Slashdot Mirror
Stolen Laptop Calls In! - Will Police Act?
broswell asks: "We rent computer equipment and occasionally our equipment gets stolen. I wrote a little VBS script that calls our webserver every hour (script below) and installed it on our laptops. Sure enough, some laptops went missing. One of the stolen laptops is now calling in from a Verizon Internet account which appears to be in a neighboring town. The Baltimore City Police grudgingly filled out a police report 'so we could collect insurance' but don't seem willing to subpoena Verizon, find the address of the end user, recover tha laptop and prosecute the thief. They seem clueless. The Maryland State police has a computer crimes unit. The have a clue, but they claim they don't have jurisdiction. It is not about the money (our customer signed for the computers and will pay for the stolen items), we just want justice." With all of the necessary information in hand of the proper authorities, how likely is it that the stolen laptop will be recovered?
For those interested, here is the script the laptop used to report itself back to its owners:
Set objShell = CreateObject("WScript.Shell")
Set objScriptExec = objShell.Exec("ipconfig /all")
strIpConfig = objScriptExec.StdOut.ReadAll
myvar = "send=" + strIpConfig
do until 0=1
on error resume next
a=HTTPPost("http://www.yourtrackinghost.com/cgi-bin/locator.pl",myvar)
WScript.Sleep 3600000
LOOP
Function HTTPPost(sUrl, sRequest)
set oHTTP = CreateObject("Microsoft.XMLHTTP")
oHTTP.open "POST", sUrl,false
oHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
oHTTP.setRequestHeader "Content-Length", Len(sRequest)
oHTTP.send sRequest
HTTPPost = oHTTP.responseText
End Function
For those interested, here is the script the laptop used to report itself back to its owners:
Set objShell = CreateObject("WScript.Shell")
Set objScriptExec = objShell.Exec("ipconfig /all")
strIpConfig = objScriptExec.StdOut.ReadAll
myvar = "send=" + strIpConfig
do until 0=1
on error resume next
a=HTTPPost("http://www.yourtrackinghost.com/cgi-bin/locator.pl",myvar)
WScript.Sleep 3600000
LOOP
Function HTTPPost(sUrl, sRequest)
set oHTTP = CreateObject("Microsoft.XMLHTTP")
oHTTP.open "POST", sUrl,false
oHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
oHTTP.setRequestHeader "Content-Length", Len(sRequest)
oHTTP.send sRequest
HTTPPost = oHTTP.responseText
End Function
If the police won't do anything, call the local press.
Your best hope is that now that you have the IP you can hack into the laptop and install a BT server with lots of nice pop music and videos. Then report the sharing site to the RIAA and watch them take this sucka down.
For instance, in this case:
http://www.laptopical.com/lojack-for-laptop.html
"Proof-positive of LoJack's power comes from such stories as the one out of William Penn University in Iowa. A student there had a college laptop stolen. Absolute Software was promptly notified. And their recovery experts there soon tracked the laptop down to the phone line that the notebook was hooked into the Internet on. The Des Moines Police Department was notified, and officers promptly put down their donuts and coffee and swooped in on the missing PC."
The lojack program seems to do the exact thing yours does, but then again, perhaps because it is "official", the police may take the information more seriously.
I had a laptop and 2 desktops stolen from my van in the parking lot next to the police station in downtown KC. One of my side windows as well as the windows of 3 other vehicles were broken out. The police department couldnt even be bothered to walk downstairs to file a report and told me I would need to phone it in, I called and the detective said I wasnt likely to get it back but he would get back to me. Later that night after I was home my work aim account logged itself online. I got the IP called the police department with the info, was called back the next day and reprimanded for "interfering in police work". Anyway I stopped interfering, 2 years later and I guess they are still busy doing "police work" because I have never heard back from them. I guess I learned my lesson, dont bother. Now when I have to be downtown I just leave the doors unlocked, its alot cheaper than replacing the windows. I've actually managed to make a game out of it, I no longer have to take old computers to the salvage place, I just load them in the van and take them downtown.
Think they understood the VBS? Now I know that you didn't directly throw that VB at them, but still.
Explain that your computers connect to the work network and log in, and you noticed that there was a computer trying to "hack in" from another town. Your security people found that the computer was your own computer, one that had been reported stolen.
Spin it in a way they'll understand.
Start a blog. Link to it from /. (just post a comment). Get worldwide exposure. Post the IP address and whatever information you can find on the user (without resorting to illegal means). Get people interested in your cause, and get your local paper to publish something. It may piss the police off, but they'll actually do something by then, hopefully.
"Better to be vulgar than non-existent" -Bev Henson
grand theft, although it contains the word 'grand' means more substantial theft than 1000, and the value is extremely variable on a per community basis..
o 7=&o5=&o1=1&o6=&o4=&o3=&s=grand%20theft
http://wordnet.princeton.edu/perl/webwn?o2=&o0=1&
every day http://en.wikipedia.org/wiki/Special:Random
The Police seem to be somewhat arbitrary on what they will and won't investigate. A recent anecdote from my part of the world (took place in Kelowna BC, Canada) is interesting: A guy goes to a filling station, pumps $100 in gas, and drives away. The gas station has the guy's face, and his license plates clear as day on security video. They phone the police and get told by the RCMP that they will not follow up this seemingly open and shut case, the reason? The RCMP says it is "too much work" to investigate every pump-and-run, and it is the gas station's fault anyway because they don't require payment up front.
Support the mob or mysteriously disappear.
You could always call the FBI and have them charged for breaking into secured computer systems, being:
1. The laptop
2. The server
with its built-in camera... mug shot? no we don't need that, we have a printscreen. lets go get him.
Now when will they put a GPS in these things?
I work for the Department of Redundancy Department.
First, try and verify that the police department isn't doing anything about it. Talk to a supervisor in a day or two and see where this case is going. Then, if nothing is being done, consult an attorney and ask what your options are. I know that most police forms have complain forms to fill out if you want to start making a stink. Work your way up the ladder, their IS a chain of accountability and if you're persistant and cause enough pain, someone will make the phone call to Verizon or whomever and get the name and address on the account.
If that fails to produce justice, follow up with the attorney and file civil suit against the police agency. You handed them about 3/4 of the case when you produced an IP address, they should have been willing and capable of filling in the missing paperwork and whatnot.
- Sometimes you're the pidgeon, sometimes you're the statue.
I had my car stolen when I was in school. 12 year old Honda Accord. Didn't think anyone would bother to steal the POS so I didn't insure against theft (money saving student). After it got stolen I called the cops and the first thing they asked me was whether the car was insured against theft. Since it wasn't, they wouldn't even take a report! Can you believe that? Anyway, I found the car a couple of days later 5 parking spots away from where I left it. The steering column was busted. There was a pair of size 9 rollerblades in the trunk (thief with size 9 feet?) and six jugs of bleach (???).
This was in local papers: a woman here in town (Ottawa, ON) had her house repeatedly broken into. After reporting to the cops and complaining that she has to buy a new lock each time they told her to leave the door unlocked!
..from the cops POV: "hey we can use x-money from our budget to go get some stupid civvies laptop, OR, we can get these new shiny black boots from acme police supply and some of the new 150,000 watt tasers! And with every sale they are throwing in a nifty black badge cover!"
Yep, I know some cops, that's how they think and act. They *don't care* for the most part, especially on small amounts of stolen items. No promotion potential, no newspaper "tough on terrorism/narcotics" coverage, etc. There's little profit in it for them, just boring drudge work, and they are really lazy guys for the most part. I mean lazy. wired, but lazy when it comes to anything like real work..
The police business is a growing profitable industry, the big money is in protecting the establishment (the mayor's or chief's laptop would be recovered immediately for example, or if it was personal like one of their own's relatives), and in large drug cases and other high profile cases of that nature. They don't like or want to deal with "little crime" for the most part.
First off, nice job with the script. Now, take it a few steps further. Let that script connect as it is, but let the server return a status indicator as to whether or not the machine is stolen. If it is - let the script modify IE, Opera, and Firefox configuration settings to use a proxy installed on a server you own. Preferably a proxy that can be set to log EVERYTHING. Just wait for them to log into something with clear text username/password, like most e-mail accounts from major providers use. Shouldn't be much of a leap to get enough info on him/her to pinpoint their street address.
It's urban legend but I'm sure similar things happen in real life:
:).
Disgruntled soon-to-be-ex-wife sells husband's car or other stuff for pennies on the dollar.
Unless you are a pawn shop owner or otherwise "knowledgable," the fact you bought it cheap is not evidence you "knowingly" received stolen goods. However, you are still in possession of them and that's usually a misdemeanor. At best, you will be out whatever you paid the real crooks.
BTW, I've received working electronic goods for a very small fraction of their street value, usually because the owner wanted to do me a favor or he just wanted to get rid of the stuff. Now only if I could get a $1,000 laptop for 80% off
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
"So, what this amounts to is some police officer saying ... "they'll get a nice new replacement anyway, why bother tracking the crooks, it's only one laptop"."
One of the first things I learned in primary school was that most people in places of authority don't care about dispensing justice unless the incident directly affects them. They'll always rationalize their way out of having to do anything. If you want anything done, you have to call them out in front of a crowd so it makes them look like an asshole if they try to ignore you.
Someone broke in my home, stole my laptop, TV and an 80 pound safe. It was painful to see my AIM messagener come up saying someone just logged on under my account. All I could do is just change the passwords.
Few days latter, it looked like they got my checking account out of my safe and used it to pay the electric bill. Close to 800 bucks. I got the money back from the bank, but the cops did nothing with it.
People wonder why apathy and cynicism is chronic in our society.
"Give Verizon a chance to be the good guy. Call their publicity department first. If they make excuses, then call local media."
Hi. I'm not sure which country you hail from, but here in the United States we have something called "due process". Verizon has to receive a supoena before disclosing that type of information. Does not matter how much a company wants to be the "good guy".
If they don't, they end up on the front page of the NY Times....
The cops won't help you recover a laptop, but when one goes missing from the Veterans Administration it becomes national news. You should have told them it had a ton of personal information about a large number of customers, or something.
Here's another double standard for you. The cops won't help you get your laptop back, but if you managed to track it down yourself, went to the guy's house, took it back and laid a beating on him, they couldn't arrest you fast enough for that.
I say get a lawyer and file a civil suit against John Doe, the person using that IP address at that time. Then you can subpoena Verizon's records yourself. Hey, if it's good enough for the RIAA...
Also, call your local news station and tell them about how the cops blew you off, and generally raise a stink until the police are forced to get off their fat asses and do their jobs.
If the cops won't help, see the tort of conversion. File a "john doe" civil suit. Once filed, your attorney would have subpoena power -- use it with Verizon to get the name, address, and phone number of the user associated with the IP. Verizon will have an entire department devoted to processing these types of requests -- you'll have no problem except figuring out what their number is. If you represent yourself, you may have to ask the court to issue the subpoena on your behalf. Once you have the identifier, amend your suit to name that party (probably keep the "john does" at least till you're certain you have all the people involved). Also check your states statutes, there may be something specifically related to your situation. The statutes are certainly available online free -- start at your state's homepage (somewhere burried of course).
What changed under Obama? Nothing Good
As sad as it might be, the phone companies never release any information about a phone number, internet connection, or anything else without a search warrant.
:-)
Oh, no, the phone companies would never disclose anything to anyone without a warrant! Haven't kept up on the news much lately, have you?
I'd say if the guy called 'em up and told 'em he was NSA, he'd have a 50-50 shot at getting the info.
~Philly
That may be part of the problem. The police in the neighboring town get credit for the arrest. Your local police just get paperwork.
The neighboring town, meanwhile, doesn't have jurisdiction over the theft.
Aren't organizational boundaries fun?
You could try reporting a posession-of-stolen-property case at the neighboring town. If you have a lawyer on salary (don't try this by the hour) you could ask about filing a "John Doe" lawsuit for "conversion" and issuing the subpoena yourself. (That's not advice, I'm not a lawyer, all I said was to ask a real attorney).
I know it was the Bahamas but isn't that technically part of the US?
Yeah, but only in the same sense that Cuba and Panama are technically part of the US. Something about being independant nations makes them pissy about our law enforcement mucking around inside their borders for some reason.
Hell, Cuba and Panama have been know to shoot at mainland cops. What's with that?
KFG
In the USA, in general...
You can't take shelter in the title to stolen goods, even if you bought the goods in good faith. (The title is void.) The real owner can come and take it back and leave you with nothing. Your course of action is then to sue the thief (if you can still find them) for the money you paid (if they are still solvent).
The law favors the real (true) owner in such cases.
(And before anyone says anything, yes, this is true only in cases of theft. Fraud is an entirely different crime; you give the good up willingly, even if you are misled. In that case, a good faith purchasor buying from the fraudster can acquire good title, even over the original owner.)
A preposition is a terrible thing to end a sentence with.
My current situation: http://www.tronster.com/missing/
My friend's 3 kids was "kidnapped" yesterday by their father here in Baltimore, their location is unknown.
After a 4 day custody trial, which ended Friday, he was orded to turn them over at a Police station at 8pm on 8/18/06. He neve showed.
I've spent the day riding with her to and from multiple Police stations as well as the Towson commissioner's office. Everywhere we go we hear the same thing, "Without a bench warrant our hands are tied."
Today I learned 2 things:
1. It's nearly impossible to get a hold of a judge on a Saturday
2. Commissioner's can be downright cruel and unhelpful
While working with the Baltimore police, most all have been very friendly (many have agreed with us about Commissioner's!) but none of them are able to do more than write down what we say. We're quickly losing hope; and even if an amber alert goes out... it may be too late if he has left the country. I have almost no faith in the Baltimore legal system and how it interacts with the police is non-existant. (Note: I blame this interaction between the two, not the Police themselves.)
Regardless, I wanted to tred on the border of being on topic as the Baltimore police and their inability to act on this may cause us to lose 3 children to an unstable man. If any Slashdoter's have 5 seconds, please click on the web-page below I made, and let me know if you see him or the kids.
With luck and more leg work, we'll get the amber alert up ASAP.
http://www.tronster.com/missing/
- Upload any non-trivial IP from the laptop to the server, since that's probably the last chance you have to keep it.
- Taunt your local police. ("Hi, I'm sending this email from a stolen computer and i just wanted you to know that you're never going to catch me because you're all a bunch of fat lazy slobs. Crime does pay, bitches!")
- Taunt the theives' local police. ("Wanna buy a laptop? I got three more just like this one, ready to go, super cheap.")
- Install a key logger, get his credentials. Post things all over the internet with the theif's ID (e.g. his next MySpace diary entry will be "so my friends and I stole some computer gear last week...")
- Append random obscenities into every email that exits the computer ("P.S. I fucked your mom too.")
- Random pseudo-malware "attacks" on police station web servers - nothing that would bring the server down, but enough to take the IT department's attention. It is possible that their heads are so far up there asses that nothing can reach their brains, but I think there's a fair chance that their IT depeartment can still get through to them.
- To be continued...
Surely there is more to add to that list. Remember - you have plausible deniability. Your computer was stolen by an egomaniac hacker who loves to taunt police and do unspeakable things to sheep.However I do recommend against the P2P thing suggested earlier. That might just move your computer from the theif to an evidence locker while the RIAA does their paperwork. That sounds counterproductive.
Call in a tip to CrimeStoppers. Not only will the cops get to feel like they're playing detective and actually do something about it, but maybe you'll get a reward for it.
This crap is -so- common with local police departments.
:/
I had a guy break into my house after a) threatening to break into my house and b) stealing what he threatened to steal from my house (along with a ton of valuable electronics).
Did the police even knock on his door? Nope.
Sure makes you feel safe
"Things are more moderner than before- bigger, and yet smaller- it's computers-- San Dimas High School football RULES!"
Some punks broke in to my car and tried to steal it. They failed, which says they sucked because it was an old Jeep that was easy to hotwire. They rifled through all the shit I had in it, but decided none of it was worth stealing (they were correct). The police came and took finger prints from likely places. I think they were mine, probably, but they tried anyhow.
Do move fast - if the thief sold it to somebody, it might stay there a while, but if they're just checking whether it works or seeing what they can find, they may fence it or pawn it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It's true I tell you, feller at work's next door neighbour read it in the paper.
Yet you would be the first one screaming if Verizon did just hand over the info to an unverified accuser (BTW; IIRC, Verizon was cleared of the allegation you are thinking of AT&T who is still under the gun). That is the whole point of doing "John Doe" suits by the **AA first. This guy should contact a lawyer to handle this correctly. That is what they get paid for. As for the police, that can be handled by filing a complaint then letting your lawyer handle that situation.
This case aside, jurisdiction is tough to set in computer related crimes because of locations involved. Usually it is the FBI who handles them because they have jurisdiction across state lines.
B.
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
A couple of years ago, a laptop (among other items) was stolen from my car. Didn't have any password protection on my user account (nothing good on there) and I had my MSN and ICQ accounts set to autosignin.
About a week after it was stolen, I came home from University to find that my desktop computer had been signed out of MSN cause someone else had signed in. Turns out someone with my laptop was coming on as me and being annoying to some of my friends. Got a webserver set up that I had access to the logs from, and put on a certain page that no-one else knew about. One of my friends dropped it into the conversation, and bam, laptop user clicks on it.
I made a couple of sworn statements to the police and took a long time convincing them that I had something useful. Took about 10 weeks for them to act on the information, and unfortunately I was away from home when they did. They traced the IP back to an account registered to some bloke a couple of hours away, and they had him under some suspicion of receiving stolen goods but never caught him with any. So, the police raided and got my laptop (and others) back. They also found a considerable qauntity of drugs, which I guess helps seal a conviction for something.
The person was aout the 4th or 5th person to handle my laptop within the week, and I believe the police have never nailed the people who originally stole it (over 2 years ago).
The person actually on MSN that we used to take the bait was this guy's 13 year old nephew. When I got the laptop back it still had all my files on it (although the used a black marker to try to fill in some engraving I had under the battery with my details) and they'd also set up their own user account. This kid had his MSN signin info, all his emails, yada yada yada. Never signed into MSN as him or looked at his stuff, I shoulda. Just reformatted it and started again - never know what shit they had on there.
So, yes, it can be done. But it takes A LOT of work to convince some low-level police grunt that an eye-pea address has some credibility (I was helped cause I had set my browser to return a really random useragent string, so we pretty much knew it was my laptop).
This guy lives in Baltimore, they have local TV stations...
At the same time, most podunk town police would be interested in "solving" the crime (or at least closing the file).
Since insurance companies are so good at preventing payouts, why not put all the evidence to them and state that you don't want to file a claim as the laptop is still recoverable, but that the police are unwilling to cooperate and that you'll need to file a claim within x weeks if the situation is unresolved. In a way it's too bad it's not a higher value item which might be cause for more action on each party's part. -Pete
Poster said the laptop in question is a rental. All the 'thief' did is fail to return it on time. Technically, he only owes money for the rent to cover the time it is in his possession.
I would ask if the company has an AUP that says something like "All equipment kept 30 days past the agreed end rental date shall be considered stolen and reported to proper authorities". Even with some half-arsed statement like that, MOST PDs will see the issue as a civil matter.
You might try the county sheriff if the local PD won't help. I once saw on the news (Chicago area) where a video store owner was trying to get some tapes back. The local PD blew him off, so he went to the sheriff who turned him on to some little used tactic where a citizen can approach a grand jury to get an arrest warrant. Well, the grand jury issued the warrant, and a beat faced man returned those tapes PDQ. IANAL, YMMV, YADDA, YADDA, YADDA.
If we could just get the legislature to create a "fine" for this, the police would probably be happy to comply as they could collect money for themselves...
Your linked-to post is quite right, and worth a repost. IANAL but used to just about everything but appear in court working in a small law office in Maryland about 15 years ago. I believe specifically what this guy needs after getting a subpoena for the John Doe's ID is a "writ of replevin" in which the court may order the Sheriff to seize the property after an ex-parte pre-trial show-cause hearing.l /dccv04br.html - for specific MD instructions and http://www.courts.state.md.us/district/forms/civil /dccv04.pdf - the form.
See:
http://www.courts.state.md.us/district/forms/civi
If you are not in MD you may make a federal case out of it; the U.S. Marshals serve these writs, too. You might find that has drawbacks - you really need a lawyer's advice, not Slashdot's.
>>anagama (611277) Sunday August 20, @01:07AM (#15943034) wrote:
If the cops won't help, see the tort of conversion [wikipedia.org]. File a "john doe" civil suit. Once filed, your attorney would have subpoena power -- use it with Verizon to get the name, address, and phone number of the user associated with the IP. Verizon will have an entire department devoted to processing these types of requests -- you'll have no problem except figuring out what their number is. If you represent yourself, you may have to ask the court to issue the subpoena on your behalf. Once you have the identifier, amend your suit to name that party (probably keep the "john does" at least till you're certain you have all the people involved). Also check your states statutes, there may be something specifically related to your situation. The statutes are certainly available online free -- start at your state's homepage (somewhere burried of course).
"Is life so dear, or peace so sweet, as to be purchased at the price of chains and slavery?" - Patrick Henry
We recently discovered a burning pile of personal effects next to the dumpster at the office. The items included a purse, wallet with some ID, personal mail, make-up and work clothing and name badge (from a local restaurant). Naturally, we called the police. The officer arrived, poked around a little bit with his foot, then turned around to get back into his car and leave. Incredulous, we asked what he was doing and why he wasn't collecting what was obviously evidence of some kind of criminal activity and he told us that "the detectives wouldn't like it he brought the material back to the station because it would get the other evidence dirty."
slashdot broke my sig
My home was broken into three times, three days in a row. It was neighborhood kids.
I wasn't getting anywhere with the police. First the cop would take a report then a detective would come out and look around. I could tell by their tone that they weren't going to do anything about it. Not, that is, until the third time. Do you know what changed their mind?
While the detectives were there trying to make it look like they were doing something I faked a call to work and pretended to leave a message that I wasn't coming in the next day. Then I faked a call to a friend asking if I could borrow his "weapon" and that I needed it that night. I turned to the cops and said, they've come in three times, three days in a row, and they're coming back. It's my right and I'm going to protect my property.
On their way out they were visibly upset. They were convinced there was going to be a blood bath the next day. I got a call 4 hours later that they caught and arrested the boys responsible. 4 hours. And that was after they were already booked and in custody. The arrests had to have been at least and hour or two earlier.
The detective kept telling me I could go to work after all, blah, blah. It really was the thought of me hiding in ambush that got these police to do their job. It took all but 2-3 hours for them to find and arrest these boys. It took me lying and convincing them I was going to shoot the next person who walked through my door to get them to do it.
This is one of those bluffs that probably only works once in a lifetime but it worked.