Out of interest, were you arrested?

As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake.

Long and unavoidable administrative delays make it much harder for villains to subvert protocols. See also time-delay bank vaults and mandatory two-week vacations for pension fund managers, where they are locked out of corpnet.

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely.

All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

Could you give some examples?

Mostly cases where businesses rely on individuals instead of process.

As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at [email protected], because everyone knows everyone else and it works.

As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a [email protected] address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing [email protected] instead.

This isn't how any of my workplaces have worked. When someone leaves, they or their boss sends an email announcing the role changes. Which companies practice the role@ method?

Thanks, that's a great example. I've actually encountered this exact thing at my current employer as well.

As JulianMorrison notes, this is common in finance. The FDIC strongly recommends that banks enforce this[1] – you can't cook the books when you have no access to the systems.

But sometimes it's not just about cooking the books: the last "SSL cert expiration" fire I lived through happened because the person who had credentials to Digicert had to take sick leave. It was never a documented/defined process because "just flip Tim an email" was always sufficient, Tim didn't mind doing the work, and Tim didn't like going on vacation.

Two week lockouts mean there's no chance of shadow IT/back channel work happening, and forces you to document your processes.

[1]: https://www.fdic.gov/news/financial-institution-letters/1995...

Thank you, that’s another good example, to which I wish I could relate less. ;)

IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.

My old company locked us out several years ago for a period of time that continues to be uninterrupted.

It certainly did shake out lots of problems...

(My point is that after having had that happen to me, if it EVER happens again and isn't cleared up within minutes, the sonic boom you hear will be my tactical resume deployment. I dismissed the warning signs as "minor glitches". Never again. However, if it is something planned and I agreed to it beforehand, I guess that's OK. On second reading, you might have been describing something like that.)

Is it legal for them to arrest you simply to keep up the appearance? You haven’t done anything illegal.

Not from the US, but here at a bank I worked with: If you trigger the silent alarm they'd have reason to suspect you are threatened and would take you to custody to make sure you are safe and release you once it's sorted out (probably an hour or so).

That makes sense. Sorting things out takes time. But trying to create an illusion that no alarm was triggered to prevent criminals from gaining knowledge: not a reason to imprison an innocent person.

>imprison an innocent person.

Kind a hard word to use for an arrest. In many places police can arrest you for some period if they suspect you have committed a crime. This is no different. No need for sensational language.

In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.”

And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken.

The mugshot can become a public record. There are websites that match mugshots to names, and make money by being paid to take mugshots down.

Nobody wants the google result for their name to be a mugshot.

Probable cause isn't "pushed button multiple times" it is "silent alarm was triggered and this guy is on the only guy in the building".

If US is doing stupid shit then US is doing stupid shit. What else can we expect a third world country to do? In civilized world you are processed yes, but since you are just arrested and not accused you will just be held until the pre-investigation has concluded

This thread is long dead and off the frontpage - and this likely won't be seen by anyone (or even you nextlevelwizard) but here goes.

> What else can we expect a third world country to do?

We can criticise the largest economy in the world as much as we want inside a browser developed mostly in the US on infrastructure (the internet) whose large parts were developed in the US talking on a website created and owned by a US based company investing capital in one of the largest tech markets in the world (the valley).

That said - the fact they have police/healthcare/tuition problems does not in fact make it a third-world county.

A developing country ("third world") is typically one with low human development index (HDI) (the US is "very high"). Low economic output (the US is the largest economy) etc.

In the US, what you're talking about is referred to as "detainment" which is very different from an arrest. I think that's where a lot of the confusion is coming from.

In the US, they cannot arrest you without probable cause. They can however detain you while they figure out what's going on.

Imprisoning is a much later step after being arrested. When you're arrested you may end up in a holding cell, or you may not.

People can be taken into protective custody without any suspicion they committed a crime, though typically this is mostly done with children and they're taken to foster care, not county detention. It has been used in the past to protect people from getting lynched after being publicly accused of a crime even if the police don't suspect them, and is used to protect confidential informants by arresting them along with everyone else just to keep up appearances, though in this case they usually agree to it in advance.

There's 'arrested' and 'detained'. In the US police can detain anyone for up to 48 hours (72 hours if it's a weekend or long holiday). If they don't file charges by then they have to release you.

For a silent/duress alarm it's easy to cross reference the person at the door with a list of personnel authorized to be in the facility. Security in a scenario like that would normally ask for an ID, radio it back to their security office to validate the person is on the access list for that office/building/facility/etc and then do a quick walk-around.

I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the right sequence and was interrupted multiple times in the call as our floor fire coordinator showed up, then a few minutes later facilities, then a few minutes later local police.

I guess the system worked and I never forgot the correct prefix after that.

I always find it crazy when systems make you dial 9 for an outside line, for this very reason.

Did the same thing myself my first week in college. Got the police. Told them what I did and I could hear the eye-roll on the other end of the line, and was told I was the third person that day.

I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.

According to Wikipedia:

> The 9-9-9 format was chosen based on the 'button A' and 'button B' design of pre-payment coin-operated public payphones in wide use (first introduced in 1925) which could be easily modified to allow free use of the 9 digit on the rotary dial in addition to the 0 digit (then used to call the operator), without allowing free use of numbers involving other digits

There's a citation, but it's a book from 1950, so not particularly easy to verify.

https://en.wikipedia.org/wiki/999_(emergency_telephone_numbe...

My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

I would add that 911 is a "queer" choice (for rotary phones), in other countries the emergency numbers are lowish numbers, in Italy 112 or 113 (or 115), and there are several records in the past of people managing to "dial" them by quickly pushing and releasing the hook switch.

There was another reason for this as it was common, many, many years ago, to restrict the possibility to make phone calls by using a little lock on the dial, like this:

https://www.ebay.it/itm/402554995319?hash=item5dba25c277:g:~...

it was placed on the #3 hole, so that you could dial 112 or 113 even when the lock was on.

> in Italy 112

Did you introduce the EU emergency number as the national one? If so - good choice.

In France we have the plethora of numbers (15, 17, 18 - I actually do not know what 16 does), and also 112.

We are still teaching "18" as the primary number (you get the firemen who will either come for a fire, or for an accident, or dispatch). We could go for 112 (and keep the older number for a generation, redirecting them to 112) and not rely on people to know which number to call.

UPDATE: I just asked my 17 yo son which number he would call in an emergency and he said 112. So there is hope :)

The EU standardised on 112 a few years ago. Old numbers continue to work.

Also, the GSM system (so almost all mobile phones, world wide) must support 112.

JFYI, besides and before the EU emergency number, in Italy we traditionally had:

112 Carabinieri (one of the two national "police" corps)

113 Polizia (the other national police corps)

115 Pompieri (Fire Brigade)

118 Ambulanza (Ambulance)

In Italian it is a common phrase "roba da chiamare il 112" o "roba da chiamare il 113" (something that needs a call to 112 or 113) as a synonym of "a serious emergency" and of course if you called those numbers they would anyway forward the call to the appropriate service (like ambulance, fire brigade, etc.).

The EU emergency number is slowly being introduced (some regions have it already, some not yet), but the 112 is already well in the minds of anyone.

How does/did a citizen make the decision of which police force to call?

> How does/did a citizen make the decision of which police force to call?

It is a good question.

It depends.

There may be territorial choices or also "political" ones.

Typically Carabinieri have more presence in the country/villages/small towns whilst Police have more presence in larger cities (but there are Carabinieri there as well and - additionally - the local police, which were once called Vigili Urbani and now are called Polizia Municipale, and there is also the Polizia Regionale, to the joy of foreigners that do have a really hard time to understand the subtleties), highways and main roads are typically Police only (Polizia Stradale), but minor roads are usually patroled by the Carabinieri.

So usually you call (called) 112 or 113 depending on where you are (where the emergency happens).

The "political" part is even more subtle.

The Carabinieri are a branch of the military, whilst the Police are "civil", people leaning to the right tend to trust the Carabinieri (whose motto is "nei secoli fedele" i.e. "faithful in centuries") more than Police, whilst people leaning to the left tend to trust the Police as being more independent.

Until not so many years ago if you (or your family) had some relationship/contacts with some (left side) parties or association you would have not been allowed to join the Carabinieri (whether this was official policy or simply what happened is another thing).

The popular perception was (is) that the Carabinieri operate strictly by the Law, whilst Police is a little more "giving/flexible" (on minor things).

On the other hand, once it was easier to join the Carabinieri with a lower level of school/education than to join the Police, so we have here all the jokes about stupidity/ignorance targeting the Carabinieri (the same ones that traditionally in the UK are about the Irish or the Polish).

In France we also have two "police" forces: the "gendarmerie" and the "police nationale".

You may know "gendarmerie" from the Louis de Funes movies (Le gendarme de St Tropez, ...) - this is a military unit that mostly works in the countryside.

The "police nationale" is an entity attached to the ministry of interior and does more or less the same things, but more in the cities.

There is a history of hatred between these organizations - yes, this is how stupid we are. They share competencies (the most well known being the elite units - GIGN and RAID)

When you want to call the police, you dial 17 and you get the right one, depending on where you are.

If you have a health problem, you call the 18 (firemen), or the 15 (ambulance).

If there is a fire, you call the 18.

This is why having a single 112 number is easier to teach to children and tourists.

If you can read french, here's a page about why 16 isn't used (anymore!) https://www.guichetdusavoir.org/viewtopic.php?t=36236

TL;DR Running out of numbers and putting in temporary measures requiring the 16 as prefix. Measures that likely didn't scale as well as expected since we moved on to a different system within basically 10 years.

Ahhh! Of course - 16 for long distance calls! How could I have forgotten (it was introduced when I was a teenager).

Thanks for reminding me :)

I heard a very interesting explanation (on BBC R4) of the reason for choosing 9 (one of the slowest numbers to dial), rather than 1 (the quickest).

The old overhead telephone lines could knock against each other in the wind, producing a pulse which (to the system) appeared to be a 1. This could easily happen three times in a row, resulting in an unwanted call to the emergency services.

On rotaryphones 0 takes the longest to dial, then comes the 9. 1 was the fastest to dial, I think this is the reason why emergency numbers tend to have the lower numbers.

https://en.wikipedia.org/wiki/Rotary_dial

You have it backwards. 1 is the shortest to dial. Zero is longest. 9 is second longest.

I grew up with a rotary phone. From memory, 1 was the shortest to dial, 9 the longest.

Actually this is country specific AFAIK. Wikipedia has a picture[1] of a phone from New Zealand which has 9 as the shortest.

[1]: https://en.wikipedia.org/wiki/Rotary_dial#/media/File:New_Ze...

This might also explain why the Kiwi emergency number is 111 as a counterpoint to the UK's 999. Interesting!

Kiwis don't count /s

I stand corrected then!

Pedantic tidbit of archaic lore: this was so because each digit was represented by the number of clicks that the rotating disc triggered on the line (with 10 clicks for 0).

If the dial was locked or missing, you could still "dial" a number by quickly tapping it with the on-hook switch the receiver would rest on, because that was the same effect the rotary dial mechanism was producing

One was the shortest to dial since it's just one pulse, nine was the longest one. The purpose was to make it hard to dial 999 accidentally.

Was the arrangement of the numbers backwards from the US rotary phone? Because in the US 1 was the shortest. That’s why large cities like New York got 212 and Los Angeles got 213 which were the fastest to dial on a rotary phone.

We stopped extensions since there were multiple exchanges being used on campus so you have to dial someone's entire number. But, you will have to dial 9 and 1 and then the number. Everyone has externally accessible phone numbers so why are we still dialling 91 when youve got to dial the whole thing anyway?

I had the same issue happen but on a fax machine. Naturally, I couldn't hear anything when the 911 operator picked up, so I continued to try out various combinations, until the watchman and a cop showed up to check on the situation: just me trying to fax something abroad late at night.

I've seen it with someone with a certain amount of dementia trying to make a modem work. What he was trying to do was actually impossible and he responded to failure by trying variations on it.

Perhaps it needs the 1 for long distance? (No, it doesn't, the software knows better.) Perhaps it needs a 9 for an outside line? (No, the modem already has an outside line, it doesn't go through the phone system.)

I'm sure you can see what he did.

To dial out at my office, you have to dial 991. It’s only a matter of time before I either accidentally dial 911 at work or accidentally dial 991 in an actual emergency.

An interesting way to use this PAM-Duress system would be to write a program that

(a) begins recording your microphone and webcam video immediately upon login

(b) Aggressively try the hell out of every passwordless Wi-Fi network it can detect, then use headless chrome to aggressively smack every button to get past the stupid login pages

(c) Stream that video and audio to a server that saves it.

> begins recording your microphone and webcam video immediately upon login

If your camera has an activity light, this might inadvertently worsen your situation.

Just disconnect the light

> Just disconnect the light

Thanks, I'm cured.

1) A lot of laptops are sealed with glue. "Just disconnecting the light" would involve prying layers apart.

2) Companies may frown upon that if you should try to modify a company issue laptop.

3) Disabling a recording indicator may be illegal where you live.

1) Put a tiny dot of Black 2.0, not very noticeable and blocks the light very well.

2) Don't do personal stuff on your company laptop. If the company doesn't let you modify it, joke's on them, only company files will get leaked. Your personal stuff shouldn't be on that laptop.

3) Fuck that, if there are photons you can collect them

Worst case just do the microphone only.

Use Emergency SOS on your iPhone

https://support.apple.com/en-us/HT208076

There's also (for Aus users), Emergency+

https://play.google.com/store/apps/details?id=com.threesixty...

Also for iOS https://apps.apple.com/au/app/emergency-plus/id691814685

or use a cellular network

I found out the hard way that a job I had once (DIY store) had a hidden panic button under the counter. I was just fidgeting while we were closing up, hands found it and did their exploration thing.

I mean it happens, the security company sent out a van already (as they should) and called to confirm. They charge a fee (just over €100 I believe? Or €250? I forgot) for false alarms, but that's fair enough. Better safe than sorry.

Anyway, a DIY store with at most 100K in the safe (weekly takings at the time, most of that was probably electronic) is probably a lot less serious than whatever you were working for, to have it surrounded by law enforcement.

Is it really called "duress systems"? I work in the IT security field and have never heard that term :)

Author here; it relates more with physical security and I've used them in the military and in corporate structures. Most duress word programs are designed to be spoken; say security calls because an alarm is set off and the aggressors are coercing you to get the security off their backs. One may say, "Sorry I was working late and fumbled the alarm. Mr. Rogers has a board meeting tomorrow so I've been working late," where Mr Rogers is a fake name of no one that works at the company.

I kinda just thought to turn that concept into a PAM as a thought-experiment mostly but there are some edge case security examples where something like this could be useful, say for journalists or when dealing with corporate espionage.

I see, thanks a lot for your clarification.