Hacker News Reader

Comment by sschueller | Hacker News Reader

Is the system restricted enough that some 20 person town with one sheriff can't access a persons phone records located 1000 miles away?

View on HN

What about a "20 person town" that doesn't even exist, with a police department that has a totally legit looking website and a police chief who emails AT&T requesting emergency access to prevent a suicide?

From an appropriate @city.gov email address?

Many (real) police departments don't actually have such an address, so that's not a reliable test.

Also, maybe not relevant for this discussion of AT&T, but what about "law enforcement" outside the US? My point is more broadly about the problem of verifying a request really and legally came from "law enforcement."

A comprehensive list of law enforcement agencies is produced as part of the census: https://bjs.ojp.gov/data-collection/census-state-and-local-l...

If my experience working with AT&T in the private sector is any indication, they would be cross referencing this sort of list when establishing new access, and I doubt this is something that can be done quickly.

> ...police chief who emails AT&T requesting emergency access to prevent a suicide?

This isn't a plausible hypothetical. If it was an emergency they would be calling through established channels and the fastest way to get access to that sort of information would likely be an emergency warrant, which is easily granted in the situation you described.

It's a bit more than a plausible hypothetical. Granted it didn't involve fake police departments, but there are documented cases [0] of hackers emailing companies, including Meta, from compromised police accounts with "emergency data requests" - which are, notably, warrantless.

[0] https://krebsonsecurity.com/2022/03/hackers-gaining-power-of...

They won't give any details about the system. That's one of the main points of the article (and Wyden's push for declassifying it)

Does it matter?

Yes, some small town cop might not have any oversight and if he starts requesting phone records of "famous" people it can quickly become a huge issue not that warrent-less access isn't already an issue for everyone else.

The rich and powerful always have ways of protecting themselves. Whether they choose to avail themselves of those services is another matter.

So .... All good? They deserve what they get?

Not sure the point of this comment.

The point is that you should be more concerned with the way common people will be abused.

Heads-up, looks like you might be shadow banned, you may want to reach out to the mods to see why.

I am. Original comment was kind of a ass backwards way of the making that point, if that was their point.

Also, yes, check on the shadow ban ... your comment history shows a bunch of flagged/dead comments that didn't warrant it.

You seem to be under the mistaken belief that cops are held accountable. They’re not. Accessing Taylor Swift’s text messages is least dangerous thing cops of all levels regularly engage in.

Until someone complains to the press, then it’s one of the more common ways LEO get fired.

Agencies will throw officers under the bus at the slightest provocation to save their own asses. The easiest way is if they get caught violating policy. Officers will often work hard to find out how to not get caught/the cracks in the system, vague areas of policies, etc.

It’s always been a cat and mouse game. Same in the military, except the military doesn’t have to deal with civilian courts and shit rolls down hill more explicitly.

Cops are almost never fired. Placed on paid administrative leave pending the outcome of an investigation? While the press is in a tizzy? Sure. Fired? No. Almost all cops found in violation of policies win on internal appeal. Even in the extremely rare case when they are fired, they’re rehired in a neighboring jurisdiction post haste.

The courts? PUH-LEASE! Prosecutors never prosecute. Even if they go to a grand jury, they end up instructing the grand jury to pass a no-bill (i.e. not enough evidence of a crime), thus letting them was their hands and say, “Gosh! The jury didn’t indict. Can’t do anything,” when in actually grand juries indict everyone. (When I was on a federal grand jury, the AUSA told us that if we were going to pass a no-bill, to tell him so he could bring more evidence (a legitimate ask) and told us that a no-bill would result the a call to him, and his boss, from the Attorney General himself.) Then of course there’s qualified immunity and case law that is overly differential to police actions — even when they violate procedure.

It’s bullshit. Cops are completely unaccountable. They’re gangs.

https://www.ncja.org/crimeandjusticenews/fired-cops-are-rout...

There's probably more danger in accessing non-famous people, such as looking for dirt on a friend's wife, son-in-law, ex-wife's new boyfriend, etc.

One of the big Snowden revelations is using NSA spying to do just that was so common place that co-workers were suspicious of anyone who didn’t illegally spy on exes or random crushes.

Not even the NSA has a database of famous person phone numbers. Most of the rich and famous don't have phone numbers, or even mailing addresses. They have companies that in turn manage their devices and properties, usually run through a "family office" of attorneys and accountants. So the NSA will have a list of numbers associated with their production company or family law firm, which would require further human investigation to determine which was actually in a person's pocket day to day.

Politicians have started adopting such structures too. House Speaker Mike Johnson famously has no bank account. He does, just not under his name. It would be managed by his family office.

I don't think this is close to universal among rich and famous, although no doubt you are correct about some. For one thing there is a principal agent problem in giving this kind of personal service company control over all your comms. Big impersonal companies can be more relied on to treat everyone the same. Many famous people will just sign up under a pseudonym.

Family offices are also an artifact of generational wealth. Plenty of famous people aren't rich enough for something that heavily staffed. Also newly wealthy will often want to be able to deal with existing friends and family on the same basis as before.

Indirectly, I've been able to observe some of the habits of someone with stratospheric levels of wealth. They had a phone number, but changed it frequently.

I worked for telcos, and the rich & famous & royalty typically had their accounts restricted from access by regular CSRs. I know there were restrictions built into the internal systems, though it didn't apply to my role.

Now the elite use Telegram groups, Signal, and rotate SIM cards. Everybody should be doing life this way, so the telcos become dumb data pipes.

In some respects, uber wealthy and street/cyber savvy criminals act same: use intermediaries, use cash, use trusts incorporated in states/places, where it is hard to trace beneficiaries, burner phones bought with cash, by intermediaries, frequent change of phones, no trace of their names on data brokers, consultants who help get rid of any trace in data brokers, etc.

Of course not.

Probably not, but why would you be worried about them and not the feds?

I'm not American, but from what I understand the FBI is more politically exposed than small-town cops. If the Bureau screws up, it's national news and someone loses a job; if Sheriff McBigot screws up, as long as he can count on the support of a few local villagers he'll be just fine.

The feds have repeatedly been found to misuse the surveillance capabilities under the FISA court, and no one has been fired. https://epic.org/surveillance-court-finds-fbi-repeatedly-mis...

Federal law enforcement and our intelligence agencies are politically powerful organizations that pretty much do as they please and never face consequences. Even our elected officials fear them. As senator Chuck Schumer put it “Let me tell you, you take on the intelligence community, they have six ways from Sunday at getting back at you.”

None of this contradicts what the GP said. Both are unaccountable in different ways; a local small-town sheriff is much more likely to get away with things that the FBI can’t, and vice versa.

Neither group should have the power but I am far more likely to be in danger from a nearby guy on a power trip than from the FBI.

> Neither group should have the power but I am far more likely to be in danger from a nearby guy on a power trip than from the FBI.

I think that that's a less obvious conclusion than one might think, even though I share your more acute distrust of local than of federal law enforcement. It might seem extremely unlikely for someone inconsequential like, let's be honest, many of us here to come to the attention of a national body; but history shows that all it takes is being affiliated with a group or movement that makes the federal government nervous to become the subject of FBI scrutiny, and this likelihood is heightened the easier surveillance becomes.

Reply on news.ycombinator.com