Hacker News Reader

Comment by hawkice | Hacker News Reader

Am I the only person who is thinking... okay, if I am the mob, I'll hack hundreds of these underfunded school districts, and watch for kids with identical grades who transfer in, whose parents have no credit history, and where the (without loss of generality) father's name is Eric (for families I'd just use the intersection of all their first initials)? That's _plenty_ of information, and you add in that the fake identities will keep the same age for children and same-ish age for the adults, and I'd bet my bottom dollar it's uniquely identifying.

Surely these days they give them a digital presence, including a same-ish-credit-rating-different-details credit history. That's just too much to leave out in 2015.

View on HN

If someone did do that, I think we'd probably know about it. The chance of getting caught hacking a school district like that is tiny - but accumulate hundreds of tiny chances and detection is almost certain.

If you're good and/or committed enough to maintain hundreds of covert hacking operations, though, there are likely better options. How about deploying facial recognition at scale on the Internet? I hear they're pretty awful compared to humans at identifying people from limited data, such as a few grainy surveillance photos... but if you already know who you're looking for and have many high resolution photos of them, it would only take one good shot of them in their new life to be uploaded to the Internet - maybe in the background of someone else's photo, or even a frame of a nice HD video - and I suspect computers would be up to the task of making the match.

I am skeptical about the first part (the second part, about facial recognition, seems good, and at this point might just be a budget issue -- that to comb through the low quality results manually given current software would take too many man-hours).

I have seen IT for school districts. It's often one person, who has an insane number of demands on their time, no resources, and no specialized knowledge in security, building a number of systems that handle sensitive and non-sensitive data the district cares about. Given how homogeneous that situation is, evading detection consistently seems... extremely doable. And being caught 1% of the time means they have access to 99% of the networks -- they aren't magicians, there wouldn't be a clear way to intuit the larger context. If they all use e.g. web based grading software, and that gets 0-day'd, your 'almost certain' estimate gets readjusted by quite a lot too, and that's not a crazy thing to have happen either.

Sounds like a fairly large effort just to get revenge. You certainly are unlikely to find someone like this before a trial.

Did you watch the Sopranos? Tony kills an informant in the programme during a trip to New England with his daughter (looking at colleges). He randomly comes across the guy and recognises him from years earlier. Seems a lot more likely than hiring a bunch of hackers.

I don't think the mob has the skills to perform an operation on this scale for an uncertain payoff. They might be willing to pay someone else for information about someone they happen to be interested in. But a fishing expedition that is outside their area of expertise. Not likely.

It's also just WAY too much work to kill an informant using that method, unless it's a big time boss. In which case they'd use other ways to try and skip trace them instead of setting up an enormous botnet of hacked school networks, which doesn't sound trivial whatsoever. This is the mob, not a black hat hacker shop with billions of dollars to spend on SIGINT.

You think mobsters can't learn black hat infosec?

  - I'll hack hundreds of these underfunded school districts

The idea that you, or the mob would hack any school district, let alone "hundreds" is dubious. Precisely how? From one school district to the next, you'll have what to hack? What degree of variety would that involve in terms of the diversity of systems. Systems that are already hardened to withstand the pranks of script kiddies?

And where to start? All of the small towns first? Distributed geographically, and with varying connection speeds? And none of them have any level of intrusion detection, or malware defenses at all? I suppose you'll spear phish thousands of school staff members and no one will notice that, and surely it has nothing to do with witness intimidation.

This assumes that all witnesses have children. What if they don't?

Also, keep in mind this was in the 1960's and on into the 1990's so, computers then, were not what they are today. And since the 80's the mob has ceased to be what it was back then, for the most part. Now, really, it's gangs and drug rings, moreso than the mobsters being busted prior to the 90's.

  - watch for kids with identical grades

Uh, right. Not really. Identical? How does that work, when the teachers are different? Why would you assume performance would be equal during a massive distracting disruption to one's life? Even "statistically identical" (if that's even a thing, though I doubt it, when it comes to public school grading systems) is a stretch.

  - parents have no credit history

Okay, how is that going to shake out? So, assuming you've "hacked" your zillions of "school districts" and now the subset of children have parents, you'll run your free credit report on all suspicious families? Okay, I guess... I mean sure... and then no credit history for some. Except there's still this thing with the school records. Combing the earth for people with no credit history doesn't sound realistic unless you can narrow the search to less than one hundred specific targets. Anything above that number sounds silly, and would draw attention.

  - use the intersection of all their first initials

Probably the only part that holds water. Except you're operating based on knowledge from the article that you've benefited from, so this gets eliminated, because as an outsider, you wouldn't be able to assume awareness of this detail. You might notice it, after the search has narrowed, but without having this knowledge in advance, I doubt it would be useful information.

  - same age for children and same-ish age for the adults

Yes, you'd be able to use this.

  - they give them a digital presence

Doubt it. These are people who know all too well how wire taps work. Doing this for a protected witness would be profoundly stupid. Contrary to popular belief, life after the internet does still exist. Sacrilege to say such a thing on HN, I know, but it's true. I can feel the wrankled eyebrows from the other side of the internet as I type this.

  - including a credit history

I think they said in the article, they do not do this. At all. The point being that this would be government intrusion on private business, severely complicating matters of fraud investigation, and more. Even now, today, in 2015 there are people completely without credit history. And so what? They can't buy a house or a car or maybe a luxurious high-end cell phone financed with a contract? Honestly, these are minor details in a small person's life.

"The idea that you, or the mob would hack any school district, let alone "hundreds" is dubious. Precisely how? From one school district to the next, you'll have what to hack? What degree of variety would that involve in terms of the diversity of systems."

Then, I suppose that you need to hack clever :-)

https://clever.com/

If mobsters were that competent, they wouldn't be mobsters in the first place.

"Organized crime?"

"Don't kid yourself, it's not that organized."

-Sneakers

Reply on news.ycombinator.com