4 ms·

But why are sealed files on the network?

nijave 4y ago
I imagine so people that should have access (like prosecutors) can get to them without visiting the court house (and potentially requesting copies of the original)
- oliwarner 4y ago
  I would have expected that a strong, physical audit trail would be a highly desirable thing. That said, I have no idea what the transaction volume is like here. My experience of TV crime investigation tells me these are rare occurrences, under warrant.
  - nijave 4y ago
    Sealed files don't require warrants they are just court records that aren't publicly accessible. My understanding is motions (appeals or some other proceeding?) can be filed by a defendent (if that's the right term) and prosecution has a limited time frame to respond. Defense lawyers will just file bogus motions hoping a deadline is missed and they can move things further along. When that happens, it makes even more work for prosecutors which eats up time they could be spending building cases
djbusby 4y ago
The "seal" is a Legal construct not a engineering/technical one.
- oliwarner 4y ago
  And before it was a digital version, a sealed file would be removed from the general filing system, kept under lock and key. They seem to have forgotten basic security principles.
  - m3047 4y ago
    Have you personally inspected those facilities, or in other words: on what do you base this generalized conjecture?
dragonwriter 4y ago
The same reason, in a health care context, that confidential patient data is: so that it an actually be worked with.
- throwaway7980 4y ago
  *so that it can cheaply be worked with
- m3047 4y ago
  So that it can be conveniently shared. I know "it's not supposed to be shared". Right? But that's policy, if a judge says "make it so" they'd have to. Right?
gwern 4y ago
Right? Every time I use PACER to look stuff up and I notice sealed-files in the docket, I think to myself, "PACER strikes me as very clunkily coded, and web programming is almost impossible to secure fully; apparently all that secures these files is simply the web app, they are foolish enough to commingle it all and count on access control denying the default of public access instead of storing them separately; I realize this is far more convenient than being offline or in separate systems entirely, but how has this not been hacked yet and all the sealed files exfiltrated?" Guess this answers that.
m3047 4y ago
True story... These people (https://www.nisc.coop/ https://www.nisc.coop/) make (and operate) software which is used by lots of infrastructury / governmenty organizations. (I leave the osint to you.) My cable company leases fiber from the city. The city built out the fiber because SCADA; they used to run the cable company. The city utility department uses SSNs as a PIN for customer accounts. Wouldn't let me change it. I eventually complained to the State Attorney General. Then they relented and let me set a PIN. It's not that they have good practices around any of this. The "app" they use to verify your PIN *shows them the PIN* or SSN. They justify this because their employees pass background checks. I'm sorry, I imagine that seems like a digression. So, back to the cable company. The cable company uses a version of NISC's software which *stores passwords in a retrievable format* and displays them for their customer service personnel. They justify this because their employees pass background checks. Welcome to 2022.

I imagine so people that should have access (like prosecutors) can get to them without visiting the court house (and potentially requesting copies of the original)

oliwarner 4y ago
I would have expected that a strong, physical audit trail would be a highly desirable thing. That said, I have no idea what the transaction volume is like here. My experience of TV crime investigation tells me these are rare occurrences, under warrant.
- nijave 4y ago
  Sealed files don't require warrants they are just court records that aren't publicly accessible. My understanding is motions (appeals or some other proceeding?) can be filed by a defendent (if that's the right term) and prosecution has a limited time frame to respond. Defense lawyers will just file bogus motions hoping a deadline is missed and they can move things further along. When that happens, it makes even more work for prosecutors which eats up time they could be spending building cases

djbusby 4y ago

The "seal" is a Legal construct not a engineering/technical one.

oliwarner 4y ago
And before it was a digital version, a sealed file would be removed from the general filing system, kept under lock and key. They seem to have forgotten basic security principles.
- m3047 4y ago
  Have you personally inspected those facilities, or in other words: on what do you base this generalized conjecture?

dragonwriter 4y ago

The same reason, in a health care context, that confidential patient data is: so that it an actually be worked with.

throwaway7980 4y ago
*so that it can cheaply be worked with
m3047 4y ago
So that it can be conveniently shared. I know "it's not supposed to be shared". Right? But that's policy, if a judge says "make it so" they'd have to. Right?

gwern 4y ago

Right? Every time I use PACER to look stuff up and I notice sealed-files in the docket, I think to myself, "PACER strikes me as very clunkily coded, and web programming is almost impossible to secure fully; apparently all that secures these files is simply the web app, they are foolish enough to commingle it all and count on access control denying the default of public access instead of storing them separately; I realize this is far more convenient than being offline or in separate systems entirely, but how has this not been hacked yet and all the sealed files exfiltrated?" Guess this answers that.

m3047 4y ago

True story... These people (https://www.nisc.coop/ https://www.nisc.coop/) make (and operate) software which is used by lots of infrastructury / governmenty organizations. (I leave the osint to you.) My cable company leases fiber from the city. The city built out the fiber because SCADA; they used to run the cable company. The city utility department uses SSNs as a PIN for customer accounts. Wouldn't let me change it. I eventually complained to the State Attorney General. Then they relented and let me set a PIN. It's not that they have good practices around any of this. The "app" they use to verify your PIN *shows them the PIN* or SSN. They justify this because their employees pass background checks. I'm sorry, I imagine that seems like a digression. So, back to the cable company. The cable company uses a version of NISC's software which *stores passwords in a retrievable format* and displays them for their customer service personnel. They justify this because their employees pass background checks. Welcome to 2022.