I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been encrypted.
SparkFun Gets A Subpoena
31–40 of 55 posts
Re: SparkFun Gets A Subpoena
#32As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people…
I'm all for helping the police, I'd be pretty willing to give them information in a case like this. But I'm amazed their initial subpoena was for ALL orders from Georgia for a multi-month period. That's an amazingly wide net.
The police might have thought that Sparkfun only sold credit card skimming machines. Hence asking for "all orders" doesn't sound as bad if you consider that they might be thinking that's only those parts.
This matches up with reality since they seem happen when Sparkfun talks to them and they agree to only get the details for that parts.
Re: SparkFun Gets A Subpoena
#33From the comments in the post: "Alright, it’s settled. We gotta build a robot to fight crime."
R. Daneel Olivah to the rescue.
Re: SparkFun Gets A Subpoena
#34I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
Usually you're not required to record this in general, but you'd have to convince the police or the judge that you don't have it. If you just sold €1,000,000 worth of goods yesterday, the police might not believe that you (now) know nothing about this person. However if the cops ask for exact details about a €10 sale 15 years ago, you should be able to easily convince them that you no longer store that information.
Lying to the police/courts and obstructing criminal investigation blatently is, obviously, a crime. You shouldn't do it. Also if they get a warrent you are breaking the law by hiding that information.
Re: SparkFun Gets A Subpoena
#35I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been…
You think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure?
You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this?
If you were to email it encrypted, you'd have to send a follow email with the decryption key. Encryption would only be a inconvience and would not protect this information at all.
Re: SparkFun Gets A Subpoena
#36Great so now anybody who reads those court records can steal those 20 peoples identities?
No. While the subpoena itself is public record, the information turned over would not be.
Re: SparkFun Gets A Subpoena
#37As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people…
"Am I reading this correctly that then these 20 people have their info in the public record after this trial closes?"
It is also possible that the county has data retention/destruction policy, in which case the county commissioner's brother-in-law will be paid on a contract basis to have his children / some migrant workers remove the drives and feed them into a tree shredder, and then sell the bits for scrap.
Here's hoping for option two.
Re: SparkFun Gets A Subpoena
#38I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been…
You think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure? You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this? If you were to email it encrypted, you'd have to send a follow email with the decryption…
The fact that they don't have anything more secure than unencrypted email gives reason to doubt that they know how to protect information like that.
An encrypted mail attachment would be a start -- if you use a second channel to deliver the secret key, e.g. call them up to tell them the password.
Re: SparkFun Gets A Subpoena
#39As much as I foam at the mouth around here against many law enforcement actions, both parties did the right thing here.
It's not like they showed up in the middle of the night and yanked their entire servers out of the office without a warrant and covered it up under "homeland security" or other nonsense.
They did it the proper way through the courts with a judge and public documentation of their actions, and asked for only a subset of the data (limited to a year and GA).
Kudos to SparkFun for responding with caution.
That said, I think the lead will be useless to them because the person could have bought it anywhere, even outside the USA and brought it into GA. Apparently there are also clones now of sparkfun boards complete with logo.
Re: SparkFun Gets A Subpoena
#40I had to stare at the word "SUBPOENAED" for a long time before concluding that it was indeed spelled correctly.