41–50 of 55 posts
As much as I foam at the mouth around here against many law enforcement actions, both parties did the right thing here. It's not like they showed up in the middle of the night and yanked their entire servers out of the office without a warrant and covered it up under "homeland security" or other nonsense. They did it the proper way through the courts with a judge and public documentation of their actions, and asked f…
If you end up being contacted by law enforcement for data, I'd recommend doing everything you can to help educate them about the information you carry. It might be tempting to volunteer as little as possible, but you also might be the first willing and knowledgeable technical person they've spoken to in some time, and starting a relationship like that on a good foot can be incredibly useful to your company; maybe even you personally.
It can mean future requirements get handled without hassle, and may never even come to you at all if they know it's information you don't or can't carry. You can also help shape policy around how such things are handled for others in future.
YMMV depending on jurisdiction, but it's worth considering contacts from law enforcement as an opportunity to build a healthy (two way) relationship.
> 7. Complete credit card numbers used on Order(s) Can you fail PCI compliance if you're able and do this? What if you use a third party system such as Stripe where you have no access to the full credit card number?
There are many ways to achieve PCI compliance. Not having the data is simply the easiest.
I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been…
As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people…
I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been…
What basis do you have to conclude that? The subpoena doesn't even include an email address. It is far more likely that the data were sent on a CD-R by registered mail, or printed out and transmitted by fax. Many court systems allow information to be submitted electronically now, but only by the attorney for the presenting side.
from Nate down in the comments section
As a result, about 20 customers that had purchased a specific device at sparkfun that had delivery in Georgia had their information given to the police to use in this investigation. I really want the people running the skim operation caught, but I agree with Nate (the sparkfun guy) that it is a very fine line harassing the others that are (most likely) blameless. Am I reading this correctly that then these 20 people…
In a different case, it was their BlueSmirf module http://www.sparkfun.com/tutorial/news/SparkFun-PINScam.pdf
As much as I foam at the mouth around here against many law enforcement actions, both parties did the right thing here. It's not like they showed up in the middle of the night and yanked their entire servers out of the office without a warrant and covered it up under "homeland security" or other nonsense. They did it the proper way through the courts with a judge and public documentation of their actions, and asked f…
This is very typical for law enforcement everywhere these days. Luckily SparkFun was diligent enough to negotiate it down to relevant information, but it the "gimme all your data" attitude is a fundamental problem. This also extend to seizures ("gimme all your servers", not just the ones involved). The courts should never allow this, so although this is the proper process, it is failing. There's no point in insisting law enforcement goes through the proper channels if those proper channels don't do their job properly.
Earlier quoted context omitted.
What basis do you have to conclude that? The subpoena doesn't even include an email address. It is far more likely that the data were sent on a CD-R by registered mail, or printed out and transmitted by fax. Many court systems allow information to be submitted electronically now, but only by the attorney for the presenting side.
"It was very surreal. Just a small csv file emailed to the investigator." from Nate down in the comments section