Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Google Security Privacy

Activist Raided By London Police After Downloading Docs Found On Google Search (theregister.com) 139

Posted by BeauHD from the something-doesn't-add-up dept.
A man who viewed documents online for a controversial London property development and shared them on social media was raided by police after developers claimed there had been a break-in to their systems. The Register reports: The raid by four Metropolitan Police constables took place after Southwark campaigner Robert Hutchinson was reportedly accused of illegally entering a password-protected area of a website. "I was searching in Google and found links to board meeting minutes," he told The Register. "Board reports, none of which were marked confidential. So I have no question that it was in the public domain." The Southwark News reported that Hutchinson was arrested at 8.20am on 10 June this year at home following allegations made by Leathermarket Community Benefit Society (CBS). The society is a property development firm that wants to build flats over a children's caged ball court in the south London borough, something Hutchinson "vocally opposes," according to the local paper.

"There's a directory, which you need to enter a password and a username to get into. But documents from that area were being published on Google," explained Hutchinson. "I didn't see a page saying 'this is the directors' area' or anything like that, the documents were just available. They were just linked directly." Police said in a statement that Hutchinson was arrested on suspicion of breaking section 1 of Britain's Computer Misuse Act 1990 "between the 17th and 24th February 2021 and had published documents from the website on social media." They added: "He was taken into custody and later released under investigation. Following a review of all available evidence, it was determined no offences had been committed and no further action was taken."

Hutchinson said his identification by Leathermarket and subsequent arrest raised questions in his mind, saying police confirmed to him that the company had handed over an access log containing IP addresses: "Now, how that ended up with me being in the frame, I don't know. There's part of this that doesn't add up..." While the property business did not respond to The Register's request for comment at the time of publication, in a statement given to the Southwark News it said: "When it came to the CBS's attention that confidential information had been accessed and subsequently shared via Twitter, the CBS made a general report of the data breach to the police â" who requested a full log of visitor access to the website before deciding whether or not to progress. The police carried out their own independent investigation into who accessed the documents and how, and have now concluded their investigation." The prepared police statement did not explain whether investigators tested Leathermarket CBS's version of events before arresting the campaigner.
This discussion has been archived. No new comments can be posted.

Activist Raided By London Police After Downloading Docs Found On Google Search More

Activist Raided By London Police After Downloading Docs Found On Google Search

Comments Filter:

  • I feel safer already.

    • Protect and serve

      People get confused by this expression. It doesn't mean police protect and serve a country's citizens. Police exists, nominally, to protect and serve a country's laws, which in practice means that country's elites. This has been court tested in as many jurisdictions as you might want to check, and time and again the courts strike down any interpretation according which police would work to protect and serve the citizens, re-stating their role as enforces of the laws, and only the laws, whatever those might

      • Police exists, nominally, to protect and serve a country's laws, which in practice means that country's elites.

        This sort of statement always mystifies me. I'm no elite; we're income-eligible for food stamps. My kids walk to a Title I (read poorest neighborhood) elementary school.
        But there's a law against vandalizing my 1994 Dodge Dakota, and another against stealing it. The police enforce those laws.
        This isn't theoretical. My neighbor recently had a pickup truck stolen, and the police chased down the thieves.

        Now, sometimes laws happen to benefit citizens, either as a side effect or as a means to an end, for example, so that citizens don't revolt.

        Congratulations! You found the loophole to make your argument unfalsifiable.

        My guess is that this sort of ant

        • The police enforce those laws.

          That's what police exists for: to enforce those, and any, laws. Any laws. Those specific laws happen to benefit you, but the moment you get caught into a law that doesn't benefit you, or even is actively opposed to you, police will equally enforce that law.

          For an example, consider the recent events in Hong Kong. Police officers there are mostly the same individuals who were policing until just a few years ago, when the city was under Common Law -- very similar, broadly speaking, to those effective in the UK

        • Re: (Score:2)

          by Uberbah ( 647458 )

          This sort of statement always mystifies me. I'm no elite; we're income-eligible for food stamps. My kids walk to a Title I (read poorest neighborhood) elementary school.

          You might be less mystified if someone gives your kids a skateboard. [youtube.com]

          My neighbor recently had a pickup truck stolen, and the police chased down the thieves.

          How many days did it take an officer to come to his house to take a statement? Sounds like they managed to do it without shooting his dog, though. But how fast do you think the response t

          • How many days did it take an officer to come to his house to take a statement?

            She called the police as the truck was rounding the corner, and they stopped the thieves less than two hours later.
            Again, very poor neighborhood. Sucks to be lawbreaking skateboarders, but the law is often on the side of little people too.

            • Re: (Score:2)

              by Uberbah ( 647458 )

              Again, very poor neighborhood.

              Uh huh. Then you at least know someone who knows someone who was hassled or worse just for being poor.

              Sucks to be lawbreaking skateboarders

              Which ones were those? Only skateboarders in the video were following the policies set before and after the lights went up. Lawbreakers were the cops, who should be in jail for assault, battery, kidnapping and false imprisonment.

        • > My guess is that this sort of anti-police rhetoric
          > comes from people who haven't gotten over youthful
          > drug experimentation experiences.

          Or maybe from people who've been arrested, or otherwise detained or questioned, for a crime they did not, in fact, commit. (Actually drug-related in my case, since you brought it up. They invented a narrative that I was a notorious dealer who'd just supplied half the clubgoers at 1015 Folsom with their ecstasy that night. It was 100% a lie. The only drugs I'

  • Aaron Swartz laws need to fix stuff like this.

    The data is public but the links are password locked so did you really hack something?

  • Internet usage = another excuse to imprison (Score:5, Insightful)

    by MooseTick ( 895855 ) on Friday August 13, 2021 @08:30AM (#61687601) Homepage

    So if you ever search, download, and share something you found on the internet; you can be arrested based on some company's word that you broke into their systems? I'd hope the accusers can be held accountable when they are wrong. A civil suit of a few million $$$ could fix accusations like this.

    This doesn't sound a lot different than your grocery store accusing you of shoplifting food, then the police raiding your house and "finding" lots of food proving you're a criminal.

    • Re: (Score:3)

      by mjwx ( 966435 )

      So if you ever search, download, and share something you found on the internet; you can be arrested based on some company's word that you broke into their systems? I'd hope the accusers can be held accountable when they are wrong. A civil suit of a few million $$$ could fix accusations like this.

      This doesn't sound a lot different than your grocery store accusing you of shoplifting food, then the police raiding your house and "finding" lots of food proving you're a criminal.

      If you'd read the fine summary you'd know he'd been vocally opposed to this corporation giving them probable cause.

      It's like you bragging that you robbed the grocery store, then having them come to your house and ask you for a receipt for that food.

      Now this guys legal defence relies on two parts. 1. Demonstrating that the documents could be accessed without violating any noteworthy security measures and; 2. That he did not do anything with the documents that could cause harm. Please note that even if

      • > If you'd read the fine summary you'd know he'd been
        > vocally opposed to this corporation giving them
        > probable cause.

        > It's like you bragging that you robbed the grocery
        > store, then having them come to your house and ask
        > you for a receipt for that food.

        No. It's more like someone with a vocal hatred of Starbucks ("Those damn pretentious sizes... why hell is a medium called a grande?"). But despite that chip on his shoulder, when he walked past a Starbucks one day, and it was handing o

      • Re: (Score:2)

        by sjames ( 1099 )

        Simply being against something or someone does not rise to probable cause for every misfortune that may befall them. Nothing he said was equivalent to "I robbed the grocery store", more like "The grocery store has substandard produce and a bad attitude".

        It sounds like the police have already satisfied themselves that he did not violate any sort of access control to obtain the documents. As a physical analogy, some idiot left the documents on a library shelf next to a book of public press releases.

        People are

      • Re: (Score:2)

        by Uberbah ( 647458 )

        If you'd read the fine summary you'd know he'd been vocally opposed to this corporation giving them probable cause.

        You think being opposed to something is a crime? What an odd world you live in.

        It's like you bragging that you robbed the grocery store, then having them come to your house and ask you for a receipt for that food.

        It's like you went to the Pete Hoekstra [wordpress.com] school of analogies.

  • Yawn (Score:2)

    by nagora ( 177841 )

    Yeah, yeah. The police should only arrest the guilty and save us the bother of trials and all that.

    Someone made a claim of criminal activity, the police interviewed the person and let them go, then later said there was no crime committed.

    Without being psychic, exactly what should they have done?

    • Demanded evidence provided by the accuser. You know, basic due process.

    • Re:Yawn (Score:5, Insightful)

      by bill_mcgonigle ( 4333 ) * on Friday August 13, 2021 @09:05AM (#61687735) Homepage Journal

      > Someone made a claim of criminal activity, the police interviewed the person and let them go, then later said there was no crime committed.

      Your bootlicking is repulsive. The facts are that they raided his home and took him into custody. This is violence.

      They *should* have interviewed him, which is what would happen in a civilized society - you don't resort to violence until all other avenues are exhausted .

      Being OK with this is a slip further towards despotism.

      • Re: (Score:2)

        by hey! ( 33014 )

        The standard for dealing with this problem in democracies is something along the lines of "warrant supported by probable cause". The question isn't whether the search in retrospect turned out to be unnecessary, the question is whether it was reasonable at the time based on what the police knew. Presuming the police complaint to be true you'd have to secure the evidence before the suspect knows he's under suspicion. Since "probable cause" is less stringent than criminal proof, you inevitably end up detaini

        • Since "probable cause" is less stringent than criminal proof, you inevitably end up detaining and searching some innocent suspects.

          When there is evidence that a crime had been committed, I agree these mistakes are inevitable. However, probable cause required first the reasonable belief that a crime was committed. That's the situation here; there was no crime, and their investigation at no point discovered evidence of a crime. So there isn't anything close to probable cause to believe that this person might have committed some crime. The activist was never suspected of a crime, because they failed to establish that there had been a cri

      • Re: (Score:2)

        by nagora ( 177841 )

        The facts are that they raided his home and took him into custody.

        Should they have waited until he handed himself in?

        This is violence.

        Grow up.

        They *should* have interviewed him,

        "Excuse me, do you own that bag of jewels?"
        "Certainly I do, officer."
        "Very well. Be on your way."

        As problematic police incidents go, this is very minor. If you think this has lowered the bar then you have a very optimistic view of where the bar currently resides.

        • Re: (Score:2)

          by Uberbah ( 647458 )

          Should they have waited until he handed himself in?

          You...do know...cops ask people questions all the time without raiding their homes and arresting them, yes? Particularly when dealing with hearsay?

          Grow up.

          Pull your head out. If it was your ass getting dragged out of your house based on the mere say-so of a company, you would be crying, not yawning.

      • The facts are that they raided his home and took him into custody. This is violence.

        No. "raids" are only violence in America. In the UK it was 4 officers who came to his house, told him he was under arrest, and took his laptop with them. No violence involved.

        Incidentally the word "raid" is only used by a website which did second hand "reporting" (quotes justified if you've ever read the register) and not from the original source they were citing. It would be kind of like how if they looked at this conversation you and I were having and wrote an article saying I was "verbally assaulting" yo

      • This same situation will re-occur over and over again. Password protection means nothing at all. When big executive uses a browser to access documents at home, guess what - it is keyword scanned, and linked in a network of advertisers database(s) plural. Even third party antivirus sites are mining user information. Windows Telemetry is another given. Police, Lawyers, politicians and everyone else should know if they use Windows or cloud access, they have probably published for all to see. Some links will b

    • An organisation complained, rather than an individual. They wouldn't have raided for a complaint from an individual.

      They might have checked that the documents were publicly accessible before staging a raid. Not just "yeah there's a password on the folder" but "oh hey we can get the documents through google too!" which should have been obvious from the server logs, with referrer and everything.

      They might have actually interviewed without raiding the premises or taking into custody.

      What they don't tell you be

    • Yeah, yeah. The police should only arrest the guilty and save us the bother of trials and all that.

      Someone made a claim of criminal activity, the police interviewed the person and let them go, then later said there was no crime committed.

      Without being psychic, exactly what should they have done?

      Arrest everyone and use the process of elimination until the stinking culprit is found? Fuck yeah! In the US the mere act of being arrested follows you for life, often costing you employment, rentals, etc, but fuck

    • Re: (Score:2)

      by sjames ( 1099 )

      They didn't just interview him, they took him from his home under arrest, seized his laptop and phone, and then interviewed him.

      Step one should have been to determine if the documents in question were locked up in the first place.

    • Without being psychic, exactly what should they have done?

      They should have simply investigated without arresting him and dragging him down to the police station.

      They should have interviewed the accusers until evidence of a crime had been established. If they don't have enough information to even know if a crime was committed, instead of arresting somebody and demanding that they prove their innocence, they should simply not do anything at all. There is no need to have the police go on "fishing expeditions" to see if they can find evidence of a crime, where none ha

      • Re: (Score:2)

        by nagora ( 177841 )

        Furthermore, they should arrest the people who made the false accusation that a crime had been committed.

        I certainly agree with this.

  • Why are the English so bad at English? It's not a cage, it's a fence. A "caged ball court" is a place you'll find BDSM royalty.

  • webserver logs? (Score:5, Informative)

    by oneiros27 ( 46144 ) on Friday August 13, 2021 @08:55AM (#61687691) Homepage

    If they got his IP address from the webserver logs, they should have:

    1. what the username was that they authenticated as
    2. What security realm they authenticated to
    3. What the referring document was[1]

    The first two are part of your standard 'common' weblog. It's possible to encode the credentials into the link ( protocol://user:password@server/filepath ), which unfortunately won't show up in the logs, as the client will separate it.

    But if the system had asked them to authenticate, they should have log entry asking for the file from that same IP address, with a 401 status (authentication required) just before the successful retrieval.

    If they tried to use some other sort of homebrew auth, I suspect that it's not as secure as they think, and it didn't bother logging anything useful.

    [1] The HTTP_REFERER *might* not be there. The basic 'common' log format doesn't include it, but it's also something that the client doesn't have to send -- and if he was browsing in some sort of 'private' mode, many clients won't send the referrer unless it's within the same domain.

    • None, they thought it was behind a password protected wordpress page, but knowing direct URI breaks that, which yoast probably put helpfully in the sites sitemap.xml for google to index,

    • Re: (Score:2)

      by sjames ( 1099 )

      Even a log of a 401 isn't really evidence. It's the equivalent to accusing someone of reading the 'no trespassing' sign. If they then found a bunch of failed authentications followed by a successful transfer of the file, they would have something reportable.

  • If you walk down a street, and see someones garage door open, with a bike unlocked in the garage. You cannot legally take it.
    Even if you have the bike on their property near the side of the road, it doesn't mean you have the rights to take it either.
    If the bike is on public property and in a spot where you can park the bike without it being locked up, you still cannot take it.
    However if the bike is on public property, and has been there for a while say a few days. Then it can be considered abandoned and y

    • Re: (Score:1)

      by Anonymous Coward

      Of course, they didn't take anything. They made a copy of it, which according to many here isn't (or shouldn't be) a crime.

      A better analogy would be is someone left a painting in their garage and left the garage door open, allowing any passerby to see the painting, and the passerby took a photograph of the painting.

      • Re: (Score:1)

        by xalqor ( 6762950 )
        Even more accurate would be that someone was standing at the entrance to their open garage, making copies of their own paintings for anyone who happens to stop by and ask.

    • This comment is embarrassing on a Nerd board.
      It has quite literally nothing to do with the story/article at hand and shows a complete lack of understanding about how everything in the digital world works.

      Not everything is directly comparable to stealing a bike.

      Failure to secure your private documents and leaving them openly findable by the average person with Google does not constitute an illegal act on either Googles or the average persons part.

    • front door is locked but the back one is wide open and has stuff that you can copy / take an photograph of from your wide open view?

    • Re: (Score:3)

      by Falos ( 2905315 )

      No. This is not a "front door unlocked" case. That gets raised because it implies a private space. A conditional space.

      If you placed a server and you told it to broadcast a file unconditionally, you've stapled a document to the message board at the park.

      Maybe you messed up and stapled your browser history instead of "couch for sale". Doesn't change the data being publicly broadcast.

      If access is conditional, that implies a private space. If a password is nominally required, I accept that it wasn't broadcast

      • Re: (Score:2)

        by Falos ( 2905315 )

        *example of nominally required password would be a properly-privileged googledoc but google has a glitch that crashes authentication for an hour into fail-open and people can see it

      • More like dropping the document in the park. I believe the companies claim they were unaware that the files were publicly accessible.

    • No, but the law in question:

      (1)A person is guilty of an offence ifâ"
      (a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured] ;

      (b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and

      (c)he knows at the time when he causes the computer to perform the function that that is the

    • The line here is in the law:

      (1)A person is guilty of an offence ifâ"

      (a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured] ;

      (b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and

      (c)he knows at the time when he causes the computer to perform the function that that is the

    • > If that bike is on the property with a Sign saying Free
      > next to it, you can take it as well. However you
      > cannot take it, if someone unknowingly to the bike
      > owner, put the free sign on it.

      Sure. But what you fail to mention is the very nature of the internet protocols at hand. Putting something up in a server running apache or nginx or whatever on ports 80 and 443 *IS* in fact the equivalent of putting that bike out on your front lawn with a big "It's free. Take it." on it.

      Now, your third

    • Re: (Score:2)

      by sjames ( 1099 )

      If the bike has a free sign and you take it, but the owner didn't put the sign there, you have a mis-understanding and must give the bike back, but you are not a thief. The person who put the sign there may expect some legal trouble unless they had reason to believe they were supposed to put the sign there.

      If the document was supposed to be secured, the company should have password protected access to the document itself, not just the page linking to the document. They definitely shouldn't have let Google i

    • No, it is not at all like stealing the bike. He copied files google search turned up, which is like PHOTOGRAPHING the bike and sharing the pictures. No bike was stolen.

    • But in this case, there isn't 'a bike'. Rather, there is a button that turns on a replicator that makes a bike out of thin air. If you put that replicator out on the sidewalk with instructions saying "This machine makes a bike out of thin air if you press this button", and someone comes along, presses the button, and walks off with the bike (of which the machine can make a practically infinite amount)... is that still theft?

  • How dare they build flats, for people to live in, in London! I've heard there's a surplus of flats available there.

  • Headline should be:

    Activist Raided By London Police After SHARING Docs Found On Google Search.

  • Company has documents that they consider top secret and protect them with a password. They mess up and the same documents can be found with a google search.

    Activist goes to their website, and finds a password protected page. Breaking in would be clearly illegal. So he does a google search, finds exactly what he was looking for, no law breaking needed, and he publishes it.

    Company employee sees top secret document on the internet. Assumes reasonably but incorrectly that their site was hacked, goes to th

    • Police goes to the activist, with reasonable cause, activist demonstrates that he downloaded the documents without breaking any law, police notes that no laws where broken and the activist is innocent. That's it.

      The story said that he was "raided" and "arrested".

    • Re: (Score:2)

      by sjames ( 1099 )

      Police goes to the activist, with reasonable cause, activist demonstrates that he downloaded the documents without breaking any law, police notes that no laws where broken and the activist is innocent. That's it.

      Police arrest him and drag him downtown after seizing his phone and laptop, then think to ask him...

      Perhaps police should have asked the company for evidence that he actually violated security on the company's server as opposed to simply reading the error message indicating that authorization was required.

      Most of us have been to the grocery store in the last month. Most of those stores have probably had some item go missing in the last month. Do we all need arresting?

  • The police focused on guilt and didn't look for evidence of innocence before making an arrest, even though that was as simple as doing a Google search. In the US, prosecutors are supposed to look for evidence of innocence before filing charges. I take it what's supposed to happen in the UK? Did CBS file a false police report via failing to properly secure their website?

    • In the US you can be arrested and held for 72 hours before charges are filed. They can then decide to not charge you and let you go, you have no recourse.

  • You would be in error in assuming organizations such as “Community Led Homes” actually builds homes. No, instead they spend most of the time concocting BS reports and living off government grants. Mostly spend on salaried directors and associates.

Slashdot Top Deals

Don't tell me how hard you work. Tell me how much you get done. -- James J. Ling

Close