel.com/authorized-agent
  - manquer 5y ago
    That would be if you have actual physical presence in those countries. If you are online that is not feasible. Also having an general counsel for your place of business, is not same as having an firm 24/7 on call.
    - dvtrn 5y ago
      I concur. You will note that I said “for a majority of”, not “all”. Even online businesses still, if they intend to register as a business entity and enjoy all that comes with registering a business, like business tax ID or EIN, they must register with a jurisdiction. Also note where I said having an attorney “or at minimum a Registered Agent” So I’m not sure what is being rebutted here.