I told them they’d been hacked. They hung up on me

On Friday, I revealed that Veritracks, an online platform used by law enforcement, parole officers and probation officers to track offenders with GPS devices such as ankle monitors, had been hacked.

The data, provided to me by a hacktivist group, contained information on not only the thousands of people being monitored, but on the government agents and private sector employees doing the monitoring as well.

Sensitive data including names, home addresses, phone numbers — as well as identifying characteristics like eye color, gender, hair color, height, markings and tattoos, race and whether the individual is a registered sex offender — was also exposed. 

When it comes to dealing with hacked and leaked data, confirming its legitimacy is the most important step. And if you’ve ever wondered what that looks like, it often involves contacting people found in the data to ask whether the information is accurate.

Doing so is always a somewhat awkward task. When someone picks up the phone, I have a short window to explain who I am and why I am calling.

And when people hear that I’m a journalist and that they may have been hacked or had their data exposed, they are almost always skeptical. I can’t count the number of times I’ve been hung up on by people who seem to be convinced that I’m a scammer.

Dealing with the Veritracks data was no different. While calling phone numbers in the dataset, I got on the phone with an employee of the Arkansas government. After letting them know about the data breach, I was met with a long silence before the eventual “click” of the phone call ending. That is a very common reaction.

I called another person, while looking at their home on Google Maps, and was hung up on as well. While my goal is to alert the public to their data being exposed, I always feel somewhat uncomfortable having the data to begin with.

Luckily, in this case, the hackers — as far as I know — made the data available only to me and the non-profit leak archiver DDoSecrets. And once I’m done analyzing and writing about the data, it is destroyed. The goal of the hack, according to the group behind it, was to expose the poor security practices of a law enforcement-related entity.

Yet, as of this week, the Veritracks system remains online. And the company behind it, which never responded to my emails, doesn’t seem to have released any public statement on the breach.

What I’m reading

• What happens after a town de-Flocks: The Verge breaks down how towns and cities all across America are canceling their contracts with Flock Safety, the nation’s largest purveyor of AI-powered automatic license plate reader cameras. But as it turns out, many of those cameras are being replaced with other surveillance technologies.
• European Cars Are Spying on Their Drivers. The Same Tech Could Be Coming to the U.S.: Reason breaks down how 27 countries in the European Union require new cars to include cameras that watch drivers’ eyes to determine if they are distracted. The “advanced driver distraction warning” as it’s called, which Reason says could soon be coming to the U.S., is raising concerns among privacy advocates.
  Police Investigator Accused of Making Over 4,000 Illegal Flock Camera Searches: Futurism reports on the recent arrest of a veteran police investigator in New York accused of conducting over 4,000 unauthorized searches of license plate data collected by Flock cameras. The officer, as we’ve seen in a growing number of other cases, was using the surveillance technology, at least in part, to track a former partner.

What do you want to know?

That’s all for this week. If you have a question you’d like me to answer about privacy, send me an email at mthalen@san.com, reach out on Signal at @mikaelthalen.12, or share it below. I’ll keep all your personal details private.