Watch as 10 cops with guns and military camo storm suspected Capital One hacker's house…

Newly released footage showing cops storming the house of the woman accused of hacking Capital One's cloud servers to steal 106 million people's personal information, has again raised questions about the over-militarization of the American police force. Software engineer Paige Adele Thompson, 33, was cuffed on Monday after the …

[Criminny Rickets]

Darwin Award Contender

Wow, if she actually did as described in the story about doing the hack then logging into her Github account from the same VPN connection, the police didn't have to follow any breadcrumbs, they just had to follow the BIG red arrows the the words "Hacker Here" pointed right at her.

[Anonymous Coward]

Re: Darwin Award Contender

I saw another article where she posted a receipt from a veterinarian that showed her name to the same place where was posting stuff related to the capital one hack. She's either that very smart, or not all there, or both.

[Mark 85]

Re: Darwin Award Contender

True. What got me was the tone of the article until one gets down the part about the weapons and her posts. At that point the "holy sh**" moment hit.

[Anonymous Coward]

Re: Darwin Award Contender

I suspect the police had knowledge of who she was living with - most white collar crime arrests are much more sedate, unless they are worried that a lot of data might get erased if they take the time to knock.

[Wade Burchette]

Re: Darwin Award Contender

Maybe something like this cartoon, except replace 'didn't wash hands' with 'hacker lives here'. (If that link doesn't work, try this one.)

[The Oncoming Scorn]

Re: Darwin Award Contender

Chinless Wonder: At Eton they taught us to wash our hands after going to the lavatory.

Winston Churchill: At Harrow, they taught us not to piss on our hands.

[JimboSmith]

Re: Darwin Award Contender

I wish everyone who did naughty things like this was as dumb as this. My ex boss who was a non techie couldn't understand why I was concerned about a new HR system. I pointed out that it's in the 'cloud' which is another way of saying somebody else's computer that's permanently connected to the Internet. She said it's all encrypted though and I said if the password is rubbish it doesn't matter how encrypted it is.

[Twanky]

Re: Darwin Award Contender

Our HR crew introduced a new online system which the staff had to log into to check and update their records and to monitor the assessment and review process - the usual crap of a small company pretending to be big. Unusually, they also organised some training on how they wanted us to use it. During the initial training session we were given our userID details and asked to log in and set our own passwords... which was fine except that we were presented with a multi-page 'terms and conditions' before we could proceed. The trainer seemed to get quite cross with me for sitting and reading it before finally being willing to click 'OK'. I tried to go back into the system to review the T&C later but it was not to be found. I asked for a copy, but an HR bod said it was not available. I then asked a colleague who was due to start his training to take screenshots - and was more-or-less asked: what are you afraid of? They just didn't get it that we were putting highly personal information on someone else's computer.

[NonSSL-Login]

Re: Darwin Award Contender

Logging in from the same VPN provider (what the story says) is hardly proof that a particular person committed a crime, especially when some popular providers have millions of customers.

Using the same VPN node might narrow it down but if a VPN provider only has one or two nodes for a particular state and one of them is faster, then all the users in that area will use that node.

Obviously she did a lot of stupid stuff that indicated she was the hacker but the VPN side is the least of the evidence.

As for VPN users being hackers...many UK peeps use a VPN now since a law was brought in forcing ISP's to keep 2 years of ICR's (Internet connection records) which logs every DNS request, ip, port and website we visit and allowed the police + everyone and their dog to access the data. VPN users get to give them a single record for a VPN node along with the middle finger, hacker or not.

Real hackers tunnel through their VPN tunnel so the IP doing the business is not the VPN node IP seen in their ICR....

[aks]

Re: Darwin Award Contender

Many use VPN to to get around restrictions on what they are allowed to access. This is often because the seller wants to charge more for or forbid consumption of in their true location. This can be audio or movie streaming or grey market.

[phuzz]

Re: Darwin Award Contender

"Logging in from the same VPN provider (what the story says) is hardly proof that a particular person committed a crime"

True, but posting her CV with your name and address on the same account she used to brag about the hack probably gave the game away...

[Rasslin ' in the mud]

Re: Darwin Award Contender

"True, but posting her CV with your name and address on the same account she used to brag about the hack probably gave the game away..."

How would posting her CV with MY name an address give away anything useful to the investigation?

[phuzz]

Re: Darwin Award Contender

Ok, maybe I should re-read what I wrote, rather than just smashing the Submit button straight away.

[404]

Re: Darwin Award Contender

That's ok, you were excited ;)

[Kiwi]

Re: Darwin Award Contender

True, but posting her CV with your name and address on the same account she used to brag about the hack probably gave the game away...

True dat..

Unless...

What if someone else had a copy of her CV and faked that?

Everything ties back to the house maybe (I mean the VPN is a pretty dodgy claim as well unless she's running her own one), even stuff like her mailing things from near somewhere else she did business but that's all circumstantial. I'm going to use the post office nearest me and the nearest vets office and so on. When I've had housemates, often we've done things at the same time using one car.

Many years back one of the flatmates did a bunk. When clearing her stuff up I found prescription medication with her first name and my surname on it, stuff that required some level of ID to get as well (can't recall what but perhaps one of the "drug precursor" ones). Another time I went to create an account on a BBS I'd never visited, only to find my details were there. I knew the SysOp personally so rang and we chatted, he gave me the password on the account and I knew immediately it wasn't mine. I suggested he check a couple of other people and sure enough someone had 2 accounts on the board, one under his name and one under mine, using the same p/w. (I actually logged in because there were a couple of echomail posts I didn't recall writing coming from that board I didn't recall visiting).

Dunno what other evidence they have, but to me the article doesn't give 'beyond reasonable doubt' evidence. But I've lived with some dodgy people and experienced some 'identity theft' (albeit very minor), so I'm willing to entertain that others could do worse stuff. Even it being her computer isn't proof if there's a chance she either let others use it knowingly, or was lax with security and someone else found a way in across the LAN.

As to the fine she faces - that'd be fine so long as the company also pays a fine - I suggest perhaps $1 for every user account that she snaffled?

[Michael Wojcik]

Re: Darwin Award Contender

What if someone else had a copy of her CV and faked that?

In this case, there's quite a lot of evidence incriminating her, from different sources. (Other details have been reported elsewhere. Finding those reports has been left as an exercise for the reader.) It's conceivable it's all fake, but at this point that doesn't seem terribly likely.

[Kiwi]

Re: Darwin Award Contender

What if someone else had a copy of her CV and faked that?

In this case, there's quite a lot of evidence incriminating her, from different sources.

I'll always be prone to doubting electronic evidence, having known people who would abuse the trust of housemates.

I don't believe she is guilty or innocent as yet, and I haven't looked beyond the article and comments here. Based on the reporting here though, I would have a very hard time buying her guilt - I've seen too much to know how easy some stuff can be faked or transplanted.. And that's before we get on to the, well lets just say 'indiscretions' of the police (interesting how that word is almost a contraction of "in these cretins" - kinda apt when talking about cops!)

[Kiwi]

Re: Darwin Award Contender

In this case, there's quite a lot of evidence incriminating her, from different sources.

I'll always be prone to doubting electronic evidence, having known people who would abuse the trust of housemates.

I'll just leave this <a href="https://www.theregister.co.uk/2019/06/28/bofh_2019_episode_4/>BOFH episode</a> here...

(El Reg, didn't we used to have a BOFH icon? Bring it back please!)

[Kiwi]

Re: Darwin Award Contender

Ack! Should proof-red first especially when doing a post-and-run!

Clickable link, as it should've been :

BOFH episode

[J. R. Hartley]

Not all heros wear capes.

[sabroni]

Not all comments make sense.

[J. R. Hartley]

Let me explain it for you, dear.

'Not All Heroes Wear Capes' is a catchphrase used to describe everyday people who do good deeds, indicating that people in reality, rather than fictitious superheroes, are capable of courageous behavior. The phrase is often used in sarcastic or humorous contexts for individuals have done something mundane, foolish or worthy of admiration.

Hope that helps you.

[Prst. V.Jeltz]

sorry , I'm still struggling

" mundane, foolish or worthy of admiration."

Those are 3 very different things. It works for the 3rd , but not the 1st or the 2nd - even if said with humour.

must be one of these meme things i'm too old for i guess

[J. R. Hartley]

Ok grandad.

[Hero Protagonist]

It’s not at all clear who you are casting as the hero in this little morality tale.

[J. R. Hartley]

Clearly the person that hacked Capital One, the bastards.

[MiguelC]

Let me try to grasp your thoughts on the issue... you're basically condoning the screwing of hundreds of thousands people who could have their personal information exposed?

Can't really see how she'd be a hero in any even remotely tangent way.

[J. R. Hartley]

Some men just want to watch the world burn.

J. R. Hartley.

[404]

You're wrong.

No. You want to go after a company, you go after their business assets, their management, not the poor bastards they take advantage of.

[Kiwi]

Re: You're wrong.

No. You want to go after a company, you go after their business assets, their management, not the poor bastards they take advantage of.

NOT defending the hackers actions.

The prime asset of any business is it's customers.

In days past, showing how lax an abusive company (or even just a single CxO) was in the treatment or respect of their customers could be enough to end the business overnight. Taking the customer database and letting the customers know you had their data (but hopefully still respecting it, ie emailing the customers some proof but not sending it elsewhere) could at times be an effective way of doing that.

Of course, today, C1 could have their databases wide open so anyone could see any customers stuff and only a few weird privacy freaks would even bother to question it, being so convenient in how I don't even need to log in to view my transaction history 'n all.. But modern privacy attitudes don't excuse poor security practise.

Yeah, not defending the hacker, but sometimes destroying the customer's trust has been an effective way to destroy a business (though MS, FB and GG all seem to have survived repeated instances of this!)

[John Brown (no body)]

Re: You're wrong.

"Yeah, not defending the hacker, but sometimes destroying the customer's trust has been an effective way to destroy a business (though MS, FB and GG all seem to have survived repeated instances of this!)"

Sadly, this doesn't seem to be the way to destroy customer trust in a company. At least not if Facebook and TalkTalk, at the very least, are anything to go by.

[Michael Wojcik]

Re: You're wrong.

Yeah, but look how quickly Equifax was driven out of ... oh, wait.

[Citizens untied]

Some men are tired of watching the world burn. FTFY

Not sure (s)he is a hero, but certainly not a villain.

[Jaybus]

Seems she was likely doing it to steal money, so....common thief?

[John Brown (no body)]

"Some men just want to watch the world burn"

That's a strange kind of un-caped hero.

[Kiwi]

It’s not at all clear who you are casting as the hero in this little morality tale.

Reputedly quiet, unarmed little girl acting alone vs a pile of masked, armoured and armed thugs?

Nope. Not at all clear who showed the most courage. (although her actions can also be linked to stupidity, if it was her and the reports of what she did are true).

[Kiwi]

Are you Gishnu?

Surely you must have an abundance of hands to have rubbed so many people up the wrong way!

(Makes me feel all warm and fuzzy that I'm not the only one to sometimes get a weird pile of downvotes :) )

(Speaking of downvotes, I finally cracked 1500! Yay me! :) )

[Marty McFly]

A little sensationalism?

C’mon Reg, a little completeness in reporting. In Washington state, it is perfectly legal to have 20 or more guns, associated accessories, and ammunition. I have no knowledge whether these were legally owned or not as you have left that out of the article! Simply reporting their existence is sensationalism and paints a picture of a darker story, which may not be an accurate portrayal.

[vir]

Re: A little sensationalism?

I think the intent wasn't to intimate anything sinister about Ms. Thompson as much as it was to contextualize the police's use of force in arresting her.

[The IT Ghost]

Re: A little sensationalism?

But, did the police *know* about the weapons before the raid? Nothing in this specific article implies they did.

[Anonymous Coward]

Re: A little sensationalism?

> But, did the police *know* about the weapons before the raid? Nothing in this specific article implies they did.

The police knew the landlord had prior for weapons offences so, presumably, were worried that the landlord would think they were coming for him not the lodger.

[rg287]

Re: A little sensationalism?

The police knew the landlord had prior for weapons offences so, presumably, were worried that the landlord would think they were coming for him not the lodge

Yes, possibly. Still doesn't explain why they look like they're prepping for a compound-clearing operation in Afghanistan...?

Not sure why a civilian law enforcement agency would be clad head-to-toe in military camo. I can't actually see any clear identification on them either. SCO19 tend to have "Police" emblazoned very clearly in big white letters on their all-black body armour and head-dress.

Dressing like a bunch of airsofters in disruptive pattern seems a bit at odds for a civilian organisation executing a simple arrest warrant.

[The Oncoming Scorn]

Re: A little sensationalism?

Oh, come on, guys, we talked about this! You're supposed to yell "FBI" at the beginning.

Ow! And what happened with getting "FBI" on the fronts of the uniforms? Huh? Gun Huh?

[m0rt]

Re: A little sensationalism?

Phrasing!

Come on....anybody? Phrasing?

[John Brown (no body)]

Re: A little sensationalism?

"Dressing like a bunch of airsofters in disruptive pattern seems a bit at odds for a civilian organisation executing a simple arrest warrant."

It does seem a bit strange for an urban environment. The colour and pattern seem more suited to a rural location. But there are some trees in the background.

I'm not sure which is the more frightening for the people on the receiving end of a raid like this though. What looks like a military raid, or cops in all black outfits.

[Kiwi]

Re: A little sensationalism?

I'm not sure which is the more frightening for the people on the receiving end of a raid like this though. What looks like a military raid, or cops in all black outfits.

Oh has to be the military raid. Have you seen the All Blacks lately? Those sissy little pansies won't even go outside in the rain in case it causes their mascara to run and..

Oh, you mean "all black outfits" in a different context to the costume of the NZ womanly rugby team?

[Anonymous Coward]

Re: A little sensationalism?

It wouldn't matter if they knew the landlord had the guns or not, the police in this country will come heavily armed like military to any hacker arrest, at least since the 80's. Often times, it's just a kid in a basement having fun, who doesn't release any of the info other than say they did it, and poses no physical threat whatsoever. We have a shoot first, ask questions later police culture here. That's not to say all police are bad, or that police are unnecessary, but enough bad apples are left in the precinct and shuffled around like Catholic priests molesting children as to make the situation kind of hard to ignore. Not to mention, much like the Catholic priests, there don't seem to be any consequences to the officers for being dirty or just plain bad cops in general.

[Stoneshop]

Re: A little sensationalism?

the police in this country will come heavily armed like military to any hacker arrest,

... because as we all know hackers are ARMED (with knowledge, that is).

[Kiwi]

Re: A little sensationalism?

the police in this country will come heavily armed like military to any hacker arrest,

... because as we all know hackers are ARMED (with knowledge, that is).

If you're using that as a criteria, then the best cop in the land is out-gunned by the most moronic PHB in the world!

[stiine]

Re: A little sensationalism?

You're way to fucking kind to the police.

[Kiwi]

Re: A little sensationalism?

The police knew the landlord had prior for weapons offences so, presumably, were worried that the landlord would think they were coming for him not the lodger.

The vast majority of landlords I'm aware of don't live in any of the premises they let. Some have never even seen the places they let.

This place sounds more like a student flat than a homeowner opening up his grown kid's bedrooms to get a little extra pension money.

I'm also someone who has been "linked to" many things. Mostly just through being in the same building or driving past the scene completely innocently, some knowing the young victim of police abuse alleged perpetrator... Saying someone is "linked to" a crime could mean they were the victim, or potential suspect who was later fully cleared, but it is a rather sensationalist way to paint them as a bad person, often used by the press when trying to drum up sympathy for excessive police actions.

[I3N]

Re: A little sensationalism?

Hear that ... never been cleared ...

remember watching them put a phone tap up ... and getting the set-up phone call ... and the efforts through my employer ...

what I did is now completely legal ...

what they wanted me to do, will never be legal ...

[Kiwi]

Re: A little sensationalism?

Hear that ... never been cleared ...

Sadly.. Being 'cleared' almost always means nothing.. You have the "the cops never accuse someone without very good reason, he must have done something" brigade, the "he just looks wrong" brigade, the "must have had a really good lawyer but still is guilty" brigade, and of course the "is guilty of something else even if not that" brigade.

As I taught my nephew.. Once you've been through it, you're more experienced than these people. You've survived more than most of them will ever face, and come out on top. The best thing to do, the best revenge against them, is to enjoy your life and be happy. Every time you smile, they die a little inside.

So hold your head up, smile, and love your life. Find joy in the simple things, and do your little bit to make their lives a little worse every chance you get.

There is no better revenge. (Although listening to Motorhead's "Sweet Revenge" does give me some naughty ideas...)

[Michael Wojcik]

Re: A little sensationalism?

In this case, the homeowner does live there, and it's not beyond the realm of possibility that the police knew that.

I'm strongly opposed to police militarization and the excessive use of force by the police. This case looks like Yet Another excessive use of force to me, even given the "but wait" details in the latter half of the article. But I also think it's both foolish and counterproductive to split hairs about what the police might or might not have known in this case. It was excessive - full stop.

[Carpet Deal 'em]

Re: A little sensationalism?

They might not have known if there were any weapons currently, but the owner's history sounds like an indication to bring in the heavy guns.

[Anonymous Coward]

Re: A little sensationalism?

And with his history they let him amass such an arsenal unhindered? I understand in the US is easy to buy weapons - but it really looks *too* easy.

[Kiwi]

Re: A little sensationalism?

And with his history they let him amass such an arsenal unhindered? I understand in the US is easy to buy weapons - but it really looks *too* easy.

Very good point. If he was a felon who had guns, a seemingly significant crime in it's own right, and was also in on the planning to kill someone by use of a bomb planted on their vehicle, why would they let him build up so many weapons? If they had knowledge of his stash when they went in to get the alleged hacker then they had knowledge of it earlier. Why not act back then, rather than letting him become a threat? Watch for him going out somewhere, perhaps watch his patterns, and grab him when he was away from the house (away from his stash) and less likely to be armed or expecting anything and in close reach of more than a pistol, eg a taser from behind while he's walking his dog would prevent him being a threat while his house is then raided.

Does make the US investigative forces (cops, feds, dea etc) seem rather stupid when they knowingly let someone build up an illegal collection of weapons, and delay a long time before acting. Especially with the propensity for yanks to go on shooting rampages.

[vir]

Re: A little sensationalism?

"But, did the police *know* about the weapons before the raid? Nothing in this specific article implies they did."

You have to fill out a form that includes your address for a background check when you purchase firearms from a store (private sales requirements depend on the state; Washington requires the same federal background check for private sales but who knows if these were purchased legally). That presumably goes into a national database so, among other things, law enforcement can check to see if you have any firearms before serving a warrant.

[BuckeyeB]

Re: A little sensationalism?

That implies that the suspect who is already allegedly committing a crime is going to obtain a firearm legally. So far as law enforcement knows, this could be a hacker belonging to a cartel, organized crime group, or others that may decide not to go quietly. They go in ready for anything and hope they don't have to pull the trigger.

[jelabarre59]

Re: A little sensationalism?

But, did the police *know* about the weapons before the raid? Nothing in this specific article implies they did.

Of course they did. They had to bring them along with them on the raid after all....

(you *have* heard the term "drop gun" haven't you?)

[stewate4]

Re: A little sensationalism?

Except firstly there's nothing to indicate the police knew about the weapons stash, and secondly the arms stash didn't belong to her and wasn't in the room she was living in. It was in the house owners rooms, ie her landlord.

You might as well justify this sort of police armed response in every situation - just in case.

[Eddy Ito]

Re: A little sensationalism?

Since this type of response is becoming the norm I think the cops and the courts have already justified it nearly all cases. And they've got "qualified immunity" a.k.a. "ignorance is an excuse" defense to back it up.

[Jellied Eel]

Re: A little sensationalism?

I have no knowledge whether these were legally owned or not as you have left that out of the article!

I think you missed this bit..

Park Quan, 66, was convicted of possessing explosives in 1983, and of having an unregistered machine gun in 1991.

I know Seattle's pretty liberal, but I'm fairly sure that those kinds of felony convictions usually result in further felony convictions if found in possession of firearms. If he'd also been found with plastic drinking straws, it'd probably be life!

[herman]

Re: A little sensationalism?

Oh man, plastic drinking straws in Seattle? The poor bugger. He'll be doing time till he is 2000 years old.

[Ugotta B. Kiddingme]

Re: I think you missed this bit..

And also the part where it is clearly stated: "Quan was charged this week with being a felon in possession of a firearm"

[veti]

Re: A little sensationalism?

Yeah, except that they found the guns when they were searching for something entirely different. The warrant has to "particularly describ[e]... the persons or things to be seized".

Unless the warrant they were using specifies "any arms potentially belonging to the landlord, who is not a suspect in the present matter", they're inadmissible.

[a_yank_lurker]

Re: A little sensationalism?

Under the law a felon cannot normally own guns on this side of the pond. It is guaranteed vacation at Club Fed for good long stretch. Given his history, showing up early morning with itchy trigger fingers in overwhelming force forces the issue. Resist and become colander or surrender quietly. He must of not felt lucky. It is not unusual to see who lives at house prior to making an arrest to see what you are likely to face and this information is probably readily available from DMV records, etc.

[horriblicious]

Re: A little sensationalism?

"...to see what you are likely to face..."

Frankly, a DMV or other check may tell you absolutely nothing about what you will face. Being on the "gun registry" in Canada was said to be vital information for police by those in favor of the registry. What this actually told you is that you had a law-abiding gun owner that had passed all records checks to get the permit. You would be quite safe to show up and knock on the door in your stocking-feet to serve the warrant. For home-owners without any such information, you better get the SWAT guys. The reality these days is the police always assume the worst and call in SWAT. This is why you can "SWAT" someone (cause police to break into someone else's house by issuing a false complaint of violence underway). The police focus is purely on harm-reduction - for them - without concern for any effects on anyone living at the location. Its not exactly guilty until proven innocent, but getting close to that.

[Pen-y-gors]

Re: A little sensationalism?

Except the police later revealed that they have found no less than 20 firearms in the house – including assault rifles and handguns as well as a wide range of related equipment including bumpstocks, scopes, and ammunition.

So, just a typical USian home then?

[Anonymous Coward]

Re: A little sensationalism?

If the police hadn't found any weapons, would they have offered to leave some behind?

[joeW]

Re: A little sensationalism?

No, but they do often leave bullets behind in those situations.

[jelabarre59]

Re: A little sensationalism?

If the police hadn't found any weapons, would they have offered to leave some behind?

Might even have been how they got there in the first place... Bring along your own evidence in case there isn't already enough there.

[Kiwi]

Re: A little sensationalism?

If the police hadn't found any weapons, would they have offered to leave some behind?

Might even have been how they got there in the first place... Bring along your own evidence in case there isn't already enough there.

Nah, the filthy pigs would never do anything like that, would they Mr Thomas? (According to wikipedia, one of the cops who planted the fake evidence in that case was 'praised for having "integrity beyond reproach" ' - scuse me I need to rapidly get rid of my dinner :( )

[Mike Moyle]

Re: A little sensationalism?

"I have no knowledge whether these were legally owned or not as you have left that out of the article!"

A felony conviction -- certainly a Federal one for illegal firearms! -- generally bars one from owning firearms in the future.

[G Olson]

Re: A little sensationalism?

And "assault rifle" only applies to select fire firearms which can fire more than one bullet with a single pull of the trigger. Did such a rifle exist; or is this more inaccurate hysterical reporting? Previous arrest for possessing an automatic weapon does not imply any rifles in the house were "assault rifles". Stick to reporting the technology you know something about.

[BuckeyeB]

Re: A little sensationalism?

An assault rifle is any scary looking gun that the media deems one. It's a term they use to increase the perceived danger. Usually, they are still semi-automatic weapons. The media also likes to imply that semi-automatic is full automatic when used with the scary assault term. A semi-automatic is a gun that with one pull of the trigger, you get a single shot fired. Full automatic weapons are illegal to own in the U.S. without a special permit that is fairly difficult to get.

[Stoneshop]

Re: A little sensationalism?

Previous arrest for possessing an automatic weapon does not imply any rifles in the house were "assault rifles".

"as well as a wide range of related equipment including bumpstocks"

Question for you: what's the effective result of combining a half-auto rifle with a bump stock?

[jelabarre59]

Re: A little sensationalism?

Question for you: what's the effective result of combining a half-auto rifle with a bump stock?

Crappy, inaccurate shooting. Kind of like cleaning with combined bleach and ammonia.

[The Nazz]

You couldn't ..

Not saying for a split second that El Reg have, but......but you couldn't make this shit up, could you?

Inside Job : Parallels* with the Morrisons saga, be interesting to see how that pans out in the UK.

*minus all the ammo and swat raid.

ps why smash the vehicle windows? no-one in their right mind would try escape in them when surrounded by the quasi-military.

[Pascal Monett]

Re: no-one in their right mind

Um, you are aware we're talking about Americans, here ?

They have lots of people not in their right mind.

[JetSetJim]

Re: no-one in their right mind

Given out current political situation, it would appear that the USians don't have a monopoly on stupid

[Pascal Monett]

I do believe I did not say that they have all the people who are not in their right mind.

[Fatman]

Re: no-one in their right mind

<quote>They have lots of people not in their right mind.</quote>

Starting with the current occupant of the White House!

[John Brown (no body)]

Re: no-one in their right mind

"Starting with the current occupant of the White House!"

Is that the teetotaller who reckons Amercan wine is better than French wine based on his perception that the labels are prettier?

[[e-mail]]

Re: You couldn't ..

They would smash the cameras to prevent anyone intent on mischief inside the property having a live feed of who was where - and if the windows in question had "dash"cams on then it should include those too.

They had an experienced IT tech (but apparently dumb criminal) and a lot of guns and assorted household stuff in a house with a man known for playing a little fast-and-loose with the law where firearms and explosives were concerned. They had other - possibly innocent, possibly involved - people in the house; there are other people living nearby; the 'hacker' had stolen the same sort of thing that people like the Russian Mafia or Chinese people traffickers (allegedly) love to get "to fund terrorism" etc so ask yourself this - do they assume the worst and go in with overwhelming force that ends up (in THIS instance) being totally over the top, or do they become the next big news story when it turns out that the "dumb" criminal left a deliberate trail to lure some of Seattle's hard-working public guardians* into an ambush that resulted in a bloodbath and culminated in a huge explosion that devastated the neighbourhood when the gas-filled house went bang?

It obviously didn't happen here, but even dumb criminals can watch TV or watch films/go to the movies and there's plenty of inspiration there. It's not that hard to find instructions for making improvised explosives - maybe not "good" ones but certainly enough to make a mess especially if you've filled your house with gas.

*With hindsight*, the police went in with more force than necessary this time. But the outcome could have been much, much different.

* You rarely hear about the ones who do good work, but somehow the bad ones get plastered all over the internet...

[Dal90]

Re: You couldn't ..

>They had an experienced IT tech (but apparently dumb criminal) and a lot of guns and assorted household stuff in a house with a man known for playing a little fast-and-loose with the law where firearms and explosives were concerned.

They (probably) didn't know about the guns -- they likely did know one of the occupants had a history with explosives, which probably did justify the actions.

>*With hindsight*, the police went in with more force than necessary this time.

I'll say it was appropriate assuming they knew the records of the other occupants.

Because of the nature of this crime, if at all possible they want to get to the computers ASAP to prevent any dead man switch type events occurring -- precluding trying something less intrusive like a traffic stop or snagging the target walking into a coffee shop that could be followed up by a search for physical evidence later (the drugs aren't going to flush themselves).

=============

1) Folks who think this type of militarization is "new"...can just go take a look at the Wikipedia page for Elián González for circa 2000;

2) Folks who think this is how it always goes down this way can google the 2007(?) arrest of Ed & Elaine Brown in New Hampshire -- which simply took restraint, patience, planning, and a wheelbarrow to haul around the balls of the U.S. Marshal who ran point on the arrest.

[Citizens untied]

Re: You couldn't ..

The bad ones should be plastered everywhere. The "good" ones are only doing what they are supposed to be doing.

[Kiwi]

Re: You couldn't ..

or do they become the next big news story when it turns out that the "dumb" criminal left a deliberate trail to lure some of Seattle's hard-working public guardians* into an ambush that resulted in a bloodbath and culminated in a huge explosion that devastated the neighbourhood when the gas-filled house went bang?

Does that happen with enough frequency to warrant the belief that it's anything but an extremely remote possibility?

Besides that, a gas explosion in a house - even one that destroys the house and damages a large number of houses in the immediate area (to the level that it's better to demolish than repair) won't necessarily kill anyone not even the people in the house at the time.

You rarely hear about the ones who do good work, but somehow the bad ones get plastered all over the internet...

There's a couple reasons why it's rare to hear of good cops or cops doing a good job. The first is obviously that the press want to report death and despair, the second is more obvious - a cop doing a proper job, acting in a fully just manner, is extremely rare.

[Anonymous Coward]

Re: You couldn't ..

It really isn't right to say exceedingly rare. For example, the police in my town are all well-versed in law and help the community on the regular. What limit are we exceeding that makes this such an impossibility?

AC because people don't seem to like to admit that there is a possibility of good police, even though they are human like the rest of us.

Also, to all first-worlders: be happy you live in a country where cops even occasionally try to do the right thing and actually get training at all, instead of living under a totalitarian dictatorship or having completely untrained idiots with battle rifles. Once saw a video in some African country where a motorbike cop took 3 magazines worth of potshots at a fleeing vehicle while riding, and shot 3 innocent bystanders. No reprocussions, and the dude got away too. Sadly I can't find it, but it was on LiveLeak some years ago.

[Kiwi]

Re: You couldn't ..

Once saw a video in some African country where a motorbike cop took 3 magazines worth of potshots at a fleeing vehicle while riding

WARNING : Watch at your own discretion. I wish I hadn't seen these myself.

You mean something like :

https://www.youtube.com/watch?v=fuMJD5yKobw

Or :

https://www.youtube.com/watch?v=TeuOLZOk6tY

There's more. Many more. And worse. And that's just the released video. There's lots that I'm sure will never be released.

[Anonymous Coward]

Re: You couldn't ..

The first was clearly justified, they were suspected murderers and opened fire first. I've already seen it. Would it have been better to pull back and try to set up stop sticks or to clear the streets first before returning fire? Maybe, but I wasn't there and I'm not a professional so I have no place to say. All I can say is no civillians were injured that I remember.

Second video was obviously poor judgement on the side of the officers. Both of them should be charged due to their negligence but of course they won't. It's inarguable that bad officers need to face more criminal prosecution for their actions to both get proper justice and to avoid that kind of behavior in the future.

You'll find evidence to both support and disclaim any argument, and with the massive number of officer involved shootings reported (and unreported) in the US you have a lot to pick from. Your fearmongering is unappreciated.

I'll give you a task: Go out there and find those "many more" and compare them to the videos and articles of positive actions from US police.

But since you didn't seem to get my main point, the African officer taking potshots never saw if the people in the vehicle had weapons or not. He never had any fire returned to him. In that regard he performed worse than both the videos you showed. My point is that even if first-world/US police are supposedly mostly terrible people, then why aren't things as bad as this:

youtu.be/fs1-OPfbA2g

youtu.be/pOjYnSAAcnQ

youtu.be/mRADCzmEX6w

youtu.be/uke-NnxQ9pY

youtu.be/twzICq_qfIo

youtu.be/VfmR54giIJA

youtu.be/P8MQTgdjcLE

And I am not saying first-world/democratic countries are free of problems themselves (youtu.be/R7SSacCrbRE) but at least these problems seem to happen less frequently in such places.

[Robert Moore]

Smells.

Something is off.

I see a rectangular object. Rather frame like.

[YetAnotherLocksmith]

Re: Smells.

How would that work then?

"They" completely hacked her, took over her chat and put stuff in the history, added stuff to her Git, etc, and she didn't notice anything? Then what, tunneled via her PC to do the hack that she had previously written up!??

[Anonymous Coward]

Re: Smells.

Possibly.

But we will wait and see. So far it does seem it may have been them. It could also have been a roommate.

If they had access (worked at Capitol One), even more likely, and probably easier, to prove if it was them (their old credentials/left malware etc).

[Kiwi]

Re: Smells.

How would that work then?

When was the last time you checked the browser history on your computer for anything off? Or if you're someone who knows nothing of CLI/Power Shell etc etc, when was the last time you checked your command history? Do other people have physical access to your computer? Do you check it all the time? A lot of people don't even know all the browsers that might be installed on their machine (how many have Chrome, IE/Edge (perhaps both), Firefox and Comodo Dragon installed, yet only use one?)

Do you keep a close eye on all the software on your machine and make sure nothing else has been added that you've not noticed? Few people do that, even people who're somewhat IT/security knowledgeable - especially if they trust their housemates to not mess with their stuff or think they're secure enough that the housemates won't ever guess their password?

Is there someone out there using your name and address etc on a service you don't even know exists? Or perhaps using an old forgotten account that you set up a few years back for a single use? Most El Reg readers probably use fake details for those things, most other people probably don't.

It's likely she was using windows. How much of that is still exposed over the network in a way that makes remote access relatively trivial?

As to her creds on the C1 machines - maybe she has a locked desk drawer with a notebook that has her old details in it? The sort of desk drawer that is commonly very cheaply built, with a lock that keeps honest people from accidentally opening it and anyone else knows can be defeated with a plastic ruler/credit card or gentle tap in the right location?

I can't say she was framed by someone in her house or even someone else who knows her, but I can say that it reminds me of the scene in "Minority Report" where one of the cops talks of "an orgy of evidence", ie too much evidence pointing to the person.

Some criminals are just plain dumb, some make big mistakes on trusting their skill and home-grown encryption, but even taking this into account it raises a few red flags for me. (Of course, her defence will be quite telling - if they push for a 'framed' angle then it suggests it is possible, if they don't - it should be easy for a decent lawyer to introduce enough 'reasonable doubt' by saying a house-mate may've framed her).

[tojb]

Re: Smells.

I've had plenty of housemates who would think nothing to setting you up for ten years inside in exchange for leaving the lid off the marge.

[Kiwi]

Re: Smells.

I've had plenty of housemates who would think nothing to setting you up for ten years inside in exchange for leaving the lid off the marge.

Yes, I do hate that myself..

[grabs large notepad]

So.. Any idea how they might have gone about this?

(If you were to bring marge into my house, I'd be aiming for 30 years as a minimum)

[steviebuk]

I'm confused.

Says she was at Amazon in 2015 so assume no longer there? If so how did she still have active login details, best practice is they change when engineers leave. And a $10k computer? Really? Just for hacking? Was it made of gold.

[JimboSmith]

Re: I'm confused.

Maybe she had attached a gold Apple watch to if?

[doublelayer]

Re: I'm confused.

The theory is that she had knowledge of security vulnerabilities, or more likely, common misconfigurations, from her time which she then used. It doesn't seem likely that she had any special access to Amazon's systems, just the required knowledge to break in, which in this case was obtained from a job at Amazon but could also be obtained from elsewhere.

As for a $10K computer, that is pretty ridiculous, but it can be done. If you max out the specs on the iMac Pro, (18 core Xeon, 256 GB memory, 4 TB SSD, and a 16GB graphics card), you can get the price all the way up to $14500. If you're thinking laptop, you can max out the specs on the System76 Serval WS to $7747, which is somewhat shy of the $10K mark but a) people exaggerate and b) you can increase the value of any computer by buying even more expensive memory* and putting it in. Neither of these maxed out machines are really of use to many people, but if you want to buy them, you can. Someone who decides to steal a bunch of credit card data for no good reason then announce their identity online might not do the mental math on whether such a purchase is truly necessary.

*It is easy to increase the price of any computer by adding memory to it. In both cases above, the maximum memory increase was responsible for large chunks of the high prices. Apple's was more expensive as their desktop chips support much faster memory and they're willing to sell you 256GB whereas system76 will only go as high as 64GB, but each involved a significant amount of expenditure to get there. If you wanted to go out and buy the same type of memory and install the upgrade yourself, you might be able to get even more, and thus a higher bill. Similarly, there is no sane limit to how much an SSD goes for--there is always a bigger one or a faster one for 1.5X the price.

[IGotOut]

Re: I'm confused.

$10,000 pc not possible?

Dead easy, just look at the price of some high end graphics cards and monitors for starters.

Nvidias Titan V will knock you back almost a third of that alone.

[John 104]

Re: I'm confused.

Shit, our medical monitors (barco) are so expensive that we became a vendor and they still run $12K a pop.

[Kiwi]

Re: I'm confused.

The theory is that she had knowledge of security vulnerabilities, or more likely, common misconfigurations, from her time which she then used. It doesn't seem likely that she had any special access to Amazon's systems, just the required knowledge to break in, which in this case was obtained from a job at Amazon but could also be obtained from elsewhere.

I struggle with that too.. No significant software upgrades in that time rendering all prior knowledge of the package rather useless? No management changes requiring a complete re-write from scratch just so they can 'put their mark' on things? In nearly 4 years, not even one change that made what she had useless? Across not one but two large firms? (Ok, Amazon's security slackness is probably standard procedure....)

The article did read more to me like she used active credentials at first read, not as convinced on a second glance.

[Eguro]

Re: I'm confused.

10k computer is more likely her room mates having no idea.

"This computer is worth more than you make in months!" she snarled.

"Okay, sheesh" - two months later - "and her like $10.000 computer or whatever".

[VonDutch]

Re: I'm confused.

Could have been a basic computer and a couple of Mac Pro monitor stands...

[batfink]

Re: I'm confused.

Probably just her gaming rig that's being reported as "her hacking machine".

[404]

Re: I'm confused.

LOL! Yeah I call mine a developer machine for tax purposes too...

[NetBlackOps]

Re: I'm confused.

Game machines make great password cracking machines, amongst other things (AI/ML).

[Anonymous Coward]

Re: I'm confused.

10K on the GPUs for brute forcing table lookups. Not difficult (at 1-2K each). But makes SHORT work of some password systems if you have access to some of the encrypted hashes/etc, and also know the algorithm (say from employees/leaks/opensource/known application).

[MrReynolds2U]

Re: I'm confused.

yep - bought from same place as orange baby's toilet

[John Brown (no body)]

Re: I'm confused.

"And a $10k computer? Really?"

That was a comment from another housemate, and almost certainly someone not up on the prices of even high end laptops. Most people have relatively cheap laptops because price is pretty much the only point most people look at when buying one other than the general "looks" of the device. Anything that looks a bit swish is, in their minds, a much more expensive device.

[Tree]

How did she afford that computer?

How did she afford that computer? It was charged to your credit card!

[Anonymous Coward]

The only one that deserves jail....

...is the head of IT at Capital One.

[Claptrap314]

Re: The only one that deserves jail....

The lack of due diligence is certainly criminal. But are you saying that doxxing is legal? And felon in possession? Nope, nope, nope!

[Anonymous Coward]

Re: The only one that deserves jail....

Just my half-pence: There are issues with the cloud, but since she noticed those vulnerabilities it was also her duty to raise that issue with others/fix it herself.

Nothing in the article mentions whether she attempted to, nor can I be arsed looking elsewhere. Just my half-pence.

[Anonymous South African Coward]

"It is becoming far too commonplace that financial institutions are susceptible to hacks, begging the questions: Why do these breaches continue to take place? And are companies doing enough to prevent future data breaches?... We cannot allow hacks of this nature to become every day occurrences."

Blame the beancounters. Their fault for cu5ting costs and expenses and going it as cheap as possible, meaning that a proper setup will never be done as there is no money.

[Peter2]

Well, yes. But beancounters are allied with the Manglement in this.

At the moment, it's cheaper to have basically no security and be breached and then go to the police and say "we were hacked by a uber skilled hacker". When a court sentences them then you can change the person found guilty costs for somewhat securing your systems. This leaves no incentive other than PR for securing your systems.

This is probably going to change now GDPR is in (at least in europe); once a few epic level fines go in then it's going to be cheaper to secure systems first to avoid having to pay 20% of your business turnover in fines per offense. This provides a very good incentive to adequately secure your systems.

[Potemkine!]

Insanity

Sending a SEAL-like team to arrest a 30yo woman accused of hacking is a clear demonstration the US is a totally fucked-up country.

[JetSetJim]

Re: Insanity

Whereas sending a SEAL-like team to enter a house where a known gun-offence felon lives (with who knows what in the commentary on his record) is probably not totally fucked up

[Potemkine!]

Re: Insanity

When you have to send a SEAL-like team to arrest a non-violent offender because there could be weapons in the house is also a proof the US is totally fucked-up. May the means used to arrest her be legitimate or not, in both case it shows the insanity running through this country.

[JetSetJim]

Re: Insanity

fair point, for sure you don't need ar-15s to hunt deer, and guns in general clearly don't protect people. but given the situation, an armed team seems at least a little reasonable

[GruntyMcPugh]

Re: Insanity

@Potemkine!

Indeed, no idea why they couldn't have just kept an eye on her, wait for her to leave the house and go shopping, then tap her on the shoulder, quietly, like.

[Eddy Ito]

Re: Insanity

They'd still have to go in at some point to collect her things and assuming they had some reason to suspect Mr. Quan might be in violation of the law, and don't they always, it wouldn't change much.

[EnviableOne]

Re: Insanity

not a SEAL like team, there is only one of the domestically the FBI-HRT

its only SWAT, which are Marines at best....

[Eddy Ito]

Re: Insanity

Par for the course. They've been using this method for such high crimes as unpaid gas bills since 2014. At least the taxpayers eventually get stung for the heinous acts of their bad cops.

[89724102172714182892114I7551670349743096734346773478647892349863592355648544996312855148587659264921]

Only 5 years? Sentences meted out for White collar crimes are naff

[sum_of_squares]

So she hacked her former employee and doxxed herself?

Am I the only one who think that sounds fishy?

[Kiwi]

So she hacked her former employee and doxxed herself?

Am I the only one who think that sounds fishy?

Nope, there's a couple of us who wonder at what was behind this.

Would be nice if the cops had taken all computer equipment in the house, just in case it wasn't actually her. I wonder if her house mates are in the market for some new HDDs?

[Anonymous Coward]

I know her, we chatted a lot in the past year. Not surprised and I think it's better than the alternative - she was in serious need of psychiatric help, which unfortunately is not readily available in US to unemployed. The alternative I spoke about was suicide, as I know that she tried that before more than once. Hopefully psychiatric evaluation will follow and she may find some help which she sought, but was not granted.

Good luck Paige Adele.

[89724102172714182892114I7551670349743096734346773478647892349863592355648544996312855148587659264921]

I wonder how many suicides and cases of mental breakdown will ultimately be caused by her actions

[IT Hack]

Off Boarding

I'm wondering if her ex-company took the appropriate measures like disabling accounts and the like. And of course regular password changes for admin or root accounts.

Beer coz why the hell not.

[EnviableOne]

Missing the Point?

Ok so she didnt work for CapOne, she worked for AWS, i thought Cloud providers didnt get access to your services run on their infrastructure?

Seriously, this is a wake-up call for anyone using IaaS, PaaS

As i have been saying for years, its not cloud, its Other People's Tin, and you have to trust they'll protect it, glad my employer hasn't gone with a cloud first strategy .....

[IT Hack]

Re: Missing the Point?

It will be interesting to see how one can audit against GDPR requirements...

I recall having a robust discussion about why we (the company I worked for) need to be careful about transitioning our accounts package into the cloud. Partly about the risks of multi-tenanted environments and certainly about access controls to our data.

Sadly (for them as it turned out) costs efficiencies won the day (short term). In a strange twist it was an outage issue that did for them.

[Mike Moyle]

Police response

Were I the suspicious and cynical sort of individual -- which, of course, I'm not! -- I might wonder whether the police already knew about the property owner's cache of boom-sticks and found the accused woman's actions to be manna from heaven as a suitable proximate cause for a raid.

If they had knowledge through a source that they didn't want to compromise (e.g., as part of an ongoing investigation, whether that investigation is related to illegal weapons sales or not), or via information illegally obtained (fruit of the poisoned tree exclusion), they might have been stymied up to this point and welcomed this as a convenient and defensible excuse to enter the premises fully locked and loaded.

Mind you -- I should probably say this explicitly for the tinfoil-hat brigades -- I have seenNOTHING that suggests that they had any way to encourage the woman -- who an anonymous poster above has claimed to have mental/emotional issues -- to break in to the CapOne server and brag about it to set them up with an excuse, and assume that they just took advantage of the synchronicity that she handed them.

[Anonymous Coward]

#1 reason for such data breaches: Data in the Cloud

Moving data, which isn't supposed to be available to the public, into the Cloud is by far the dumbest idea to begin with. Data in the Cloud *WILL* leak.

[Kiwi]

Re: #1 reason for such data breaches: Data in the Cloud

Moving data, which isn't supposed to be available to the public, into the Cloud is by far the dumbest idea to begin with. Data in the Cloud *WILL* leak.

Having large amounts of customer data "in the cloud" isn't really a problem,

Having even a single byte of unencrypted customer data 'in the cloud' is.

Encrypt it 3 ways till Sunday. If there's a good reason why it should remain unencrypted, there's a bloody good reason why you should be paying thrice to make sure you have a decent security team and looking strongly at local hosting.

(The ability to 'spin up' or 'spin down' resources at will without having to buy actual tin is a very compelling reason for businesses to look at such things - I don't blame them and I'd consider it myself if I was doing more than hosting a teensy little site known to one or two people and a couple of dozen fortunate port scanners)

[Nightkiller]

I'm not sure how far the definition goes, but this was no "hacker".

No stealth penetration was performed and no social engineering occurred.

This was careless administration and Breach of Trust.

[Anonymous Coward]

Cannot find her old web site

Was it only taken down recently?

I found a link to it here, written by her:

https://christydancer.wordpress.com/2010/03/15/yes-its-been-9-months/

[Anonymous Coward]

Hmmm...

I’m sure you brits are thinking “excessive force” and “overkill” but you have to realize in 20 years about a quarter of a billion new guns are sold. When you take into account just about anyone can buy one, and the fact guns almost never wear out... there’s a HUGE number of guns in civilian hands.

Our US citizens probably have more guns than just about any military on the planet. Zombie apocalypse... please.

Our police train like they’re the military, which is what you’re seeing, because there is a good chance they’re going to be outgunned.

If it turns out they’re not... it’s a training exercise.

[Kiwi]

Re: Hmmm...

When you take into account just about anyone can buy one, and the fact guns almost never wear out

I'd be surprised if the latter is true.. Not looked after, not cleaned, left loaded and cocked, probably in a bedroom drawer or somewhere else not exactly known for being a dry environment with a stable temperature..

I can imagine springs under compression that would prefer no compression, a build up of dust/grit in the barrel (perhaps binding to any grease or oil in there), cartridges slowly absorbing moisture - and corroding as well, and firing mechanisms that were moved a few times - just enough to remove any protective oils - then left to rust.

I'd be really surprised if the majority of guns in the US could actually be relied on to safely fire. I could of course be completely wrong, knowing only farming/hunting guns here in NZ, but I really would be surprised :)

[bigtreeman]

Out sauced

Every time a company out sources anything, they loose some control.

They

Save money and increase profits

Avoid responsibility

Employ less people

Who should be blamed ? - Capital One

[Gnosis_Carmot]

Wow. This person is a whole bucket o' crazy.

Brags about the crime online so much that other hackers warned her she was facing jail.

Uses the same credentials to commit said crime.

Posting in Twitter ‘I’ve basically strapped myself with a bomb vest, f*****g dropping capitol ones dox and admitting it...I wanna distribute those buckets i think first.’

Posting about a desire to commit suicide

Claiming to be a woman.

[Anonymous Coward]

Re: Wow. This person is a whole bucket o' crazy.

Every news source reporting this story certainly seems to be repeatedly stating the accused’s gender to an unusual degree.

[Jove]

Vetting ...

Another demonstration of Corporates not conducting adequate vetting - in the case of Financials, insufficient vetting of associates of potential candidates.

[Can't drive 55]

Troubled by the NY AG comments

I realize these companies have a responsibility to protect data, but the attitude of the NY AG is, as an example, if I had a business with windows in the front and iron bars across bulletproof glass, it would still be my fault if someone drilled through the exposed glass and torched my office by spraying gasoline through the hole. At some point the criminals need to be solely responsible for their crimes. NOTHING is impermeable.

This isn't low hanging fruit. These attorneys general are using skyhooks to pick plums, hoping for huge settlements. Follow the money.