3 ms·

>> The loophole, which a source demonstrated for The Intercept, allows genealogists working with police to manipulate search fields within a DNA comparison tool

by rolph 3y ago

>> The loophole, which a source demonstrated for The Intercept, allows genealogists working with police to manipulate search fields within a DNA comparison tool to trick the system into showing opted-out profiles. In records of communications reviewed by The Intercept, Moore and two other forensic genetic genealogists discussed the loophole and how to trigger it. In a separate communication, one of the genealogists described hiding the fact that her organization had made an identification using an opted-out profile. <<

dylan604 3y ago
The fact you have to trick the system to do something should give pause then and there that maybe what you are doing is not the expected behavior. By deliberately doing something like this acknowledges the user is aware of the behavior and is okay with doing it anyways. This should be used in determining level of "guilt" or curiosity getting the cat.
- WarOnPrivacy 3y ago
  > The fact you have to trick the system to do something should give pause This sort of Exceeding Access isn't being used to violate copyright or expose Gov wrongdoing. There is zero politician outrage over it, purchased or otherwise.
- 14 3y ago
  If this was a “hacker” who got caught doing this you know damn well that key point would be used to say “unauthorized access”
  - dylan604 3y ago
    hopefully, they're not using wget with the work around or they'd really be screwed
kelnos 3y ago
I'm surprised that evidence gathered through this method can't be thrown out in court. The customer that provided the DNA did not give consent to sharing the data, and the company holding the data did not give consent to share it with law enforcement (would be entertaining if the act of exploiting a security hole in the search form could be a CFAA violation on top of that). Of course, this doesn't stop parallel construction; once they find their likely suspects through the illegally-obtained genetic search, they can likely often construct a case without even mentioning the genetic tracing.
- rolph 3y ago
  >> they can likely often construct a case without even mentioning the genetic tracing<< I think that would be cause to throw the whole thing out, if it was eluted during discovery.
  - ralferoo 3y ago
    Actually, I've never really understood the reason behind this. Surely, it doesn't really matter WHY you suspected somebody in the first place. If there's enough other evidence to show irrefutably that they committed the crime, there shouldn't be a huge difference between the first tip coming from some random guy phoning the cops and saying "there's a dodgy looking guy here" or getting a random match from a DNA database? I can see the intent behind probable cause for e.g. traffic stops, because that is designed to stop prejudiced-based harassment. But if there is an extremely close DNA-match found randomly, that search hasn't caused any harm to anyone, and should be a perfectly good reason to investigate someone a little more thoroughly. Maybe it should be disclosed in the case, e.g. "we became suspicious because of the DNA matching, and further investigation showed the victim's blood all over his house, clothes, and the murder weapon that he'd put back in his tool rack" should be a slam dunk conviction not grounds for letting someone go on a technicality because e.g. there wasn't a nosy neighbour who'd reported them for being too noisy or whatever.
- superkuh 3y ago
  Using the interface in unintended (by the creators) ways is a prosecutable crime under the CFAA. People can be and have been imprisoned for it. https://en.wikipedia.org/wiki/Weev#Trial https://en.wikipedia.org/wiki/Weev#Trial is a notable example.
EvanAnderson 3y ago
If incrementing a counter in a URL got somebody sent to jail this absolutely should render evidence acquired this way inadmissible at the very least.

by rolph 3y ago

dylan604 3y ago

The fact you have to trick the system to do something should give pause then and there that maybe what you are doing is not the expected behavior. By deliberately doing something like this acknowledges the user is aware of the behavior and is okay with doing it anyways. This should be used in determining level of "guilt" or curiosity getting the cat.

WarOnPrivacy 3y ago
> The fact you have to trick the system to do something should give pause This sort of Exceeding Access isn't being used to violate copyright or expose Gov wrongdoing. There is zero politician outrage over it, purchased or otherwise.
14 3y ago
If this was a “hacker” who got caught doing this you know damn well that key point would be used to say “unauthorized access”
- dylan604 3y ago
  hopefully, they're not using wget with the work around or they'd really be screwed

kelnos 3y ago

I'm surprised that evidence gathered through this method can't be thrown out in court. The customer that provided the DNA did not give consent to sharing the data, and the company holding the data did not give consent to share it with law enforcement (would be entertaining if the act of exploiting a security hole in the search form could be a CFAA violation on top of that). Of course, this doesn't stop parallel construction; once they find their likely suspects through the illegally-obtained genetic search, they can likely often construct a case without even mentioning the genetic tracing.

rolph 3y ago
>> they can likely often construct a case without even mentioning the genetic tracing<< I think that would be cause to throw the whole thing out, if it was eluted during discovery.
- ralferoo 3y ago
  Actually, I've never really understood the reason behind this. Surely, it doesn't really matter WHY you suspected somebody in the first place. If there's enough other evidence to show irrefutably that they committed the crime, there shouldn't be a huge difference between the first tip coming from some random guy phoning the cops and saying "there's a dodgy looking guy here" or getting a random match from a DNA database? I can see the intent behind probable cause for e.g. traffic stops, because that is designed to stop prejudiced-based harassment. But if there is an extremely close DNA-match found randomly, that search hasn't caused any harm to anyone, and should be a perfectly good reason to investigate someone a little more thoroughly. Maybe it should be disclosed in the case, e.g. "we became suspicious because of the DNA matching, and further investigation showed the victim's blood all over his house, clothes, and the murder weapon that he'd put back in his tool rack" should be a slam dunk conviction not grounds for letting someone go on a technicality because e.g. there wasn't a nosy neighbour who'd reported them for being too noisy or whatever.
superkuh 3y ago
Using the interface in unintended (by the creators) ways is a prosecutable crime under the CFAA. People can be and have been imprisoned for it. https://en.wikipedia.org/wiki/Weev#Trial https://en.wikipedia.org/wiki/Weev#Trial is a notable example.

EvanAnderson 3y ago

If incrementing a counter in a URL got somebody sent to jail this absolutely should render evidence acquired this way inadmissible at the very least.