News for hackers. Stuff that matters.
Re:Hackers gaining power of subpoena via fake “emergency dat... by lazyier on Tuesday March 29, 2022 @01:35PM (#30845803)
If it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity.

Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated.

If they can't be bothered to answer the phone then it's not important.

Re:Hackers gaining power of subpoena via fake “emergency dat... by chipsa on Tuesday March 29, 2022 @01:46PM (#30845977)
How do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?
Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Tuesday March 29, 2022 @01:52PM (#30846056)
The court's own website usually has contact information that can be independently verified. This isn't that difficult a problem to solve.
Re:Hackers gaining power of subpoena via fake “emergency dat... by sodality2 on Tuesday March 29, 2022 @02:18PM (#30846403)
Do courts all have domains under a government subdomain?
Re:Hackers gaining power of subpoena via fake “emergency dat... by willcipriano on Tuesday March 29, 2022 @02:24PM (#30846483)
All the courts that would issue these types of warrants will be easy to find. This isn't the sort of thing you do over a traffic ticket or shoplifting. It's not the court you go to when your neighbor owes you fifty bucks. These are murder and kidnapping cases. The people processing these warrants today are likely already on a first name basis with the clerks of these courts.

Think about it, how do you validate any court order? Why is this only a problem now? I think it's beacuse they want to side step the judicial oversight process. Keep that intact, as the constitution requires, and this issue disappears.

Re:Hackers gaining power of subpoena via fake “emergency dat... by chipsa on Tuesday March 29, 2022 @04:00PM (#30847618)
Local-ish courthouse for me only has a contact info for regular business hours. So if not in business hours, then what? There's ~3200 counties (or equivalent) in the US. There's no way to be on a first name basis with the clerks of each county courthouse, let alone if you have a big county with multiple different types of courts.

As for how you validate court orders now? You largely don't. That's why it's possible to use fake court orders to take down true but unpleasant information: https://www.cnet.com/news/privacy/forged-court-papers-are-be...

Re:Hackers gaining power of subpoena via fake “emergency dat... by willcipriano on Tuesday March 29, 2022 @04:06PM (#30847702)
Your local courthouse may not even do jury trials. It doesn't do the sort of cases that require 3AM emergency warrants. If it's that important it can go in front of a district or federal judge, otherwise it can wait for business hours.

Local police departments don't need the ability to engage a global surveillance apperatus at the drop of a hat. Stuff like that can be ran up the chain first.

Re:Hackers gaining power of subpoena via fake “emergency dat... by rosndo on Tuesday March 29, 2022 @04:42PM (#30848098)
> It doesn't do the sort of cases that require 3AM emergency warrants

You will be in trouble if you ignore a real warrant on this basis.

Your lawyers will probably tell you that it’s better to just take the risk of possibly complying with a fake warrant.

Re:Hackers gaining power of subpoena via fake “emergency dat... by willcipriano on Tuesday March 29, 2022 @04:52PM (#30848213)
Who would you even give the data to if they are closed? Fax it over the the courthouse if you are concerned, or tell them it's at your location ready for pickup. If they are legit that won't be a problem.
Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Tuesday March 29, 2022 @05:22PM (#30848537)
The data is collected by the LEO, not the court. But yes, you can fax it to the law enforcement office, whose number should also be independently verifiable.
Re:Hackers gaining power of subpoena via fake “emergency dat... by rosndo on Wednesday March 30, 2022 @12:42AM (#30851552)
> whose number should also be independently verifiable

This is not a legal requirement. If you fail to comply with a legitimate request because you couldn’t verify the number, you go to jail.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Wednesday March 30, 2022 @02:15AM (#30852005)
Can you point us to an incident where this has ever happened, namely, where a service provider didn't to respond to a demand immediately while they verified its authenticity and someone went to jail for it? Or even got a finger wagged at them by a judge? Third-party records production is almost never time-sensitive to the degree that, say, a warrant to search for drugs or contraband is, and there's little risk of spoliation of evidence.
Re:Hackers gaining power of subpoena via fake “emergency dat... by rosndo on Wednesday March 30, 2022 @04:16AM (#30852598)
As the article points out, nobody actually verifies these requests.

So no, I can’t point you to such an incident. Have people been held in contempt for failing to comply fast enough? for sure.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Wednesday March 30, 2022 @09:47AM (#30855167)
You cannot conclude that because someone has been held in contempt for intentionally failing to respond to a records production request because they simply didn’t want to do it, that someone would also be held in contempt for delaying production for a few hours while they make a good-faith attempt to verify the authenticity of a request. Judges take all the facts and circumstances into account—including intent—when making these kinds of decisions, especially those that involve depriving someone of their liberty.
Re:Hackers gaining power of subpoena via fake “emergency dat... by rosndo on Wednesday March 30, 2022 @11:11AM (#30856252)
> delaying production for a few hours

Ah yeah, I think you are totally right. Our disagreement stems from the fact that I don’t believe that few hours is sufficient at all.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Tuesday March 29, 2022 @04:46PM (#30848142)
Is being unable to independently verify a request for information or a warrant a real problem, or are you just making up problems that may not actually exist?

Let's stick to reality, folks.

If you have ever received a demand from a court that you couldn't verify the authenticity of, I'd like to hear from you.

Re:Hackers gaining power of subpoena via fake “emergency dat... by heavyset_go on Tuesday March 29, 2022 @07:09PM (#30849508)
> These are murder and kidnapping cases.

They're also "we think this kid is selling marijuana" cases. Law enforcement doesn't even need a warrant, they can just send a request for data and every company will just rubber stamp it and give them whatever they want.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Tuesday March 29, 2022 @07:42PM (#30849781)
This is wrong, and I know several legal process departments who will tell you otherwise, e.g.,:

https://www.apple.com/legal/privacy/law-enforcement-guidelin...

Please, post about legal issues only if you know what you are talking about.

Re:Hackers gaining power of subpoena via fake “emergency dat... by kenniskrag on Tuesday March 29, 2022 @02:41PM (#30846677)
Do not forget that it is world wide. The gov has next to a signature a feature called apostille.
Re:Hackers gaining power of subpoena via fake “emergency dat... by salawat on Tuesday March 29, 2022 @05:06PM (#30848372)
They do not! And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Even more fun would be the process of jurisdictional verification. All of which I'm sure the "Officers" would be more than happy to leave you be with your electronics and whatnot long enough to verify, right?

Longer I'm alive, the more insane our system seems to me on a daily basis. Not sure if it's just cognitive decline or rapidly amplified cynicism as I dig into the signalling nightmare that is the interface between the executive and the judiciary system.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Tuesday March 29, 2022 @06:09PM (#30849014)
> And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Name one court that signs warrants to service providers that can't be verified by spending 5 minutes doing some basic research, or that has a LEO office serving such warrants that also can't be verified.

Re:Hackers gaining power of subpoena via fake “emergency dat... by salawat on Thursday March 31, 2022 @09:15PM (#30874165)
So you go look up warrants on a regular basis?

The topic at hand isn't whether a lawyer or a court officer can, but whether EVERYONE can in a timely manner such that if a police officer or LEO (or someone impersonating one, since we're talking zero trust) can be told to go sod themselves by a layman.

Fundamentally this is a signal/info propagation problem. Processes take time.

Re:Hackers gaining power of subpoena via fake “emergency dat... by otterley on Sunday April 03, 2022 @06:50PM (#30901544)
The people who process these requests, particularly at the large companies that possess such data, are typically dedicated to the task and possess the specialized knowledge needed to do so. They have often developed significant relationships with the law enforcement community.
Re:Hackers gaining power of subpoena via fake “emergency dat... by salawat on Sunday April 03, 2022 @07:45PM (#30901923)
Do you know them? Do you have a connection that you could entrust with giving you a positive or negative answer as to whether the armed man with no sense of humor in the cop uniform outside is the real deal?

I don't. Hell, even if I had a lawyer on hand, I doubt the lawyer would go "hold up.. checking the registries, yup it's legit"; rather they'd tell you to cooperate then maybe challenge outcomes down the road when the paperwork catches up.

For most, the answer is they take it on faith anyone usurping that authority would have such a shit ton of bricks dropped on them, no one would be stupid enough to do it. Obviously, that logic is showing it's age.

Frankly, if I were the courts/LE and found out this was going on, there'd be a new Public Enemy #1. Trust is too important.

Re:Hackers gaining power of subpoena via fake “emergency dat... by IncRnd on Tuesday March 29, 2022 @01:53PM (#30846062)
People were able to do this for years prior to Google's existence. I'm sure a social media company can determine how to find a court without Google.
Re:Hackers gaining power of subpoena via fake “emergency dat... by grepfru_it on Tuesday March 29, 2022 @01:53PM (#30846072)
Every court has a phone number, you can lookup the court independently and call the main line to get routed to the appropriate party
Re:Hackers gaining power of subpoena via fake “emergency dat... by verve_rat on Tuesday March 29, 2022 @04:23PM (#30847881)
Use a phone book?