Detroit man steals 800 gallons using Bluetooth to hack gas pumps at station
fox2detroit.com
fox2detroit.com
The dispensers have constant real-time communication to the forecourt controller and the attendant inside. What are they showing when this "hack" happens? Are the attackers taking the RS485 line down (which would show the pump offline immediately inside) and forcing the pump to manually dispense?
I'd kill to see some more actual information than this. I am not aware of a single pump on the market with Bluetooth right now but I do remember some IR-based remotes for some old Wayne pumps.
Whew - sanity prevails! When I read the part about not stopping, I was a bit worried that the e-stop somehow was not a simple mechanical failsafe.
In the post-apocalypse or some other lawless society perhaps
> In the post-apocalypse or some other lawless society perhaps
> Detroit man steals 800 gallons
> Detroit
* oh but watch out for bird/lime/lyft/uber scooters literally everywhere and everyone's drunk
Downtown has improved wildly since when even when I was growing up near there in the 80s/90s, but people don't realize how large Detroit is. It's nearly 140 square miles. Downtown is, charitably, 2sqmi, and that's including all the way up to Wayne State. The light rail is the People Mover loop downtown plus a trolley up Woodward, within that range.
The theft mentioned in the article occurred at 8 Mile and Wyoming, which is a 20 minute highway drive from Campus Martius in no traffic. "Clean Downtown" that happened when the city hosted the super bowl and other related efforts have very lopsidedly focused on the downtown area.
I know in my grocery store training c. 1998 they definitely told us to give verbal warnings to thieves that we saw what they did, but now, even that much is dangerous.
>Insurance covers material losses as long as reasonable precautions are taken.
No one would get insurance to cover small, regular losses. And even so, insurance isn't some magic pot of gold that restores the losses that lead to closure, it just means the impact is absorbed over everyone. It's still there.
[1] Recent discussion of the concept here https://news.ycombinator.com/item?id=37688954
This was not Detroit, or even the USA. Think slightly North.
Why do people think there's some kind of insurance that has anything to do with people shoplifting from a standard retail store?
Like that's not a thing. There's insurance for catastrophic losses and out of the ordinary stuff but there's not an insurance policy that's paying for people stealing from gas pumps, or grabbing a TV from an electronic store and running out the door.
So if shrink was forecast at 0.75% of sales but actually came in lower the store would see better margins on their financials.
https://en.wikipedia.org/wiki/Grant%27s_Law#:~:text=Grant%20....
Stories abound of staff at Walmart and Target being fired for attempting to enforce store shoplifting policies (https://www.ksl.com/article/14319284/4-walmart-employees-fir...). Broadly speaking, the risk of injury to other employees and customers, the risk of lawsuit if their staff misinterpret the law in the moment and overstep the authority each state gives them (a patchwork of law that stores are not interested in training its staff on), and mostly, the risk of brand harm if these stores gain a reputation for being a place where fights break out between employees and the public, regardless of reason, are far costlier than the opportunity cost of being unable to sell lossage.
Instead, companies just track lossage and sales, and if a given neighborhood proves to have too many shoplifters, they pull up stakes and close the store.
I guess it gives room for small business owners, who are willing to shield themselves behind bullet barriers, willing to defend their own property with guns, and don't care whatsoever about bad PR.
It is, sometimes, one thing if it's Susan's shop (you know Susan; she lives in the apartment down on the corner of Fourth and Mission, stealing from Susan would be like stealing from your own aunt) and another if it's Walmart (you will never meet Sam Walton in your life, or any of the management of that company. There isn't even a franchisee).
Usually they just offset the losses by raising prices.
[1] https://www.macrotrends.net/countries/USA/united-states/murd....
[2] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand....
At best, the relationship is weak, and not well understood.
Sub out "not worth an employees' life" with "not worth an expensive assault/false imprisonment lawsuit" if you're extra cynical.
I think the OP meant:
>better to lose some money than risk losing a longtime customer...[as a] policy makes a lot of sense
It's still all serial based comms, but unless the attendant is trained or aware they might just think someone is pumping. It will show up on the daily report when the dispenser report doesn't match the sales report.
I don’t think any engineer in the last 20 years would put IR on the thing. At the same time I wonder “who would put Bluetooth on the embedded controller for such a machine?”
There's no substantiation that Bluetooth was used, nor that the perpetrator(s) is/are from Detroit. The most detail I've found, including quote from Detroit PD, is here: https://www.detroitnews.com/story/news/local/detroit-city/20...
Reading between the lines, it sounds like one person performed the hack, and numerous people then proceeded to fill up for free -- knowingly or otherwise. There's no specific assertion anywhere that one particular individual stole 800 gallons of fuel. Of course that doesn't stop dozens of news sites all over the web from reporting inaccurate "information".
If you can just roll up to the pump and communicate with it over Bluetooth, then I'd argue that it's a design flaw and the manufacturer should be held accountable as this seems like a gross laps in security.
"Paying at the pump is for chumps - when you can get gas for free - and illegal, but it didn’t stop a Detroit man from stealing almost 800 gallons of gas at the Shell at Eight Mile and Wyoming."
On iOS, there's nrf connect. Which is slightly more limited, but can still do BLE. I think there's other bluetooth-serial apps for iphones, but apple has a stick up their butt about bluetooth-classic not working super good unless the other device has a "made for i" chip/cert in it.
If either of these don't work well enough, ESP32s can be had for <$5 and can act as a bridge between your device and whatever you want to exploit.
Is BLE why "modern" iphones don't have issues with android/3rd party devices/accessories? I remember a long time ago when an iPhone meant you could only share bluetooth with other Apple devices. My iPhone today doesn't seem to be like that.
Also, you assume that someone wouldn’t just sell the gas they stole, which is probably very much worth the small investment in tools.
When you make a return without a receipt you generally just get store credit instead of cash. If you don't need some chips and tallboys, you can typically sell the credit to someone behind the station for .3 to .4 of the face value. That isn't great but since the gaming machines only take cash its a solid way to get liquid.
If you provide a product that is intended to offer a certain level of security you should get punished when your product fails in a spectacular manor.
You can punish both.
Especially considering immobilizers have been mandatory in the EU since the ‘90s and cost a manufacturer less than $1.
This is not some state of the art high tech high cost mitigation.
It wasn't more than a decade ago that I was swapping 3des pinpads out. If you had really old pump all you needed was a small screw driver to stop the meters from turning after you popped the front panel off.
I suspect it might've been something like a default feature of the embedded PC that they didn't bother to disable, so you can "plug in" a BT keyboard / mouse and take control of the system.
One of the guys I went to high school with worked the swing shift at a gas station in our town. The shift was 11pm-11am. It was a small town so the gas station rarely had any business after midnight. I guess the guy got bored and started reading all the manuals the manager had in his office.
To this day, I'm not even sure how he did it, but he managed to change the price of gas/gallon on two of the four pumps down to 5 cents a gallon. Then he proceeded to call all his friends and family to come fill up for almost nothing. He reverted it back sometime around 5 or 6am. It took the station a few months to figure out what had happened, but by then, we both had graduated and were on to college. I remember running into him at a bar when I was home and he told me the whole story.
When I worked there (before he was working the night shift) I remember there was a box on the floor by the cash register which displayed the price of gas. It had a sizable chunk of cables going in and out of the box, along with some buttons on top near the display. The manager at the time told explicitly not to fuck around with that box, its a federal crime and I will go to jail. I'm guessing the guy figured out how to change the price from that box.
To this day, I still have no idea how he did it.
Your story is from the 1990s, just based on the state of technology we can assume that the pump prices were set at a computer inside the station that wasn't networked. The computer probably had a modem that called headquarters once a day to upload information, but the manager directly edited the prices when there was need to change prices.
Note that the manager drives around to look at the posted prices on all stations around. The manager is not allowed to talk to the managers of each station as this would violate federal monopoly laws (this does happen all the time, but legally they cannot do it and that is policy any chain will have - they may or may not ignore a manager ignoring the law depending on if they think they would be caught).
I'm sure gas stations do illegal collusion all the time in some towns. However it is illegal and so at least some station managers will not do it and all company policies will say drive.
No jndi hotspots
Not to say no one did that, but it seems pretty stupid to integrate that into the pump itself (as well as extra trouble).
Seems like if someone wanted to do that, it would be far easier to those companies to just ship a Raspberry Pi-sized device and bolt it to the side/top of the pump, or put it up in the canopy with the lights.
A data gathering system wouldn't need client connections nor would it realistically even be connected to the pump controls.
They're just accessing some Bluetooth service interface for the pump.
The industry is too huge to just give up.
Bluetooth® technology supports transmit powers from -20 dBm (0.01 mW) to +20 dBm (100 mW).
I wouldn't base a national franchise's business on what BT 5.0's 'up to' states, but it's not impossible that they would rely on at least 50 meters working. I can think of very few gas stations that have a separation from pump to cashier of more than that and most of them are truck stops.
Edit: Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023.
Just drive up, unlock pump, fill up, lock pump, leave.
I would not be surprised if the pump doesn't have a time-stamped log of Bluetooth service function calls. And even if it does, how long can you run this scam before they notice missing inventory from their underground tanks? How long do they keep CCTV footage?
Strip out every timestamp correlated with a sale.
Strip out no object at a pump.
Scan through the remainder.
You could probably hack that together in python in 15 minutes, but I doubt there's commercial software offering that functionality. Which means nobody (outside a digital forensics firm) is doing that, and certainly not for $60 worth of gas.
And still, that requires the station even noticing missing inventory. I really wonder how long people have been using that hack, you'd probably check for leaks in the underground tank before checking whether your pumps have been compromised...
Or, do what has been done since the beginning of video recordings used in investigations...have a human sit in front of the screen scanning the footage.
And then you find out the car was a white Toyota corolla and it's missing a number plate, now what?
If the thieves are going to such lengths as to hack the pumps, they're likely taking the 60 seconds necessary to tape over their license plate.
This is an extreme premeditated attack, not someone running off with gas on a whim.
https://www.amazon.com/Universal-Electric-Rust-Proof-Weather...
Verified Purchaser: "I like that I don't have to pay for tolls"
How Texas Paper Tags Became a $200M Criminal Enterprise: https://www.nbcdfw.com/investigations/how-texas-paper-tags-b...
https://www.cleverdude.com/content/4-things-you-need-to-know...
Some stations just have shitty tech. A station near me fails open if you initiate a credit card transaction, take the pump off the hook, and then abort the transaction.
My state doesn't even emboss plates anymore. If I did mount one and kept my real tag number on it, could anyone even tell? I'm boring as shit, so I don't know why I'd have a James Bond gadget on my car...
> Looks like pump then pay is more regional than I assumed. Yes it’s still a thing in some parts of the US in 2023.
I haven't seen this in forever. Even the shitty little gas stations where I grew up, I thought those were all upgraded ages ago. The EPA tends to frown on tanks that have been in the ground a long time, and since that's the biggest cost, they tend to get the electronics upgraded too so that it's pay at the pump. No idea why anyone with cash wouldn't be forced to pay first.
Of course, my state used a bunch of bad paint on license plates for a number of years so you could just peel off all the paint removing any contrast from a legit plate and you'd look no different than most people's unreadable plates anyway.
That’s the thing it’s easy to say something is a perfect crime, it’s harder to prove.
I'm in a good-sized city, and every gas station I've been to lets you pay inside after filling up. The only ones that require pre-pay (either by going inside as you described, paying for a max amount, or by CC) are the farthest pumps away from the store.
That being said - perhaps its an "attendant" state? Several states have laws which restrict motorists from pumping their own gas, is this the scenario which you are talking to?
edit: grammar
But I've also ran into plenty of places that if you hit "pay inside" on the pump will simply just turn the pump on, or will call you via the pump intercom (is that common everywhere?) and tell you they're turning the pump on for a max of XX gallons and to prepay or use the card at the pump if that's not enough.
-Confirm account: super small test move to confirm liveness of endpoint
-Place hold: (locks $⁷5 worth of funds attached to an account) Finalize transaction
-Finalize transaction for final amount
-Release hold
This is actually a really troublesome thing for people who have trouble keeping their account balances positive, because you can end up locking them out of further financial activity until the hold is expired/released.
It's one of those things you don't really think about but are all over the place, and are a big part of making the world turn the way it does.
I do not miss at all standing in line behind someone who couldn't figure out which lottery ticket they wanted to buy.
They probably start investigating for a fuel leak, pull the data from all the pumps, and then realise the number of gallons pumped and the number of gallons paid for don't match up, and then check the CCTV.
in the gas trade, they use the term "evaporation" ;P
Also, volume is huge.
If a gas station averages 1 car at all times across a month, you’re talking 400,000+ gal. Even just 1 hour of pumping each day is 18,000 gal.
Are they really going to bother if one person swipes 20 gal a month?
The only place I have ever seen the requirement to pay first was in some tourist resorts in Spain, I guess to prevent theft. Weirdest thing ever, it's like....lady I have no idea how much fuel this rental car will take, how can I possibly prepay you.
How would you hear about it? Unless you're friends with a gas station owner/employee, how would you know? The amount is small enough that it'll never show up in local media, just like the local teenager shoplifting wouldn't show up on local media.
Depends on if local police and district attorneys actually acts on it
For whatever reason, everyone within 25 miles of Detroit "lives in Detroit" even though a whole lot of us might visit the city less than once a year.
The media will usually say "Metro Detroit" when referring to someone who doesn't actually live in the city[0] of Detroit and given the location of the gas station, it's probably an actual person who lives in the city.
[0] In which case it could be someone living in one of three different counties.
Also, I just call it south east Michigan. Detroit is subordinate to Oakland County now. Maybe we should call it Oakland-Macomb for better accuracy.
It's more likely that someone left a Bluetooth interface open on the service/control interface. Could be even be something used for normal service operations that wasn't properly secured.
Perhaps the BT connection bridged the device to the internet, but we have no indication of that and the internet was used as the vector. It could have been a local wireless software update interface so maintenance doesn't have to open up each pump to apply the patch.
I'm not sure who eats the cost of the theft, but I'm guessing it's the same people that make almost no money from the sale of the fuel. These were not wealthy people; they were working obscene hours and barely scraping by.
They said they get $0.30 per gallon which mostly goes toward the other overhead, leaving $0.07 of profit per gallon.
Things will be "interesting" over the next 10-20 with the switch to electrification - yet another entire sector that may no longer be viable for small/medium independent owners. (but, time marches on - we don't see many people lamenting the "buggy whip manufacturers" from days of old)
This is where we are at now, the ultimate luxury, everyone has complete moral immunity for life for absolutely anything they do so long as someone else has more money than them, never mind if they are in the top 10% of the world's wealthy overall.
Something as straightforward as "stealing is wrong" doesn't apply. "Stealing from people I don't like is fine".
I've never seen anyone introduce the idea of "wealth absolutism". From your comment though I'm not sure if you would allow the bottom 10% to feel complete moral immunity.
The first problem is that companies that add wireless/IoT capabilities to devices have nothing to do with their implementation/security beyond writing a cheque. I used to work for a company that created IoT devices for huge brands[0]. They make a toothbrush, a lightbulb or a vacuum cleaner. They're good at that, but they bring in someone else to either "wholesale create an IoT product" or collaborate on its creation where the "IoT pieces" (and their security) were farmed out to us.
Of course, we didn't have much to do with the creation of the product, either. We (frequently) used a white-label Chinese product -- often, but not always, explicitly chosen by the manufacturer. In fact, the large brands often insist on a specific Chinese provider for long-term maintenance/cost savings[1].
We receive a "dev board" and device that consists of an ESP8266/ESP32 bolted onto whatever it's IoT-ing, and a cloud service (hosted in the country of origin; almost always China). The developers involved write a mobile app and some firmware that interacts with the cloud web service -- which we have no control over/cannot work around or suggest additional security layers -- and we integrate it. It creates an impenetrable SEP field[2].
Companies who care about security care about it up to some industry defined standard that has some form of acronym (the names of which escape me these days) which involve, basically, filling out a form or two attesting (truthfully) to the requirements but that serve only to shield those involved in the process from responsibility beyond whatever the acronym-defining organization thinks to ask. It involved passing a lot of those questions off to the third-party who runs the cloud service, who -- surprise, surprise -- know what boxes to check to receive payment.
[0] I love my former employer so I'm leaving the brands off, but at least one product involved was popular enough that my parents received one as a gift for Christmas ... it was fun explaining that some code I had written was running on their phone.
[1] The pattern (one that we didn't advocate) went "hire us to build the initial, user-friendly, polished version of the app" then pass it onto said OEM to maintain/update it between hardware versions. To the extent that the first version could be secured, it is (until it's not). They don't trust the OEM to write the initial version, but once it's out there, augmenting it costs 1/10th the price and that's about all their willing to pay after the initial product is created.
[2] Someone Else's Problem (Douglas Adams -- Hitchhiker's Guide to the Galaxy).
Any other more stories other than all of these pulling from the Fox 2 news one?
Couple reports over last years from Orlando, Texas etc with a cheap homemade device being used...
https://www.clickorlando.com/news/local/2022/05/24/gas-pump-...
There are many single board computers that have BT, WiFi, and other radios enabled and forgotten.
For example, try to get a laptop that does not have a built in camera. It is significantly higher price that with camera. I am guessing similar is happening in gas pump manufacturing.
The firmware stack would also fall into the similar 'laziness'. "The [chip/radio/whatever] driving library is already made, why recompile it without the BT when it could be working right now"...
What are you basing that on?
why recompile it without the BT when it could be working right now
Why would someone recompile anything when they could just turn it off?
Yeah, and it's > $7.50 in the country I currently live in. So count yourself lucky if you live in Detroit.
https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=pet&s=e...
https://levtech.ro/product/universal-service-remote-control-...
There is also this...
That said, GP's assertion that the station can make up for stolen gas with ads is nonsensical and dishonest.
However, you'll get arrested for stealing gas -- so as a practical matter, when confronted with the situation, tolerating the ads is the recommended option!
Or what some of us refer to as 'humour'. It's worth getting into, a lot of people say good things.
I'm here to help.
Even if you got away with this, you're looking at $2000-$4000 in profit? Seems hardly with the risk (even if you're not concerned with ethics). Not to mention you have to safely store 800 gallons of gas somewhere.
> FOX 2: "And then cars just keep coming up and filling up?"
> "Yeah they meet up with them and tell them to come over here," he said.
It sounds like they find paying customers, then have the customers go get the gas from the unlocked pump. So essentially they are running a black market gas station within the actual gas station.
Maybe another option is to use bluetooth to replay someone else's card info into the pump. Extra funny if the one exploiting the skimmer for gas is completely different from whomever installed it to steal CC numbers!
what? women can't be hacker criminals ? this is a news channel with real editors who we assume graduated high school and went to college ?
to be clear, when I read "detroit man does X", I assume we are going to hear about the actual person, that is, they are known. so it's jarring to follow that headline with it flipping around the terminology, in the first paragraph "Detroit man" singular becomes "scammers" - oh it's multiple people? are they all from Detroit?
this is why news consumers are so stupid. "facts" are some kind of handwavy thing for nerds
> Paying at the pump is for chumps - when you can get gas for free - and illegal
The whole article may have been generated and then skimmed by the "authors".
This is article is like saying the bank teller has some kind of responsibility to mitigate an armed thief emptying out the bank vault when the bank vault has no lock, no door, and no real form of security.
Up until now, the technology firms which creative this software have pushed the responsibility of security unfairly (and, imo, criminally negligent) onto their customers. This article just represents that the respective technologists need to actually do their job.
There may be no security on the bluetooth, but there were cameras and accountants who noticed a discrepancy in the sales figures.
In a way, it's better to have 'system level security' (ie. auditors and CCTV) than to secure just the fuel pump - after all, another thief might be around the back lowering his own pump into the big storage tanks, bypassing the bluetooth entirely...
And that's apparently very common. According to the podcast I linked to in another comment, the deliveries are often done when no one is around, so the hatches to the tanks are often left unlocked overnight.
Seriously though, the writing is shockingly poor, informal, and reads as if it's some kind of Dr. Seuss book. "And when the clerks inside try to stop it - they can’t." "if they see a big backup at a pump, or someone hanging around a little too long, they’ll call cops to check it out." .. It's like it was run through one of those scripts that changes all words to be within the top 100-200 most commonly-used words in the language.
Also, "Some gas station owners are falling victim to a sophisticated scam. " .. It's not a scam. No one is being scammed.
Just to clarify further, FOX appears to just be fabricating things, as the Detroit PD don't know the nature of the hack, and did not mention anything about Bluetooth: https://www.detroitnews.com/story/news/local/detroit-city/20...
I'm not sure if the station themselves do the above check, or someone else. Based on other equipment I've worked on I'd expect this to be done weekly by the station, but I don't actually know what the service intervals on a gas pump is.
From a year ago. 2 9v batteries to engage the pump.
The article seems to imply per incidence, but even then you only need 50 friends. Or you can cover you tracks just by making the change, then letting an hour go by before going to fill you tank - making it seem like you were one of the lucky ones to get the cheap fuel.
So... fill up your car. Then leave. Then use a diff station next time. Rinse, repeat.
I am sure the people who did this will get hefty prison sentences and hefty fines. While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government and "lets go after the small guy".
I almost think we should make cracking of Large Companies Legal, that will force these companies to use good security practices.
FWIW, I doubt this is a ma&pa gas station. In the US, in most cases, ma&pa stations charge more for gas and make their money from Auto Services. Most Stations in the US are owned by the large Oil Companies or other large corporations.
Discovering shoddy security is one thing, abusing a lax security to cause damages, is a completely different thing. If you leave your house door unlocked, that does not mean I'm now legally entitled to walk in and steal your shit.
Also in regards to discovering weak security, there are rules around that. Intentional pen-testing without explicit consent is still a crime in most jurisdictions, as it should be.
I don't have the right to pen-test all the IT systems I like, and start lock-picking at the doors in my neighborhood, just for the noble goal of testing their security, without the explicit permission of the owners of those systems/properties.
If I accidentally enter my password in the birthday field and that crashes your system due to special characters, that's an accidental security finding I can report without repercussions, but that doesn't mean I can now start hammering your live system with port scanners and SQL-injections, just to be "thorough".
Quite often the oil company name is licensed and the gas station is independently owned. The gas station owner doesn't even need to buy gas exclusively from that company. I remember learning this when a BP gas station in Louisiana was having a tough time during the Deepwater Horizon leak. But I got curious as to how much is one way or the other
As of April 2023 there are 150,174 convenience stores in the USA, of which 118,678 stores (79%) sell fuel. Overall, convenience stores sell approximately 80% of the motor fuels purchased in the United States. 54.6% of convenience stores are owned by a single store operator (so a single owner or family that owns just that one store).
The top oil companies together own 15,400 gas stations as franchises:
> Major oil companies have begun to reemerge on the retail landscape, reversing a decade-plus trend that reduced their share of the market to less than 0.5% by 2017. Shell Oil Co./Motiva Enterprises LLC, Chevron Corp., Exxon Mobil Corp., BP North America and ConocoPhillips/Phillips 66 collectively have approximately 15,400 stores that all are franchise operations. Shell Oil Co./Motiva Enterprises LLC and Chevron own and operate stores.
https://www.convenience.org/Topics/Fuels/Who-Sells-Americas-...
The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people.
If the government can't enforce its own laws, what the fuck do we pay taxes for?
I'm not even saying pro or against here, that's just the facts of it. Police aren't here to protect you, they've established in court, in fact, that they do not need to intervene in a situation where you're in danger. That they also occasionally do some good for the community (or kill people in cold blood for trivial offenses) is a knock on effect, not the purpose.
Even if the police were perfectly moral and upstanding, relying on them to respond to an incident in real time is just a bad idea. But, if someone broke into my house and I got high res video of their face and license plate, that person would eventually be jailed and I would be able to collect damages from them. Maybe not in LA or NYC, but definitely where I live.
I wasn't really weighing in on the OP, I was weighing in on the person I replied to:
> The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people.
Which is not to say that that NEVER happens but it seems clear the monopoly on force is used as much if not moreso to maintain a status quo that benefits the power structure that wields it. "The sounds of children screaming have been removed" comes to mind, where police are in a place they are needed and resourced appropriately to respond and simply don't, because they don't have to. And the flip-side of that is, you have clear cut cases of people being harassed by cops because they're homeless, or outright killed by them for stealing food because they literally cannot pay for it.
There is absolutely a need in society for a police force, but our current one has demonstrated it's inability to meet that need over and over.
Property theft seems like the most-ignored type of crime these days. Police often do little more than fill out a report unless the thief is still there and stole a huge dollar amount. They obviously prioritize violent crime much higher than vandalism.
> the #1 type of theft is actually wage theft
This is a myth. Retail theft is much higher than wage theft.
I'm not talking about what they prioritize, I'm talking about what actually gets solved. How many times have we seen someone chased down and shots fired at them for stealing a couple sodas or something?
Meanwhile, murders, sexual assaults, nothing. Nada. And that's assuming that the perpetrator wasn't themselves a police officer.
> This is a myth. Retail theft is much higher than wage theft.
Not according to everything I've read on the subject: https://www.epi.org/publication/wage-theft-bigger-problem-fo...
They didn't just discover it but went on to exploit it on a semi-industrial scale. It is very hard for me to sympathise with them.
> I am sure the people who did this will get hefty prison sentences and hefty fines.
As they should, yes.
> While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government
Why would the government be disappointed in the company operating the pumps? The pump company is out of fuel and money. That should be enough incentive for them to step up their game.