Slashdot Mirror
A Massive Cache of Law Enforcement Personnel Data Has Leaked (zdnet.com)
Zack Whittaker, reporting for ZDNet: A data breach at a federally funded active shooter training center has exposed the personal data of thousands of US law enforcement officials, ZDNet has learned. The cache of data contained identifiable information on local and state police officers, and federal agents, who sought out or underwent active shooter response training in the past few years. The backend database powers the website of Advanced Law Enforcement Rapid Response Training -- known as ALERRT -- at Texas State University. The database dates back to April 2017 and was uploaded a year later to a web server, believed to be owned by the organization, with no password protection. ZDNet obtained a copy of the database, which was first found by a New Zealand-based data breach hunter, who goes by the pseudonym Flash Gordon.
Getting my popcorn ready now. This is gonna be good.
...uploaded a year later to a web server, believed to be owned by the organization, with no password protection....
Whoever put into place this stunningly amazing illustration of absolute ignorance about security should never be allowed near a keyboard again.
The way law enforcement has decided they don't give a fuck about our privacy, I'm afraid I have little sympathy for this.
If you're in charge of this kind of information, and you put it on a server with no protection, you probably have no business in that job.
Do the police expect us to care about their privacy when they don't care about ours?
I'm sure that Law Enforcement is perfectly fine with the breach. After all, since they have nothing to hide, they have nothing to fear.
Right?
What is the underlying problem for these data breaches? Sloppy admins? Inadequate management? Lack of funding to do the job properly?
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
This is why we need strong encryption and authentication as a legal requirement for all personal information databases. Law enforcement may not like it, but if they require backdoors on encryption schemes and access, this will continue to make them as vulnerable as everyone else. They have proven the argument they oppose for us. I get the problems this causes, but the damage allowed by not using proper data protection is generally much worse. And now they may end up learning this the hard way, and that's a shame.
Or not.
These bootlickers are fine having all of our personal data so it's only karmic justice that we get the same. Teach these ham sandwiches a lesson they won't forget.
That data alone would give anyone insight into the capabilities of police and law enforcement departments across the country.
Might actually be useful for formulating public policy. And ultimately, who's in charge of formulating pubic policy?
That's right.
THE PUBLIC!
Why would they bother? Neither Ryan's nor McConnell's data was leaked so why would they care?
Too Late, this was already stolen in the OPM (Office Of Personnel Management) breach. Remember, the OPM breach compromised every single federal worker, military person, and everyone who had gone through a top secret back ground check - as all FS86 forms were stolen. Most high level officers have gone through this.
I swear, people can't see the forest for the trees.
If the OPM data breach didn't change anything, nothing will.
US law enforcement types love to blame the messenger rather than take responsibility for their mistakes.
Support Right To Repair Legislation.
That would be a change, since currently it's the right-wing president and his band of idiots who are bringing chaos and hurting those keeping our society safe (in particular, the FBI).
That incident didn't get near the coverage in the media that it deserved. It contained potentially incriminating data including mental health and financial records from background checks for over 20 million people. It's a gold mine of potential blackmail information that could be used against our federal employees and military.
And yet I'm still completely right. What motivation does either of those politicians have to get privacy legislation up for a vote? Especially when both have been actively hostile to the very notion of consumer privacy rights. And before you claim a both sides nonsense, when the FCC passed data privacy rules in 2016 that were later overturned by Congress not a single Democrat in the Senate or House voted for the repeal. In the Senate not a single Republican voted against the repeal and in the House only 15 Republicans of 236 voted against the repeal. So sorry, I'm not missing anything.
In other news, another law enforcement vendor's system was breached.
This vendor provides de-escalation procedures and non-violent methods for conflict resolution.
The vendors states there was nothing in the databases for the hackers to steal.
I keep hearing every other day about "massive" data leaks, but then I never find any kind of link or indication of where you actually get the data. I have the Tor browser installed, but never find any .onion that actually works or has any content on it. These leaks are certainly not available on The Pirate Bay as torrents. I have no idea where to get it.
That happened under Obama so the media basically swept it under the rug.
You didn't mention the 5+ million fingerprints also stolen.
> potential blackmail
A Chinese citizen was arrested by the FBI for creating the malware used in the attack.
That happened under Obama so the media basically swept it under the rug.
It was reported on every major news outlet when it happened. So that's a strange notion of "sweeping under the rug" you've got there.
A Massive Cache of Law Enforcement Personnel Data Has Leaked
SJW donut shop revenues hardest hit.
Just from searching the WaPo archives I found more than 4 or 5 dozen stories about the OPM breach going on for months after it was fully disclosed. So, again, you have some weird idea of what "sweep under the rug" means.
Yep. It's a directory of every single person - military, civilian, or contractor - who holds or has ever held a security clearance, including all their most sensitive information, all their dirty laundry, and a convenient list of all their family members and closest friends.
Seriously, this should have been the MOST classified database in the entire world. If there was only one thing deserving SCI protection, it should have been this.
But nope. They let China log right in and download it. And who knows who else.
Well, it was reported. Then swept under the rug.
Heads should have rolled over that breach. Instead they gave out free subscriptions for credit monitoring service, which completely discounts and ignores the severity of the data that was spilled.
Media? They lynch Trump's staff over the cost of their office furniture. One of Obama's cronies allowed the worst data breach in history and the media gave a collective "Meh".
seriously for the protected classes, but not us peasants.
Was anyone able to find the leaked dataset?
Seriously, Slashdot. Where's the fucking link?
How was if swept under the rug? The WaPo ran dozens of stories for months on end and even wrote followup stories about it earlier this year. Sorry, but you're full of shit.
Other people are bad at naming things too, as a programmer I don't feel alone now.
Re "How was if swept under the rug?"
Read the report. Nothing was done. The US gov sat on the discovery about mil/gov data getting accessed for months.
The movement of data in real time out of the USA was allowed.
Nothing was done to protect the data. Nothing was done to secure and encrypt the data.
The data set was left as bait to try and see what was going to be done.
The data set was copied out of the USA. The US gov for some expected the data set to be searched and used in real time.
That the access would be back to the US site, not the movement of all data out of the USA. The data set was left open, unencrypted to see how the access and searching would happen.
Nothing was searched for and all the data got copied out as the US gov watched on. The only method discovered was that the data was copied.
The tame US media reported the copy of the gov/mil data set as if a movie studio had a movie archive copied.
Domestic spying is now "Benign Information Gathering"
Reporting that the data moved out of the USA was not reporting on why the data to moved out and why nothing was done to protect the data once access was discovered. The US gov watched for a long time. Nothing was done. The data movement out of the USA was watched. The full data set was allowed to be copied.
Domestic spying is now "Benign Information Gathering"