Hacker News Reader

Comment by kefs | Hacker News Reader

I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been encrypted.

View on HN

You think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure?

You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this?

If you were to email it encrypted, you'd have to send a follow email with the decryption key. Encryption would only be a inconvience and would not protect this information at all.

The fact that they don't have anything more secure than unencrypted email gives reason to doubt that they know how to protect information like that.

An encrypted mail attachment would be a start -- if you use a second channel to deliver the secret key, e.g. call them up to tell them the password.

OK so you doubt their means. Look at the ends. Have there been many security breeches from the police/courts? Is this a large threat to personal security? I don't think so. Hence I think they must be doing something right here.

The following is just one group's public releases, spanning about 5 months, at approx 20gb.

https://thepiratebay.se/user/AntiSecurity/

Just because you don't hear about vulnerabilities and attacks, doesn't mean they don't happen.

What basis do you have to conclude that? The subpoena doesn't even include an email address. It is far more likely that the data were sent on a CD-R by registered mail, or printed out and transmitted by fax. Many court systems allow information to be submitted electronically now, but only by the attorney for the presenting side.

"It was very surreal. Just a small csv file emailed to the investigator."

from Nate down in the comments section

Oh, I didn't bother to read the comments. That surprises me, to be frank.

Reply on news.ycombinator.com