More Than 1.5 Million Canadian Crime Stoppers Tips Leaked (www.cbc.ca) 35
A CBC investigation found that more than 1.5 million Canadian Crime Stoppers tips spanning 25 years were exposed in a breach of the P3 Global Intel tip-management platform. About 850,000 records contained personally identifiable information, including addresses, phone numbers, emails, license plates and some banking details. Longtime Slashdot reader doconnor shares the report: The data was stolen last March by hacktivist collective Internet Yiff Machine. In a manifesto, the group said it wanted to disprove the claim by P3 Global Intel -- the company hired by Crime Stoppers to manage its tips -- that the platform was "anonymous" and "secure." A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest. The report found that more than 4,300 Crime Stoppers tipsters identified themselves by their full name, with hundreds of records containing staff warnings that individuals had "self-identified" or been "exposed," yet their information remained unredacted.
The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime, with nearly 49,000 tips linked to cases cleared through arrests or criminal charges. Cybersecurity experts criticized the retention of decades-old records... "If a tip is closed, does that need to stay online?" asked cybersecurity expert Ben Coon. "The answer to that, to me, is no."
The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings. Furthermore, affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity.
"For a system that has been designed to promise anonymity to the users, that has failed categorically," said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.
The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime, with nearly 49,000 tips linked to cases cleared through arrests or criminal charges. Cybersecurity experts criticized the retention of decades-old records... "If a tip is closed, does that need to stay online?" asked cybersecurity expert Ben Coon. "The answer to that, to me, is no."
The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings. Furthermore, affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity.
"For a system that has been designed to promise anonymity to the users, that has failed categorically," said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.
The "Promise of anonymity" is never plausible... (Score:5, Insightful)
Re:The "Promise of anonymity" is never plausible.. (Score:5, Informative)
I intentionally complained out the ass in one of those "anonymous" surveys and was indeed spoken to by my director about it. Proved my point and quit shortly after.
Re: (Score:2)
Quit? Oh man you should have lived in Europe. You'd probably have been able to retire on the payout the courts would have given you.
Re: (Score:2)
Quit? Oh man you should have lived in Europe. You'd probably have been able to retire on the payout the courts would have given you.
Wink, wink! Just because there is a law, doesn't mean it won't happen. Just buried a few layers deeper.
Re: (Score:2)
Probably not. In Europe justice is mostly restorative, i.e. you get back your losses and no massive punitive damages on top. You can sometimes claim for the mental harm it did to you, but mostly you will be claiming for lost earnings, including set-backs to your career.
Re: (Score:2)
Luckily they are teaching the children this at a young age; I do sysadmin work for a school district and the kids filled in an anonymous survey. Cue the dean asking me a few days later - to get the names of all those who cussed out the school or used foul language. Taught them a valuable lesson about how they can't trust those above them!
Re: (Score:2)
Yeah.
That's why when faced with a crime that concerns you, you should either face it openly or like Charles Bronson, in the movies.
Re: (Score:2)
I mean, everybody working at one of the many corporations doing their ridiculous "anonymous employee surveys" where individual employees are sent individual links knows that, right?
Oh they very much are anonymous. At least they are where I live. If they weren't (I really hope they aren't and would love to prove it) my employer would find themselves financially arse-fucked by the courts and I will be able to retire early and rich.
Re: (Score:2)
They do, however, ask for our site and our job title. Which would be just fine if I was Engineer #81 of 200 working out of corporate HQ. Instead, our job titles are unusually specific - Mine is basically "$Teamname Engineer 3", of which there are only two in the entire company, and we're based out of different satellite offices (we're all remote, so my "site" is just the company's la
Re: (Score:2)
One small correction: everything you've put out there is there for the taking.
Snitches get stitches (Score:2)
...and now there is a database of snitches available to anyone looking for revenge.
Re: (Score:2)
Do not enter details that are private (Score:5, Interesting)
It is surprising how at some point in the early 2000s, when the normies flooded the internets, it was more than enough to present someone with an elaborate form and they would fill anything you would ask of them, all information you could possibly want. Entire industries like socialmedia built upon this.
If you enter or write down or post anything anywhere, you should know it is basically public information at that point and you should consider and treat it as such. If in doubt, avoid entering any data, or any legit data; give as little as possible and use as much anonymized data like alias-emails etc as possible.
You do not want your private data at the mercy of the cheapest bidders and their off-shored staff from too often hostile regimes.
Re:Do not enter details that are private (Score:4, Interesting)
Do you remember when it was normal advice to "never use your real name online".
Then the cops got tired of that crap and suddenly it was considered wrong to not use your real name on social media. I have to this day never done so, I am still living in that era where giving out your name is wrong.
Re: (Score:2)
Do you remember when it was normal advice to "never use your real name online".
Still the response I give when asked to join faceplace or doxmeord.
Re: (Score:1)
Then the cops got tired of that crap and suddenly it was considered wrong to not use your real name on social media.
Which cops? The only ones I can think of who would say that are the 20% of Europeans who think anonymity on the internet is immoral. That's also why they get this:
https://fightchatcontrol.eu/ [fightchatcontrol.eu]
Re: (Score:2)
Then the cops got tired of that crap
The cops had nothing to do with that. For the general populace that change was pushed a lot by Facebook which at the time pushed its service as a way of connecting to real people at your college. But even then you have rose coloured glasses on. Remember the advice? I think the advice came *after* the internet of old. These days very few people use their real name online unless you have a public facing personality and that "blue check" is a source of income for you. On the other hand if you look to Slashdot
Re: (Score:1)
when the normies flooded the internets
Sorry but no. Phishing and fraud existed before the "normies" did, and there are a significant number of very stupid and naïve tech gurus out in the world as well whose idea of privacy and security amount to "Who? Never met them." I mean the early internet by design considered no aspect of anonymity, privacy, or security.
Take the rose coloured glasses off.
Report the leak to CrimeStoppers (Score:1)
...oh, wait
Re: (Score:2)
Longtime Slashdot reader (Score:2, Offtopic)
After 25 years, it's nice to see I've finally graduated to Longtime Slashdot reader.
Re: (Score:2)
When Slashdot mattered it was glorious.
Re: (Score:2)
Welcome to the club. ;-)
Re: (Score:2)
I bet the majority of the users nowadays hadn't even been born back when we were enjoying our hot grits.
Well there's your problem.. (Score:3)
> The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings.
Q'uelle surprise, their basic training is to lie.
Re: (Score:2)
Possibly they meant they don't require tipsters' personal information, not that people didn't add the information on their own initiative. Like slashdot can claim that they don't retain personal information, but still some slashdotters might have included personal information in their posts, which slashdot does not control. A few use real names, others advertise books or software code they have published that are traceable to their name.
New way to report (Score:2)
I'm reporting a crime involving Jeffrey Epstein.
Sincerely
Jeffrey Epstein
Re: (Score:2)
Dear Crimestoppers, I'm reporting a crime involving Jeffrey Epstein. Sincerely Jeffrey Epstein
I heard he was well hung....
why was this on-line (Score:2)
GDPR (Score:2)
The data should have been deleted (Score:3)