4 ms·

How about asking the hacked person for permission to access their (other?) communications to prosecute the hacker? Too simple? Doesn't scale automatically? But

How about asking the hacked person for permission to access their (other?) communications to prosecute the hacker? Too simple? Doesn't scale automatically? But if the latter is the case, it's not something to be used sparingly.

im3w1l 3y ago
I'm guessing they don't want the target to know they are hacked.
- ipaddr 3y ago
  That should not be allowed. Police should give discloser.
  - JumpCrisscross 3y ago
    > That should not be allowed. Police should give discloser. This obviously cannot be a boundary condition for policing; it's adversarial. The question is whether this balances public needs against private rights. My gut feeling is the extensions should require court approval or disclosure.
    - roblabla 3y ago
      We're talking about disclosing to victims here. There should be no adversarial relationship between the police and a hacking victim that I can see.
      - lovemenot 3y ago
        An organisation might hack some of its allies, who would act as a contact canary. Reporting contact by the police to their friends.
  - elisbce 3y ago
    It is an adversarial game. The hackers could plant fake victims as monitors for police activities. This is an important reason why the police can't disclose to the victims that they were hacked or how they were hacked. However, I think we could at least make the laws such that the police can disclose certain information upon request post mortem. Absolutely not during investigation.
godelski 3y ago
This seems like a better check on the authoritative power imo. It can come with gag orders and so on. But no free citizen's property should be seized without explicit permission or extreme circumstances. But I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures). I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar. And we all know Goodhart, so I'm sure someone will exploit this like the parent suggested.
- pooper 3y ago
  > I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar. I was wondering how this would fit if an entity like equifax wanted to hide a data breach. However, reading your statement again, failure to report a security breach is unlawful in all fifty states as far as I can tell from a Google search (I anal, I don't know the law) so I'd imagine EU laws would be at least as strong as this. With that out of the way, yes, I am ok with this.
- hn_thrwn 3y ago
  This is like you getting mugged and the police stealing your car afterwards.
- krageon 3y ago
  > It can come with gag orders and so on Those are not really a thing in the EU (at least, not for regular police) > you're not free if the government can just seize your things when you have not broken any law This is something that can and does happen in the Netherlands, f.e. when the government feels they need to destroy your apartment and build a new one (as part of gentrification, generally). They are tangentially required to get you replacement housing, but not at the same price or in a similar location. Thus, not in any practical sense. If they cannot find this for you they will still kick you out and where you will live after is your problem.
- orra 3y ago
  > I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures). The Netherlands is party to the ECHR. Article 5 through 8 inclusive are relevant, especially Article 8. The Dutch constitution may also cover this ground, but I'm not familiar with it.
halJordan 3y ago
This doesn't scale. The fbi has tried for years to cooperatively remediate US businesses who have been hacked. And not just carders, although those too- but actual apts pursuing national security goals. And the frank news is that these businesses do not care. It isnt their responsibility, and they do have responsibilities. The infosec goobers on HN are about 5 years behind the times. Since about Obama (when the fbi started doing this in the us) it's been clear that the whole name/shame won't cause orgs to do better. Publishing active proof of concepts for exploits will not cause orgs to patch. It will take national legislation giving people federal-pound-me-in-ass-prison to get them to enforce cybersecurity.
- sh34r 3y ago
  I'll take it a few steps further than you. Legislation won't fix it. Until the military is authorized to start up a new branch of the military to redteam corporations, nothing will ever change. If they don't patch immediately, throw the entire C-suite in Gitmo under suspicion of being enemy combatants. Does that sound hyperbolic? It really shouldn't. These negligent corporate parasites are by far the greatest national security threat we've ever faced. bin Laden couldn't have dreamed of doing as much damage to the US as they have. China will hand us our asses on a silver platter if we ever go to war with them, because these rootless global capitalists have betrayed their country with every budget they've approved with 100x more given to stock buybacks than infosec. Taiwan better start reading Mao's little red book, because we don't stand a chance. Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It's just going to make it so no qualified person will ever take the CISO fall-guy position, only exacerbating the problem further. It's not the CISO's fault.
  - Cpoll 3y ago
    > Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It might? In civil engineering it kind of works like this, doesn't it?
    - sh34r 3y ago
grevos 3y ago
I concur!
themitigating 3y ago
How would they identify the person and get their contact info. I'm assuming their automated system is looking at IPs and services

im3w1l 3y ago

I'm guessing they don't want the target to know they are hacked.

ipaddr 3y ago
That should not be allowed. Police should give discloser.
- JumpCrisscross 3y ago
  > That should not be allowed. Police should give discloser. This obviously cannot be a boundary condition for policing; it's adversarial. The question is whether this balances public needs against private rights. My gut feeling is the extensions should require court approval or disclosure.
  - roblabla 3y ago
    We're talking about disclosing to victims here. There should be no adversarial relationship between the police and a hacking victim that I can see.
    - lovemenot 3y ago
      An organisation might hack some of its allies, who would act as a contact canary. Reporting contact by the police to their friends.
- elisbce 3y ago
  It is an adversarial game. The hackers could plant fake victims as monitors for police activities. This is an important reason why the police can't disclose to the victims that they were hacked or how they were hacked. However, I think we could at least make the laws such that the police can disclose certain information upon request post mortem. Absolutely not during investigation.

godelski 3y ago

This seems like a better check on the authoritative power imo. It can come with gag orders and so on. But no free citizen's property should be seized without explicit permission or extreme circumstances. But I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures). I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar. And we all know Goodhart, so I'm sure someone will exploit this like the parent suggested.

pooper 3y ago
> I'd still argue that you're not free if the government can just seize your things when you have not broken any law, and don't feel like that's a high bar. I was wondering how this would fit if an entity like equifax wanted to hide a data breach. However, reading your statement again, failure to report a security breach is unlawful in all fifty states as far as I can tell from a Google search (I anal, I don't know the law) so I'd imagine EU laws would be at least as strong as this. With that out of the way, yes, I am ok with this.
hn_thrwn 3y ago
This is like you getting mugged and the police stealing your car afterwards.
krageon 3y ago
> It can come with gag orders and so on Those are not really a thing in the EU (at least, not for regular police) > you're not free if the government can just seize your things when you have not broken any law This is something that can and does happen in the Netherlands, f.e. when the government feels they need to destroy your apartment and build a new one (as part of gentrification, generally). They are tangentially required to get you replacement housing, but not at the same price or in a similar location. Thus, not in any practical sense. If they cannot find this for you they will still kick you out and where you will live after is your problem.
orra 3y ago
> I don't know if the Dutch has anything similar to the US's 4th amendment (against unreasonable search an seizures). The Netherlands is party to the ECHR. Article 5 through 8 inclusive are relevant, especially Article 8. The Dutch constitution may also cover this ground, but I'm not familiar with it.

halJordan 3y ago

This doesn't scale. The fbi has tried for years to cooperatively remediate US businesses who have been hacked. And not just carders, although those too- but actual apts pursuing national security goals. And the frank news is that these businesses do not care. It isnt their responsibility, and they do have responsibilities. The infosec goobers on HN are about 5 years behind the times. Since about Obama (when the fbi started doing this in the us) it's been clear that the whole name/shame won't cause orgs to do better. Publishing active proof of concepts for exploits will not cause orgs to patch. It will take national legislation giving people federal-pound-me-in-ass-prison to get them to enforce cybersecurity.

sh34r 3y ago
I'll take it a few steps further than you. Legislation won't fix it. Until the military is authorized to start up a new branch of the military to redteam corporations, nothing will ever change. If they don't patch immediately, throw the entire C-suite in Gitmo under suspicion of being enemy combatants. Does that sound hyperbolic? It really shouldn't. These negligent corporate parasites are by far the greatest national security threat we've ever faced. bin Laden couldn't have dreamed of doing as much damage to the US as they have. China will hand us our asses on a silver platter if we ever go to war with them, because these rootless global capitalists have betrayed their country with every budget they've approved with 100x more given to stock buybacks than infosec. Taiwan better start reading Mao's little red book, because we don't stand a chance. Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It's just going to make it so no qualified person will ever take the CISO fall-guy position, only exacerbating the problem further. It's not the CISO's fault.
- Cpoll 3y ago
  > Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It might? In civil engineering it kind of works like this, doesn't it?
  - sh34r 3y ago

grevos 3y ago

I concur!

themitigating 3y ago

How would they identify the person and get their contact info. I'm assuming their automated system is looking at IPs and services