9 ms·

Forging a judicial order is trivial. There is no way Verizon or anyone else knows if there is a specific form used in one of the 1700+ counties that comprise th

Forging a judicial order is trivial. There is no way Verizon or anyone else knows if there is a specific form used in one of the 1700+ counties that comprise the US. Federal subpoenae are even easier because they are uniform and are filed under seal. Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" The documents are written on simple copy paper and lack any kind of security features. Expect more of these as word gets out. Also, it's easy enough to file a small claims case and have a subpoena issued. Usually, there's no one to quash the subpoena. Civil subpoenas take a little longer than criminal ones and you have to pay to have them served, but so what?

chatmasta 3y ago
I'm always torn about this kind of exploit. On the one hand it's obviously vulnerable. On the other hand, securing it would require centralization of authority. I think I'm actually okay with accepting the tradeoff of insecure verification of "legitimacy," in exchange for decentralization of police power. But it's also worth noting that the "vulnerable" system is not the centuries old system of policing. If you get arrested by a fake cop, that system affords you legal remedies - it might take a few days but you'll see justice. The vulnerable system here is Verizon's process for responding to inbound messages claiming to be search warrants. And when this system fails, the victim has effectively no remedy - their stalker already read the data that Verizon sent him. So that's even less of a reason to increase centralization of the policing system. It won't solve the problem because the problem is with a different system.
- pas 3y ago
  every judiciary authorized to issue warrants should simply put them on their own website, put some id on the paper, folks can verify. what else is needed? these aren't supposed to be secret anyway
  - chatmasta 3y ago
    That's the least bad solution available IMO, since the Internet and DNS is the closest thing to decentralized we have available to us. But it requires a special TLD available exclusively to courts, which would make the TLD registry a centralized authority. What if a political activist refuses to validate the TLD of a court in the middle of Texas because of a disagreement with a ruling?
    - CaliforniaKarl 3y ago
      > But it requires a special TLD available exclusively to courts, which would make the TLD registry a centralized authority. The .gov domain already exists: https://beta.get.gov/domains/before/ https://beta.get.gov/domains/before/
  - gpm 3y ago
    I believe warrants are frequently sealed (secret, at least temporarily) to prevent people from destroying evidence/fleeing...
    - jszymborski 3y ago
      Right, but I can imagine a system where you can enter a "subpoena ID" and it can tell you if it's valid and when it was issued, possibly even which jurisdiction. That should be enough info where folks can verify the validity of their subpoena w/o revealing too much data. Including date of issuance and jurisdiction should help prevent using stale IDs to scare someone. If the subpoena is not sealed, the ID would show all the subpoena info, further narrowing down the ability to replay stale IDs. I'm definitely missing something obvious though because technical solutions are often not a panacea in cases like this
      - pas 3y ago
        no, I don't there's anything missing, other than the usual apathy toward systems reforms in most societies. this would probably work pretty well for these "utility-like big gatekeeper corps" which handle a shitton of subpoena requests, of course it doesn't help if a SWAT team is executing a someone-shout-and-knock-with-that-huge-doorfucker-implement on the wrong house. in many countries there are state-managed online id systems allowing sending documents to legal persons ... which would make it really really trivial. send the warrant to the department executing it and to the department handling these at Verizon. (I wouldn't be surprised to learn that most of the US states already have something like this, but not used like this.) it can be optional/voluntary for natural persons, it can be mandatory for companies above some size, etc.
- jncfhnb 3y ago
  Sorry who do you want having the right to subpoena these records besides the government?
  - chatmasta 3y ago
    There's more than one "government," that's what I mean by decentralization. There are thousands of courts throughout the country. I don't want some federal agency to be responsible for verifying the legitimacy of every warrant sent from every court.
    - gruez 3y ago
      How about having the federal government be responsible for publishing a list of public keys for each court jurisdiction?
      - h_r 3y ago
        That's what I was thinking... Why can't we solve this with non-repudiation crypto that is already available?
      - chatmasta 3y ago
        Does the court in each jurisdiction need to submit their public key for inclusion? Who in the federal government is responsible for verifying that a legitimate court submitted the key? What if the head of the agency responsible for verifying these courts institutes a policy that courts will lose their verification for rulings against abortion? What if two courts in neighboring jurisdictions claim to be the same court? They each submit a different public key, but both can verify they hold the private key that pairs with the public key they submitted. How does the federal agency even verify the identity of a courthouse? Do they need to physically visit them and meet with the judge to tap a Yubikey? What if somebody steals the YubiKey from the judge? What if a referendum dissolves a jurisdiction? What is the process for revocation of verification?
        gruez 3y ago
- smsm42 3y ago
  There's a solution for this, which is relatively easy to implement, if we dare to. Recognize data privacy as a right. Enable the victim to sue the leaking party, with easy recovery and costs, for any bad subpoena accepted, and pay substantial fine for violating the rights. Very heavily substantial if it leads to subsequent other damage (such as stalking or violence). Miraculously, the data hoarders would find ways to verify subpoenas (and design protocols and pay for development of necessary tools) very quickly, I think. Of course, this would require such law to actually survive the lobbying block of the data hoarders in the first place, and that's not likely to happen, alas.
  - kevin_thibedeau 3y ago
    We need an embarrassing data leak on Congress before they will be motivated. They covered their asses quick when Bork's video rentals were publicized.
    - autoexec 3y ago
      Even then they might likely just pass a law that makes it illegal to leak the data of a member of congress while leaving the rest of the American public screwed.
      - pixl97 3y ago
        "This law covers anyone in Congress or having assets worth 20 million dollars or more"
- ramraj07 3y ago
  They could just come up with a standard hologram sticker that certifies all govt orders..
- cortesoft 3y ago
  > And when this system fails, the victim has effectively no remedy - their stalker already read the data that Verizon sent him. Shouldn't the remedy be the guy goes to jail for a long time for forging a search warrant?
  - KennyBlanken 3y ago
    You're assuming the perpetrator can be identified, the US government gives a shit enough to pursue the matter (unless the victim is someone economically or politically elite, they won't), and the perp is somewhere our government can reach them in terms of extradition. The most relevant example I can think of would be a CCP hacker forging a search warrant for a US-based political activist. The government would probably care, but good luck identifying some random Chinese Army hacker, much less extraditing them.
- a_subsystem 3y ago
  Why can't the police come to one of the Verizon stores in person and have a manager there verify by calling back the officially posted number of the department they are from?
- timthelion 3y ago
  Cryptographic signatures exist. This is a trivial exploit to solve...
tiahura 3y ago
Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" Says who? I'm not aware of any rule or statute that prohibits the recipient of a subpoena from confirming with the court that it is legitimate? Usually, there's no one to quash the subpoena. There's always someone who can move to quash - the recipient. There's usually two people - the recipient and the opposing party. A federal subpoena includes the rule on how to do it right on the subpoena. https://www.uscourts.gov/sites/default/files/ao088b.pdf https://www.uscourts.gov/sites/default/files/ao088b.pdf As a side note, there are a myriad of potentially applicable statutes and case law relating to obtaining phone records. Depending on what was requested, a subpoena may not be required.
0xDEADFED5 3y ago
cryptome has been reporting on this shit for a long time. here's a document from 2010 that was the first result for for my first search: https://cryptome.org/isp-spy/le-tel-spy.pdf https://cryptome.org/isp-spy/le-tel-spy.pdf
eqvinox 3y ago
A search warrant is not a sealed subpoena, and you should always at least be able verify the people who issued it exist and have the authority to do so. I would hope you can also verify some identification number and major details, but I only know the German legal system, not the US one.
- KennyBlanken 3y ago
  Literally nothing stops these companies from having a staff member look up the courthouse's contact info on the official court website, call a clerk, and verify the warrant....except they don't want to pay for the labor to do so.
  - photonbeam 3y ago
    Perhaps they should be reimbursed for the cost
    - lnxg33k1 3y ago
      Perhaps if they can't operate without being a danger to society they shouldn't be allowed to exist
      - ZhadruOmjar 3y ago
        Is offering phone services to the public being a danger to society?
        eqvinox 3y ago
        Responding to legal requests is part of operating a phone service, and apparently they failed to do that without seriously endangering a stalking victim. I have no idea what exact laws and liabilities apply here, but my feeling is there's very likely going to be an undisclosed civil settlement between Verizon and the victim, and maybe some laughable fine (let's say ≤$10k) for violating privacy laws on the criminal side.
hn_throwaway_99 3y ago
> Forging a judicial order is trivial. That's like saying forging a plea from a Nigerian prince is trivial. Verizon should be deeply embarrassed by this - I mean the initial request came from a proton account with misspellings and grammar mistakes of a child. I don't know how Verizon does it, but I have a friend who works in the "respond-to-law-enforcement department" at one of the FAANGs. Given the company, they get tons of legal requests for info, but also tons of fraudulent ones, not to mention ones from real governmental organizations but that are dubious that they challenge. Point being they have extremely detailed processes and technology to respond to these requests. Verizon is the biggest cell phone company in the US, they can afford to not look like a total clown show in this regard.
- mariuolo 3y ago
  > Verizon should be deeply embarrassed by this Companies have no feelings, only pockets. Make carelessness expensive enough and they will care.
- gpm 3y ago
  > I mean the initial request came from a proton account with misspellings and grammar mistakes of a child. Many phishing attempts are shockingly bad like this - but that doesn't make it difficult to not have mispellings and grammar mistakes and come from a vaguely plausible domain (gmail?). If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense.
  - hn_throwaway_99 3y ago
    Two points: "Normal" phishing is a bad example, because many phishing emails notoriously use misspellings and bad grammar on purpose because scammers don't want to waste their time on people with half a brain, they only want people dumb enough to respond in spite of the ludicrous misspellings. But in this Verizon case, that logic doesn't apply, because there was only a single targeted recipient. With respect to "If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense", I wholeheartedly agree. My point was only that the fact that Verizon responded to this fake subpoena despite the reddest of red flags makes me think that they must have horrible procedures generally for verifying these types of requests.
usrbinbash 3y ago
> The documents are written on simple copy paper and lack any kind of security features. Wait, sorry, sorry, sorry, hold up, full stop...could you repeat that again? These orders arrive AS GODDAMN PAPER PRINTOUTS?!? Am I to understand that official orders that instruct telco providers to provide the private communication data of people, are transmitted as smushes of pigment on thin pieces of wood-paste, instead of a digitally signed file that the recipient can trivially verify with the ordering entities public key?
- Schiendelman 3y ago
  Yes, and until we pass real consequences for data breaches - protections for individuals - none of this will change.
  - bdavbdav 3y ago
    I think their point is that the fault here is on the system that requires people comply with non verifiable warrants, as opposed to the people handing over the data.
- esaym 3y ago
  What, gmail is better?
- eqvinox 3y ago
  > Am I to understand that official orders that instruct telco providers to provide the private communication data of people, are transmitted as smushes of pigment on thin pieces of wood-paste, Yes. Or a PDF attachment on an e-mail, possibly scanned from something that was printed a few minutes earlier because someone had to sign it with a pen. > trivially verify with the ordering entities public key You're underestimating the complexity of establishing a PKI infrastructure to handle federal, state and local authorities, signalling which keys have what exact authority, revoking compromised keys, … and then doing tech support for some redneck judge that owns more guns than electronic devices.
  - hnfong 3y ago
NoToP 3y ago
Usually subpoenas and search warrants come with a stamp, and more importantly records are returned to the court registrar, not handed over directly to the person claiming to be servicing a court order. The registrar would presumably say "wtf we didn't order this" and then the gig is up.
- chislobog 3y ago
  I don’t mean to engage in an argument here but that isn’t how emergency data requests or even most electronically issued compatible requests work in USA. edit: compliance, not compatible Most telecom providers have a compliance portal that only nominally engages with human supervision or legal departments. You fill out the form from your computer using the department credentials, typically on a semi hidden webpage belonging to the either the provider or serviced for the provider by a law enforcement program (like FBIs LEEP). Records are rarely returned to a court registrar for EDRs or any digital request, and in the case of a magistrate federal warrant they are frequently issued after the fact or by email. I suggest it would be trivial to get a real warrant, or real fake-warrant, by impersonating LE. I have personally seen warrant discussions and approvals between ADAs and small departments take place over personal gmail, if this tells you anything. More info (Krebs, I know) https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/ https://krebsonsecurity.com/2022/03/hackers-gaining-power-of... Verizon LERT https://cryptome.org/isp-spy/verizon-spy.pdf https://cryptome.org/isp-spy/verizon-spy.pdf
  - NoToP 3y ago
    Oh right. I am American but my experience with this aspect of the legal system is entirely in Australia. I just assumed that all western legal systems are nearly interchangeable.
cogman10 3y ago
> Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" Yes, they actually can. There should be contact information associated with a subpoena that verizon can both verify are legitimate and then directly contact to validate the subpoena. This comes up in the medical field and, due to much higher penalties if they respond to a fake, medical staff get trained to do just this [1]. HIPAA doesn't care if you are tricked into revealing HIPAA information. [1] https://www.hipaaexams.com/blog/medical-record-subpoena https://www.hipaaexams.com/blog/medical-record-subpoena
- yladiz 3y ago
  If the subpoena is fake, and contains fake contact info (like a phone number), how does the receiver verify it is actually a real number from the courts? I guess the phone numbers are public record?
  - chislobog 3y ago
    Oddly enough this is more complex in places with multiple jurisdictional overlap. Imagine a city with police force of 6,000 combined with country, federal, state, and university LE. You might have a total of 20 neighboring or overlapping agencies ranging from 6 to 6,000 employees. Personal cellphone numbers are used in LE sometimes, whatever one might think of that practice or implications for discovery and preservation.
  - dehugger 3y ago
    Independently validate contact information! don't use what's on the letter/form/email. This is basic security for everything, from Grandma's savings account on up. The State/Fed have public official websites with this information.
  - corobo 3y ago
    Much like when you receive mail from your bank, you call them via a known number. Never trust user input, even irl.
  - hiatus 3y ago

chatmasta 3y ago

I'm always torn about this kind of exploit. On the one hand it's obviously vulnerable. On the other hand, securing it would require centralization of authority. I think I'm actually okay with accepting the tradeoff of insecure verification of "legitimacy," in exchange for decentralization of police power. But it's also worth noting that the "vulnerable" system is not the centuries old system of policing. If you get arrested by a fake cop, that system affords you legal remedies - it might take a few days but you'll see justice. The vulnerable system here is Verizon's process for responding to inbound messages claiming to be search warrants. And when this system fails, the victim has effectively no remedy - their stalker already read the data that Verizon sent him. So that's even less of a reason to increase centralization of the policing system. It won't solve the problem because the problem is with a different system.

pas 3y ago
every judiciary authorized to issue warrants should simply put them on their own website, put some id on the paper, folks can verify. what else is needed? these aren't supposed to be secret anyway
- chatmasta 3y ago
  That's the least bad solution available IMO, since the Internet and DNS is the closest thing to decentralized we have available to us. But it requires a special TLD available exclusively to courts, which would make the TLD registry a centralized authority. What if a political activist refuses to validate the TLD of a court in the middle of Texas because of a disagreement with a ruling?
  - CaliforniaKarl 3y ago
    > But it requires a special TLD available exclusively to courts, which would make the TLD registry a centralized authority. The .gov domain already exists: https://beta.get.gov/domains/before/ https://beta.get.gov/domains/before/
- gpm 3y ago
  I believe warrants are frequently sealed (secret, at least temporarily) to prevent people from destroying evidence/fleeing...
  - jszymborski 3y ago
    Right, but I can imagine a system where you can enter a "subpoena ID" and it can tell you if it's valid and when it was issued, possibly even which jurisdiction. That should be enough info where folks can verify the validity of their subpoena w/o revealing too much data. Including date of issuance and jurisdiction should help prevent using stale IDs to scare someone. If the subpoena is not sealed, the ID would show all the subpoena info, further narrowing down the ability to replay stale IDs. I'm definitely missing something obvious though because technical solutions are often not a panacea in cases like this
    - pas 3y ago
      no, I don't there's anything missing, other than the usual apathy toward systems reforms in most societies. this would probably work pretty well for these "utility-like big gatekeeper corps" which handle a shitton of subpoena requests, of course it doesn't help if a SWAT team is executing a someone-shout-and-knock-with-that-huge-doorfucker-implement on the wrong house. in many countries there are state-managed online id systems allowing sending documents to legal persons ... which would make it really really trivial. send the warrant to the department executing it and to the department handling these at Verizon. (I wouldn't be surprised to learn that most of the US states already have something like this, but not used like this.) it can be optional/voluntary for natural persons, it can be mandatory for companies above some size, etc.
jncfhnb 3y ago
Sorry who do you want having the right to subpoena these records besides the government?
- chatmasta 3y ago
  There's more than one "government," that's what I mean by decentralization. There are thousands of courts throughout the country. I don't want some federal agency to be responsible for verifying the legitimacy of every warrant sent from every court.
  - gruez 3y ago
    How about having the federal government be responsible for publishing a list of public keys for each court jurisdiction?
    - h_r 3y ago
      That's what I was thinking... Why can't we solve this with non-repudiation crypto that is already available?
    - chatmasta 3y ago
      Does the court in each jurisdiction need to submit their public key for inclusion? Who in the federal government is responsible for verifying that a legitimate court submitted the key? What if the head of the agency responsible for verifying these courts institutes a policy that courts will lose their verification for rulings against abortion? What if two courts in neighboring jurisdictions claim to be the same court? They each submit a different public key, but both can verify they hold the private key that pairs with the public key they submitted. How does the federal agency even verify the identity of a courthouse? Do they need to physically visit them and meet with the judge to tap a Yubikey? What if somebody steals the YubiKey from the judge? What if a referendum dissolves a jurisdiction? What is the process for revocation of verification?
      - gruez 3y ago
smsm42 3y ago
There's a solution for this, which is relatively easy to implement, if we dare to. Recognize data privacy as a right. Enable the victim to sue the leaking party, with easy recovery and costs, for any bad subpoena accepted, and pay substantial fine for violating the rights. Very heavily substantial if it leads to subsequent other damage (such as stalking or violence). Miraculously, the data hoarders would find ways to verify subpoenas (and design protocols and pay for development of necessary tools) very quickly, I think. Of course, this would require such law to actually survive the lobbying block of the data hoarders in the first place, and that's not likely to happen, alas.
- kevin_thibedeau 3y ago
  We need an embarrassing data leak on Congress before they will be motivated. They covered their asses quick when Bork's video rentals were publicized.
  - autoexec 3y ago
    Even then they might likely just pass a law that makes it illegal to leak the data of a member of congress while leaving the rest of the American public screwed.
    - pixl97 3y ago
      "This law covers anyone in Congress or having assets worth 20 million dollars or more"
ramraj07 3y ago
They could just come up with a standard hologram sticker that certifies all govt orders..
cortesoft 3y ago
> And when this system fails, the victim has effectively no remedy - their stalker already read the data that Verizon sent him. Shouldn't the remedy be the guy goes to jail for a long time for forging a search warrant?
- KennyBlanken 3y ago
  You're assuming the perpetrator can be identified, the US government gives a shit enough to pursue the matter (unless the victim is someone economically or politically elite, they won't), and the perp is somewhere our government can reach them in terms of extradition. The most relevant example I can think of would be a CCP hacker forging a search warrant for a US-based political activist. The government would probably care, but good luck identifying some random Chinese Army hacker, much less extraditing them.
a_subsystem 3y ago
Why can't the police come to one of the Verizon stores in person and have a manager there verify by calling back the officially posted number of the department they are from?
timthelion 3y ago
Cryptographic signatures exist. This is a trivial exploit to solve...

tiahura 3y ago

Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" Says who? I'm not aware of any rule or statute that prohibits the recipient of a subpoena from confirming with the court that it is legitimate? Usually, there's no one to quash the subpoena. There's always someone who can move to quash - the recipient. There's usually two people - the recipient and the opposing party. A federal subpoena includes the rule on how to do it right on the subpoena. https://www.uscourts.gov/sites/default/files/ao088b.pdf https://www.uscourts.gov/sites/default/files/ao088b.pdf As a side note, there are a myriad of potentially applicable statutes and case law relating to obtaining phone records. Depending on what was requested, a subpoena may not be required.

0xDEADFED5 3y ago

cryptome has been reporting on this shit for a long time. here's a document from 2010 that was the first result for for my first search: https://cryptome.org/isp-spy/le-tel-spy.pdf https://cryptome.org/isp-spy/le-tel-spy.pdf

eqvinox 3y ago

A search warrant is not a sealed subpoena, and you should always at least be able verify the people who issued it exist and have the authority to do so. I would hope you can also verify some identification number and major details, but I only know the German legal system, not the US one.

KennyBlanken 3y ago
Literally nothing stops these companies from having a staff member look up the courthouse's contact info on the official court website, call a clerk, and verify the warrant....except they don't want to pay for the labor to do so.
- photonbeam 3y ago
  Perhaps they should be reimbursed for the cost
  - lnxg33k1 3y ago
    Perhaps if they can't operate without being a danger to society they shouldn't be allowed to exist
    - ZhadruOmjar 3y ago
      Is offering phone services to the public being a danger to society?
      - eqvinox 3y ago
        Responding to legal requests is part of operating a phone service, and apparently they failed to do that without seriously endangering a stalking victim. I have no idea what exact laws and liabilities apply here, but my feeling is there's very likely going to be an undisclosed civil settlement between Verizon and the victim, and maybe some laughable fine (let's say ≤$10k) for violating privacy laws on the criminal side.

hn_throwaway_99 3y ago

> Forging a judicial order is trivial. That's like saying forging a plea from a Nigerian prince is trivial. Verizon should be deeply embarrassed by this - I mean the initial request came from a proton account with misspellings and grammar mistakes of a child. I don't know how Verizon does it, but I have a friend who works in the "respond-to-law-enforcement department" at one of the FAANGs. Given the company, they get tons of legal requests for info, but also tons of fraudulent ones, not to mention ones from real governmental organizations but that are dubious that they challenge. Point being they have extremely detailed processes and technology to respond to these requests. Verizon is the biggest cell phone company in the US, they can afford to not look like a total clown show in this regard.

mariuolo 3y ago
> Verizon should be deeply embarrassed by this Companies have no feelings, only pockets. Make carelessness expensive enough and they will care.
gpm 3y ago
> I mean the initial request came from a proton account with misspellings and grammar mistakes of a child. Many phishing attempts are shockingly bad like this - but that doesn't make it difficult to not have mispellings and grammar mistakes and come from a vaguely plausible domain (gmail?). If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense.
- hn_throwaway_99 3y ago
  Two points: "Normal" phishing is a bad example, because many phishing emails notoriously use misspellings and bad grammar on purpose because scammers don't want to waste their time on people with half a brain, they only want people dumb enough to respond in spite of the ludicrous misspellings. But in this Verizon case, that logic doesn't apply, because there was only a single targeted recipient. With respect to "If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense", I wholeheartedly agree. My point was only that the fact that Verizon responded to this fake subpoena despite the reddest of red flags makes me think that they must have horrible procedures generally for verifying these types of requests.

usrbinbash 3y ago

> The documents are written on simple copy paper and lack any kind of security features. Wait, sorry, sorry, sorry, hold up, full stop...could you repeat that again? These orders arrive AS GODDAMN PAPER PRINTOUTS?!? Am I to understand that official orders that instruct telco providers to provide the private communication data of people, are transmitted as smushes of pigment on thin pieces of wood-paste, instead of a digitally signed file that the recipient can trivially verify with the ordering entities public key?

Schiendelman 3y ago
Yes, and until we pass real consequences for data breaches - protections for individuals - none of this will change.
- bdavbdav 3y ago
  I think their point is that the fault here is on the system that requires people comply with non verifiable warrants, as opposed to the people handing over the data.
esaym 3y ago
What, gmail is better?
eqvinox 3y ago
> Am I to understand that official orders that instruct telco providers to provide the private communication data of people, are transmitted as smushes of pigment on thin pieces of wood-paste, Yes. Or a PDF attachment on an e-mail, possibly scanned from something that was printed a few minutes earlier because someone had to sign it with a pen. > trivially verify with the ordering entities public key You're underestimating the complexity of establishing a PKI infrastructure to handle federal, state and local authorities, signalling which keys have what exact authority, revoking compromised keys, … and then doing tech support for some redneck judge that owns more guns than electronic devices.
- hnfong 3y ago

NoToP 3y ago

Usually subpoenas and search warrants come with a stamp, and more importantly records are returned to the court registrar, not handed over directly to the person claiming to be servicing a court order. The registrar would presumably say "wtf we didn't order this" and then the gig is up.

chislobog 3y ago
I don’t mean to engage in an argument here but that isn’t how emergency data requests or even most electronically issued compatible requests work in USA. edit: compliance, not compatible Most telecom providers have a compliance portal that only nominally engages with human supervision or legal departments. You fill out the form from your computer using the department credentials, typically on a semi hidden webpage belonging to the either the provider or serviced for the provider by a law enforcement program (like FBIs LEEP). Records are rarely returned to a court registrar for EDRs or any digital request, and in the case of a magistrate federal warrant they are frequently issued after the fact or by email. I suggest it would be trivial to get a real warrant, or real fake-warrant, by impersonating LE. I have personally seen warrant discussions and approvals between ADAs and small departments take place over personal gmail, if this tells you anything. More info (Krebs, I know) https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/ https://krebsonsecurity.com/2022/03/hackers-gaining-power-of... Verizon LERT https://cryptome.org/isp-spy/verizon-spy.pdf https://cryptome.org/isp-spy/verizon-spy.pdf
- NoToP 3y ago
  Oh right. I am American but my experience with this aspect of the legal system is entirely in Australia. I just assumed that all western legal systems are nearly interchangeable.

cogman10 3y ago

> Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" Yes, they actually can. There should be contact information associated with a subpoena that verizon can both verify are legitimate and then directly contact to validate the subpoena. This comes up in the medical field and, due to much higher penalties if they respond to a fake, medical staff get trained to do just this [1]. HIPAA doesn't care if you are tricked into revealing HIPAA information. [1] https://www.hipaaexams.com/blog/medical-record-subpoena https://www.hipaaexams.com/blog/medical-record-subpoena

yladiz 3y ago
If the subpoena is fake, and contains fake contact info (like a phone number), how does the receiver verify it is actually a real number from the courts? I guess the phone numbers are public record?
- chislobog 3y ago
  Oddly enough this is more complex in places with multiple jurisdictional overlap. Imagine a city with police force of 6,000 combined with country, federal, state, and university LE. You might have a total of 20 neighboring or overlapping agencies ranging from 6 to 6,000 employees. Personal cellphone numbers are used in LE sometimes, whatever one might think of that practice or implications for discovery and preservation.
- dehugger 3y ago
  Independently validate contact information! don't use what's on the letter/form/email. This is basic security for everything, from Grandma's savings account on up. The State/Fed have public official websites with this information.
- corobo 3y ago
  Much like when you receive mail from your bank, you call them via a known number. Never trust user input, even irl.
- hiatus 3y ago