Slashdot Mirror
Student Exposes Bad Police Encryption, Gets Suspended Sentence (podcrto.si)
An anonymous reader shares a story about Dejan Ornig, a security analyst in Slovenia who warned the Slovenian police department about vulnerabilities in their supposedly secure communication system TETRA in 2013. (Here's Google's English translation of the article, and the Slovenian original.)
He discovered that the system, which was supposed to provide encrypted communication, was incorrectly configured. As a result lots of communication could be intercepted with a $25 piece of equipment and some software. To make matters worse, the system is not used just by the police, but also by the military, military police, IRS, Department of Corrections and a few other governmental institutions which rely on secure communications.
After waiting for more than two years for a reaction, from police or Ministry of Interior and getting in touch with security researchers at the prestigious institute Jozef Stefan, he eventually decided to go public with his story... The police and Ministry of interior then launched an internal investigation, which then confirmed Ornig's findings and revealed internal communications problems between the departments... Ornig has been subject to a house search by the police, during which his computers and equipment that he used to listen in on the system were seized. Police also found a "counterfeit police badge" during the investigation. All along Ornig was offering his help with securing the system.
On May 11th Ornig received a prison sentence of 15 months suspended for duration of three years, provided that he doesn't repeat any of the offenses for which he was found guilty (illegal access of the communications system). He can appeal this judgment.
After waiting for more than two years for a reaction, from police or Ministry of Interior and getting in touch with security researchers at the prestigious institute Jozef Stefan, he eventually decided to go public with his story... The police and Ministry of interior then launched an internal investigation, which then confirmed Ornig's findings and revealed internal communications problems between the departments... Ornig has been subject to a house search by the police, during which his computers and equipment that he used to listen in on the system were seized. Police also found a "counterfeit police badge" during the investigation. All along Ornig was offering his help with securing the system.
On May 11th Ornig received a prison sentence of 15 months suspended for duration of three years, provided that he doesn't repeat any of the offenses for which he was found guilty (illegal access of the communications system). He can appeal this judgment.
This site depresses me sometimes. Look at this comment getting voted up. I mean, aside from the dodgy analogy housebreaking vs penetration testing (which may be similar or not, depending on the specifics) look at this: "Regardless of his objective, he broke the law." --- as if your intentions can not be an absolute defence - punching someone is illegal; punching someone in self-defence is **not** - but "regardless of his objective" is somehow a valid statement? C'mon.
Score:4, Interesting (at time of writing). Seriously.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Really, it's laughable to suggest it's anything other than that.
Try reading the article. (Yes, the Google translation is worse than most Slashdot summaries). Not only did he have an imitation badge, he also used the badge to pretend to be a police officer in 2010 and 2014. If he was a hacker without a "wannabe cop" mentality, things would have turned out differently.
Thus why no law enforcement will actually admit in court to using Stingrays. They would rather withdraw the evidence and have the case fail instead.
Spoken like a true apparatchik
Ah, yes. I oppose your particular flavor of freedom, so I must be a Communist!
** snipped long winded speech **
Communist? I didn't mean tomac use you of being a communist by calling you an apparatchik, any number of other similarly themed descriptors would fit you as well. You seem like the kind of dusty stiff necked bueraucrat who would rather follow the letter of the law even if it resulted in your country's military get steamrolled by it's enemies than bend the rules a bit and reap the benefits of discovering a gaping security flaw in your country's most secret and sensetive communications system.