Companies make it too easy for thieves to impersonate police and steal data

First time I realized this was possible was in the TV show Mr. Robot [0] and I thought it couldn't have been that easy. However, after my experience within the cybersecurity sector, I can see this happen easily. Old processes that require implicit trust don't work in the modern, connected world.

We already have the technology (PKI with smartcards) to fix this, but unless something really bad happens, there doesn't seem to be a rush to do so.

[0] From Mr Robot Season 2 Episode 9 https://www.youtube.com/watch?v=5qTSoCzp-LY

In a lot of places, you just bribe the police and do it officially.

Governments could make these requests a lot easier to verify. Companies shouldn't be in the position of having to guess at who is a real government official.

The solution is to minimize data in company's possession, which includes minimizing collection and retension. Otherwise, even if you close this loophole, another will appear. Your data is an asset with value and people will seek it out.

Carefully checking every request costs money. Giving away data to unauthorized parties pretending to have such authorization costs nothing. Follow the incentives.

The government has been entirely too slow to adopt the really simple stuff like PGP-signed email. If we had what was child's play in the 90s, most of these problems would go away. (And be replaced with different problems, like someone hacking the police's computers to get their private key, but let's imagine they can use some sort of HSM because those exist now.)

Then set minimum standards for data requests, possibly in law, if not via the European idea of a data commissioner.

Then two things

0. Persue companies that screw up like this. I mean the SEC strikes terror into the hearts of the Boards of some of the worlds richest companies so it’s feasible

1. Fucking prosecute the actual criminals! Yea companies should put more effort in. So raise the floor so no one feels doing the right thing leaves them at a disadvantage- but also, this is very much a blame the banks for having cash in the safe during a robbery. The robbers need to be prosecuted- and the companies need to think of data like cash in transit - needs much better protection than they currently do

It should not be too hard to verify?

Call up the clerk of the court who issued the order, or the police department of the city, or whoever the relevant authority is, and ask them to confirm.

You don't need digital signatures or encryption to do that.

The governments require this. This is 100% the governments' fault.

There may an opportunity for a startup to authenticate law enforcement, like a specialized version of id.me.

Why are we blaming the companies because the police are easy to impersonate?

Very true.

The companies that gave data to criminals need to be bankrupted.