6 ms·

> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Som

> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Somewhere towards the end of the call, I asked them if it was okay to keep the emails. Why not at least ask, right? >...This isn't something I'm even remotely cool with, so we ended the call a couple minutes later, and agreed to have our lawyers speak going forward. Honestly, the city was acting in very good faith, but OP decided to troll them and refused to cooperate with the third party auditor. To this day we have to kind of accept the affidavit he signed that data is gone.

Uvix 3y ago
I wouldn't call the city asking for the writer to agree to a warrantless search "acting in very good faith".
- legitster 3y ago
  A warrant is only required for a police search. You can agree to have anyone search your property as a resolution to any legal agreement if you want to.
  - thsksbd 3y ago
    A warrant is required for all government search, and I can just as easily waive my right for a warrant w/ the police. In fact, a workers for the municipality is the very last government level Id want snooping in my house. Next thing I know Im getting fined for having the wrong colored bathroom tiles.
    - legitster 3y ago
      > A warrant is required for all government search This is not at all true. For example, if you enter into an agreement with your state to be a foster parent, you also have to agree for the state to inspect your home regularly. It's part of the agreement - no warrant required. The state is free to make search a condition of an agreement. So if the state wants to say "Agree to a search or we will pursue criminal proceedings", you are free to accept or deny their agreement.
      - plagiarist 3y ago
        Agreeing to a search as part of access to a nonessential service is quite different from being extorted with the thread of criminal proceedings if you don't allow them to violate your rights.
      - l33t7332273 3y ago
        I think this point is needlessly pedantic because it hasn’t much to do with the topic at hand. GP’s point was that you were wrong to say that warrants are _only_ required for police searches. The search we’re talking about here is very much the kind of search that warrants a warrant.
        legitster 3y ago
        At least in the state of Washington, only police officers are authorized to execute warrants. So I don't feel like I am being pedantic. If you are saying it requires a warrant, it's officially a police search. I feel like I am taking crazy pills in this thread and no one has an idea of what a warrant actually is and they are just throwing it around like a magic word.
    - dragonwriter 3y ago
      > A warrant is required for all government search, False. (As, also, is the upthread claim that "A warrant is only required for a police search") Reasonableness is required for all government search, warrants are usually (but not categorically, there are all kinds of established exceptions to the warrant requirement) required for reasonableness.
kelnos 3y ago
I would refuse to cooperate with the third party auditor as well. No one gets to scan my hard drive without a court order. And even then, I wouldn't provide the decryption passphrase unless I was legally required to. Even though there isn't anything illegal or incriminating on my hard drive (as far as I know, anyway), I wouldn't agree to let someone violate my privacy for a mistake they made. Regardless, this whole thing would be "verification theater". OP could have copied the records out to a flash drive before deleting them from the hard drive, and hid it in his floorboards, and there'd be no record he did that. Third-party audit would say "yep, looks like the files have been deleted off the hard drive", and that would be that. Also, "good faith"? The lawyer OP ended up talking to said that their behavior seemed to indicate they were moving in the direction of CFAA charges. While we can't know that for certain, that's quite the opposite of good faith.
- pierat 3y ago
  A simple affidavit under perjury should absolutely suffice. How do you know I didn't upload it to S3, some torrent, IPFS, or elsewhere? I'd tell them to fuck off if they want to lay hands on my computer.. or at least come back with a court order.
  - chaps 3y ago
    Yes, I did indeed sign an affidavit.
    - thsksbd 3y ago
      And did you have to sign it? What would have happened if you hadn't? Why do you have to sign a legally enforceable document because some idiot messed up?
      - 0cf8612b2e1e 3y ago
        Not OP, but signing it probably made the mess immediately disappear. Even if there was no legal requirement, the stress and potential expenses are not worth it if the data was genuinely deleted. Taking a moral stand has costs that not everyone can bear.
cyral 3y ago
OP could have easily copied the contents to another disk or remote server if they were malicious, and then still complied with the search. There is no way to prove the data was never moved to another system. That is besides the point that their mistake should not become his problem to deal with.
0cf8612b2e1e 3y ago
>… and refused to cooperate with the third party auditor Well, yeah. No way I am letting someone scan and archive my drives/data to correct their mistake. They broke other people’s privacy and now they want to break mine? Pound sand. Even if they could prove my drives had been wiped, that would do nothing to prove it had not been otherwise copied elsewhere.
- legitster 3y ago
  This is not how the law works. If enriched uranium shows up at your door, you don't just get to hold onto it just because someone screwed up.
  - anonexpat 3y ago
    Not quite equivalent. When the feds show up looking for the uranium, I can clearly see if they take my refrigerator with them when they leave.
  - eli 3y ago
    If I give the uranium back and they want to search my house anyway they better have a warrant
    - legitster 3y ago
      Okay, but if you demand a warrant to confirm you don't have uranium, you can't be surprised if they are going to treat you as hostile.
      - 0cf8612b2e1e 3y ago
        > The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. Yeah, who the hell does this guy think he is? We want to explore every nook of his house and he gets uppity? Clearly something to hide.
tetha 3y ago
So they make a grave mistake from a data protection point of view. Why do I need to give a contractor access to things on my drives like my work contracts, bank statements, other contracts, encrypted SSH keys, as well as some information other people gave me to keep redundant - because of their mistake? Especially because the average one of these contractors doesn't tend to exude competency. You know, like the first party I'm talking to which caused this whole disaster? Especially because it wouldn't help. If I wanted to, I'd have drives they don't know about, or containers they can't recognize.
chaps 3y ago
This was definitely not my first rodeo and I like to think I've done a good job in acting in good faith in future similar instances [1] for example. Every time I've reported something, the other side acts differently every single time. Sometimes they're friendly, sometimes they put out obvious traps ("prove it that you found HIPAA sensitive info"), and sometimes they're just thankful it didn't go worse. You gotta realize that we live in a world where people have been prosecuted for using nmap. So we have to ride a fine line between careful and aggressive. I don't expect this to be a thing that stops happening as I continue sending FOIAs. Recently a police agency released to me thousands of social security numbers from ALPR scans (of all things). When I reported it, they shrugged us off and asked us to redact the documents ourselves. When we refused (why would I accept that liability) to, they redacted more, but left in about 800 more SSNs. [1] https://www.vice.com/en/article/3aqagy/contractor-exposed-the-movements-of-people-wearing-ankle-gps-bracelets https://www.vice.com/en/article/3aqagy/contractor-exposed-th...
- legitster 3y ago
  I get it. But as someone who has worked a lot of helpdesk and customer service roles in my life, all I can do is whinge. These departments clearly do not have the processes or experience to respond correctly, so the brunt of the pain is going to fall on inexperienced and overworked public servants whose whole job is to be harassed by citizens. So please be nice!
  - chaps 3y ago
    Heh, the city called me a good samaritan for acting in good faith, plus completely redid their entire process afterwards, including escalation paths to make this sort of thing less aggressive and conflict oriented in the future. So, uh, I'm honestly not sure what to say when things ultimately ended up better in the end. And fwiw, I've worked at a high volume help desk too.
    - qingcharles 3y ago
      That's basically the opposite of the City of Chicago who did pretty much everything they could do behind the scenes to frustrate and ridicule you just for asking for some public information.
wddkcs 3y ago
As it should be- think of the possible abuse if a government entity could send you private information 'by mistake', and then be able to mandate a search of your property for that info.
jrockway 3y ago
I don't think the OP trolled them. It's their mistake, and he pointed out the mistake. "We'll hire a contractor to do whatever they want with your computer, or you go to jail." is not a fair way of resolving the situation. It cover's the mistake-maker's ass at great cost to the person who reported the mistake. Would you ever use a computer again if someone else of unknown intent had unlimited access to it for an extended period of time? I certainly wouldn't. The suggested remedy isn't even effective. You can't prove that you deleted something. It could all be on an SD card buried under a rock somewhere, regardless of what the consultant finds. Frankly, given the track record of cooperation, the first offer should have been "just delete them and sign an affidavit attesting to that" which is exactly what happened.
- stevage 3y ago
  Unknown intent? The intent could not possibly be more clear.
  - chaps 3y ago
    Which is? :)
  - tgsovlerkhgsel 3y ago
    The intent could be either confirming the deletion of the data... or trying to find evidence to charge you with some kind of crime for having the data in the first place... or trying to dig up random dirt. Services which Kroll conveniently seems to also provide.
jacobsenscott 3y ago
Are you kidding? Let some contractor a local government hires copy your drives? Those people will be incompetent at best. Protecting your property isn't "trolling".

Uvix 3y ago

I wouldn't call the city asking for the writer to agree to a warrantless search "acting in very good faith".

legitster 3y ago
A warrant is only required for a police search. You can agree to have anyone search your property as a resolution to any legal agreement if you want to.
- thsksbd 3y ago
  A warrant is required for all government search, and I can just as easily waive my right for a warrant w/ the police. In fact, a workers for the municipality is the very last government level Id want snooping in my house. Next thing I know Im getting fined for having the wrong colored bathroom tiles.
  - legitster 3y ago
    > A warrant is required for all government search This is not at all true. For example, if you enter into an agreement with your state to be a foster parent, you also have to agree for the state to inspect your home regularly. It's part of the agreement - no warrant required. The state is free to make search a condition of an agreement. So if the state wants to say "Agree to a search or we will pursue criminal proceedings", you are free to accept or deny their agreement.
    - plagiarist 3y ago
      Agreeing to a search as part of access to a nonessential service is quite different from being extorted with the thread of criminal proceedings if you don't allow them to violate your rights.
    - l33t7332273 3y ago
      I think this point is needlessly pedantic because it hasn’t much to do with the topic at hand. GP’s point was that you were wrong to say that warrants are _only_ required for police searches. The search we’re talking about here is very much the kind of search that warrants a warrant.
      - legitster 3y ago
        At least in the state of Washington, only police officers are authorized to execute warrants. So I don't feel like I am being pedantic. If you are saying it requires a warrant, it's officially a police search. I feel like I am taking crazy pills in this thread and no one has an idea of what a warrant actually is and they are just throwing it around like a magic word.
  - dragonwriter 3y ago
    > A warrant is required for all government search, False. (As, also, is the upthread claim that "A warrant is only required for a police search") Reasonableness is required for all government search, warrants are usually (but not categorically, there are all kinds of established exceptions to the warrant requirement) required for reasonableness.

kelnos 3y ago

I would refuse to cooperate with the third party auditor as well. No one gets to scan my hard drive without a court order. And even then, I wouldn't provide the decryption passphrase unless I was legally required to. Even though there isn't anything illegal or incriminating on my hard drive (as far as I know, anyway), I wouldn't agree to let someone violate my privacy for a mistake they made. Regardless, this whole thing would be "verification theater". OP could have copied the records out to a flash drive before deleting them from the hard drive, and hid it in his floorboards, and there'd be no record he did that. Third-party audit would say "yep, looks like the files have been deleted off the hard drive", and that would be that. Also, "good faith"? The lawyer OP ended up talking to said that their behavior seemed to indicate they were moving in the direction of CFAA charges. While we can't know that for certain, that's quite the opposite of good faith.

pierat 3y ago
A simple affidavit under perjury should absolutely suffice. How do you know I didn't upload it to S3, some torrent, IPFS, or elsewhere? I'd tell them to fuck off if they want to lay hands on my computer.. or at least come back with a court order.
- chaps 3y ago
  Yes, I did indeed sign an affidavit.
  - thsksbd 3y ago
    And did you have to sign it? What would have happened if you hadn't? Why do you have to sign a legally enforceable document because some idiot messed up?
    - 0cf8612b2e1e 3y ago
      Not OP, but signing it probably made the mess immediately disappear. Even if there was no legal requirement, the stress and potential expenses are not worth it if the data was genuinely deleted. Taking a moral stand has costs that not everyone can bear.

cyral 3y ago

OP could have easily copied the contents to another disk or remote server if they were malicious, and then still complied with the search. There is no way to prove the data was never moved to another system. That is besides the point that their mistake should not become his problem to deal with.

0cf8612b2e1e 3y ago

>… and refused to cooperate with the third party auditor Well, yeah. No way I am letting someone scan and archive my drives/data to correct their mistake. They broke other people’s privacy and now they want to break mine? Pound sand. Even if they could prove my drives had been wiped, that would do nothing to prove it had not been otherwise copied elsewhere.

legitster 3y ago
This is not how the law works. If enriched uranium shows up at your door, you don't just get to hold onto it just because someone screwed up.
- anonexpat 3y ago
  Not quite equivalent. When the feds show up looking for the uranium, I can clearly see if they take my refrigerator with them when they leave.
- eli 3y ago
  If I give the uranium back and they want to search my house anyway they better have a warrant
  - legitster 3y ago
    Okay, but if you demand a warrant to confirm you don't have uranium, you can't be surprised if they are going to treat you as hostile.
    - 0cf8612b2e1e 3y ago
      > The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. Yeah, who the hell does this guy think he is? We want to explore every nook of his house and he gets uppity? Clearly something to hide.

tetha 3y ago

So they make a grave mistake from a data protection point of view. Why do I need to give a contractor access to things on my drives like my work contracts, bank statements, other contracts, encrypted SSH keys, as well as some information other people gave me to keep redundant - because of their mistake? Especially because the average one of these contractors doesn't tend to exude competency. You know, like the first party I'm talking to which caused this whole disaster? Especially because it wouldn't help. If I wanted to, I'd have drives they don't know about, or containers they can't recognize.

chaps 3y ago

This was definitely not my first rodeo and I like to think I've done a good job in acting in good faith in future similar instances [1] for example. Every time I've reported something, the other side acts differently every single time. Sometimes they're friendly, sometimes they put out obvious traps ("prove it that you found HIPAA sensitive info"), and sometimes they're just thankful it didn't go worse. You gotta realize that we live in a world where people have been prosecuted for using nmap. So we have to ride a fine line between careful and aggressive. I don't expect this to be a thing that stops happening as I continue sending FOIAs. Recently a police agency released to me thousands of social security numbers from ALPR scans (of all things). When I reported it, they shrugged us off and asked us to redact the documents ourselves. When we refused (why would I accept that liability) to, they redacted more, but left in about 800 more SSNs. [1] https://www.vice.com/en/article/3aqagy/contractor-exposed-the-movements-of-people-wearing-ankle-gps-bracelets https://www.vice.com/en/article/3aqagy/contractor-exposed-th...

legitster 3y ago
I get it. But as someone who has worked a lot of helpdesk and customer service roles in my life, all I can do is whinge. These departments clearly do not have the processes or experience to respond correctly, so the brunt of the pain is going to fall on inexperienced and overworked public servants whose whole job is to be harassed by citizens. So please be nice!
- chaps 3y ago
  Heh, the city called me a good samaritan for acting in good faith, plus completely redid their entire process afterwards, including escalation paths to make this sort of thing less aggressive and conflict oriented in the future. So, uh, I'm honestly not sure what to say when things ultimately ended up better in the end. And fwiw, I've worked at a high volume help desk too.
  - qingcharles 3y ago
    That's basically the opposite of the City of Chicago who did pretty much everything they could do behind the scenes to frustrate and ridicule you just for asking for some public information.

wddkcs 3y ago

As it should be- think of the possible abuse if a government entity could send you private information 'by mistake', and then be able to mandate a search of your property for that info.

jrockway 3y ago

I don't think the OP trolled them. It's their mistake, and he pointed out the mistake. "We'll hire a contractor to do whatever they want with your computer, or you go to jail." is not a fair way of resolving the situation. It cover's the mistake-maker's ass at great cost to the person who reported the mistake. Would you ever use a computer again if someone else of unknown intent had unlimited access to it for an extended period of time? I certainly wouldn't. The suggested remedy isn't even effective. You can't prove that you deleted something. It could all be on an SD card buried under a rock somewhere, regardless of what the consultant finds. Frankly, given the track record of cooperation, the first offer should have been "just delete them and sign an affidavit attesting to that" which is exactly what happened.

stevage 3y ago
Unknown intent? The intent could not possibly be more clear.
- chaps 3y ago
  Which is? :)
- tgsovlerkhgsel 3y ago
  The intent could be either confirming the deletion of the data... or trying to find evidence to charge you with some kind of crime for having the data in the first place... or trying to dig up random dirt. Services which Kroll conveniently seems to also provide.

jacobsenscott 3y ago

Are you kidding? Let some contractor a local government hires copy your drives? Those people will be incompetent at best. Protecting your property isn't "trolling".