Florida posted the password to a key disaster system on its website | Hacker News Reader

Florida posted the password to a key disaster system on its website

arstechnica.com

36 pointsfurcyd11 comments

Might be good to update this with the current article title: COVID data manager investigated, raided for using publicly available password

Reading the affidavit used to get the warrant, they don't seem to cite any evidence beyond the fact that the user triggering the alert had an IPv6 IP allocated to Comcast. Nothing about say, Comcast verifying the IP was issued to the Jones at the time of the 'intrusion'. Unless that is in the redacted section. Would that sort of know-how require redaction?

this version redacts less of that section: https://beta.documentcloud.org/documents/20421201-fdle-searc...

Interesting. So basically they say:

1) Trust us that the IP we gave was really from the person who triggered the alert. (vs real log samples)

2) trust our magical computer powers that we know it belongs to Jones’ address at the time in question (Vs say we spoke with X at Comcast and they verified....)

Is that all it takes in terms of “evidence” to get a warrant like this?

for the second I have no idea whats common there, it surprised me a bit too, but the first that seems normal. The judge is not going to say "actually, that doesn't look like a valid log entry" (that'd be trivial to fake too).

If she was fired in may then she should have know to not to use her former employer's resources. Yes, Florida's DoH opsec was extremely sloppy, but that doesn't pardon her actions. If some land property fence has collapsed that doesn't mean you can trespass.

Any Comcast subscriber could park in front of her house and use her wifi to log in, using those published credentials. Nothing ties the broadcast to her.

She had no reason to do it. But people she embarrassed did.

Sure, and by that regard, as much as this sucks to go through in being raided, all she has to do is stay quiet and hire a lawyer, even if she did it.

Corrupt governments suck, but lets be real, we are long way from rooting out the corruption, especially at the state level.

Is it still unusual for a home to have an IPV6 address?

And if it's assigned as needed by the ISP, how often might they be recycled (regardless of the actual lack of needing to, due to the large address space)?

Not sure I've still got the same IPv6 address, but even my IPv4 address for my ATT residential account has never changed. I have been assigned the same one since I opened the account 3 years ago.

It's not unusual at all, it is rather less usual to reallocate them regularly and unlikely it was coincidentally allocated to one of the ~1700 households with someone who used the system in question.

Nonetheless, I don't see any reason to believe she sent a message. It is quite possible that her previous employer has had access to her computers via organization provided software and/or is also incompetent when it comes to logging. Additionally, they clearly already knew her IP addresses, and she an obvious choice to impersonate.

I think a federal agency should take the entire department and state house apart and look for crimes by current state employees and law enforcement. Either that or they can dump these federal "cyber" laws if they can't evenly detect, investigate and prosecute their misuse by individuals and states.

On a slightly different tangent, I think this serves as an example for why one should be able to refuse all requirements to use a computer as part of one's work. These kinds of legal risks during and after employment are not reasonable.

> It's not unusual at all, it is rather less usual to reallocate them regularly and unlikely it was coincidentally allocated to one of the ~1700 households with someone who used the system in question.

Thanks for that. I haven't used anything but my phone's hotspot since around 2013 or 15. Out of touch.

Reply on news.ycombinator.com