For years, people have been impersonating police online in order to get companies to hand over incredibly sensitive personal information.
Reporting by 404 Media recently revealed that Verizon handed over the address and phone logs of an individual to a stalker pretending to be a police officer who had a PDF of a fake warrant.
Worse, the imposter wasn't particularly convincing.
His request was missing a form that is required for search warrants from his state.
He used the name of a police officer that did not exist in the department he claimed to be from.
He used a Proton Mail account, which any person online can use, rather than an official government email address.
Impersonating police to get sensitive information from companies isn't just the realm of stalkers and domestic abusers; according to Motherboard, bounty hunters and debt collectors have also used the tactic.
The second is that too many companies fail to prevent thieves from stealing data by pretending to be police.
For starters, they must do better at scrutinizing warrants, subpoenas, and emergency data requests when they come in.
Fake emergency data requests raise special concerns, because real ones depend on the discretion of both companies and police-two parties with less than stellar reputations for valuing privacy.
This Cyber News was published on www.eff.org. Publication date: Fri, 19 Jan 2024 20:43:05 +0000