12 ms·

Byron Bay data breach victim told to pay Adidas, NBA $1.2M by US courts

202 points by ColinWright 3y ago

jongjong 3y ago
You wouldn't think there is a very good judicial process in place if it could charge someone of a crime without first establishing the identity of the perpetrator beforehand. What's to stop fictitious entities from being charged with fictitious crimes against fictitious victims? Surely the standard of proof should be higher...
- qingcharles 3y ago
  This was a civil case, not a criminal case[1]. In civil cases after the plaintiff has made a prima facie case the burden shifts to the defendant to dismiss the claims against them, if they can, usually at their cost. Lots of people end up with default judgments against them every day because the court systems are terribly difficult to navigate with no legal knowledge. Civil in rem forfeiture is even worse as most jurisdictions allow for the state to take your property with no court involvement at all if you fail to file the right paperwork at the right place at the right time. [1] I have been in court three different times and seen the wrong defendant brought from the jail to be released since they aren't the person being sought by the indictment, but a case of misidentification by law enforcement. Quite how these people managed to alert the jail authorities to the problem I do not know; having spent significant time in jail I have no idea how you would get any personnel to take seriously the idea that you "aren't supposed to be there."
mvdtnz 3y ago
This is absurd. This is just as much as indictment of ridiculous American courts as it is the corporations prosecuting such a case. What is happening in that clown country that a civil case against a person who wasn't even involved in the infraction can be judged liable when they are not even present to defend themselves? America is a bully nation.
- Aeolun 3y ago
  I don’t understand what the companies hope to gain out of this aside from loads of bad publicity?
  - nomilk 3y ago
    That was my first thought too. Perhaps companies can't easily differentiate between cases of stolen identity and cases where a bad actor claims their identity was stolen.
    - ganoushoreilly 3y ago
      Maybe I misread but if they were Exparte, were they implying she wasn't there and it's possible all these verdicts were handed down without any of her input? In that case the companies may not / wouldn't know? Either way still a horrible situation.
      - staticautomatic 3y ago
        Ex parte just means it’s an emergency and you need the court to move fast
        bbatsell 3y ago
        No, ex parte means not requiring a party that would normally be required. It is _also_ used in emergencies because the process of pleadings, answers, and replies would be too slow, so you are asking the court to temporarily ignore the rule that the other party respond before the court issues some sort of order or response.
        staticautomatic 3y ago
        You still have to argue your way out of notice.
  - prepend 3y ago
j-bos 3y ago
Situations like these keep bringing me back to the idea that important actions should require an actual, in person, human notary seal. Contract signings, online court service, title changes, etc should not be valid without an offline record examiner who affirms under threat of perjury that the parties involved are who they claim (or are claimed to be).
- colechristensen 3y ago
  Eh, I was forced to have a notary do something and it ended up being an apparently 20 year old dude at a UPS store looking at some papers for a few seconds. Not exactly the high trust exercise it’s made out to be.
  - hamandcheese 3y ago
    I suspect this could be improved by, say, installing the same biometric recognition machines they have use for border control at every post office/bank/etc. These machines could attest that you are present and signing something. They would still require some oversight, but one person could oversee many machines. I'm sure this is an unpopular idea on HN, but at least it's a way that our governments could use facial recognition/fingerprints/retina to reduce fraud.
    - colechristensen 3y ago
      Banks actually do a lot of this already, without you necessarily knowing about it when you visit a branch.
  - j-bos 3y ago
    It doesn't have to be perfect trust. The benefit is having a third party involved under oath, with a known identity, purpose, and personal liability.
- nmfisher 3y ago
  Some countries/jurisdictions do exactly that, and trust me, it's a massive pain in the ass. Would you really want to visit a notary just to set up an eBay account? Because that's what you're proposing. The existing system isn't foolproof but, by and large, it works perfectly well. If the transactions in TFA truly were fraudulent, no court is going to hold her liable. The bigger problem here is a US court being happy to issue ex parte judgments for someone who should have been trivially contactable.
gruez 3y ago
>She was then served electronically with papers from the US District Court of Florida outlining Adidas' case against her. I don't get it, based on this[1] it looks like electronic service is only possible if the party consented. That seems fairly reasonable. How would this have happened? Is there more to this? The docket for this case is here: https://www.courtlistener.com/docket/66634655/adidas-ag-v-the-individuals-business-entities-and-unincorporated/ https://www.courtlistener.com/docket/66634655/adidas-ag-v-th.... I'd be very interested to see what the "Certificate of Service" contains, but I don't have PACER access. [1] https://www.law.cornell.edu/rules/frcp/rule_5 https://www.law.cornell.edu/rules/frcp/rule_5
- deleted 3y ago
  [deleted]
- shirro 3y ago
  My understanding is there are international agreements (eg Hague Convention) when serving civil court documents to someone in another sovereign nation like Australia. US courts have no jurisdiction here and nobody cares about their rules. I think electronic service has similar limitations in Australia.
- mikeyouse 3y ago
  Jesus.. It's really bleak. It's mostly a link to this website: https://servingnotice.com/Da29d1x/index.html https://servingnotice.com/Da29d1x/index.html Apparently "Serving Notice dot com" is sufficient to say someone has been served? I downloaded the Pacer documents with Recap enabled so you should be able to see them on the CourtListener website.
  - gruez 3y ago
    >Apparently "Serving Notice dot com" is sufficient to say someone has been served? Apparently, because the judge allowed it. Looking at the relevant document[1], the reason that was allowed was that: 1. the defendant is foreign 2. "the defendants conducted their businesses over the Internet" 3. "the defendants used e-mail regularly in their businesses" 4. "the plaintiff shows e-mail is likely to reach defendants" [1] https://servingnotice.com/Da29d1x/015%20-%20221221%20[_]%20Order%20Granting%20Motion%20for%20Alt.%20Service.pdf https://servingnotice.com/Da29d1x/015%20-%20221221%20[_]%20O...
bagels 3y ago
How was the ex parte trial even allowed here? Did she not respond to the summons? Is this just something they do if the person is outside US jurisdiction?
- themoonisachees 3y ago
  The court docs say that the brands made the case that because the illegal business had been happening over the internet, reaching out to her via email was a satisfactory way of serving her. What a farce.
COGlory 3y ago
My brother in law had his identity stolen about 6 months ago. He went through the normal routine of cancelling everything, putting holds on everything, etc. He thought he was in the clear, until last week, he received a letter in the mail for a summons for several felonies, including fraud, in the state of Utah (he lives in PA). It is insane to me that PayPal, Venmo, VISA, etc, all can allow someone who isn't him to open accounts, run transactions, etc, but not have to bear the legal liability of it, and instead it appears to be him that is legally liable. IMO, the transacting companies here are the ones that need to be charged. I never consented into the American credit system, yet by virtue of being born here, all these companies can, and will, apparently let others open accounts in my name, with no liability.
- qingcharles 3y ago
  He's lucky he found out about the summons, because it's very common to commit a traffic infraction, get pulled over and then find yourself facedown at gunpoint when the cop finds out you have several warrants for crimes you never committed. And depending on your ethnicity it could certainly lead to your untimely demise by police if you got belligerent about it.
  - COGlory 3y ago
    He only found out because it got sent to his parents house, where he has not lived for 9 years.
  - tbrownaw 3y ago
    > very common Are there statistics on this somewhere?
    - jjoonathan 3y ago
      ALPRs are everywhere these days. "Very common" is probably understatement in this situation.
      - gruez 3y ago
boondoggle16 3y ago
So what do you do in a situation like this? I mean really? Total punisher mode, make other judges think twice and sacrifice yourself?
- mhb 3y ago
  Recoup your $1.2M using the identities of everyone up and down the chain of this travesty.
  - justinclift 3y ago
    Maybe do so across a sprinkling of (important) countries, so they get a taste of the international jurisdiction nightmare for themselves? ;)
- NotYourLawyer 3y ago
  Hire a lawyer and get it sorted out pretty easily, I would think.
  - jacquesm 3y ago
    Right because if some idiots in a country where you've never been get their paperwork wrong it should bankrupt you... Note that you're effectively arguing for your own book here, this shouldn't require a lawyer and it should have never gotten this far.
    - NotYourLawyer 3y ago
      I mean... mistakes get made. It shouldn't be hard to get this one reversed if that's all there is to it, but hiring a lawyer is absolutely the right way to make that happen. By all means, try to recover attorney's fees after the fact. But sticking your head in the sand and complaining about it isn't going to get you very far.
      - jacquesm 3y ago
        This goes well beyond mistakes, it is utterly absurd that the judge would not look at this more closely absent a defendant in a country on the other side of the planet, especially when this kind of money is involved. It's not a $50 parking ticket. Imagine yourself in their situation, having to defend a legal case in court in a place where you've never been to that has no bearing on anything you've done in your life. That makes the world's population open to being sued for profit in these courts because the courts simply don't do their job. A mistake is when you pass the pepper instead of the salt. This is ruining someone's life. From TFA: "Ms Luke has engaged an intellectual property lawyer in the United States, with an initial engagement fee of $US10,000 ($14,800), in a bid to have the rulings overturned and the damages retracted. " "The single mother of four said the situation was taking its toll. "The anxiety that this causes, not knowing if they are going to come and take our house, can they freeze my assets, can they get access to my bank accounts? "We just don't know and it really is a case of guilty until I can prove otherwise."" That engagement fee is on the low side and yet I think that 99% of the people that might get caught up in stuff like this have absolutely no way of paying that kind of money to correct something they have part in. Besides, the suggestion that you can recoup your legal fees is not really fair: in practice you won't be able to recoup all your fees and you certainly won't be able to recover your time or the stress.
tedunangst 3y ago
> In court documents seen by the ABC, default judgements were handed down by the US courts and damages were awarded against Ms Luke of $US200,000 ($293,000) in the NBA case and $US1million ($1.5 million) in the Adidas matter. Can we see these documents?
- rahimnathwani 3y ago
  See point 3 on page 4 here: https://storage.courtlistener.com/recap/gov.uscourts.flsd.625220/gov.uscourts.flsd.625220.29.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.flsd.62...
jedberg 3y ago
If she was compromised by credential stuffing at PayPal, I have to say I'm disappointed. I actually wrote the anti-credential-stuffing code 20 years ago. It was one of the core component of PayPal security. We were one of the first sites to get those kinds of attacks so we got good at stopping them. I would be sad if that skillset had been lost.
- latchkey 3y ago
  If Paypal required non-sms based 2FA on all logins, would that help stop the issue?
  - RachelF 3y ago
    Paypal had it, then removed it, then added it again recently.
    - deleted 3y ago
      [deleted]
  - jedberg 3y ago
    Sure, but also it would piss off unsophisticated users and also cause a huge increase in customer service issues with people getting locked out. That why it keeps flipping between required and optional. Way back then we would send RSA tokens to the top users to stop them from getting hacked, but since they cost $10 each and required training and setup with an agent, only top users would get them.
    - themoonisachees 3y ago
      If you're talking about RSA tokens as in the tokens sold by RSA Security the company, my company uses them and my team is in charge of their issuance. We've estimated the total including man-hours cost of issuing a single token at about 250€. Sure in the grand scheme of things it isn't much but I can't imagine it'd be better for PayPal, and that gets expensive fast if you send them to clients and not just employees. Part of this is of course genuine security verifications but a lot of it is due to RSA Security's obtuse design decisions. We tend to avoid them entirely and instead rely on modern SAML providers with app-based 2FA whenever we can now.
javajosh 3y ago
"In both cases, Adidas and the NBA were given leave by the courts to run the cases ex parte — without a requirement for all parties in the case to be present. " Wait, what? I thought habeas corpus was a thing in the US?
- anigbrowl 3y ago
  Habeas corpus only applies to criminal cases, and it's about the state having to justify its detention of an arrested person. You can be tried and convicted in absentia although this is quite unusual. But you see a few murder cases prosecuted against fugitives every year if the evidence is strong enough.
  - javajosh 3y ago
    Well that's terrifying. People can sue you in civil court and you don't even have to be present or notified that the trial is happening and then be on the hook for millions of dollars? Am I the only one who thinks there's something wrong with that?
    - anigbrowl 3y ago
      I'm just explaining why habeas corpus isn't the issue here. My understanding is you do have to be notified for civil suits, but the article is so poorly written it's hard to understand exactly what the legal issues were and I don't feel like spending an hour researching the case.
- NotYourLawyer 3y ago
  This isn't a criminal trial.
empyrrhicist 3y ago
A boring dystopia indeed.
michaelteter 3y ago
This is really stupid. Follow the money. If she had been responsible for the theft, the money collected should somehow be traceable back to her. Obviously it would not be, and given the data breach she would have plausible deniability. Furthermore, no sane lawyer would hope to recover such large numbers from a single mother of four children. There is no value in prodding a legal system to render a pointless judgement against a plaintiff who is very likely not responsible for the crime.
coding123 3y ago
It's crazy that a lot of this crap is just associates hiring paper throwers that just keep this shit going. Responding to the cases just raises a blip somewhere and it's passed onto another yet higher-level paper shuffler. But in the end, the courts just keep awarding because Shifferd-Melnap-Hamilton (fake name), a well trusted legal firm, always wins therefore should continue winning.
testemailfordg2 3y ago
Strange co-incident, just woke up from a dream about something similar where a deep state mole remained annonymous using these kind of transactions.....Yikes, not a good start to the day, going to bed again...
tjpnz 3y ago
The tl;dr is that the victim was Australian and the court proceedings were heard in the US. Unless they're put before a court in Australia she's under no obligation to pay. Knowing a bit about Australian society it would not go down well if they tried. I would've used the money she spent on a US IP lawyer to sue Medibank for negligently allowing her personal information to be hacked and sold on the dark web. At the very least I hope she's part of the class action.
- tiew9Vii 3y ago
  She’s under no obligation to pay but I do wonder if she ever decides to take a trip to the US if she will be escorted away from the airport under police escort on landing. That’s a big worry if I was in her shoes. The next big data breach in Australia will be from the wave or realestate rental “startups”, it’s only a matter of time. The sites are badly designed which doesn’t give much faith in security. Also the largest being a Murdoch subsidiary which I guess the data conveniently has huge money value for ad targeting… The online rental application companies collect (require) more data than any paper rental application form, credit card/bank/mortgage application, or visa application. It’s also unregulated! They’ve positioned themselves so a large number of rental applications have to go through them to apply. The amount of detailed sensitive pii data they hold has to be huge. It’s a treasure trove for any hacker and an easier target than a bank or insurance company.
  - r00fus 3y ago
    > She’s under no obligation to pay but I do wonder if she ever decides to take a trip to the US if she will be escorted away from the airport under police escort on landing. That’s a big worry if I was in her shoes. Do connecting flights in the US count? It's possible also that airlines can reroute flights to connect through the US.
    - royroyroys 3y ago
      There are no international terminals in the US so you will need to enter the US if flying via the US.
ryandrake 3y ago
"Identity Theft" shouldn't even be a thing. Someone falsifies documents and takes out a loan or something that should not have been approved. That's bank fraud and should be an issue entirely between the fraudster and the lender/bank. Somehow banks have re-named it from "bank fraud" to "identity theft," deftly shifting responsibility onto some unrelated third party, who now has to deal with it. "Your identity was stolen! That makes you the victim. Now go help fix it!" Banks should not be able to shift the blame. They did a crappy job and lent money or opened an account for someone they shouldn't have. They are the ones who should bear the burden of mopping up their mistake.
- jaredandrews 3y ago
  Yes thank you. This is my "actually it's GNU + Linux" tic, please fellow Americans (and I would be interested in learning if this problem exists in other countries) do not accept the framing that a bank giving a loan to someone they thought was you is _your problem_! It's their problem! We should not be normalizing this phrase or practice.
  - codetrotter 3y ago
    > I would be interested in learning if this problem exists in other countries In Norway you can voluntarily register as not wanting to allow credit assessments to be performed on you. This in turn can help a bit because it results in most attempts at making loans in your name not being possible. https://www.datatilsynet.no/regelverk-og-verktoy/sporsmal-svar/kredittopplysning/hvordan-sette-sperre/ https://www.datatilsynet.no/regelverk-og-verktoy/sporsmal-sv... There are four companies in Norway that do credit assessments. You have to individually register your desire to not allow credit assessments for your name with all four of these. https://tfinans.no/blogg/frivillig-kredittsperre https://tfinans.no/blogg/frivillig-kredittsperre But then, what protects you against someone simply requesting that your credit is unlocked and then taking loans in your name after all? Well, from what I gather one would have to use BankID to confirm that credit is to be unlocked. So even if someone steals my passport, they will not immediately be able to unlock my credit. They’d have to jump through a bunch of hoops to also steal my BankID.
harry8 3y ago
Paypal are terrible and should be closed down. I had a paypal account. They demanded copies of my govt. ID. I refused and said close the account. I only ever used it to make payment to web shops using my credit card. Paypal refused repeatedly to simply close the account given their change in terms of service to which I do NOT agree. Will someone hack into paypal? Absolutely they will and it will have happened multiple times since this debacle. Will someone hacking paypal then use this account which should not exist to do something that causes a problem for me? Paypal are responsible for this. This is 100% paypal's problem. Paypal should be on the wrong end of the most expensive litigation seen in this are from which they do not survive. Paypal's actions in this area are quite deliberate and they know and understand the consequences to people. Paypal are foul.
Atsuii 3y ago
To give context to people who may have not heard; there has been a MASSIVE amount of high profile data breaches in the Australia in the past 12 months with zero consequences for the businesses involved. In a 6 month period I had; - My private health insurance data leaked (AHM/Medibank) - including claim history, medicare number, password, username, email, phone - My old phone account (Optus) - including my phone number, my current passport number(!!!), current address, phone. - My old credit card account (Latitude finance) - including my current passport, driver license, my income history and bank statements that was provided to get the credit card originally, address, phone, email The ONLY thing that any of these businesses have done is pay for a replacement passport and a 12 month credit watch. Optus wasn't even a 'breech', they had an API exposed with the all the data! How is someone meant to protect themselves from this? It is pure negligence. Until governments legislate that the punishment for exposing personal data is more expensive than the work and infrastructure required to keep it secure this will continue to happen.
- blitzar 3y ago
  > Until governments legislate that the punishment for exposing personal data is more expensive The EU did. Everyone, for some inexplicable reason hates it; and not the casual hate one spews when it rains or traffic is bad but a deep visceral hatred normally reserved for war criminals or kiddie fiddlers.
  - nailer 3y ago
    I'n my experience people hate cookie warnings, but few people hate companies being punished for leaks.
bunnie 3y ago
Looking at the court documents, it seems shady organizations registered a bunch of domain names that are used in the trade of brand-name athletic gear. The victim's identity was used to register one of those domain names, but just looking at the other registrations it's pretty clear the organizations are based out of China. In this context, the case brought by the brand owners is a little more reasonable -- if they did not try to defend their brands against this level of counterfeiting, then, they can be found to have lacked diligence in defending their trademarks. However, in the case of the victim, her owing $1.2mm in penalties hinges on her identity being used as the owner of some domain names that contain these brands' names. I suppose if the victim had "infinite resources" the next step as the victim would be to file a lawsuit against the domain name registrars for claiming she owned the sites. If the registrar would remove her stolen identity from the site then the suit would have no basis to link her to the domain names and she would be cleared. But then again, what incentive would a domain name registrar have to remove your stolen ID as the owner? If they simply agreed to do it when asked, then anyone could send a fake letter to the registrar claiming you don't own your DNS records and remove you as the owner of them. Genuine question to HN readers -- if you woke up tomorrow and found a whois entry that had your name and details listed as owner for a site that traded in illicit goods and/or morally objectionable content, how would one go about correcting that?
- Supermancho 3y ago
  globalsupport@icann.org and contacting the registrar to start. File a police report (this will help if anyone comes to visit your address) regarding identity theft. Contact the IRS regarding identity theft and possible foreign dba. Contact the post office if you dont have a locked mailbox..also, if you get any domain related mail, it can elevate the federal response. Talk to your bank about invalidating all checks and putting a limit on daily withdrawls/spending. This is just off the top of my head. It is a huge headache that will trouble you for a few years.
  - themoonisachees 3y ago
    So in other words, the state that results from wrongfully typing someone's name in a textbox that is never verified when buying the domain is a multi-year endeavour for that person? Surely there has to be a better way.
randomcarbloke 3y ago
Surely this is unenforceable given she is not a US citizen or resident?
mhb 3y ago
So if there was a crime, and it was committed by the person whose identity was "stolen", is the implication that there is no reason for law enforcement to investigate the person who "stole" it?

202 points by ColinWright 3y ago

You wouldn't think there is a very good judicial process in place if it could charge someone of a crime without first establishing the identity of the perpetrator beforehand. What's to stop fictitious entities from being charged with fictitious crimes against fictitious victims? Surely the standard of proof should be higher...

qingcharles 3y ago
This was a civil case, not a criminal case[1]. In civil cases after the plaintiff has made a prima facie case the burden shifts to the defendant to dismiss the claims against them, if they can, usually at their cost. Lots of people end up with default judgments against them every day because the court systems are terribly difficult to navigate with no legal knowledge. Civil in rem forfeiture is even worse as most jurisdictions allow for the state to take your property with no court involvement at all if you fail to file the right paperwork at the right place at the right time. [1] I have been in court three different times and seen the wrong defendant brought from the jail to be released since they aren't the person being sought by the indictment, but a case of misidentification by law enforcement. Quite how these people managed to alert the jail authorities to the problem I do not know; having spent significant time in jail I have no idea how you would get any personnel to take seriously the idea that you "aren't supposed to be there."

mvdtnz 3y ago

This is absurd. This is just as much as indictment of ridiculous American courts as it is the corporations prosecuting such a case. What is happening in that clown country that a civil case against a person who wasn't even involved in the infraction can be judged liable when they are not even present to defend themselves? America is a bully nation.

Aeolun 3y ago
I don’t understand what the companies hope to gain out of this aside from loads of bad publicity?
- nomilk 3y ago
  That was my first thought too. Perhaps companies can't easily differentiate between cases of stolen identity and cases where a bad actor claims their identity was stolen.
  - ganoushoreilly 3y ago
    Maybe I misread but if they were Exparte, were they implying she wasn't there and it's possible all these verdicts were handed down without any of her input? In that case the companies may not / wouldn't know? Either way still a horrible situation.
    - staticautomatic 3y ago
      Ex parte just means it’s an emergency and you need the court to move fast
      - bbatsell 3y ago
        No, ex parte means not requiring a party that would normally be required. It is _also_ used in emergencies because the process of pleadings, answers, and replies would be too slow, so you are asking the court to temporarily ignore the rule that the other party respond before the court issues some sort of order or response.
        staticautomatic 3y ago
        You still have to argue your way out of notice.
- prepend 3y ago

j-bos 3y ago

Situations like these keep bringing me back to the idea that important actions should require an actual, in person, human notary seal. Contract signings, online court service, title changes, etc should not be valid without an offline record examiner who affirms under threat of perjury that the parties involved are who they claim (or are claimed to be).

colechristensen 3y ago
Eh, I was forced to have a notary do something and it ended up being an apparently 20 year old dude at a UPS store looking at some papers for a few seconds. Not exactly the high trust exercise it’s made out to be.
- hamandcheese 3y ago
  I suspect this could be improved by, say, installing the same biometric recognition machines they have use for border control at every post office/bank/etc. These machines could attest that you are present and signing something. They would still require some oversight, but one person could oversee many machines. I'm sure this is an unpopular idea on HN, but at least it's a way that our governments could use facial recognition/fingerprints/retina to reduce fraud.
  - colechristensen 3y ago
    Banks actually do a lot of this already, without you necessarily knowing about it when you visit a branch.
- j-bos 3y ago
  It doesn't have to be perfect trust. The benefit is having a third party involved under oath, with a known identity, purpose, and personal liability.
nmfisher 3y ago
Some countries/jurisdictions do exactly that, and trust me, it's a massive pain in the ass. Would you really want to visit a notary just to set up an eBay account? Because that's what you're proposing. The existing system isn't foolproof but, by and large, it works perfectly well. If the transactions in TFA truly were fraudulent, no court is going to hold her liable. The bigger problem here is a US court being happy to issue ex parte judgments for someone who should have been trivially contactable.

gruez 3y ago

>She was then served electronically with papers from the US District Court of Florida outlining Adidas' case against her. I don't get it, based on this[1] it looks like electronic service is only possible if the party consented. That seems fairly reasonable. How would this have happened? Is there more to this? The docket for this case is here: https://www.courtlistener.com/docket/66634655/adidas-ag-v-the-individuals-business-entities-and-unincorporated/ https://www.courtlistener.com/docket/66634655/adidas-ag-v-th.... I'd be very interested to see what the "Certificate of Service" contains, but I don't have PACER access. [1] https://www.law.cornell.edu/rules/frcp/rule_5 https://www.law.cornell.edu/rules/frcp/rule_5

deleted 3y ago
[deleted]
shirro 3y ago
My understanding is there are international agreements (eg Hague Convention) when serving civil court documents to someone in another sovereign nation like Australia. US courts have no jurisdiction here and nobody cares about their rules. I think electronic service has similar limitations in Australia.
mikeyouse 3y ago
Jesus.. It's really bleak. It's mostly a link to this website: https://servingnotice.com/Da29d1x/index.html https://servingnotice.com/Da29d1x/index.html Apparently "Serving Notice dot com" is sufficient to say someone has been served? I downloaded the Pacer documents with Recap enabled so you should be able to see them on the CourtListener website.
- gruez 3y ago
  >Apparently "Serving Notice dot com" is sufficient to say someone has been served? Apparently, because the judge allowed it. Looking at the relevant document[1], the reason that was allowed was that: 1. the defendant is foreign 2. "the defendants conducted their businesses over the Internet" 3. "the defendants used e-mail regularly in their businesses" 4. "the plaintiff shows e-mail is likely to reach defendants" [1] https://servingnotice.com/Da29d1x/015%20-%20221221%20[_]%20Order%20Granting%20Motion%20for%20Alt.%20Service.pdf https://servingnotice.com/Da29d1x/015%20-%20221221%20[_]%20O...

bagels 3y ago

How was the ex parte trial even allowed here? Did she not respond to the summons? Is this just something they do if the person is outside US jurisdiction?

themoonisachees 3y ago
The court docs say that the brands made the case that because the illegal business had been happening over the internet, reaching out to her via email was a satisfactory way of serving her. What a farce.

COGlory 3y ago

My brother in law had his identity stolen about 6 months ago. He went through the normal routine of cancelling everything, putting holds on everything, etc. He thought he was in the clear, until last week, he received a letter in the mail for a summons for several felonies, including fraud, in the state of Utah (he lives in PA). It is insane to me that PayPal, Venmo, VISA, etc, all can allow someone who isn't him to open accounts, run transactions, etc, but not have to bear the legal liability of it, and instead it appears to be him that is legally liable. IMO, the transacting companies here are the ones that need to be charged. I never consented into the American credit system, yet by virtue of being born here, all these companies can, and will, apparently let others open accounts in my name, with no liability.

qingcharles 3y ago
He's lucky he found out about the summons, because it's very common to commit a traffic infraction, get pulled over and then find yourself facedown at gunpoint when the cop finds out you have several warrants for crimes you never committed. And depending on your ethnicity it could certainly lead to your untimely demise by police if you got belligerent about it.
- COGlory 3y ago
  He only found out because it got sent to his parents house, where he has not lived for 9 years.
- tbrownaw 3y ago
  > very common Are there statistics on this somewhere?
  - jjoonathan 3y ago
    ALPRs are everywhere these days. "Very common" is probably understatement in this situation.
    - gruez 3y ago

boondoggle16 3y ago

So what do you do in a situation like this? I mean really? Total punisher mode, make other judges think twice and sacrifice yourself?

mhb 3y ago
Recoup your $1.2M using the identities of everyone up and down the chain of this travesty.
- justinclift 3y ago
  Maybe do so across a sprinkling of (important) countries, so they get a taste of the international jurisdiction nightmare for themselves? ;)
NotYourLawyer 3y ago
Hire a lawyer and get it sorted out pretty easily, I would think.
- jacquesm 3y ago
  Right because if some idiots in a country where you've never been get their paperwork wrong it should bankrupt you... Note that you're effectively arguing for your own book here, this shouldn't require a lawyer and it should have never gotten this far.
  - NotYourLawyer 3y ago
    I mean... mistakes get made. It shouldn't be hard to get this one reversed if that's all there is to it, but hiring a lawyer is absolutely the right way to make that happen. By all means, try to recover attorney's fees after the fact. But sticking your head in the sand and complaining about it isn't going to get you very far.
    - jacquesm 3y ago
      This goes well beyond mistakes, it is utterly absurd that the judge would not look at this more closely absent a defendant in a country on the other side of the planet, especially when this kind of money is involved. It's not a $50 parking ticket. Imagine yourself in their situation, having to defend a legal case in court in a place where you've never been to that has no bearing on anything you've done in your life. That makes the world's population open to being sued for profit in these courts because the courts simply don't do their job. A mistake is when you pass the pepper instead of the salt. This is ruining someone's life. From TFA: "Ms Luke has engaged an intellectual property lawyer in the United States, with an initial engagement fee of $US10,000 ($14,800), in a bid to have the rulings overturned and the damages retracted. " "The single mother of four said the situation was taking its toll. "The anxiety that this causes, not knowing if they are going to come and take our house, can they freeze my assets, can they get access to my bank accounts? "We just don't know and it really is a case of guilty until I can prove otherwise."" That engagement fee is on the low side and yet I think that 99% of the people that might get caught up in stuff like this have absolutely no way of paying that kind of money to correct something they have part in. Besides, the suggestion that you can recoup your legal fees is not really fair: in practice you won't be able to recoup all your fees and you certainly won't be able to recover your time or the stress.

tedunangst 3y ago

> In court documents seen by the ABC, default judgements were handed down by the US courts and damages were awarded against Ms Luke of $US200,000 ($293,000) in the NBA case and $US1million ($1.5 million) in the Adidas matter. Can we see these documents?

rahimnathwani 3y ago
See point 3 on page 4 here: https://storage.courtlistener.com/recap/gov.uscourts.flsd.625220/gov.uscourts.flsd.625220.29.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.flsd.62...

jedberg 3y ago

If she was compromised by credential stuffing at PayPal, I have to say I'm disappointed. I actually wrote the anti-credential-stuffing code 20 years ago. It was one of the core component of PayPal security. We were one of the first sites to get those kinds of attacks so we got good at stopping them. I would be sad if that skillset had been lost.

latchkey 3y ago
If Paypal required non-sms based 2FA on all logins, would that help stop the issue?
- RachelF 3y ago
  Paypal had it, then removed it, then added it again recently.
  - deleted 3y ago
    [deleted]
- jedberg 3y ago
  Sure, but also it would piss off unsophisticated users and also cause a huge increase in customer service issues with people getting locked out. That why it keeps flipping between required and optional. Way back then we would send RSA tokens to the top users to stop them from getting hacked, but since they cost $10 each and required training and setup with an agent, only top users would get them.
  - themoonisachees 3y ago
    If you're talking about RSA tokens as in the tokens sold by RSA Security the company, my company uses them and my team is in charge of their issuance. We've estimated the total including man-hours cost of issuing a single token at about 250€. Sure in the grand scheme of things it isn't much but I can't imagine it'd be better for PayPal, and that gets expensive fast if you send them to clients and not just employees. Part of this is of course genuine security verifications but a lot of it is due to RSA Security's obtuse design decisions. We tend to avoid them entirely and instead rely on modern SAML providers with app-based 2FA whenever we can now.

javajosh 3y ago

"In both cases, Adidas and the NBA were given leave by the courts to run the cases ex parte — without a requirement for all parties in the case to be present. " Wait, what? I thought habeas corpus was a thing in the US?

anigbrowl 3y ago
Habeas corpus only applies to criminal cases, and it's about the state having to justify its detention of an arrested person. You can be tried and convicted in absentia although this is quite unusual. But you see a few murder cases prosecuted against fugitives every year if the evidence is strong enough.
- javajosh 3y ago
  Well that's terrifying. People can sue you in civil court and you don't even have to be present or notified that the trial is happening and then be on the hook for millions of dollars? Am I the only one who thinks there's something wrong with that?
  - anigbrowl 3y ago
    I'm just explaining why habeas corpus isn't the issue here. My understanding is you do have to be notified for civil suits, but the article is so poorly written it's hard to understand exactly what the legal issues were and I don't feel like spending an hour researching the case.
NotYourLawyer 3y ago
This isn't a criminal trial.

empyrrhicist 3y ago

A boring dystopia indeed.

michaelteter 3y ago

This is really stupid. Follow the money. If she had been responsible for the theft, the money collected should somehow be traceable back to her. Obviously it would not be, and given the data breach she would have plausible deniability. Furthermore, no sane lawyer would hope to recover such large numbers from a single mother of four children. There is no value in prodding a legal system to render a pointless judgement against a plaintiff who is very likely not responsible for the crime.

coding123 3y ago

It's crazy that a lot of this crap is just associates hiring paper throwers that just keep this shit going. Responding to the cases just raises a blip somewhere and it's passed onto another yet higher-level paper shuffler. But in the end, the courts just keep awarding because Shifferd-Melnap-Hamilton (fake name), a well trusted legal firm, always wins therefore should continue winning.

testemailfordg2 3y ago

Strange co-incident, just woke up from a dream about something similar where a deep state mole remained annonymous using these kind of transactions.....Yikes, not a good start to the day, going to bed again...

tjpnz 3y ago

The tl;dr is that the victim was Australian and the court proceedings were heard in the US. Unless they're put before a court in Australia she's under no obligation to pay. Knowing a bit about Australian society it would not go down well if they tried. I would've used the money she spent on a US IP lawyer to sue Medibank for negligently allowing her personal information to be hacked and sold on the dark web. At the very least I hope she's part of the class action.

tiew9Vii 3y ago
She’s under no obligation to pay but I do wonder if she ever decides to take a trip to the US if she will be escorted away from the airport under police escort on landing. That’s a big worry if I was in her shoes. The next big data breach in Australia will be from the wave or realestate rental “startups”, it’s only a matter of time. The sites are badly designed which doesn’t give much faith in security. Also the largest being a Murdoch subsidiary which I guess the data conveniently has huge money value for ad targeting… The online rental application companies collect (require) more data than any paper rental application form, credit card/bank/mortgage application, or visa application. It’s also unregulated! They’ve positioned themselves so a large number of rental applications have to go through them to apply. The amount of detailed sensitive pii data they hold has to be huge. It’s a treasure trove for any hacker and an easier target than a bank or insurance company.
- r00fus 3y ago
  > She’s under no obligation to pay but I do wonder if she ever decides to take a trip to the US if she will be escorted away from the airport under police escort on landing. That’s a big worry if I was in her shoes. Do connecting flights in the US count? It's possible also that airlines can reroute flights to connect through the US.
  - royroyroys 3y ago
    There are no international terminals in the US so you will need to enter the US if flying via the US.

ryandrake 3y ago

"Identity Theft" shouldn't even be a thing. Someone falsifies documents and takes out a loan or something that should not have been approved. That's bank fraud and should be an issue entirely between the fraudster and the lender/bank. Somehow banks have re-named it from "bank fraud" to "identity theft," deftly shifting responsibility onto some unrelated third party, who now has to deal with it. "Your identity was stolen! That makes you the victim. Now go help fix it!" Banks should not be able to shift the blame. They did a crappy job and lent money or opened an account for someone they shouldn't have. They are the ones who should bear the burden of mopping up their mistake.

jaredandrews 3y ago
Yes thank you. This is my "actually it's GNU + Linux" tic, please fellow Americans (and I would be interested in learning if this problem exists in other countries) do not accept the framing that a bank giving a loan to someone they thought was you is _your problem_! It's their problem! We should not be normalizing this phrase or practice.
- codetrotter 3y ago
  > I would be interested in learning if this problem exists in other countries In Norway you can voluntarily register as not wanting to allow credit assessments to be performed on you. This in turn can help a bit because it results in most attempts at making loans in your name not being possible. https://www.datatilsynet.no/regelverk-og-verktoy/sporsmal-svar/kredittopplysning/hvordan-sette-sperre/ https://www.datatilsynet.no/regelverk-og-verktoy/sporsmal-sv... There are four companies in Norway that do credit assessments. You have to individually register your desire to not allow credit assessments for your name with all four of these. https://tfinans.no/blogg/frivillig-kredittsperre https://tfinans.no/blogg/frivillig-kredittsperre But then, what protects you against someone simply requesting that your credit is unlocked and then taking loans in your name after all? Well, from what I gather one would have to use BankID to confirm that credit is to be unlocked. So even if someone steals my passport, they will not immediately be able to unlock my credit. They’d have to jump through a bunch of hoops to also steal my BankID.

harry8 3y ago

Paypal are terrible and should be closed down. I had a paypal account. They demanded copies of my govt. ID. I refused and said close the account. I only ever used it to make payment to web shops using my credit card. Paypal refused repeatedly to simply close the account given their change in terms of service to which I do NOT agree. Will someone hack into paypal? Absolutely they will and it will have happened multiple times since this debacle. Will someone hacking paypal then use this account which should not exist to do something that causes a problem for me? Paypal are responsible for this. This is 100% paypal's problem. Paypal should be on the wrong end of the most expensive litigation seen in this are from which they do not survive. Paypal's actions in this area are quite deliberate and they know and understand the consequences to people. Paypal are foul.

Atsuii 3y ago

To give context to people who may have not heard; there has been a MASSIVE amount of high profile data breaches in the Australia in the past 12 months with zero consequences for the businesses involved. In a 6 month period I had; - My private health insurance data leaked (AHM/Medibank) - including claim history, medicare number, password, username, email, phone - My old phone account (Optus) - including my phone number, my current passport number(!!!), current address, phone. - My old credit card account (Latitude finance) - including my current passport, driver license, my income history and bank statements that was provided to get the credit card originally, address, phone, email The ONLY thing that any of these businesses have done is pay for a replacement passport and a 12 month credit watch. Optus wasn't even a 'breech', they had an API exposed with the all the data! How is someone meant to protect themselves from this? It is pure negligence. Until governments legislate that the punishment for exposing personal data is more expensive than the work and infrastructure required to keep it secure this will continue to happen.

blitzar 3y ago
> Until governments legislate that the punishment for exposing personal data is more expensive The EU did. Everyone, for some inexplicable reason hates it; and not the casual hate one spews when it rains or traffic is bad but a deep visceral hatred normally reserved for war criminals or kiddie fiddlers.
- nailer 3y ago
  I'n my experience people hate cookie warnings, but few people hate companies being punished for leaks.

bunnie 3y ago

Looking at the court documents, it seems shady organizations registered a bunch of domain names that are used in the trade of brand-name athletic gear. The victim's identity was used to register one of those domain names, but just looking at the other registrations it's pretty clear the organizations are based out of China. In this context, the case brought by the brand owners is a little more reasonable -- if they did not try to defend their brands against this level of counterfeiting, then, they can be found to have lacked diligence in defending their trademarks. However, in the case of the victim, her owing $1.2mm in penalties hinges on her identity being used as the owner of some domain names that contain these brands' names. I suppose if the victim had "infinite resources" the next step as the victim would be to file a lawsuit against the domain name registrars for claiming she owned the sites. If the registrar would remove her stolen identity from the site then the suit would have no basis to link her to the domain names and she would be cleared. But then again, what incentive would a domain name registrar have to remove your stolen ID as the owner? If they simply agreed to do it when asked, then anyone could send a fake letter to the registrar claiming you don't own your DNS records and remove you as the owner of them. Genuine question to HN readers -- if you woke up tomorrow and found a whois entry that had your name and details listed as owner for a site that traded in illicit goods and/or morally objectionable content, how would one go about correcting that?

Supermancho 3y ago
globalsupport@icann.org and contacting the registrar to start. File a police report (this will help if anyone comes to visit your address) regarding identity theft. Contact the IRS regarding identity theft and possible foreign dba. Contact the post office if you dont have a locked mailbox..also, if you get any domain related mail, it can elevate the federal response. Talk to your bank about invalidating all checks and putting a limit on daily withdrawls/spending. This is just off the top of my head. It is a huge headache that will trouble you for a few years.
- themoonisachees 3y ago
  So in other words, the state that results from wrongfully typing someone's name in a textbox that is never verified when buying the domain is a multi-year endeavour for that person? Surely there has to be a better way.

randomcarbloke 3y ago

Surely this is unenforceable given she is not a US citizen or resident?

mhb 3y ago

So if there was a crime, and it was committed by the person whose identity was "stolen", is the implication that there is no reason for law enforcement to investigate the person who "stole" it?