Great so now anybody who reads those court records can steal those 20 peoples identities?
SparkFun Gets A Subpoena
11–20 of 55 posts
Re: SparkFun Gets A Subpoena
#12SparkFun is lucky that the subpoena was for one of their products being used in a credit card skimmer and not an improvised cruise missile. Also, protip for criminals: make your own circuit boards without identifying marks.
This is not the first time[1] we've had issues with our products showing up in the news for less than stellar reasons - luckily nothing as awful as an explosive device. As Nate said in the article, we know our parts can be used for good or for evil. If only there was less of the latter...
Re: SparkFun Gets A Subpoena
#13SparkFun is lucky that the subpoena was for one of their products being used in a credit card skimmer and not an improvised cruise missile. Also, protip for criminals: make your own circuit boards without identifying marks.
> Also, protip for criminals: make your own circuit boards without identifying marks.
Why? This seems like the perfect sort of thing to buy with someone's stolen credit card - it provides a red herring for the police to chase after, and at least in this case, gives the thieves a warning that an investigation is in process.
Re: SparkFun Gets A Subpoena
#14Re: SparkFun Gets A Subpoena
#15I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
For this specific case, they'd probably need to keep that accounting information for filing taxes. I'm not sure about the U.S., but in Canada we need to keep tax-related records for 7 years (I think).
Re: SparkFun Gets A Subpoena
#16I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
It may be theoretically possible, but it's probably more hassle than it's worth. It's easier for inventory tracking if you have a paper trail (or equivalent on disk). It's also good to have the receipts if you're ever audited.
It's also inconvenient for the 99.999% of customers who aren't trying to cover their tracks, because without the info they wouldn't be able to check their order history.
And it's not simply a matter of telling the law enforcement agency "We don't store that information." You most likely have to jump through the hoops to prove that you don't store the information.
Re: SparkFun Gets A Subpoena
#17I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
If a company gives that response law enforcement will just come back with a warrant. You might say that's the case. But from their perspective it sounds fishy, and their only way to be sure is to take your servers and find out for themselves.
Re: SparkFun Gets A Subpoena
#18I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
It seems like it would be difficult to run a business without keeping basic information on your current and past customers. Or are you suggesting lying to the police? That doesn't sound like a good idea at all.
Re: SparkFun Gets A Subpoena
#19I'm wondering if they track unique MAC or IMEI numbers for devices involved. A Bluetooth module would have a unique MAC ID, but I've never heard of that ID being used for network admin or security. MAC for WiFi or Ethernet is used for DHCP and MAC address filters.
If the investigator were smart enough, they could ID the other coupled nodes connecting to the BlueSMiRF device. This technique is done to locate a WiFi node.
Re: SparkFun Gets A Subpoena
#20As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people…
I'm all for helping the police, I'd be pretty willing to give them information in a case like this. But I'm amazed their initial subpoena was for ALL orders from Georgia for a multi-month period. That's an amazingly wide net.
I suspect that the police in this case have no idea how big sparkfun is or how much business they do.