Hacker News Reader

Comment by IncRnd | Hacker News Reader

The real fix is to require a warrant without these loopholes. Judges can be available on a moment's notice for these sorts of issues.

View on HN

Are we sure it's not trivial to fake a warrant?

Yeah, it's the same issue. You'd have to call the court back to verify the warrant.

If it's important enough to issue a warrant then it's important enough to have a court official and issuing police/judge on call to confirm its validity.

Being able to read back a code to validate the contact is all that is enough. It doesn't even have been complicated.

If they can't be bothered to answer the phone then it's not important.

How do you give them a call? Info given on the warrant? Which is fake? And so they fake the call back info?

The court's own website usually has contact information that can be independently verified. This isn't that difficult a problem to solve.

Do courts all have domains under a government subdomain?

All the courts that would issue these types of warrants will be easy to find. This isn't the sort of thing you do over a traffic ticket or shoplifting. It's not the court you go to when your neighbor owes you fifty bucks. These are murder and kidnapping cases. The people processing these warrants today are likely already on a first name basis with the clerks of these courts.

Think about it, how do you validate any court order? Why is this only a problem now? I think it's beacuse they want to side step the judicial oversight process. Keep that intact, as the constitution requires, and this issue disappears.

Do not forget that it is world wide. The gov has next to a signature a feature called apostille.

Local-ish courthouse for me only has a contact info for regular business hours. So if not in business hours, then what? There's ~3200 counties (or equivalent) in the US. There's no way to be on a first name basis with the clerks of each county courthouse, let alone if you have a big county with multiple different types of courts.

As for how you validate court orders now? You largely don't. That's why it's possible to use fake court orders to take down true but unpleasant information: https://www.cnet.com/news/privacy/forged-court-papers-are-be...

Your local courthouse may not even do jury trials. It doesn't do the sort of cases that require 3AM emergency warrants. If it's that important it can go in front of a district or federal judge, otherwise it can wait for business hours.

Local police departments don't need the ability to engage a global surveillance apperatus at the drop of a hat. Stuff like that can be ran up the chain first.

> It doesn't do the sort of cases that require 3AM emergency warrants

You will be in trouble if you ignore a real warrant on this basis.

Your lawyers will probably tell you that it’s better to just take the risk of possibly complying with a fake warrant.

Who would you even give the data to if they are closed? Fax it over the the courthouse if you are concerned, or tell them it's at your location ready for pickup. If they are legit that won't be a problem.

The data is collected by the LEO, not the court. But yes, you can fax it to the law enforcement office, whose number should also be independently verifiable.

> whose number should also be independently verifiable

This is not a legal requirement. If you fail to comply with a legitimate request because you couldn’t verify the number, you go to jail.

Can you point us to an incident where this has ever happened, namely, where a service provider didn't to respond to a demand immediately while they verified its authenticity and someone went to jail for it? Or even got a finger wagged at them by a judge? Third-party records production is almost never time-sensitive to the degree that, say, a warrant to search for drugs or contraband is, and there's little risk of spoliation of evidence.

As the article points out, nobody actually verifies these requests.

So no, I can’t point you to such an incident. Have people been held in contempt for failing to comply fast enough? for sure.

You cannot conclude that because someone has been held in contempt for intentionally failing to respond to a records production request because they simply didn’t want to do it, that someone would also be held in contempt for delaying production for a few hours while they make a good-faith attempt to verify the authenticity of a request. Judges take all the facts and circumstances into account—including intent—when making these kinds of decisions, especially those that involve depriving someone of their liberty.

> delaying production for a few hours

Ah yeah, I think you are totally right. Our disagreement stems from the fact that I don’t believe that few hours is sufficient at all.

Is being unable to independently verify a request for information or a warrant a real problem, or are you just making up problems that may not actually exist?

Let's stick to reality, folks.

If you have ever received a demand from a court that you couldn't verify the authenticity of, I'd like to hear from you.

> These are murder and kidnapping cases.

They're also "we think this kid is selling marijuana" cases. Law enforcement doesn't even need a warrant, they can just send a request for data and every company will just rubber stamp it and give them whatever they want.

This is wrong, and I know several legal process departments who will tell you otherwise, e.g.,:

https://www.apple.com/legal/privacy/law-enforcement-guidelin...

Please, post about legal issues only if you know what you are talking about.

They do not! And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Even more fun would be the process of jurisdictional verification. All of which I'm sure the "Officers" would be more than happy to leave you be with your electronics and whatnot long enough to verify, right?

Longer I'm alive, the more insane our system seems to me on a daily basis. Not sure if it's just cognitive decline or rapidly amplified cynicism as I dig into the signalling nightmare that is the interface between the executive and the judiciary system.

> And you'll be surprised how tricky it is to find local/state courts as someone with non-regular contact with the legal system.

Name one court that signs warrants to service providers that can't be verified by spending 5 minutes doing some basic research, or that has a LEO office serving such warrants that also can't be verified.

So you go look up warrants on a regular basis?

The topic at hand isn't whether a lawyer or a court officer can, but whether EVERYONE can in a timely manner such that if a police officer or LEO (or someone impersonating one, since we're talking zero trust) can be told to go sod themselves by a layman.

Fundamentally this is a signal/info propagation problem. Processes take time.

The people who process these requests, particularly at the large companies that possess such data, are typically dedicated to the task and possess the specialized knowledge needed to do so. They have often developed significant relationships with the law enforcement community.

Do you know them? Do you have a connection that you could entrust with giving you a positive or negative answer as to whether the armed man with no sense of humor in the cop uniform outside is the real deal?

I don't. Hell, even if I had a lawyer on hand, I doubt the lawyer would go "hold up.. checking the registries, yup it's legit"; rather they'd tell you to cooperate then maybe challenge outcomes down the road when the paperwork catches up.

For most, the answer is they take it on faith anyone usurping that authority would have such a shit ton of bricks dropped on them, no one would be stupid enough to do it. Obviously, that logic is showing it's age.

Frankly, if I were the courts/LE and found out this was going on, there'd be a new Public Enemy #1. Trust is too important.

People were able to do this for years prior to Google's existence. I'm sure a social media company can determine how to find a court without Google.

Every court has a phone number, you can lookup the court independently and call the main line to get routed to the appropriate party

Use a phone book?

Faking a warrant is a felony, perhaps even a federal one that would get the FBI involved I assume. You'd have to forge an official court document, forge a signature of a judge, etc. That has _serious_ consequences and prison time vs. faking a "data request" that might be entirely digital with no physical document or signatures, etc.

Not saying it can't happen or won't happen, but a criminal has to be seriously determined and ready to risk a long prison sentence to fake a warrant.

I feel like I've been seeing a lot of comments lately to the effect of, "no - that would be illegal!" Yeah, we are talking about criminals who are already breaking one law. Often criminals who, in the very nature of their crime, are hard to identify.

But then, even if they're not overtly breaking the law with a simple request for information, debt collectors and car warranty salesman are notorious for sending letters that will imply they are your financial institution, the letter was sent by your account manager, etc. IRS impersonators will tell people that jail time is imminent. I can imagine someone could create something that looks to a non-lawyer (who's afraid and not paying attention) like it's basically warrant signed by someone who's basically a judge, but just doesn't outright say that. You'd still need to verify - hey is this person actually a judge, and did this person actually sign that as a warrant?

Yes, which is why just set the bar at responding to any request for any data with "Sorry we do not respond to requests for data that aren't court ordered warrants. Please come back with a warrant we can verify."

The problem here is that companies have a policy of trusting some government email address for little one-off, no warrant needed requests. Don't have that policy.

> Please come back with a warrant we can verify

The problem is that it might not be easy to verify a real warrant, but that’s not grounds for noncompliance.

>> Please come back with a warrant we can verify

Ok. Now how do I verify one, assuming the information in this article is accurate?

You check the court records. These are easy to find with a digital records search, or you call the court clerk. The phone number is listed on the warrant. This is not hard, but it's not an automated process by design.

> The phone number is listed on the warrant.

You should not rely on any information on the document you want to verify - look it up yourself.

From the end of the article:

“Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill.

The Digital Authenticity for Court Orders Act would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content.

So yes, people are faking court documents.

Ah yes, the good old "just make crime illegal"

Do people honestly think that's a deterrent for people already committing felonies?

Most criminals aren't thinking about any of that at all. Either they're so goal focused, any possible punishments don't even cross their mind, or they think they're clever enough to not have to worry about it.

All of which makes me wonder, and this being HN, wouldn’t it make so much sense of law enforcement agencies start signing these kind of requests with verifiable public keys?

It seems like such a trivial problem from a technology point of view, it makes me believe it’s mostly an organizational problem.

I agree that it does seem like a trivial problem that is mostly organizational. There are nearly 18,000 police departments in the US. Standardizing anything across a subset these and getting approval from the judicial system just seems like a nightmare.

This seems like one of those issues that is solved only when someone is murdered and a law is written after their name.

Let's add Blockchain to this so warrants are verifiable on a private Blockchain.

At the very bottom of the article:

8<--------------------------------------------

The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology.

8<--------------------------------------------

I should have done a better job at reading the article, thanks for this.

From the end of the article:

This isn’t a fix. Warrants are easy to fake, not necessarily easy to verify.

Reply on news.ycombinator.com