Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The City of Seattle accidentally gave me 32M emails for $40 (2018)

mchap.io

Post reply on HN
Print view View original

71–80 of 230 posts

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#71

Post by anonexpat »

legitster wrote: post #62
0cf8612b2e1e wrote: post #49

Earlier quoted context omitted.

>… and refused to cooperate with the third party auditor Well, yeah. No way I am letting someone scan and archive my drives/data to correct their mistake. They broke other people’s privacy and now they want to break mine? Pound sand. Even if they could prove my drives had been wiped, that would do nothing to prove it had not been otherwise copied elsewhere.

This is not how the law works. If enriched uranium shows up at your door, you don't just get to hold onto it just because someone screwed up.

Not quite equivalent. When the feds show up looking for the uranium, I can clearly see if they take my refrigerator with them when they leave.

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#72

Post by tetha »

legitster wrote: post #37
jawns wrote: post #22

The most interesting part of this story is the potential legal risk of holding onto the records that were improperly disclosed. Had the author not notified the city that they had royally screwed up by divulging far more sensitive information than they had realized, they likely would have never realized the error, and he would have been free to do whatever he liked with the data. But once he notified them of their err…

> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Somewhere towards the end of the call, I asked them if it was okay to keep the emails. Why not at least ask, right? >...This isn't something I'm even remotely cool with, so we ended the call a couple minutes later, and agreed to have our lawyers speak going forwa…

So they make a grave mistake from a data protection point of view.

Why do I need to give a contractor access to things on my drives like my work contracts, bank statements, other contracts, encrypted SSH keys, as well as some information other people gave me to keep redundant - because of their mistake?

Especially because the average one of these contractors doesn't tend to exude competency. You know, like the first party I'm talking to which caused this whole disaster?

Especially because it wouldn't help. If I wanted to, I'd have drives they don't know about, or containers they can't recognize.

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#73

Post by eli »

legitster wrote: post #62
0cf8612b2e1e wrote: post #49

Earlier quoted context omitted.

>… and refused to cooperate with the third party auditor Well, yeah. No way I am letting someone scan and archive my drives/data to correct their mistake. They broke other people’s privacy and now they want to break mine? Pound sand. Even if they could prove my drives had been wiped, that would do nothing to prove it had not been otherwise copied elsewhere.

This is not how the law works. If enriched uranium shows up at your door, you don't just get to hold onto it just because someone screwed up.

If I give the uranium back and they want to search my house anyway they better have a warrant

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#74

Post by legitster »

Uvix wrote: post #44
legitster wrote: post #37

Earlier quoted context omitted.

> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Somewhere towards the end of the call, I asked them if it was okay to keep the emails. Why not at least ask, right? >...This isn't something I'm even remotely cool with, so we ended the call a couple minutes later, and agreed to have our lawyers speak going forwa…

I wouldn't call the city asking for the writer to agree to a warrantless search "acting in very good faith".

A warrant is only required for a police search. You can agree to have anyone search your property as a resolution to any legal agreement if you want to.

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#75

Post by chaps »

pierat wrote: post #68
kelnos wrote: post #45

Earlier quoted context omitted.

I would refuse to cooperate with the third party auditor as well. No one gets to scan my hard drive without a court order. And even then, I wouldn't provide the decryption passphrase unless I was legally required to. Even though there isn't anything illegal or incriminating on my hard drive (as far as I know, anyway), I wouldn't agree to let someone violate my privacy for a mistake they made. Regardless, this whole t…

A simple affidavit under perjury should absolutely suffice. How do you know I didn't upload it to S3, some torrent, IPFS, or elsewhere? I'd tell them to fuck off if they want to lay hands on my computer.. or at least come back with a court order.

Yes, I did indeed sign an affidavit.

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#76

Post by eli »

chankstein38 wrote: post #36
chaps wrote: post #2

Hah, that's a much simpler title. :)

How do I find more information out about FOIA requests? Also, in your post I think you mentioned "FOIA junkies" or something along those lines, this implies to me there's a community of people who understand this stuff and talk about it. That sounds really interesting to join. Is there a subreddit or something?

https://foia.wiki/wiki/FOIA_Basics

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#78

Post by legitster »

kelnos wrote: post #55
legitster wrote: post #42

Earlier quoted context omitted.

The dataset was so large they were probably not opening up the files before sending them over. It was clearly a rookie mistake by someone who had never had to do this stuff before and wouldn't have known what to look for. Again, the vast majority of the emails were automated alert/spam emails. So it's unclear if a random sample of the data would have turned up anything interesting to look at if you didn't know what y…

That's not a "rookie mistake"; that's gross negligence. Whenever I write some sort of script to produce some sort of data file, I always look to ensure that the data file ends up looking like what I expect. This isn't even to ensure my data file doesn't include something private, just to ensure that it actually includes what I intended it to, and I didn't do something dumb like put the data in the same field twice, o…

We are not talking about one of the geniuses here at HN. The guy answering FOIA requests for the city is the IT equivalent of the counter person at a McDonalds. I don't think it's fair to flame them for being an idiot when it's clearly a process issue.

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#79

Post by chaps »

reciprocity wrote: post #28

This blog hasn't been updated in some time given this entry is also its last entry. Are you still working with FOIA in some way?

Very much so! Since writing, I've since gone into freelance investigative journalism and nonprofit work focusing on gov transparency. A lot of what I learned has fortunately been applicable to a lot of investigative work. I need to write more about my own work, but time time time.

This piece heavily used email metadata requests:

https://southsideweekly.com/lightfoot-pac-paid-consultant-wh...

Re: The City of Seattle accidentally gave me 32M emails for $40 (2018)

#80

Post by legitster »

eli wrote: post #73
legitster wrote: post #62

Earlier quoted context omitted.

This is not how the law works. If enriched uranium shows up at your door, you don't just get to hold onto it just because someone screwed up.

If I give the uranium back and they want to search my house anyway they better have a warrant

Okay, but if you demand a warrant to confirm you don't have uranium, you can't be surprised if they are going to treat you as hostile.
Post reply on HN