Bloomberg: tech giants (practically ALL of them) "duped" into releasing data through fraudulent legal requests which was used to sexually extort minors

[Guest]

28 minutes ago, Slug said:

I honestly have no idea what the numbers look like on law enforcement abuse of emergency requests.  I'm sure it happens.  Legitimate emergency requests are supposed to be followed up with a full signed order after the fact, to confirm their use.  This story is about unauthorized (non law enforcement) parties scamming that system so that's the angle I'm speaking towards.

That so many fraudulent orders were granted should give a hint at how prevalent the orders generally are. These things aren’t rare at all.

[Slug]

7 minutes ago, sblfilms said:

That so many fraudulent orders were granted should give a hint at how prevalent the orders generally are. These things aren’t rare at all.

I know exactly how prevalent the orders generally are.  What I don't know is how many fraudulent orders were granted. 

 

I know that your larger companies receive in the neighborhood of 50-70k lawful requests per year.  Emergency disclosure requests are a fraction of that and presumably Johnny Badguy social engineering a fake emergency request is an even smaller portion of those.  Even one of those false ones being successful is one too many IMO, but we're not talking widespread abuse relative to the number of legitimate orders.

 

If the analysts working for these companies aren't doing verification callbacks before releasing information or doing some other kind of confirmation that the request they received is coming from a legitimate source, then they need better procedures and/or better training.

[Jwheel86]

I wonder if the solution would be to build a portal into the NCIC system as a security checkpoint.

[Slug]

12 minutes ago, Jwheel86 said:

I wonder if the solution would be to build a portal into the NCIC system as a security checkpoint.

It's worth exploring.  Some companies have portals that only verified law enforcement can access to submit requests.  The rub is that you still need to field requests from agents that don't have an account.  There's no legal requirement for officers to use a company's portal while there is a requirement for companies to respond to orders.  Having a central, company agnostic authorization hub that let companies know that the requestor is definitely in law enforcement would be a good thing.  The trick would be getting everyone on board and ironing out liability both in the case of system failures and rejection of requests that come from outside of that portal.