Re-Victimization from Police-Auctioned Cell Phones | Hacker News Reader

Re-Victimization from Police-Auctioned Cell Phones

krebsonsecurity.com

122 pointsimpish920834 comments

Never heard of PropertyRoom.com - but from a quick look at the "Police Auctions" it just looks like a legalized market for stolen goods haha. I mean they have a bundle of ~10 "used" bikes.

Why try to find the owner of stolen goods, when you can just put it online and sell it youself...

Guessing they hold it for a certain amount of time before selling it.

Particularly funny that they have "Steal of the Day" deals: https://www.propertyroom.com/s/prsoddsteals2023.

States have various rules for finding the original owners. Unfortunately, they're mostly rather antiquated, like having to post in a local newspaper. The onus is really on the person who lost/had their property stolen to track down where it might be.

Kudos to An Garda Síochána (Irish police force) for putting a lot of work into returning recovered stolen property to its owners. About 7 years ago, they published photos of many bikes that they had recovered in the Dublin region. Similar to other cities, bike theft has been endemic in Dublin for a long time but the guards do make the effort to combat it.

https://www.garda.ie/en/about-us/online-services/unclaimed-p...

I'm Dave Levin, one of the authors of this study. Happy to answer any questions!

First of all, it's great that you were able to effect change here. It's a bit of a shame that that part wasn't mentioned in TFA until the last paragraph.

Are there lots of other companies that might be selling unwiped phones from civil forfeiture, or does PropertyRoom run most of the market?

Thanks for the kind words!

We looked for other police auction websites; the only other US-based one we found was GovDeals. We analyzed their police auctions and found they paled in comparison to PropertyRoom. As far as we can tell, PropertyRoom is the major player.

>"We informed them of our research in October 2022, and they responded that they would review our findings internally,” Levin said. “They stopped selling them for a while, but then it slowly came back, and then we made sure we won every auction. And all of the ones we got from that were indeed wiped, except there were four devices that had external SD [storage] cards in them that weren’t wiped.”

Well at least it seems to have a happy ending.

At least on the iOS side, where phones are locked to a particular user's AppleID, how useful are one of these phones bought at auction? I'd guess they're only useful for harvesting the previous owner's content and for parts.

The problem is that about 20% of the phones in the study had the passcode disabled, and another 5% had easy-to-guess passcodes.

Even with the device's passcode though, AFAIK you can't just re-assign the phone to your own AppleID without the previous owner AppleID releasing it.

EDIT: ...only if the previous user opted in to Activation Lock[1]

1: https://support.apple.com/en-us/HT201365

But you can open the photos app and look at all the drivers licenses they've collected.

Activation Lock is enabled when Find My is enabled, and when you sign into iCloud this is enabled by default.

You can change the associated apple id password using only the phone pin, then use that to disable activation lock & find my phone, then the phone is fully yours. Most people use easily guessable pins.

So wait, you are being paid by the state to seize private property, and then you sell it for profit?

Welcome to the Police. They don't serve and protect you and I, only people and businesses with big money.

Don't forget themselves, they protect themselves the most.

Some states require that anything of value seized by the police has to be sold at public auction. I think the spirit is that it has to be made available to the public to avoid the state simply taking it for themselves, fwiw.

But the state did take it for themselves, and now they're selling it back. That's not "made available", that's fencing.

Yet, destroying all the items is worse. What other options does one have? I mean, yes there is a perverse incentive, but that's more for cash forfeiture without a crime, which is a real thing too in the US..

Generally auctions are considered the least-unfair way of disposing of property. Outside of forfeiture or lost property, in some causes a court can force shared-ownership property to be auctioned, to give it a "fresh start" without the problematic shared ownership. This also happens with hundreds-of-millions-of-dollar real estate.

Anyone know of the equivalent PropertyRoom.com for Canada?

If you live in a large municipality, check out their website. Lots of weird stuff for sale like old police cruisers.

Thanks

All I have to say is that it shouldn't just be a process to wipe data, but it should be that if you don't wipe data, and it includes data about people who are not yourself, that selling it without wiping it should be considered a criminal act of negligence.

Of course the US couldn't give one shit about that. Our privacy laws are fucking bullshit.

What about shadow volumes? Encrypted hidden data?

How about a criminal act of negligence to sell anything that _can_ at one point or another store data. Then we can just destroy all of these electronics as the _climate change warriors_ cry about that too.

I swear there is no good outcome. Everyone will find something to complain about and suggest laws and jail time to prosecute the behavior while others are screaming to defund police and that the US incarceration rate is too high.

Unless they’re CEOs or “rich” then we can send them all to jail based on public opinion.

If it was hidden or inaccessible it seems obvious that you have no longer acted negligently.

Actually wiping a disk will erase shadow volumes and hidden data

are you that ignorant about how disks works or just trolling?

This is the sort of thing that confirms the idea that Apple and the Android phone manufacturers get away with WAY too much. If their business model involves taking and using and processing THIS MUCH personal information, they should be held to a significantly higher standard of care. Stolen phones should mostly not exist, and this problem definitely simply shouldn't exist. This 100% ought to be on them.

So, to be clear: the police stole a bunch of phones, some of which had the passcode disabled, and sold them without wiping the data... and you place the blame on the phone manufacturer? The only people in this story who haven't messed up, and the only ones who made an effort to protect the user's privacy?

Bot answer

What?

What does "Stolen phones should mostly not exist" mean? People steal stuff all the time, that's reality.

People do steal stuff, but that stuff isn't usually a data collection device which is clearly tied to an specific individual. For every phone that exists, Apple, Google, and/or the wireless carriers have extensive and detailed records of who owned the device and when, along with multiple measures of where that phone was at any given time, who was using it, and what it was being used for.

If my phone is stolen, these companies continue to know exactly where it is and who has it and what they are doing with it at all times. I should be able to call the police and have them track down my device and retrieve it for me.

There's the potential that someone could try to scam this system by selling a phone second hand and then pretending the sale never happened, but of course our purchases and financial records are typically being tracked at all times as well, and there are countless records of nearly every interaction we have with other people, and receipts are also a thing. The risks of scams in a "phone theft mostly isn't a thing" world would have to be measured against the scams and thefts we have today in our current "All your data is constantly collected and endlessly stored, but never used to benefit you" world.

A significant % of the population, have bank accounts, mail, social medias and IDs pictures on their phones.

Reply on news.ycombinator.com