Thread by @doctorow

An "Emergency Data Request" (#EDR) is a warrantless demand by a police officer to a tech company, designed for white-hot emergencies when a cop needs an online service to cough up some of its user data to save a life or prevent a tragedy. 1/

Criminals *love* EDRs. Once a crook breaks into a police email server (something so easy that the children running the LAPSUS$ crime-gang did it several times), they can send their own EDRs to online services, who will dutifully dox their own users. 2/

After all, if someone's in mortal danger, there's no time to stop and verify the cop's identity:

pluralistic.net/2022/03/30/law…

Children don't just abuse EDRs, they're also *abused* with EDRs. 3/

Facebook, Apple, Google, Snap, Twitter and Discord have all been tricked with fake EDRs into giving up sensitive information about underage children, according to a @Business report by @WilliamTurton.

bloomberg.com/news/articles/… 4/

These EDRs were wielded by "sextoritionists" - sexual criminals who blackmail their victims into performing sex acts on camera; videos of these sex acts are used as leverage for increasingly extreme extortion demands. 5/

There was a sextortion wave in the 2010s. It turned out that one extremely prolific sextortionist was a US Embassy staffer stationed in London, who ran a sextortion campaign that targeted at least 75 young women over two years:

arstechnica.com/tech-policy/20… 6/

A 19 year old targeted hundreds of girls and women, and was only caught when he tried to extort a former Miss Teen USA, who had connections that put her in touch with the FBI:

arstechnica.com/tech-policy/20… 7/

The men who attacked women in this first wave relied on a piece of malware called a "Remote Access Trojan" (RAT). A 2014 sweep of RAT criminals busted 100 men who had victimized 70,000 women and girls

arstechnica.com/information-te… 8/

But today's sextortionist doesn't need to break into his target's computer. He can just send an email from a hacked police account to an online service and they'll hand him all the information he needs to gain access to his target's most sensitive data. 9/

(Readers interested in learning more about how sextortion works in the real world are encouraged to read @LaurenMcWoof's superb 2020 novel, "Send Pics"):

memex.craphound.com/2020/04/21/sen… 10/

There are 18,000 police agencies in the US, making it impossible to determine whether an EDR comes from a real cop or not (and, of course, between the 18,000 agencies, it's inevitable that some of those cops will make fraudulent EDRs for money or as a favor to a buddy). 11/

What's more, the online services have little or no clue about how their users' data is being accessed and shared. 12/

Amazon had to fire a string of Chief Security Officers until it found a one so underqualified that he wouldn't complain about the company's incredibly reckless data handling. This led to a string of breaches that the company can't fully quantify.

wired.com/story/amazon-f… 13/

Amazon isn't uniquely cavalier about your data. A newly published leaked Facebook memo reveals that the company's privacy engineers have warned their bosses that the company has no way to know how it's used your data:

documentcloud.org/documents/2171… 14/

To quote those engineers: "We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose.’... 15/

"...And yet, this is exactly what regulators expect us to do, increasing our risk of mistakes and misrepresentation." 16/

Reporting for @motherboard, @lorenzofb quotes an internal Facebook source who calls the company's data handling "broadly speaking, a complete shitshow."

vice.com/en/article/akv… 17/

Let's recap: the companies collect as much of your data as they can. They store it forever. They give it to anyone who has a police department email address, without question. And they don't keep track of who they give your data to. 18/

Image:
Paulo Valdivieso
flickr.com/photos/p_valdi…

CC BY-SA 2.0, modified
creativecommons.org/licenses/by-sa… 19/

ETA - If you'd like an essay-formatted version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

pluralistic.net/2022/04/27/im-…