7 ms·

SparkFun Gets A Subpoena

120 points by phren0logy 14y ago

igorsyl 14y ago
Did Sparkfun send a representative to the court house? I'd be surprised if the court forced Sparkfun to show up and incur transportation and other related costs.
- jauer 14y ago
  Having received subpoenas for other things, no. You provide the information to the requesting agency and they take it to court. I assume if you were going to refuse you'd have to have a lawyer show up.
ChuckMcM 14y ago
Interesting take. The credit card skimming scams are coming fast and furious, they are easy money according to some folks. I have heard estimates at $2B/yr in the US in lost cash. That being said, a subpoena can be 'quashed' if you can prove that the agency is over reaching or 'fishing' but if you refuse it you put yourself in a position to be held in contempt by the court.
CHsurfer 14y ago
From the comments in the post: "Alright, it’s settled. We gotta build a robot to fight crime."
- bitwize 14y ago
  ED-209!
  - pavel_lishin 14y ago
    Not a problem, I'll just commit my crimes in stairwells.
- juiceandjuice 14y ago
  R. Daneel Olivah to the rescue.
K2h 14y ago
As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people have their info in the public record after this trial closes? wow... not sure I'd want my name on that list. At first I thought it was this[1] device, but on closer reading of the article it indicates a sparkfun silkscreen on a board, which I don't think the mag reader would have. Has anyone figured out which board was in the offending device? [1] http://www.sparkfun.com/products/8634 http://www.sparkfun.com/products/8634
- MBCook 14y ago
  I'm all for helping the police, I'd be pretty willing to give them information in a case like this. But I'm amazed their initial subpoena was for ALL orders from Georgia for a multi-month period. That's an amazingly wide net.
  - InclinedPlane 14y ago
    I suspect that the police in this case have no idea how big sparkfun is or how much business they do.
    - eridius 14y ago
      More likely, they just ask for everything in the hopes that they don't miss anything, and then rely on the targeted business to try to argue down the scope of the subpoena. The police have no incentive to try and limit the scope because they don't care about protecting the privacy of the people they're investigating.
      - sirclueless 14y ago
        > they don't care about protecting the privacy of the people they're investigating. That seems like an overbroad generalization. All else being equal, I'm sure the police don't want to compromise people's privacy. To be sure it's not their top priority, and if they had to choose between missing important data and dragging too many innocent people into an investigation they will probably err on the side of too much data. Even if the police don't much care about privacy, there are a lot of people who do. For example, there's no way a court would let any of this subpoenaed evidence into the record unless it was specifically relevant to a charge being brought.
eck 14y ago
SparkFun is lucky that the subpoena was for one of their products being used in a credit card skimmer and not an improvised cruise missile. Also, protip for criminals: make your own circuit boards without identifying marks.
- stilldavid 14y ago
  This is not the first time[1] we've had issues with our products showing up in the news for less than stellar reasons - luckily nothing as awful as an explosive device. As Nate said in the article, we know our parts can be used for good or for evil. If only there was less of the latter... [1] http://www.sparkfun.com/news/308 http://www.sparkfun.com/news/308
  - DanBC 14y ago
    Christopher Tappin claims he didn't know the batteries were going to be used for evil. (http://www.guardian.co.uk/world/2012/apr/27/chris-tappin-denies-terror-links http://www.guardian.co.uk/world/2012/apr/27/chris-tappin-den...)
    - stilldavid 14y ago
      I'm not entirely sure what you're getting at here. Should we stop selling Arduinos because they can be programmed for nefarious purposes, in addition to lowering the barrier to entry for embedded electronics in the classroom? How about spools of wire because wire can be made a part of something far more sinister than we can imagine? Should Apple stop selling the iPhone because it's also bluetooth-enabled? I understand where you're coming from, but think it's entirely ungrounded in this case. We actively work with the DHS on export control. There is a very real risk involved in selling the products we do, but I don't think that should stop us from our goal of education and - right there at the bottom of every page on our site - sharing ingenuity.
- pavel_lishin 14y ago
  > Also, protip for criminals: make your own circuit boards without identifying marks. Why? This seems like the perfect sort of thing to buy with someone's stolen credit card - it provides a red herring for the police to chase after, and at least in this case, gives the thieves a warning that an investigation is in process.
rudiger 14y ago
I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
- tonyarkles 14y ago
  For this specific case, they'd probably need to keep that accounting information for filing taxes. I'm not sure about the U.S., but in Canada we need to keep tax-related records for 7 years (I think).
- jlarocco 14y ago
  It may be theoretically possible, but it's probably more hassle than it's worth. It's easier for inventory tracking if you have a paper trail (or equivalent on disk). It's also good to have the receipts if you're ever audited. It's also inconvenient for the 99.999% of customers who aren't trying to cover their tracks, because without the info they wouldn't be able to check their order history. And it's not simply a matter of telling the law enforcement agency "We don't store that information." You most likely have to jump through the hoops to prove that you don't store the information.
- bunderbunder 14y ago
  If a company gives that response law enforcement will just come back with a warrant. You might say that's the case. But from their perspective it sounds fishy, and their only way to be sure is to take your servers and find out for themselves.
- eli 14y ago
  It seems like it would be difficult to run a business without keeping basic information on your current and past customers. Or are you suggesting lying to the police? That doesn't sound like a good idea at all.
- Tobu 14y ago
  It depends. Some countries have laws creating data retention requirements — in some contexts, for some time periods (with mandatory expiration in the EU), with sharing conditional on some purposes (hopefully for reasons relating to serious crime, but with some laws suspecting or detecting copyright infringement is good enough), with varying degrees of judicial review and oversight of bad-faith requests. https://en.wikipedia.org/wiki/Telecommunications_data_retention https://en.wikipedia.org/wiki/Telecommunications_data_retent... (concerns telcos, e-mail hosts, and web-hosts) The USA doesn't have a law like that, but it doesn't have a right to privacy either (there is a law about the privacy of correspondence that the NSA and telcos have ignored), so this sort of data retention law is sidestepped by a few large actors “voluntarily” collecting and sharing information. National security letters, gag orders, and whatever power incited AT&T to first do large scale warrantless interception mean that there can be a lot of abuse with little consequences for the participants. This might also apply to smaller actors, although less publicised (I don't know if there's any bad publicity the US government would care about). If you collect it, you might end up sharing it.
tomjen3 14y ago
Great so now anybody who reads those court records can steal those 20 peoples identities?
- dtparr 14y ago
  No. While the subpoena itself is public record, the information turned over would not be.
neurotech1 14y ago
I'm wondering if they track unique MAC or IMEI numbers for devices involved. A Bluetooth module would have a unique MAC ID, but I've never heard of that ID being used for network admin or security. MAC for WiFi or Ethernet is used for DHCP and MAC address filters. If the investigator were smart enough, they could ID the other coupled nodes connecting to the BlueSMiRF device. This technique is done to locate a WiFi node.
jwwest 14y ago
> 7. Complete credit card numbers used on Order(s) Can you fail PCI compliance if you're able and do this? What if you use a third party system such as Stripe where you have no access to the full credit card number?
- jws 14y ago
  Neither credit card numbers nor IP addresses were included because we don’t retain that information for our own protection as an organization. In general, you can not be compelled to produce something which you do not have. This is why you see legislation proposed with mandatory retention policies for various businesses.
- aaronblohowiak 14y ago
  >Can you fail PCI compliance if you're able and do this? There are many ways to achieve PCI compliance. Not having the data is simply the easiest.
jonknee 14y ago
Curious that in an effort to combat credit card skimming, the cops are requesting SparkFun to print out full credit card information for thousands of innocent parties.
kefs 14y ago
I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been encrypted.
- rmc 14y ago
  You think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure? You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this? If you were to email it encrypted, you'd have to send a follow email with the decryption key. Encryption would only be a inconvience and would not protect this information at all.
  - morsch 14y ago
    The fact that they don't have anything more secure than unencrypted email gives reason to doubt that they know how to protect information like that. An encrypted mail attachment would be a start -- if you use a second channel to deliver the secret key, e.g. call them up to tell them the password.
    - rmc 14y ago
      OK so you doubt their means. Look at the ends. Have there been many security breeches from the police/courts? Is this a large threat to personal security? I don't think so. Hence I think they must be doing something right here.
      - kefs 14y ago
        The following is just one group's public releases, spanning about 5 months, at approx 20gb. https://thepiratebay.se/user/AntiSecurity/ https://thepiratebay.se/user/AntiSecurity/ Just because you don't hear about vulnerabilities and attacks, doesn't mean they don't happen.
ck2 14y ago
As much as I foam at the mouth around here against many law enforcement actions, both parties did the right thing here. It's not like they showed up in the middle of the night and yanked their entire servers out of the office without a warrant and covered it up under "homeland security" or other nonsense. They did it the proper way through the courts with a judge and public documentation of their actions, and asked for only a subset of the data (limited to a year and GA). Kudos to SparkFun for responding with caution. That said, I think the lead will be useless to them because the person could have bought it anywhere, even outside the USA and brought it into GA. Apparently there are also clones now of sparkfun boards complete with logo.
- jsprinkles 14y ago
  It went this well because no copyright was violated.
- rickmb 14y ago
  Not quite the right thing: the subpoena is too broad. This is very typical for law enforcement everywhere these days. Luckily SparkFun was diligent enough to negotiate it down to relevant information, but it the "gimme all your data" attitude is a fundamental problem. This also extend to seizures ("gimme all your servers", not just the ones involved). The courts should never allow this, so although this is the proper process, it is failing. There's no point in insisting law enforcement goes through the proper channels if those proper channels don't do their job properly.
jayferd 14y ago
I had to stare at the word "SUBPOENAED" for a long time before concluding that it was indeed spelled correctly.
duggan 14y ago
For a european perspective; a company I used to work for was in this situation many times over. We worked with law enforcement and the data protection commission to ensure zero "pollution" of unrelated information into legal requirements (like subpoenas). If you end up being contacted by law enforcement for data, I'd recommend doing everything you can to help educate them about the information you carry. It might be tempting to volunteer as little as possible, but you also might be the first willing and knowledgeable technical person they've spoken to in some time, and starting a relationship like that on a good foot can be incredibly useful to your company; maybe even you personally. It can mean future requirements get handled without hassle, and may never even come to you at all if they know it's information you don't or can't carry. You can also help shape policy around how such things are handled for others in future. YMMV depending on jurisdiction, but it's worth considering contacts from law enforcement as an opportunity to build a healthy (two way) relationship.
mkramlich 14y ago
The interesting thing in this case is that the cops may have in effect caused more credit card numbers to be skimmed (innocent people's data taken against their will, and possibly sent or stored in plaintext somewhere along the way, putting them in further jeopardy) than the original thieves did with their skimmer. But rememeber, when a government agent does it (whether cops here or soldiers or drones abroad) it's good and just. Only when a "bad guy" does something is it evil and wrong. If the government spies on you, it's legal. When you spy on them, it's illegal. If you were to plot to overthrow the US government, for example, it's treason: illegal and "evil". Whereas if the US government plots to overthrow a foreign government, it's perfectly legal and ok. Fun stuff to think about.
micheljansen 14y ago
What gives me a bit of hope is the fact that after the scary letter with a lot of legalese, SparkFun and the Police Department were able to just talk about it as people and do what was best for everyone. The police was not interested in having to sift through a big pile of irrelevant data; SparkFun was not comfortable handing over sensitive information of innocent customers. I wish it were more common that people just talk and cut the crap.

120 points by phren0logy 14y ago

Did Sparkfun send a representative to the court house? I'd be surprised if the court forced Sparkfun to show up and incur transportation and other related costs.

jauer 14y ago
Having received subpoenas for other things, no. You provide the information to the requesting agency and they take it to court. I assume if you were going to refuse you'd have to have a lawyer show up.

ChuckMcM 14y ago

Interesting take. The credit card skimming scams are coming fast and furious, they are easy money according to some folks. I have heard estimates at $2B/yr in the US in lost cash. That being said, a subpoena can be 'quashed' if you can prove that the agency is over reaching or 'fishing' but if you refuse it you put yourself in a position to be held in contempt by the court.

CHsurfer 14y ago

From the comments in the post: "Alright, it’s settled. We gotta build a robot to fight crime."

bitwize 14y ago
ED-209!
- pavel_lishin 14y ago
  Not a problem, I'll just commit my crimes in stairwells.
juiceandjuice 14y ago
R. Daneel Olivah to the rescue.

K2h 14y ago

As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people have their info in the public record after this trial closes? wow... not sure I'd want my name on that list. At first I thought it was this[1] device, but on closer reading of the article it indicates a sparkfun silkscreen on a board, which I don't think the mag reader would have. Has anyone figured out which board was in the offending device? [1] http://www.sparkfun.com/products/8634 http://www.sparkfun.com/products/8634

MBCook 14y ago
I'm all for helping the police, I'd be pretty willing to give them information in a case like this. But I'm amazed their initial subpoena was for ALL orders from Georgia for a multi-month period. That's an amazingly wide net.
- InclinedPlane 14y ago
  I suspect that the police in this case have no idea how big sparkfun is or how much business they do.
  - eridius 14y ago
    More likely, they just ask for everything in the hopes that they don't miss anything, and then rely on the targeted business to try to argue down the scope of the subpoena. The police have no incentive to try and limit the scope because they don't care about protecting the privacy of the people they're investigating.
    - sirclueless 14y ago
      > they don't care about protecting the privacy of the people they're investigating. That seems like an overbroad generalization. All else being equal, I'm sure the police don't want to compromise people's privacy. To be sure it's not their top priority, and if they had to choose between missing important data and dragging too many innocent people into an investigation they will probably err on the side of too much data. Even if the police don't much care about privacy, there are a lot of people who do. For example, there's no way a court would let any of this subpoenaed evidence into the record unless it was specifically relevant to a charge being brought.

eck 14y ago

SparkFun is lucky that the subpoena was for one of their products being used in a credit card skimmer and not an improvised cruise missile. Also, protip for criminals: make your own circuit boards without identifying marks.

stilldavid 14y ago
This is not the first time[1] we've had issues with our products showing up in the news for less than stellar reasons - luckily nothing as awful as an explosive device. As Nate said in the article, we know our parts can be used for good or for evil. If only there was less of the latter... [1] http://www.sparkfun.com/news/308 http://www.sparkfun.com/news/308
- DanBC 14y ago
  Christopher Tappin claims he didn't know the batteries were going to be used for evil. (http://www.guardian.co.uk/world/2012/apr/27/chris-tappin-denies-terror-links http://www.guardian.co.uk/world/2012/apr/27/chris-tappin-den...)
  - stilldavid 14y ago
    I'm not entirely sure what you're getting at here. Should we stop selling Arduinos because they can be programmed for nefarious purposes, in addition to lowering the barrier to entry for embedded electronics in the classroom? How about spools of wire because wire can be made a part of something far more sinister than we can imagine? Should Apple stop selling the iPhone because it's also bluetooth-enabled? I understand where you're coming from, but think it's entirely ungrounded in this case. We actively work with the DHS on export control. There is a very real risk involved in selling the products we do, but I don't think that should stop us from our goal of education and - right there at the bottom of every page on our site - sharing ingenuity.
pavel_lishin 14y ago
> Also, protip for criminals: make your own circuit boards without identifying marks. Why? This seems like the perfect sort of thing to buy with someone's stolen credit card - it provides a red herring for the police to chase after, and at least in this case, gives the thieves a warning that an investigation is in process.

rudiger 14y ago

I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?

tonyarkles 14y ago
For this specific case, they'd probably need to keep that accounting information for filing taxes. I'm not sure about the U.S., but in Canada we need to keep tax-related records for 7 years (I think).
jlarocco 14y ago
It may be theoretically possible, but it's probably more hassle than it's worth. It's easier for inventory tracking if you have a paper trail (or equivalent on disk). It's also good to have the receipts if you're ever audited. It's also inconvenient for the 99.999% of customers who aren't trying to cover their tracks, because without the info they wouldn't be able to check their order history. And it's not simply a matter of telling the law enforcement agency "We don't store that information." You most likely have to jump through the hoops to prove that you don't store the information.
bunderbunder 14y ago
If a company gives that response law enforcement will just come back with a warrant. You might say that's the case. But from their perspective it sounds fishy, and their only way to be sure is to take your servers and find out for themselves.
eli 14y ago
It seems like it would be difficult to run a business without keeping basic information on your current and past customers. Or are you suggesting lying to the police? That doesn't sound like a good idea at all.
Tobu 14y ago
It depends. Some countries have laws creating data retention requirements — in some contexts, for some time periods (with mandatory expiration in the EU), with sharing conditional on some purposes (hopefully for reasons relating to serious crime, but with some laws suspecting or detecting copyright infringement is good enough), with varying degrees of judicial review and oversight of bad-faith requests. https://en.wikipedia.org/wiki/Telecommunications_data_retention https://en.wikipedia.org/wiki/Telecommunications_data_retent... (concerns telcos, e-mail hosts, and web-hosts) The USA doesn't have a law like that, but it doesn't have a right to privacy either (there is a law about the privacy of correspondence that the NSA and telcos have ignored), so this sort of data retention law is sidestepped by a few large actors “voluntarily” collecting and sharing information. National security letters, gag orders, and whatever power incited AT&T to first do large scale warrantless interception mean that there can be a lot of abuse with little consequences for the participants. This might also apply to smaller actors, although less publicised (I don't know if there's any bad publicity the US government would care about). If you collect it, you might end up sharing it.

tomjen3 14y ago

Great so now anybody who reads those court records can steal those 20 peoples identities?

dtparr 14y ago
No. While the subpoena itself is public record, the information turned over would not be.

neurotech1 14y ago

I'm wondering if they track unique MAC or IMEI numbers for devices involved. A Bluetooth module would have a unique MAC ID, but I've never heard of that ID being used for network admin or security. MAC for WiFi or Ethernet is used for DHCP and MAC address filters. If the investigator were smart enough, they could ID the other coupled nodes connecting to the BlueSMiRF device. This technique is done to locate a WiFi node.

jwwest 14y ago

> 7. Complete credit card numbers used on Order(s) Can you fail PCI compliance if you're able and do this? What if you use a third party system such as Stripe where you have no access to the full credit card number?

jws 14y ago
Neither credit card numbers nor IP addresses were included because we don’t retain that information for our own protection as an organization. In general, you can not be compelled to produce something which you do not have. This is why you see legislation proposed with mandatory retention policies for various businesses.
aaronblohowiak 14y ago
>Can you fail PCI compliance if you're able and do this? There are many ways to achieve PCI compliance. Not having the data is simply the easiest.

jonknee 14y ago

Curious that in an effort to combat credit card skimming, the cops are requesting SparkFun to print out full credit card information for thousands of innocent parties.

kefs 14y ago

I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been encrypted.

rmc 14y ago
You think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure? You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this? If you were to email it encrypted, you'd have to send a follow email with the decryption key. Encryption would only be a inconvience and would not protect this information at all.
- morsch 14y ago
  The fact that they don't have anything more secure than unencrypted email gives reason to doubt that they know how to protect information like that. An encrypted mail attachment would be a start -- if you use a second channel to deliver the secret key, e.g. call them up to tell them the password.
  - rmc 14y ago
    OK so you doubt their means. Look at the ends. Have there been many security breeches from the police/courts? Is this a large threat to personal security? I don't think so. Hence I think they must be doing something right here.
    - kefs 14y ago
      The following is just one group's public releases, spanning about 5 months, at approx 20gb. https://thepiratebay.se/user/AntiSecurity/ https://thepiratebay.se/user/AntiSecurity/ Just because you don't hear about vulnerabilities and attacks, doesn't mean they don't happen.

ck2 14y ago

As much as I foam at the mouth around here against many law enforcement actions, both parties did the right thing here. It's not like they showed up in the middle of the night and yanked their entire servers out of the office without a warrant and covered it up under "homeland security" or other nonsense. They did it the proper way through the courts with a judge and public documentation of their actions, and asked for only a subset of the data (limited to a year and GA). Kudos to SparkFun for responding with caution. That said, I think the lead will be useless to them because the person could have bought it anywhere, even outside the USA and brought it into GA. Apparently there are also clones now of sparkfun boards complete with logo.

jsprinkles 14y ago
It went this well because no copyright was violated.
rickmb 14y ago
Not quite the right thing: the subpoena is too broad. This is very typical for law enforcement everywhere these days. Luckily SparkFun was diligent enough to negotiate it down to relevant information, but it the "gimme all your data" attitude is a fundamental problem. This also extend to seizures ("gimme all your servers", not just the ones involved). The courts should never allow this, so although this is the proper process, it is failing. There's no point in insisting law enforcement goes through the proper channels if those proper channels don't do their job properly.

jayferd 14y ago

I had to stare at the word "SUBPOENAED" for a long time before concluding that it was indeed spelled correctly.

duggan 14y ago

For a european perspective; a company I used to work for was in this situation many times over. We worked with law enforcement and the data protection commission to ensure zero "pollution" of unrelated information into legal requirements (like subpoenas). If you end up being contacted by law enforcement for data, I'd recommend doing everything you can to help educate them about the information you carry. It might be tempting to volunteer as little as possible, but you also might be the first willing and knowledgeable technical person they've spoken to in some time, and starting a relationship like that on a good foot can be incredibly useful to your company; maybe even you personally. It can mean future requirements get handled without hassle, and may never even come to you at all if they know it's information you don't or can't carry. You can also help shape policy around how such things are handled for others in future. YMMV depending on jurisdiction, but it's worth considering contacts from law enforcement as an opportunity to build a healthy (two way) relationship.

mkramlich 14y ago

The interesting thing in this case is that the cops may have in effect caused more credit card numbers to be skimmed (innocent people's data taken against their will, and possibly sent or stored in plaintext somewhere along the way, putting them in further jeopardy) than the original thieves did with their skimmer. But rememeber, when a government agent does it (whether cops here or soldiers or drones abroad) it's good and just. Only when a "bad guy" does something is it evil and wrong. If the government spies on you, it's legal. When you spy on them, it's illegal. If you were to plot to overthrow the US government, for example, it's treason: illegal and "evil". Whereas if the US government plots to overthrow a foreign government, it's perfectly legal and ok. Fun stuff to think about.

micheljansen 14y ago

What gives me a bit of hope is the fact that after the scary letter with a lot of legalese, SparkFun and the Police Department were able to just talk about it as people and do what was best for everyone. The police was not interested in having to sift through a big pile of irrelevant data; SparkFun was not comfortable handing over sensitive information of innocent customers. I wish it were more common that people just talk and cut the crap.