French intelligence officer caught selling confidential data on the dark web | Hacker News Reader

French intelligence officer caught selling confidential data on the dark web

zdnet.com

277 pointsreacweb86 comments

This serves as a good example of why privacy should be protected. Even under the assumption the police use data collected only for legitimate purposes, it only takes one corrupt officer for anyone to have access for less savory ends; While these are of course contrived cases, consider the stalker who purchases access to a facial recognition database, a robber who uses the mentioned phone tracking system to determine when a house is empty, or an identity thief who buys recordings from unnecessary phone taps.

The most reliable way to prevent any of this is to avoid infringement of privacy and surveillance overreach.

Some time ago a manager of a portuguese football team who was a former intelligence officer was caught paying off tax service workers to gain access to spending habits of some referees. His goal was to use that info to blackmail them to submission and force them to favour his team.

I can imagine certain hedge funds paying top dollar for inside info from FDA, Apple suppliers etc etc.

All government records should have a public available audit of all access activities. The user or group making the request should always be revealed except by court order and those should still be acknowledge or determinable by some means. The type of data revealed can be classified into groups indicating how detailed it is, from simple identification confirmation to tax and criminal records.

the key is public access to the the logs of access. next step would be giving the public the ability to challenge the data within reasonable limits

That reinforces the OPs point though. If that system can be circumvented, all bets are off.

If there wasn't centralized databases full of private information on individuals, this wouldn't b possible.

That doesn't help much unless there's a meaningful punishment for officers who abuse this access. Since in the US we are happy to re-hire police officers who have been publicly known to kill people without actual cause (e.g. https://www.nbcnews.com/news/us-news/officer-who-fatally-sho... ) I have trouble believing that a record of police officers who merely abuse surveillance data will do much.

This has always been my preferred option for data sharing with government (or even private companies). It should stop people looking up celebrities or ex-lovers details just because they're bored.

For practical purposes there should be delay (say six months) so an investigation stands a chance of not tipping off the person being investigated.

For delays longer than six months to keep the access hidden a full court order is required.

> these are of course contrived cases

No they aren't. Those are all obvious and inevitable uses (well, ab-uses) of a bribable official in a context where govenment data collection is tolerated.

As a note, the DGSI is the result of the merger of the DST (counter espionage) and RG (domestic intelligence). The RG was a notoriously shaddy and scandals ridden operation, known for building files on French public figures (own file was typically the first document a newly promoted minister for interior requested to read) and was often compared to a political police. I wouldn't be surprised to learn that the officier in question came from the RG.

Is an intelligence agency having files on public figures considered "shady"? I'd have thought it was an important part of their job. Provided any juicy information isn't misused for political ends, of course.

I agree, intelligence officers are supposed to investigate anyone who might pose a threat to the nation, and a politician in bed with foreign powers or corporations is a very dangerous threat, moreso than a couple of idiots who might go on murder-suicide runs.

These organizations wouldn't be doing their job if they didn't kept thorough files on politicians.

But in the case of France this file was known to be "who is sleeping with who in Paris", including people posing no security threat whatsoever.

If someone has a secret that could be discovered by a foreign intelligence service (or even a pressure group), and used to manipulate them, then that arguably is a security threat.

We should discover it first and use it against them before anyone else can. National security...

> this file was known to be "who is sleeping with who in Paris", including people posing no security threat whatsoever.

Yes, exactly. That's precisely what I expect any functioning and remotely competent secret service to do. Secret services are bound to look into anyone that is involved in anything that might represent a liability and a security threat. Thus to make sure someone doesn't pose a security threat... Secret services need to look into that person to perform threat assessments and protect the state and potential victims alike.

Let's not pretend for a moment that foreign powers haven't used sex, either directly by ordering agents to seduce and compromise targets or indirectly through collecting explicit evidence, to infiltrate and compromise state institutions.

>That's precisely what I expect any functioning and remotely competent secret service to do. Secret services are bound to look into anyone that is involved in anything that might represent a liability and a security threat.

I can see how Jacque's and Pierre's prolific fucking is a threat to their sense of security...

Better document it... It might come in handy...

We can't have the enemy using people's sex lives against them... That's our job...

Otherwise the terrorists will strike again... We repeatedly failed in our capacity to protect the nation, but please trust us... We just need more money and power... National security...

> I can see how Jacque's and Pierre's prolific fucking is a threat to their sense of security...

If Jacque is the leading candidate for president of france from a conservative party and an anti-NATO regime managed to record a collection od videos of Jacque and Pierre doing their private business to pressure him to be more anti-NATO... And Pierre is actually Dmitry and is in france as a translator for the diplomatic mission of the anti-NATO regime...

Perhaps the secret service could have done something to avoid this, right?

Do you understand how this works?

The RG was supposed to collect files on some people, including many public figures, based on slighty vague criteria. It was widely thought to collect files mostly on other people, based on quite different criteria.

This was a problem both because of what it did collect and what it should have collected but missed.

Honestly the most surprising part of this to me is that ministers would be able to read their own file. Presumably there would be no professional need to know anything in your own file, right?

I, for one, would be curious to know what is known about my person. If the information is true, false, or true but misleading, it may confer an advantage to know their possible assumptions in any adversarial situation.

Which is a good argument to give everyone access to their own file, but not to limit it to ministers and above.

One of RG major role was allowing local informations to go upstream so that politics knew what was going on outside of their ivory tower. Since they were operating using local branches it was a sure way to get first hand informations.

Of course to do their jobs they had to keep files on anyone or anything relevant. Could this be potentially misused ? Definitely. But it had a pretty good reason of existing.

After they got merged they lost most of their local branch and got retasked. Meaning the government have to rely more on second hand data and can more easily fall prey to falsified informations. The truth is a little more complicated than that but it was indeed a really useful tool.

Completely true. And moreover, it is now acknowledged that the failure to stop the terrorist attacks in the recent years comes for a part from the RG having been nearly disbanded. They were far from being an agency which only spied on public figures, they were in fact a very important tool for gathering information at a local level, which was badly missed to have first hand intel on extremists. Their bad reputation came mostly from the 60s-70s when they were targeting a lot the labor unions who had connections with the Soviet Union.

The "provided" is a big proviso. As is the selectivity. Heavier surveillance of one party than another is political in itself, and lots of places have a problem with aggressively policing the left while leaving rightwing subversion and even actual violence alone.

See this ridiculous scandal about a Macron aide dressing up as riot police to beat up protestors: https://www.theguardian.com/world/2018/sep/19/macron-aide-ac...

> a political police

It's not the only group that has been accused of being a political police. I've heard that a member of my family had to leave France because of the French equivalent of Secret Service was after him, during the Mitterand presidency. He spent a few years abroad then was surrendered by a South American country. As far as I've heard, he was on the run because of inter-service rivalry, since he has done work for the DGSE.

Government is made out of people. Well-meaning voters impute moral motives to government actions and new laws, but institutions are only as moral as their checks and balances keep them in line. Morality alone doesn't cut it.

You need to punish people who don't punish people who don't follow the rules. That's a reflexive rule and is the minimum requirement to get a stable institutional process.

    > You need to punish people who don't punish people who don't follow the rules. That's a reflexive rule and is the minimum requirement to get a stable institutional process.

The story here is straight up cybercrime: a French cop who got pinched using police resources for personal and nefarious gains. He's getting 7 years and stiff fine.

What did Equifax in the US get in response to their colossal-scale criminal negligence? Nothing. Zero fines and no one went to jail. Instead they were required to "make a deal" which netted them a tidy profit.

One is a large company and one is a person. This is a well worn logical stumbling point that many don’t consider.

They're not equal in the eyes of the law...

So?

>He's getting 7 years and stiff fine.

If found guilty, they faces up to seven years and possibly a stiff fine, depending on how much was made. This may end with a deal made and the cop making a tidy profit.

I have published this link because I was chocked when I encountered this news. This does not match with my understanding of police. In such services as DGSI, I would expect to see many smart people who have a true vocation for the service and some ambitious politicians who try to climb the hierarchy (not exclusive). Of course, there are some depressive, desperate, alcoolic or crazy people. Maybe there are spies paid by foreign countries, but I would not expect to see greedy treators. Maybe, I have a crazy theory. What if this guy was selling this data to try to catch big fishes ? What if this guy did this in secret because his boss is a risk averse politician ? A person frustrated by the inertia or other ineffectivity of the service and experiencing other difficulties in their life may fall into this madness. I think they have regular psychological assessment because this job is very hard.

I am just an imaginative layman. My source of knowledge about police is my father (RIP) who was a police officer. He had friends who worked in dgsi.

You are willing to believe that someone may be mentally ill, desperate, alcoholic, acting to expose internal weaknesses or a spy but you are unwilling to believe money as a motive.

Work in police exposes people to many traumatic situations. You may encounter very tragic situations or cases where your efforts to help result in more damages. Facing a gun is traumatic. This work can hurt even the strongest and can ruin their life. I have more difficulties to imagine these people selling their soul just for money. Often it is easier to leave police for better paid private activities.

It seems that maybe you ought to do some deeper research into the subject. Here are some good topics to get you started:

Corruption in the Baltimore Police Department.

The Seven Five (a documentary about NYPD corruption.)

Operation Countryman - https://www.theguardian.com/uk-news/2018/aug/19/files-shed-l...

Corruption in France: http://www.reuters.com/article/2012/10/05/us-france-police-c...

Corruption in the DEA: https://www.google.com/amp/s/arstechnica.com/tech-policy/201...

IMHO, corruption in french police is not widespread. The situation of police in Marseille (your link) is very extreme and not really representative of the whole country. The optimistic view is that police is fighting very hard to stop corruption and even in terrible places like Marseille, they have succeded to stop a big case.

> I have more difficulties to imagine these people selling their soul just for money.

Despite what you seem to think, police are not more righteous or just than any other person, as we've seen through the constant abuse, corruption, and violence perpetrated by LEO and intelligence agencies. In fact, due to the kind of people drawn to the positions and the screening to filter out people who are too intelligent to blindly follow the state, I would argue that "these people are in fact MORE likely to fall for corruption or "sell their soul just for money" as you say

I am French and there are rumors that some people inside the police forces are earning side money by funneling information from the police files to former police officer working as private investigators (with the advantage of having insider access to police data).

I always assumed that this practice was widespread. That is just an extension of the traditional practice of "tricoche" (police officers performing investigations for private customers).

It is obvious that former police officer working as private have their relation network. This makes former police officer so valuable. Active officers trust them and want them to succeed (they may need to go private themself one day). I have not heard about money transfer. This may happen sometimes at small scale, but corruption is a very sensible subject in police. People do not want to be caught as corrupt. This is very damaging to reputation.

This happens in every intelligence service, in every country.

That's why intelligence personel are themselves usually subject to surveillance and intelligence.

>This does not match with my understanding of police

Sounds right in line with my understanding of police

>I would expect to see many smart people who have a true vocation for the service

Too bad we end up with, partially due to agencies screening for the particular personality types they can use and control, power tripping sycophants with no critical thinking abilities who will blindly follow the state while simultaneously breaking the rules they're meant to enforce for personal gain

>but I would not expect to see greedy treators. Maybe, I have a crazy theory

It sounds like you have an incredibly idealistic view of police officers due to your father, which is understandable.

>What if this guy was selling this data to try to catch big fishes ?

Highly, highly unlikely

>A person frustrated by the inertia or other ineffectivity of the service and experiencing other difficulties in their life may fall into this madness.

This sounds like a poor excuse to defend crooked LEO

> I think they have regular psychological assessment because this job is very hard.

They have psychological assessments so the government can ensure they will follow orders, have no dissenting opinions, and will blindly defend other LEO/intelligence officers even when they are in the wrong

It looks like a chicken, acts like a chicken, talks like a chicken, so it must secretly be a horse...

Conveniently, there's another post on police officers today

https://news.ycombinator.com/item?id=18147076

Police in France is very very different of police in the different states of US.

You say that, and yet here we are discussing French police corruption that is exactly like what occurs in the US

Private data is power and power corrupts people. The only real solution is not to have that data in the first place

I would expect the intelligence services to be present on the dark web, as undercover agents, to gather information or dismantle criminal organizations. It must feel strange when they discover they are tracking someone of their own services.

Maybe they have a difficult telling time telling them apart since they all act so similarly...

I'm surprised he only face 7 years of prison. In the US he would probably face 30+ years no ?

more like, threatened with 30+ years by the prosecutor, but plea bargained down to 5

Depending on how wealthy and how white they are

> This case stands out because it's usually hackers and cyber-criminals who sell this data and not police officers.

Does it? ... "who got caught" who is after adtech executives who sells your data? Equifax, anyone?

Ah, DGSI. https://www.france24.com/en/20160929-sarkozy-scandal-spy-squ...

What exactly is dark web here. Do they mean some tor/IPFS site, or private contacts, or what? If it's the former, can someone give links where this type of info is sold, just out of curiosity.

A hired thug who doesn't care who his master is.

Oh no, somebody gave up the public's right for privacy for personal gain, I am shocked.

Bigger government will be even better.

dreyfusaffair.onion

Let's hope the accused officer isn't a member of an unpopular minority group.

By the way from other french articles: For 30 euros, you gave him a phone number, he would give you his bank statements. For 50 euros, he would give you his identity. For 150 euros, driver license number, date of delivery, ID card number, social security number, license plate…. You could even know about the flights he booked.

For 300 euros, could get his entire life. It was possible to get the police documents and those from Interpol. But the most interesting with the 300 euros offer was that with a simple phone number you could get all his phone calls and it's physical location even month before. This was what chocked me the most. There was a higher price for celebrities and politicians : I believe those people have a special status.

What's persistently disturbing is that in a free (black) market the price for that commodity has sunk so low. It means that there's a lot of offer available...

At a guess he's not the only bent officer.

>But the most interesting with the 300 euros offer was that with a simple phone number you could get all his phone calls and it's physical location even month before

You can just log the pings to phone towers to get a rough location of a person. In that case it's probably kept automatically for a while in case it's needed for actual police work.

The title is somewhat misleading and the reality is much more serious.

As the article mentions this was not just a "police officer" this was an agent of DGSI, something perhaps like the intelligence branch of the FBI in the US if such thing exists.

@dang

I'm appalled of the growing number of dead posts that I see lately. Since normal accounts apparently can't answer them, how do you think they will regulate themselves?

>dead posts

What do you mean by 'dead posts' in this context, please?

Unnecessarily uncivil and bizarre posts can be flagged and killed for normal viewers. If you want to see them, you can change the setting in your account (set showdead=Yes), but it's not really an improvement to the experience on the site, just a bit of transparency...

Also, shadowbanned accounts have their posts dead automatically. If you think the post contributes in a positive way, you can vouch for it (click through to the post page).

I think the point of dead posts is that there is no punishment that works. These are posters that thrive on and are reinforced by conflicting interaction regardless of voting. When the posts are "dead" (and thus get no interaction) we have extinction of the reinforcement.

Unfortunately conflicts are absolutely necessary for solving deep problems and if conflict is banned outright then what remains is shallow or polite conversation.

(Conflict does not mean malevolence)

>(Conflict does not mean malevolence)

Not all conflict does, but in this case, the OP was talking about people who are baiting argument for the sake of argument. They're not looking to solve some problem. They're just looking to be dicks.

There is a difference.

Yes. But how do you enlarge the frame to include the conflict _and_ be able to tell the useful one from the malevolent one?

My argument is that it is not clear in what way the dead posts became dead and neither self-correction nor peer-correction are possible any more.

I don't know myself exactly all the circumstances that may lead to a dead post, but I don't really need to know - all I know is that the posts are rather off-the-rails and outliers, or just plain bizarre.

As for correcting the user's behavior - I think we make the calculation that interactive correction is impossible or infeasible at this time and in this forum. This is a self-interested calculation, but I think I must agree that it's a healthy self-interest.

Eventually, if they will be more careful not to alienate other users and make more useful and helpful comments, others who have showdead=Yes (like myself) could vouch for them.

I may have done so once or twice (I don't recall actually doing so), so that circumstance would seem to be rare...

I honestly don't know how to do it. But I will say that on HN at least, there seems to be a moderation team interested in finding that balance.

The only comments I've seen that get killed are so far off the rails or so hateful as to be completely unproductive.

From what I've seen online, the malevolent ones just seem to want to resort to personal attacks, or make terrible arguments full of basic logic flaws.

I get what you're saying, but I would say that the onus is on the individual arguing to prove they are not malicious. If I type something that can be construed as 'off-topic' or malicious, I always either preface it with an explanation to the word choice (i.e. don't read tone in text, because this is said with a flat emote). Otherwise, I expect my comment to get flagged and killed.

Like this one. This has nothing to do with the original story, so it may get killed. And that's something that I understand and am okay with.

Yeah, the dead comments are generally a good thing. The problem is that there are a large number of dead comments that appear to be false positives.

That is true, but in my experience HN mods have a really hard time recognizing the difference between malicious trolls/spammers who need to be kept in the dark vs. well-meaning commenters who could improve with a little correction. More often, anyone who comes to the attention of the mods is assumed to be a troll and gets silently throttled or hellbanned.

Could you please email hn@ycombinator.com with some more details so we can take a look?

The problem seems to be well understood. As long as there is 'no punishment that works' the dialog is closed so I see no point at this time to pursue this.

Ufortunatelly there are no walls high enough to protect this or any garden from snakes. To pretend otherwise is shallow thinking

Ah, amateurs. He should have printed a notice saying "by entering the premises you agree to my privacy policy". Then it would be ok to sell the data.

That won't fly under GDPR. The building owner should give you consent form:

  You consent to:

  - [ ] Your data will be processed by police department
        to fulfill your request.
  - [ ] Your data will be used to help with ongoing investigations*/**/***.
  - [ ] Your data will be used to better evaluate information
        coming from you****.

  <font size=smallest>
  *    - by consenting you agree to be included in department's suspect list.
  **   - by consenting you agree to have data shared with all other government
         agencies, as well as private investigators listed in Appendix A.
  ***  - by consenting you agree to have your data shared with select journalists
         (listed in Appendix B), as well as any and all social media profiles
         of the department.
  **** - by consenting you agree to be randomly searched and detained if the department
         determines a need for it.
  </font>

  Appendix A:
  [redacted due to national security concerns]

I'd happily sign such a form when dealing with the police. At least it would give me some prospect of legal recourse if the data was ultimately found to be being used in any other way.

I'd rather if they didn't spy on me in the first place...

Every time I see one of those forms I feel like the hungry, desperate sex workers who "consent" to being degraded and humiliated so that they can feed their families for another day...

We say "yes," but the head shakes "no".

Just say no if you feel you shouldn't. It's not required to live -- it's required to get something from someone else that you want. You have agency (as does any sex worker who isn't being trafficked). It's absurd that you'd make the comparison between a family starving and you using a website, but it's even worse because you're pushing off the responsibility of your own actions onto anyone and everyone else.

The "premises" being the world, given that he was selling Interpol data?

Bouillabaisse recipe?

Reply on news.ycombinator.com