Law enforcement is able to request what would otherwise be classified as sensitive information from technology companies should the need arise.
Tech firms do share how often law enforcement knocks on its door in the form of transparency reports but what if the person claiming to be a part of law enforcement, isn’t.
This appears to have happened to Meta, Apple and Discord as reported by Bloomberg.
Ne’er-do-wells have reportedly masqueraded as law enforcement officials and submitted forged emergency data request. Usually, requests for information must be accompanied by a search warrant or a subpoena but emergency requests don’t require any of that.
As such, people familiar with the matter told Bloomberg that Apple and Meta provided user details such as addresses, phone numbers and IP addresses in mid-2021. This stolen information has allegedly been used to launch harassment campaigns against users.
The report goes on to say that some cybersecurity researchers believe minors are behind the requests with one believed to be linked to LAPSUS$.
As regards Discord, Krebs on Security reports that earlier this year it received a emergency data request and complied with the request. Unfortunately, while the request came from a legitimate account, that account had been compromised.
“We verify these requests by checking that they come from a genuine source, and did so in this instance. While our verification process confirmed that the law enforcement account itself was legitimate, we later learned that it had been compromised by a malicious actor. We have since conducted an investigation into this illegal activity and notified law enforcement about the compromised email account,” Discord told cybersecurity expert Brian Krebs.
This is not a problem that is easily solved. Emergency data requests are meant to be used when somebody’s life is in immediate danger. Further complicating the matter is that fact that these firms aren’t only servicing requests in the US, but in other parts of the world as well. This can make responding to these requests quickly even more important and unfortunately, bad actors leverage that to their advantage.
It’s clear that law enforcement needs to take its cybersecurity a lot more seriously especially when breaches occur and information is published to the dark web or illicit forums.
While stronger security may help, it takes a lot to deter a cybercriminal who is willing to go above and beyond to reach their mark and given that impersonating police is not new, we don’t see how this problem can be solved.
[Image – Maggie Yap on Unsplash ]
