The real fix is to require a warrant without these loopholes. Judges can be available on a moment's notice for these sorts of issues.

Are we sure it's not trivial to fake a warrant?

Faking a warrant is a felony, perhaps even a federal one that would get the FBI involved I assume. You'd have to forge an official court document, forge a signature of a judge, etc. That has _serious_ consequences and prison time vs. faking a "data request" that might be entirely digital with no physical document or signatures, etc.

Not saying it can't happen or won't happen, but a criminal has to be seriously determined and ready to risk a long prison sentence to fake a warrant.

I feel like I've been seeing a lot of comments lately to the effect of, "no - that would be illegal!" Yeah, we are talking about criminals who are already breaking one law. Often criminals who, in the very nature of their crime, are hard to identify.

But then, even if they're not overtly breaking the law with a simple request for information, debt collectors and car warranty salesman are notorious for sending letters that will imply they are your financial institution, the letter was sent by your account manager, etc. IRS impersonators will tell people that jail time is imminent. I can imagine someone could create something that looks to a non-lawyer (who's afraid and not paying attention) like it's basically warrant signed by someone who's basically a judge, but just doesn't outright say that. You'd still need to verify - hey is this person actually a judge, and did this person actually sign that as a warrant?

Yes, which is why just set the bar at responding to any request for any data with "Sorry we do not respond to requests for data that aren't court ordered warrants. Please come back with a warrant we can verify."

The problem here is that companies have a policy of trusting some government email address for little one-off, no warrant needed requests. Don't have that policy.

> Please come back with a warrant we can verify

The problem is that it might not be easy to verify a real warrant, but that’s not grounds for noncompliance.

>> Please come back with a warrant we can verify

Ok. Now how do I verify one, assuming the information in this article is accurate?

You check the court records. These are easy to find with a digital records search, or you call the court clerk. The phone number is listed on the warrant. This is not hard, but it's not an automated process by design.

> The phone number is listed on the warrant.

You should not rely on any information on the document you want to verify - look it up yourself.

From the end of the article:

“Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill.

The Digital Authenticity for Court Orders Act would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content.

So yes, people are faking court documents.

Most criminals aren't thinking about any of that at all. Either they're so goal focused, any possible punishments don't even cross their mind, or they think they're clever enough to not have to worry about it.

Ah yes, the good old "just make crime illegal"

Do people honestly think that's a deterrent for people already committing felonies?

Yeah, it's the same issue. You'd have to call the court back to verify the warrant.

If it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity.

Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated.

If they can't be bothered to answer the phone then it's not important.

How do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?

The court's own website usually has contact information that can be independently verified. This isn't that difficult a problem to solve.

Do courts all have domains under a government subdomain?

All the courts that would issue these types of warrants will be easy to find. This isn't the sort of thing you do over a traffic ticket or shoplifting. It's not the court you go to when your neighbor owes you fifty bucks. These are murder and kidnapping cases. The people processing these warrants today are likely already on a first name basis with the clerks of these courts.

Think about it, how do you validate any court order? Why is this only a problem now? I think it's beacuse they want to side step the judicial oversight process. Keep that intact, as the constitution requires, and this issue disappears.

Local-ish courthouse for me only has a contact info for regular business hours. So if not in business hours, then what? There's ~3200 counties (or equivalent) in the US. There's no way to be on a first name basis with the clerks of each county courthouse, let alone if you have a big county with multiple different types of courts.

As for how you validate court orders now? You largely don't. That's why it's possible to use fake court orders to take down true but unpleasant information: https://www.cnet.com/news/privacy/forged-court-papers-are-be...

Your local courthouse may not even do jury trials. It doesn't do the sort of cases that require 3AM emergency warrants. If it's that important it can go in front of a district or federal judge, otherwise it can wait for business hours.

Local police departments don't need the ability to engage a global surveillance apperatus at the drop of a hat. Stuff like that can be ran up the chain first.

> It doesn't do the sort of cases that require 3AM emergency warrants

You will be in trouble if you ignore a real warrant on this basis.

Your lawyers will probably tell you that it’s better to just take the risk of possibly complying with a fake warrant.

Who would you even give the data to if they are closed? Fax it over the the courthouse if you are concerned, or tell them it's at your location ready for pickup. If they are legit that won't be a problem.

The data is collected by the LEO, not the court. But yes, you can fax it to the law enforcement office, whose number should also be independently verifiable.

> whose number should also be independently verifiable

This is not a legal requirement. If you fail to comply with a legitimate request because you couldn’t verify the number, you go to jail.

Can you point us to an incident where this has ever happened, namely, where a service provider didn't to respond to a demand immediately while they verified its authenticity and someone went to jail for it? Or even got a finger wagged at them by a judge? Third-party records production is almost never time-sensitive to the degree that, say, a warrant to search for drugs or contraband is, and there's little risk of spoliation of evidence.

As the article points out, nobody actually verifies these requests.

So no, I can’t point you to such an incident. Have people been held in contempt for failing to comply fast enough? for sure.

You cannot conclude that because someone has been held in contempt for intentionally failing to respond to a records production request because they simply didn’t want to do it, that someone would also be held in contempt for delaying production for a few hours while they make a good-faith attempt to verify the authenticity of a request. Judges take all the facts and circumstances into account—including intent—when making these kinds of decisions, especially those that involve depriving someone of their liberty.

> delaying production for a few hours

Ah yeah, I think you are totally right. Our disagreement stems from the fact that I don’t believe that few hours is sufficient at all.

Is being unable to independently verify a request for information or a warrant a real problem, or are you just making up problems that may not actually exist?

Let's stick to reality, folks.

If you have ever received a demand from a court that you couldn't verify the authenticity of, I'd like to hear from you.

> These are murder and kidnapping cases.

They're also "we think this kid is selling marijuana" cases. Law enforcement doesn't even need a warrant, they can just send a request for data and every company will just rubber stamp it and give them whatever they want.

This is wrong, and I know several legal process departments who will tell you otherwise, e.g.,:

https://www.apple.com/legal/privacy/law-enforcement-guidelin...

Please, post about legal issues only if you know what you are talking about.

Do not forget that it is world wide. The gov has next to a signature a feature called apostille.

They do not! And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Even more fun would be the process of jurisdictional verification. All of which I'm sure the "Officers" would be more than happy to leave you be with your electronics and whatnot long enough to verify, right?

Longer I'm alive, the more insane our system seems to me on a daily basis. Not sure if it's just cognitive decline or rapidly amplified cynicism as I dig into the signalling nightmare that is the interface between the executive and the judiciary system.

> And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Name one court that signs warrants to service providers that can't be verified by spending 5 minutes doing some basic research, or that has a LEO office serving such warrants that also can't be verified.

So you go look up warrants on a regular basis?

The topic at hand isn't whether a lawyer or a court officer can, but whether EVERYONE can in a timely manner such that if a police officer or LEO (or someone impersonating one, since we're talking zero trust) can be told to go sod themselves by a layman.

Fundamentally this is a signal/info propagation problem. Processes take time.

The people who process these requests, particularly at the large companies that possess such data, are typically dedicated to the task and possess the specialized knowledge needed to do so. They have often developed significant relationships with the law enforcement community.

Do you know them? Do you have a connection that you could entrust with giving you a positive or negative answer as to whether the armed man with no sense of humor in the cop uniform outside is the real deal?

I don't. Hell, even if I had a lawyer on hand, I doubt the lawyer would go "hold up.. checking the registries, yup it's legit"; rather they'd tell you to cooperate then maybe challenge outcomes down the road when the paperwork catches up.

For most, the answer is they take it on faith anyone usurping that authority would have such a shit ton of bricks dropped on them, no one would be stupid enough to do it. Obviously, that logic is showing it's age.

Frankly, if I were the courts/LE and found out this was going on, there'd be a new Public Enemy #1. Trust is too important.

People were able to do this for years prior to Google's existence. I'm sure a social media company can determine how to find a court without Google.

Every court has a phone number, you can lookup the court independently and call the main line to get routed to the appropriate party

Use a phone book?

All of which makes me wonder, and this being HN, wouldn’t it make so much sense of law enforcement agencies start signing these kind of requests with verifiable public keys?

It seems like such a trivial problem from a technology point of view, it makes me believe it’s mostly an organizational problem.

At the very bottom of the article:

8<--------------------------------------------

The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology.

“Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill.

The Digital Authenticity for Court Orders Act would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content.

8<--------------------------------------------

I should have done a better job at reading the article, thanks for this.

From the end of the article:

The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology.

I agree that it does seem like a trivial problem that is mostly organizational. There are nearly 18,000 police departments in the US. Standardizing anything across a subset these and getting approval from the judicial system just seems like a nightmare.

This seems like one of those issues that is solved only when someone is murdered and a law is written after their name.

Let's add Blockchain to this so warrants are verifiable on a private Blockchain.

/s

This isn’t a fix. Warrants are easy to fake, not necessarily easy to verify.

In theory you could automate it, but that would require a different architecture.

It's honestly pretty stupid that email is being used for this instead of having a secure portal which could include things like RSA hard tokens, or even just passwords with 2FA would be a step up. Nothing is fool proof, but this sort of stuff is common with other sensitive information like finance.

Honestly, email would do the job too, if it was signed email.

I’m pretty sure the largest deployed PKI system is the US federal government’s - it really feels like we should be able to deploy something for law enforcement agencies. (And in fact that’s what the legislation mentioned at the end of the article appears to do.)

Does that actually fix the issue if they've compromised the security of the email server using real or generated accounts?

The email server typically does not contain key material. If you’ve ever interacted with the military or related contractors you may recognize this card: https://www.cac.mil/common-access-card/

That’s a smart card, containing a certificate that can be used to sign email, be used as a client cert for web access, etc.

Now, it has moved the problem to some extent, in that now you have to secure the CA that’s issuing these certs.

I'm a little familiar with CAC cards from years ago. I don't believe they were using them to sign emails at that time. Thats different than the signing process I was familiar with. That would work.

The DoD root CAs are pretty damn secure. They're offline in physical vaults on military installations. Compromising one of those is a far cry more difficult than some town of 400's local PD e-mail server.

Granted, you only need to compromise a RAPIDs office to issue yourself a CAC, but that is still offline and on military installations (though often much less secure reserve/guard installations).

Wouldn't the cert need to be specific to the individual for proper identification? So getting one for yourself might not provide the sufficient privilege.

The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort of thing is usually issued as a smart card ID, so it's used for several things, and it's unlikely people lose it without reporting it lost and getting it revoked).

They specifically mentioned issuing themself one, not stealing one.

Yeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked.

If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.

> In theory you could automate it [..]

Sorry for the somewhat off-message thought, but perhaps this kind of thing is actually more secure if you _don't_ attempt to automate it?

Maybe the person receiving the request should actually go and look up the phone number of the police department or court who allegedly issued it/approved it, and then call that number (note: not the number mentioned on the request itself).

Surely if that was the SOP, this kind of stuff would just stop?

Where are they looking it up? Is that source secure? If it's just on a website, that could be easily corrupted.

There's a huge number of systems across the US. I am assuming that a centralized system would provide better security overall compared to the many small and often neglected local systems. This would also standardize the process, reducing the possibility of some locales practice insecure processes.

> If it's just on a website, that could be easily corrupted.

Back in the day we had things called "telephone directories" (I'm showing my age somewhat)

Is it beyond the wit of man to have the CIA/FBI/NSA/$TLA publish a "list of places to phone" when you receive an Emergency Data Request?

If the source isn't on the list, you can ignore it. If it is on the list, phone the number on the list to verify it?

This really isn't rocket science. At least not for those of use who grew up in an age where you could step into a phone box and open up a printed directory and look up someone's phone number...

Yeah, I'm baffled by the idea that the internet is the only possible way to convey information about phone numbers.

It's not even that we are old enough to have experienced looking up a number in a phone book and some people here are to young to have that experience. The obvious solution to this seemingly unsolvable problem is to print some numbers on a piece of paper and post it to each company you want to get data from in the future.

This is a solution that can only be implemented by the legislative branch of the federal government. (Very unlikely to happen)

The problem is indeed unsolvable by the recipients.

So are they issuing a new book every time a department/precinct is created, merged, disbanded, or the number is otherwise changed? This still doesn't solve the issue of authentication of the issuing party since the phone location could be unsecured, or the call rerouted.

That is a possibility. It would likely need to be digital, not printed, to avoid stale data. The identity verification will still be less than what you could do with something certificates or RSA tokens since there's nothing guaranteeing the person on the other end is who they say they are (numbers change, area could be unsecured/unmanned, call redirected, etc).

> It would likely need to be digital, not printed, to avoid stale data

Q: Would one expect police departments to be the kind of places which would change their main telephone number regularly?

Consumers change providers often. Institutions? Maybe not so much. (As an aside, I've just checked, and my old university's phone number is exactly the same as it was 30-odd years ago when I enrolled).

To be frank, I'd prefer a printed version for something like this. Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often. If ever.

"Harder to hack a directory that's hard copy and whose entries really ought not to be changing very often."

Phreaks often dumpster dove for this info.

How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down.

> Phreaks often dumpster dove for this info

For the telephone number of their local police department? Is it supposed to be secret? My point is that it should be public!

> How does it not change often? There are constantly new departments starting, departments/precincts merging, and departments shutting down

There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids.

For $deity's sake, some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes.

This isn't a technical problem, folks :(

"Is it supposed to be secret? My point is that it should be public!"

If I have a list of all the agency numbers, then I can look for organizations that disbanded and use those numbers. Since they could still exist in the book (because it wasn't updated instantly), the other party could think you're legitimate.

"There is simply no reason for a newly-started/merged police department to be able to unilaterally issue an Emergency Data Request, and I say this as a father of three young kids."

How so? For the first year of existence they can't issue anything because they have to wait for the next book to be publish. That's sounds dumb. There's no reason they shouldn't be able to issue anything they have the lawful authority to do so. Have any support/logic for your claim that they have no reason?

"some new and/or newly-merged and/or micro police force must surely have their local, regional and national-level police forces on speed dial on all their phones. If someone is missing and needs to be found quickly, all they need to do is pick up the phone and reach out to "higher authority" (who can be quickly authenticated, because they definitely have been around for decades), not start acting like the local heroes."

Um... so how does this higher level authority authenticate this lower level authority if they aren't in the book we are using for authentication? In some cases, jurisdiction can get in the way of the scenario you just described. And again, how long are you going to prevent a department from doing what they are lawfully allowed to do?

"This isn't a technical problem, folks"

Ok, then how do you solve the authentication issues in my previous comment? So far your system hasn't addressed them.

Trivial for someone who is suspicious and cares, sure. But that is not _prevention_ by any stretch. People still get phished via email every single day. I wish I could rely on something more robust than just the services I use being extra careful.

Sure, but the point is the process at the company receiving the request for data should change. They should verify the requesting entity.

Then if the people processing these requests don't follow that process, then that is a different problem. But as it stands now, those people can follow the process to the letter and we still get the wrong outcome.

Yup, came here to say this. Look up the number (don’t trust any number provided in the email, actually go look it up) and pick up the phone.

Very effective and simple solution.

Yes, the call back mechanism is a pretty good one but it has limitations too. It requires the switchboard operator at the police station to be trustable. Indeed, that human needs to actually pick up the phone. In many cases, the 911 line is the only one that's routinely answered.

I'm thinking that the number of "Gun to victim's head; we need secrets from $Corporation_Name now!!!" situations which a typical small police dept. would actually experience, even over a decade, is ~ZERO. And the chance that a small police dept. would have the skill set, familiarity with the procedure, etc., so that they could correctly request the right data, from the right part of the right corporation, is about the same.

SO - move the power to make such requests up to (say) State Police departments, or even somewhere in the DHS. Those guys have (or should have) sufficient resources to secure their e-mail, staff call-back phone lines 24/7, etc. And in the other direction, they should be far better able to vet alleged local police officers who contact them with emergency requests.

If it's really an emergency then calling the 911 line seems justified?

How do you call 911 in aother city? AFAIK, 911 calls always go to the local dispatch center.

Area code, then 911. And often, the 911 dispatcher asks "What city?" as the very first thing they say.

Require police stations to register their callback number for EDRs. Require a response before releasing information.

You still have the issue of vetting each police station, but you can do that once before the EDR comes in. Then when the EDR comes in, you call that number, confirm the details.

It can still be hacked, but not nearly as easily as a random officer's email account.

It could also be “fixed” by deciding that the risks associated with government not getting data that could help stop an ongoing crime is less severe than the risks associated with these data leaks.

Who makes that decision?

Us. By not using shitty systems to host our data as well as actively combatting laws and regulations that require backdoors or cross-platform compatibility.

I don't want my conversations to be "cross-platform compatible" with Facebook. Thank you very much.

The lawmaker or the voters, depending on how you look at things.

And also the companies in question. They are responding to non warrant requests. As I understand it there is not legal obligation to do anything on their part.

It is a public perception thing. The companies (probably rightly) think the public will react badly to headlines about "Little kidnapped girl could have been saved by Google, but they didn't care" more so than the current article we are discussing.

This would be a good step.

Others have brought up problems with this but another one is that companies get paid by police agencies to provide these data in response to records requests, they are incentivized to not rate-limit these responses.

How much are they paid? It seems unlikely that they get enough income to cover a department dedicated to this processing, let alone make significant money out of it.

I’d guess the processing they do is minimal and that the rate they charge goes up every year.

Absolutely. This is “just” another control measure that needs to be (a) made aware of (b) implemented stringently throughout organizations.

Most people don’t realize how boring cyber prevention often is.

I think the article kind of hit on a good system:

- FBI is CA?

-- Issues hardware PKI to local departments

--- Only PKI-signed EDRs are processed without manual phone verification

This could work for domestic requests, but the one example of this I've seen in the wild (and this was mentioned in the original post) involved a request (supposedly) coming from police internationally. Though, requests from foreign police are more likely to be handled with scrutiny, so maybe forcing more manual verification (and identification of the proper process in the first place) aren't bad things.

Then local cops with poor security get hacked...

Haha.

It’s also trivial to create a fake police department in some small town, set up google maps entry etc…

What then? What about when you operate internationally and have to accept requests from 100+ jurisdictions?

It's not trivial. But regardless, you're saying the hacker should submit data to Google and also answer a telephone call, both of which increase the risk of getting caught later. The aim should be to stop or mitigate the misuse of EDRs, not to cure the underlying problem of social engineering.

The people discussed in this article are absolutely capable and willing to pick up phone calls.

Well maybe not 14 year old British kids. Not until they come up with better real-time voice synthesis.

Get the police department phone number from the town's government and not google maps.

And how do you identify the real government for some small town? There are many that don’t even have websites.

Contact the state government to ask? There’s a good chance nobody will be able to provide the answers you seek on short notice.

Somehow there were ways to get this done before websites existed. I do not believe that those channels for government no longer exist. If they choose to make themselves impossible to locate offline, this is on them. If all else fails, government-to-government should still be viable, and then the local government will take it from there.

I'm not sure there was ever much verifying before websites existed. Just less fraud.

Back in the NES days Tengen called the United States Copyright Office and told them they needed the technical details of the NES lockout chip to defend themselves in a copyright lawsuit. The Copyright Office faxed over the requested information. Except it was social engineering, there was no copyright lawsuit. Tengen used that proprietary information to build their own cartridges without paying the NES licences costs.

> Somehow there were ways to get this done before websites existed

Ah yeah, because fake subpoenas didn’t work before the internet existed?

> I do not believe that those channels for government no longer exist. If they choose to make themselves impossible to locate offline, this is on them.

Who says they ever existed? Back in the pre-internet days the situation was just worse.

Even the federal government can’t manage this, just look at misissuances of .gov domain names.

If you're in a community that's so small it has no online presence for their government, then chances are you already know who to call anyway.

So google gets one of these requests and supposedly its from a police force in a small town that has no government website. How do they know who to call to confirm?

County? State? I would argue that this should be the method anyway. Start from the lowest level of known authentic bureaucracy and then work down from there until you reach a legitimate city government representative. I don't think website is an ideal method in any case.

So your solution is to get rid of speedy emergency requests entirely?

Sounds like you’re just repeating the point that authenticating these requests is impossible, as that authentication would have to happen fast.

And then you need to do this internationally. What will you do? Contact the embassy? Suddenly your authentication process could take months, which is a problem if you’re legally required to comply sooner than that.

> So your solution is to get rid of speedy emergency requests entirely?

No?

Anecdotally, from what we are reading today, a typical EDR response time is on the order of an hour. So while someone on my team is gathering the requested data, someone else is doing the verification.

> Sounds like you’re just repeating the point that authenticating these requests is impossible, as that authentication would have to happen fast.

If anything, I'm implying that if the government mandates that EDRs exist, they should have to back it up with someone to handle authentication. A phone number at the state level would do the trick.

> And then you need to do this internationally. What will you do?

First I'd have to be convinced why I should do this in every jurisdiction, why that jurisdiction would have access to customer data from other jurisdictions, etc.

Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific.

> if the government mandates that EDRs exist

Q: Is government mandating this? At what level?

...and if so, why?

Well, I assumed that the only reason anybody was complying with an EDR was because there was a law mandating they do so. Otherwise, why aren't they just dropping these requests in the trash?

> the only reason anybody was complying with an EDR was because there was a law mandating they do so

Alternatively, it's possible that understaffed and overworked providers are more concerned about their company looking bad when "Missing Child X with schoolbag containing cellphone" isn't located before the next news cycle?

Doesn't due process exist for a reason? Even if that's occasionally a PITA for the authorities?

> So while someone on my team is gathering the requested data, someone else is doing the verification

The whole point is that verification will take much longer than hours.

> Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific.

The government is very specific when it comes to what is required of you. The government is not very specific when it comes to what is required of the government.

> The whole point is that verification will take much longer than hours.

How can it take longer than hours to reach the actual police department in $someSmallTown, USA ?

$Deity forbid you actually happen to live in $someSmallTown and need the police in a hurry...

Research the village constables in Alaska. There are also small towns that have only part time police forces. This sort of stuff really isn't uncommon.

FWIW I lived in a village with a part-time police presence. Based on our experiences they're great for helping local kids not get run over on the walk to school (and for closing down public spaces when Covid paranoia was at its highest in early 2020). Manhunts or major crimes? Not so much.

I'm struggling to get my head around how a tiny and/or part-time police force should be the (sole?) point of contact for an emergency data request when <drum roll> they're not even there for the majority of every 24h cycle.

"Dear $TelCo, you must immediately release location data for subscriber 1-800-555-2368, it's so important and urgent we haven't got time to find a judge. Since it's almost 4pm we're going off duty now and will be at our desks from 9am tomorrow. Yours, $PartTimeForce"

$someSmallTown might not even have a police department, how are you supposed to find out if the only one that comes up on the internet is fake?

Someone wearing a uniform turns up on your doorstep with a piece of paper that they claim is a search warrant. You say you want to talk to your lawyer. They say they're in a hurry and this is really important. At this point you decide to google the name of the person who signed the warrant, you phone the number you find on the internet, "Judge" Smith answers, so you let the "officer" into your house.

Really?

Nope, but for cities to be prepared for such emergencies before hand by completing some basics of bureaucracy by being properly authenticated, much like you expect a city fire department to have some fire trucks purchased already instead of expecting to purchase one in seconds when they need one from the dealership 1000 miles away.

Yeah, of course the federal government could legislate this problem away. Not gonna happen though.

It is literally impossible for request recipients to solve this problem.

> It is literally impossible for request recipients to solve this problem.

This I agree with. I'm trying to find the actual text of the law, I'm surprised the government isn't pretty specific about what constitutes a valid EDR, who can send them, etc. Bureaucrats love to write rules.

From the article, I couldn't see what actually compelled the need to comply with an "EDR". From what I could see, they were not actual warrants or subpoenas that legally compelled performance, they were requests. They do it out of not wanting to have bad PR in case it was real, because the consequences for a screw up are pretty much nil.

The end solution is either an authentication scheme, a $1000 rush processing fee that includes a verification process and the requirement to call it in (It is an emergency, isn't it? Emergencies do not happen often, so what is $1000 to an american organization funded by taxpayer dollars?) or E2E encryption that makes it they can't give data.

Another thing about the $1000 fee, is you get to see the payment information about the account it comes from, and you can further require it comes from a government account which matches the requesting organization. Thanks to governments being very gung ho about their financial surveillance infrastructure being a hard requirement for almost everything now.

>So your solution is to get rid of speedy emergency requests entirely?

Who said that?

That’s the implication. A lengthy verification process makes speedy processing of requests impossible.

A fake subpoena is not a home invasion. It's not like seconds matter.

Until you get in trouble for not complying with a real one.

Worst case scenario is probably a horrible PR disaster after a child dies because you couldn’t process a real request fast enough.

And we’re not talking about seconds, but easily days or weeks.

You think this is something someone can't figure out in a matter of weeks?

We've banned this account for breaking the site guidelines.

If you don't want to be banned, you're welcome to email [email protected] and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html.

>Sorry, but this isn’t your first comment demonstrating severe struggles with reading comprehension.

This isn't reddit, you can't talk to people like that here. I'm not engaging this further.

https://news.ycombinator.com/newsguidelines.html

Would you please stop perpetuating flamewars on HN and also please stop using HN primarily for political/ideological battle? We ban accounts that do those things because they destroy what the site is supposed to be for.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

For some problems, there is no good solution.

That’s my point. The OP “riskable” claimed the opposite though.

Are the white pages a thing in the States?

I mean I want to call some entity in the US that doesn't have its number on a website, how do I do that now in a non emergency situation? Is there any reason that wouldn't work in an emergency?

This doesn't seem like an actual problem anyone has ever had.

No, except for easy-to-influence websites that scrape numbers from sketchy sources and accept user submissions without verification.

Not that the inability to confirm a phone number in a hypothetical phone book would be an excuse for noncompliance anyway.

The secretary of state for that state can provide that information.

Only in the United States. There are almost two hundred countries in the world. What if the request comes in from Kiribati?

If you give them days, weeks or perhaps months to come up with a response. Sure.

Not going to work internationally anyway.

You are being intentionally argumentative, and not in a devil's advocate, let's explore all the consequences of the topic at hand kind of way.

You are engaging in bad faith, please stop it.

That’s really not the case. What is “bad faith” about suggesting that the secretary of state probably isn’t going to rapidly solve this problem for you?

It’s not even about being a “devils advocate”, the balance of probabilities rests squarely on the side of this being far more difficult than many commenters here try to make it out to be.

I think it is you who is engaging in bad faith.

I’m really confused as to how this relates to what is being discussed here.

>And how do you identify the real government for some small town? There are many that don’t even have websites.

This was the question I responded to. I'm not sure how else to explain it?

We are talking about fake law enforcement requests sent to big internet companies. Do you think these bigcos have presence in McMullen, AL?

Contacting the state government should be the right choice (but it may not be in practice). In many countries, every public official has the legal duty to direct you to the relevant authority if you contact them with matters outside their duties. That's a sensible requirement, because citizens should not have to be familiar with the internal administrative structures of government agencies.

> And how do you identify the real government for some small town? There are many that don’t even have websites

(Sorry to have to ask) but are there [m]any towns in the USA without telephones?

Where do you intend to find the numbers to call?

There are towns in the US where the local government consists only of a couple of people who may only do local government work for a few hours a week.

There are towns with essentially no online presence, you could easily create your own fake local government, police and whatever you’d like.

> There are towns in the US where the local government consists only of a couple of people who may only do local government work for a few hours a week

How does anyone authenticate anything allegedly issued by such small parts of local government?

"Not very quickly" is presumably one part of the answer?

In the real world these documents are usually not authenticated, perhaps beyond trying to get a person on the phone by googling the issuing authority.

It’s actually a pretty novel idea that companies should be prepared to deal with fake court orders, etc. In theory it’s supposed to be the job of law enforcement to prevent this, but of course that is also essentially impossible.

If the federal lawmakers wanted the federal government to undertake the herculean task of making all these documents verifiable and traceable, they could of course do that. Are they likely to do so? No.

Also, there’s an important detail that is largely being ignored in this conversation: How many hours of paralegal time can we expect companies to spend verifying legal requests concerning accounts that don’t belong to paying customers?

> In the real world these documents are usually not authenticated [..]

So if a stranger in a suit were to turn up on your doorstep with a "search warrant" to search your house, issued by a court/judge/jurisdiction you'd never heard of, you'd not attempt to authenticate it?

> verifying legal requests

I'm not sure that these EDRs as described can be said to be "legal requests".

Aren't they just asking for disclosure of data without the usual legal checks and balances?

> So if a stranger in a suit were to turn up on your doorstep with a "search warrant" to search your house, issued by a court/judge/jurisdiction you'd never heard of, you'd not attempt to authenticate it?

Most people would not, no. I’ve had a search warrant served on my home once by police in civilian clothes, they handed me a piece of paper and refused to give ID even though I insisted.

What are you going to do? Physically fight them? Bad idea.

> I'm not sure that these EDRs as described can be said to be "legal requests".

The thing is that real search warrants or court orders do not provide any additional security over these EDRs when the submitting party is not acting in good faith.

> The thing is that real search warrants or court orders do not provide any additional security over these EDRs when the submitting party is not acting in good faith.

I'm not sure what you're saying there, can you expand on this? Are you saying a fake search warrant or fake court order is no more secure than a fake EDR?

My point is that the EDR system (if we can even call it a system) appears designed to avoid any and all scrutiny, verification or legal process. "We need this in a hurry, lives are on the line, we haven't got time to get a court order" doesn't exactly invite the recipient to understand that they have every right to say no.

EDRs are basically backdooring an otherwise fairly well-understood system with checks and balances.

Create a fake small town?

Fantastic story, it's hilarious that the "town" popped up on Google Maps for a bit.

So every major technology company will need to figure out the real contact details of every town government (how do you propose they will they do this?) and then when they receive one of these "life or death situation, you must respond immediately" requests they are supposed to call up the town, get the number for the police department in the town (hopefully the police department isn't shared between multiple towns or this could get confusing) and then call up the police department to confirm that they are the ones who sent the request?

I guess I don't see the value the town government contact details is providing here. If you have some way of figuring out the real contact details for every town why wouldn't that same mechanism work for figuring out the real contact details of every police department?

In the United States, does <area code> 555-1212 not work anymore? It certainly seems to: https://www.businessinsider.com/555-phone-number-tv-movies-t... https://www.nationalnanpa.com/number_resource_info/555_numbe...

Yes? Tech companies don't have to do arbitrary things for whoever calls up. The court or law enforcement official has to convince you they are real and that they have a warrant.

Try refusing to comply with a real warrant because you aren’t convinced that it’s real. You will go to jail.

Turns out the government actually has no duty to convince you, locking you up tends to be convincing enough.

They'll lose their case if all they did was call you and make a demand. Expecting them to show up in person in some capacity and show you the paperwork is fully reasonable. For a while they mostly operated with letters and sometimes registered mail but that can be faked also.

Look, if you want to preserve your rights you've gotta stand up for them.

This is so deeply wrong. You will go to jail if you act like this.

> Look, if you want to preserve your rights you've gotta stand up for them.

You have absolutely no such right to refuse to comply with subpoenas, search warrants or court orders not delivered via your preferred means.

> Expecting them to show up in person in some capacity and show you the paperwork is fully reasonable

It’s not reasonable, because actual judges will not partake in such games. They will just hold you in contempt.

It might sound reasonable to a layman, but your lawyer will think you’ve gone crazy.

The only real reason you get charged with contempt is for ignoring the warrant. If you try to verify it you're not ignoring it. If you ignore something that's not a warrant they're SoL. It's my understanding these "emergency requests" have no legal basis. The ability of the state to pressgang people into service is very limited.

I'm willing to agree the law is crap and you might go to jail (briefly) anyway, but that's not an excuse for "it should work this way" which is the direction everyone seems to be taking it.

Don’t get stuck on the “emergency requests”, the people faking those are perfectly happy to fake court orders too.

> but that's not an excuse for "it should work this way" which is the direction everyone seems to be taking it.

I see many people arguing that the recipients should solve this problem by doing better verification, I don’t think that’s reasonable.

This is absolutely something that the lawmakers need to fix, but that will be a herculean task.

I'm aware they'll fake court orders too, which is your defense if you piss off the court. Sadly this is only an issue that can be solved by the recipients doing more verification. If the courts offered more verification, you still need to teach the recipients to make use of it.

Someone will sell this information. West Law / Lexis Nexis already provide a lot of this kind of thing (contact info for judges and people in various government agencies).

I wasn't able to find this information on West Law or Lexis Nexis, do you know what term they use to describe this category of information?

Try Judicial Profile.

Accurint

Ah, the fake blade runner station in Do Androids Dream of Electric Sheep?

Require PGP signed requests, and you should have more guarantee?

The problem would be establishing a web of trust of which PGP keys are valid, who still is "law enforcement", and whether they're on gardening leave or have retired etc.

There's too many (US) law enforcement bodies to make a centralised system work, as you'd need to get a certificate authority managing every individual officer's status for every one of these (small and large) agencies, and handle onboarding and offboarding.

In other countries there are more formal structures for these request through verifiable channels, with standard operating procedures in place.

The question is whether the companies are adopting a lowest common denominator model (a false but assumed valid US request can request any user's data) or not, as that might start to make it a more global concern, and get it on European data protection regulators' radars.

There is already a FedPKI and it's already the Department of Justice's job to track law enforcement, is it not?

No, I don't believe it's the DoJ's job to track law enforcement. There is some Federal-level recordkeeping of crime statistics... training... intelligence sharing.

Could you explain what you mean, or give some examples?

How do you verify the PGP key for a random LEO? The web of trust is a total failure for general use verification, it only solves the special ultra-paranoid use case.

Key distribution has always been the weak point of PGP.

You would use something like WKD and not the web of trust. https://wiki.gnupg.org/WKD

DHS already has a portal LEOs use to collaborate - would be pretty easy to set up something at the federal level - if there was the will.

Government institutions are some of the best places where centralized certificate handling/signing infrastructures shine.

And yet it's basically impossible to get a government organization to sign emails except internally using MS Exchange's encrypted email support.

> The statements about this being "unfixable" are utter nonsense.

It’s not unfixable. It’s broken by design.

Already the part where an EDR can override any safeguards is broken.

If it's that important, then you need to design a safer system and pay the cost of doing so.

Anything else is leaving the front door wide open for hackers.