Hacker News new | past | comments | ask | show | jobs | submit login
Woman allegedly impersonated prosecutor, dropped charges against herself (unionleader.com)
534 points by coloneltcb on Oct 28, 2020 | hide | past | favorite | 311 comments



One has to wonder what legal frauds, asset grabs, and impersonations have transpired that were never discovered. Some perspective on this is the story of Alves dos Reis (https://en.wikipedia.org/wiki/Alves_dos_Reis) who in 1924 stole ~1% of Portugal's GDP in bank notes printed under forged orders. The scheme may have never been uncovered had Reis succeeded in maintaining a controlling interest in the Bank of Portugal and eliminated the paper trail.


Having someone else do your prison time was fairly common. Now with more cooperation between organizations and improved biometrics it has dropped.

Different people would be arrested, show up to court, or enter the prison. Impossible for organizations downstream to detect or assume a switch had happened.


This seems similar to the Catholic concept of buying indulgences as a carbon offset type concept against sins. Pay to play


It's not; indulgences remit the temporal punishment associated with sin (mortal sins incur eternal punishment in additional to temporal punishment; merely venial sins incur only temporal punishment). Mortal sin can be forgiven only through contrition and reconciliation. Temporal sin can be forgiven at the leisure of the Church (i.e., through indulgences). To commit a sin with the intention of attempting to obtain forgiveness through reconciliation afterward is itself a mortal sin.

Indulgences still exist, and you can still purchase them in the sense that you can make a donation to a priest to offer the sacrifice of the Mass for a specific intention (like the remittance of a portion of the temporal punishment for the sins of a friend or loved one), and the offering of the sacrifice has indulgences associated with it in addition.

This is not the only way to gain indulgences. There are many ways to gain them. Praying for the souls of the faithful departed on All Souls Day (in combination with the usual conditions, i.e. a) being in a state of grace, b) having the interior disposition of complete detachment from sin, even venial sin, c) having sacramentally confessed their sins, d) receiving the Holy Eucharist, and e) pray for the intentions of the Supreme Pontiff) on November 2nd allows for one to obtain a plenary indulgence (which remit ALL temporal punishment) either for oneself or for a person of your choosing.


This sounds like a World of Warcraft quest.


i have a certain fondness for both MMOs and the faith i lost. this is not that far off if you also allow that people seem to get a lot of meaning out of the quest even though you may no longer believe it actually describes the existing state of things.

the companionship you feel with the others on the journey with you, the feeling of losing yourself in something much bigger than you, the structured life with a clear definition of The Good (do these is this order to achieve digital/eternal reward)...this analogy works.


>To commit a sin with the intention of attempting to obtain forgiveness through reconciliation afterward is itself a mortal sin.

Source? If you do it with a mortal sin I can understand it would be a second mortal sin. But it seems harsh to make a venial sin into a mortal sin from this.


The venial sin isn't the problem, you're attempting to deceive God through manipulation. I would think anyway, not a Catholic.


I'm not sure I would call it deceit, God is all-knowing. I would consider it taking God's mercy for granted and treating him like a mechanical forgiveness dispenser.

I'm hesitant to say it's always a mortal sin, because it seems like it can happen in a lighthearted manner. For example if someone struggles with gluttony, that person might think "I know I shouldn't have a 2nd hamburger, but I'm weak and it would taste so good, I'll have it now and go to confession later". That doesn't seem like mortal sin territory to me.


That is a common misunderstanding of canonical Catholic teaching about "indulgentia a culpa et a poena".

Keeping the carbon offset analogy, an indulgence in the Catholic sense would be more akin to first making sure you are carbon neutral (all parties are at peace and forgiven/reconciled), then you spend %10 of your salary to go beyond that and offset the carbon credits of the person you wronged.


Instead of sticking with the carbon credits analogy I'll articulate more directly what I understand from reading up on indulgences at https://www.newadvent.org/cathen/07783a.htm

For a sin that has already been forgiven, an indulgence is associated payment you owe that if you didn't pay, you will spend more time in purgatory.

If this is an accurate reading, does it not dilute the meaning of "forgiven"? Does it not amount to a money-making racket at best, or, more probably, extortion?


You have some good points, maybe you should write them up and post them up where church-goers would see them, like a church door or something.


“What’s wrong with the church?! We’ve got some theses!! (You’ll never guess how hard-hitting no. 95 is!) <next>”


Though, of course, the church door bit almost surely never happened.


>Does it not amount to a money-making racket at best, or, more probably, extortion?

The vast vast vast majority of indulgences have no money aspect at all. See the list of plenary (meaning all temporal punishment is removed) indulgences on Wikipedia[1], none of them involve money.

[1] https://en.wikipedia.org/wiki/Indulgence#Plenary_indulgences


From your link:

“ Least of all is an indulgence the purchase of a pardon which secures the buyer's salvation or releases the soul of another from Purgatory. “

One might associate it with helping move an individual from a smaller circle to a larger circle of ethics: https://en.m.wikipedia.org/wiki/The_Expanding_Circle

“ Singer discusses the relationship between biological capacity for altruism and morality. He argues that altruism, when directed to one's small circle of family, tribe or even nation, is not moral, but it becomes so when applied to wider circles. “

E.g. charity where you sacrifice your individual goods for the larger community is good for the soul.


An even bigger misconception is that indulgences were actually bought on behalf of _someone else_.

They were meant to address a very real problem with catholic heaven/hell theology:

What if I belong in heaven, but somene I love, who I can't possibly imagine spending eternity without, belongs in hell?

Indulgences were originally meant to address this: the party that belonged in heaven could, through their sacrifice, guarantee a spot in heaven for their loved one. It was only later that the "sacrifice" become strictly monetary.


As far as I know, indulgences never got you out of hell. They were to shorten your time in purgatory.


>An even bigger misconception is that indulgences were actually bought on behalf of _someone else_.

Are you saying it's true that indulgences can be obtained for others or that it's false that indulgences can be obtained for others?

In reality indulgences can be obtained for yourself, or for others, including those in Purgatory. They can't be obtained for people in Hell.

>It was only later that the "sacrifice" become strictly monetary.

Indulgences are not strictly monetary. The vast majority involve no money at all.

https://en.wikipedia.org/wiki/Indulgence#Plenary_indulgences


Indulgences for the damned were inefficacious and applied to the Church suffering in purgatory.


Until Teztel started selling carbon offsets for dead polluters. An offered coin springs a dead soul from purgatory.


Sounds like a new ICO opportunity :)

Would be interesting if there were a climate change coin...

oh wait, https://earth-token.com/


The obvious response is that every PoW coin is a climate change coin.

:-(


So common in fact, like language, it becomes a prescriptivism / descriptivism thing ...


Positively identifying people was very difficult before fingerprinting came along. The police used all kinds of schemes of erratic accuracy.


Several years ago I read the book Fingerprints by Colin Beavan [0] and it was really eye opening how different life was before we had modern forms of identification.

Example 1: In countries that had little formal legal structures and rudimentary identification (e.g. India in the early 1800s), it was incredibly easy to be a criminal and just move from town to town while acquiring new identities. In other words, there was a huge upside to becoming a career criminal since it was both difficult to catch you (no forensic evidence) and even if you were caught, you could just reboot your life.

Example 2: He mentions a case where a gentleman was charged TWICE for crimes that were later found to have been committed by someone else who had only a passing resemblance.

I read this book before Twitter/Facebook became ubiquitous and every like, share, comment was public knowledge but even at the time, it was mind boggling how different "identity" was back then.

0 - https://amzn.to/3kDqEgj


The flipside of this would be that anyone from out-of-town would be shunned under the assumption that they had left their previous town for negative reasons.


That's probably part of the reason the branding of the hand worked reasonably well in practice in Britain.

If you plead the 'benefit of the clergy', you were branded, so you didn't do it again.


Isn't photo ID much more relevant for the above than fingerprints? Usually fingerprints are used to investigate crime scenes, not to ascertain identity of an already known person (you don't normally ascertain that this person here is Alex A by their fingerprints - you use them to see if Alex A was in the room where the jewelry got stolen).


Fingerprints are much more reliable than photos.

I was watching a show on TV last night where they were minutely examining a newly discovered photo of Lincoln to see if it was really Lincoln or someone else. One analyst gave it an "85% probability it was Lincoln".


Jeez I’m wondering what the going price would be for that today.


I've seen reports that it's somewhat common for the rich in China[1], so there might be some info on what it costs there, and maybe some extrapolation could be made. Either the "serve prison in lieu of me" or "say you were the one that committed the crime" version. There are weird perverse incentives at play in some of the laws of criminal justice system in China.[2]

1: https://news.ycombinator.com/item?id=4339051

2: https://news.ycombinator.com/item?id=10173395 (warning, the linked article describes very disturbing behavior and specific instances)


Not so long ago the heir to the Red Bull fortune was alleged to have driven his Ferrari through a police check point at speed, killing an officer. Since it was a police officer killed, the matter was investigated and the mangled Ferrari found on the estate. One of the house hold staff came forward, claiming he was the driver. Apparently this is somewhat expected in these situations. But it did ruffle lots of feathers, so the poor heir had to go on the run for a while. But no worry, a few years later all charges are dropped because everyone has been compensated and it was a while ago, so lets just let bygones be bygones, and go back to dealing with the stress of being a member of Thailand's 2nd wealthiest family.

https://www.abc.net.au/news/2020-07-24/thailand-charges-agai...


To add the latest update to the story, the public outcry continues to be strong and after going back-and-forth on whether to pursue prosecution of the heir, the police asked Interpol to issue a red notice: https://www.nytimes.com/2020/10/05/world/asia/thailand-red-b...


It may sound a bit barbaric, but the family of the victim might be better off with a chunk of money than with the knowledge that the perpetrator is serving time.

(However, if you look at the incentives and deterrence, inflicting inefficient punishment like sending someone to prison for a long time, might still make sense.)


No reason we can't do both.


There's a maximum amount of punishment you want to mete out to convicts. Otherwise everything would carry a penalty worse than death.

So there's a trade-off between handing out more of that punishment in fines to be paid to the victim or in economically inefficient activities like prison time.

As a related matter, I think corporal punishment deserves more consideration. Mostly because it's cheaper to administer than prison, and also avoids forcible socializing convicts only with each other as happens in prison.

(Of course, it's a punishment with a certain cruelty. Alas violence and injury are a common enough sight in overcrowded prisons, too.)


The person we're discussing is heir to a $20 billion fortune. A fine that would constitute actual punishment to him is in the billions. Which I'm entirely in favor of here, preferably 19.9 billion or higher.

But restitution isn't punishment. Restitution helps reduce harm to the victim, and is a separate issue entirely to punishment.


Sorry, I wasn't talking aware that you were talking punishment as in the need to cause pain for some abstract moral reason or to make people feel good.

I was more worried about issues like deterrence and restitution.

Punishment and deterrence are somewhat related, but not the same.


> the family of the victim might be better off with a chunk of money than with the knowledge that the perpetrator is serving time.

Justice isn't always about providing benefit to those harmed. It's also about providing a framework in which crime is avoided by all because they know there are repercussions they can't avoid.

When the expectation is that you're rich and you can get away with killing someone either through paying someone to take the fall or bribery, then that will happen more often. If the expectation is that everyone is equal under the law, that will happen less.

The US isn't perfect in this regard, but I think it's a lot better than what's being described here. If Ivanka Trump drove recklessly and killed someone, it would be a lot harder for it to play out the same way here. That's not to say she would necessarily face justice, just that it's a lot harder to get out of it, so there wouldn't necessarily be an expectation that it will go away. There's a huge difference in expecting to get away with something and knowing it's uncertain when the consequences are years in prison.


However, do compare wrongful death claims in the US which are handled in a civil suit.

O.J. Simpson famously got off with 'not guilty' in the murder case, but lost the civil suit.

See https://en.wikipedia.org/wiki/Wrongful_death_claim and https://en.wikipedia.org/wiki/O._J._Simpson_murder_case#Civi...


Yes, civil suits are brought be individuals, so are less about societal pressure and more about recompense, while criminal cases are brought by the state. I believe there's also a lower bar, and civil court works by "a preponderance of the evidence" as opposed to "beyond a reasonable doubt". The courts serve different purposes.


> Yes, civil suits are brought be individuals, so are less about societal pressure and more about recompense, while criminal cases are brought by the state.

This is somewhat inaccurate; while it is true that criminal cases can only be brought by the State, civil cases can be brought by the State or private parties.


Oh, good to know, I wasn't aware of that. Thanks! :)


Though as far as I can tell, the state only gets treated like any other private party in a civil suit.


This reminds me of the classic phrase, “the butler did it”. It took me ages to realise that butlers aren’t naturally villainous, but rather were expected to take the fall for any malfeasance committed by the family.


> It took me ages to realise that butlers aren’t naturally villainous, but rather were expected to take the fall for any malfeasance committed by the family.

I just realized that in Oct 28th, 2020. Thanks for that.


This might or might not be true, but it's not the origin of "the butler did it".

The origin of the phrase is in the classical detective story trope.


> The origin of the phrase is in the classical detective story trope.

Which, if I'm not mistaken, itself doesn't derive from household staff taking the fall for their employers, but from them being omnipresent but, by strong social custom, ignored.


Yeah, I'm fairly sure that's the case. So while checking the motives of the high society suspects, nobody would suspect the lowly butler -- which, in another trope, had some dark past related to the family he was employeed at...


edit- after reading up on this, I'm not sure where you got your information from but everything I could find shows it to just be the common detective/mystery trope.


It just follows logically that historically some powerful families would have paid off a fall guy if necessary, and they could have used a butler in some cases. This could've been the origin of the term, before it even showed up in murder mysteries. Perhaps from the 1700s


>This could've been the origin of the term, before it even showed up in murder mysteries. Perhaps from the 1700s

The thing is, it doesn't show up in murder mysteries themselves (except only as a fourth-wall breaking meta-reference to the trope).

It originates with murder mystery readers -- as the name of a trope.


I bet a good butler is much harder to find than a patsy.


Yes. Though you need a patsy who would have conceivably eg have access to the fancy cars.


But... Were they really?


Is this happening in movies under my nose?


Whoa.


There have even been death penalty cases that someone else takes the fall for, usually a terminally ill patient who wants their family looked after.


Per a friend still happening in India and affordable to a surprising percentage of the population


Probably more of a price in terms of favors and relationships than money. e.g. If a mob could somehow bust you out then you belong to them for some percent of the prison time. Just a guess though.


Do you mean busting out as in a violent prison break, or having the right connections and bribes and intimidation behind the scenes?


There's a TV series watchable on-line about him. Only in Portuguese, though...

https://arquivos.rtp.pt/programas/alves-dos-reis/


Obrigado!


This is Portuguese for Thanks?

Off topic, but reading it I just noticed it sounds an awful lot like ありがとう (“arigatou” as in “domo arigatou Mr. Roboto”).

I think there’s an etymology lesson in this, although I’m not sure which way it goes, probably Portuguese -> Japanese via Nagasaki.


It's a well known theory but it's most likely false[1], though there are several words imported to Japan via Portuguese that have long remained, such as the word for England, イギリス, which comes from the Portuguese for English (people), Ingles, which drives me a bit potty as it's used now to refer to the whole of the UK and I have trouble trying to distinguish England from Scotland et al when speaking with Japanese people.

Ironically, "Japan" is from an old Chinese word for Japan that was then imported to Europe… by those dastardly misnomerists of countries, the Portuguese!

[1] https://japanese.stackexchange.com/a/5481/10723


In Sweden we often use "England" for the UK. But I always feel a little guilty when doing it.


It's actually related to the English phrase "much obliged!" -- from the Latin obligare, participle obligatus, meaning to indebt (both morally and fiscally).

https://en.wiktionary.org/wiki/obligo#Descendants


You shouldn't usually try to guess etymology based on superficial phonetic similarity, especially for such a common word. It is exceedingly unlikely that a country would adopt a language would just adopt a word for giving thanks (though there are exceptions).

Just for some fun of even greater coincidences between Japan and a Romance language, there are two almost identical words in Japanese and Romanian that have no etymological relationship: "sat" / "里" ("sa to") meaning village in both languages; and "baba" / "婆" ("ba ba") a derogatory term for an old woman in both languages ("hag").


Part of my practice is financial fraud investigation.

>One has to wonder what legal frauds, asset grabs, and impersonations have transpired that were never discovered.

A lot. More than you'd expect. And by people and organizations you wouldn't expect.

However, most people are objectively terrible at performing fraud. The things that ultimately lead to people being caught are so simple.


Yep, working on the other side (criminal defense) I quickly, within a year or two, found that fraud, or what the laws would consider fraud that could be prosecuted, tend to unravel extremely quickly in most cases, planning is almost always inadequate if they wanted to get away if any planning is involved at all, and common OPSEC failures tank a great deal of them almost right off the bat. Also, there's a definite correlation between how many co-conspirators are involved with how quickly their scheme is discovered. This goes for all conspiracies under the legal definition - when you need more than two people to agree to a common plan or purpose to commit something, it turns out keeping even just a partnership quiet and in check is really hard for all but the most simple schemes. OF course that does also imply that the better, more organized outfits never come through my (public defender) office and so, there's a selection bias there, but the volume of cases is very high and it's hard to imagine that this represents at least a large portion of acts that caused enough damage/loss to elicit police attention.

I think there are probably some very talented solo operators who did their homework and have contingency plans and have OPSEC down who are able to pull off some long running schemes that may never be uncovered, just knowing the points of failure in th processes I've seen, but the amount of specialized knowledge and discipline required is going to be comparable to what's required to succeed in almost any field. Except for the very few at the top of the chain that nobody knows about, most people are better off getting a real job instead.A lot of those people who engage in fraud do it and get caught because ths isn't what they wanted to do butout of necessity, greed, or shortsighted assumptions they opportunistically engaged in the scheme. The internet does enable, I believe, single individuals to commit long term fraud operations as effectively lone-wolf actors whose necessity to employ a service offered elsewhere can be effectively done anonymously, and these are the dedicated, professional, and sometimes sometimes ideologically engaged types whose choice to engage is a long-term project and the sheer amount of knowledge in divergent fields of expertise required makes me wonder that if it wouldn't be better served to actually run amnesty programs to get these people into the legitimate sector even as consultants if not corporate jobs because our retributive criminal justice system renders that basically impossible. A bug bounty for fraud, perhaps? Just a thought.


I wonder how many people get away with fraud because so many other people are so bad at it.

Perhaps being just better than terrible is enough to not be found out because things are generally as they seem.


Some people are caught for their perfect crimes, because they can't keep themselves from bragging about them in the pub.

(And I can see the temptation.)


What are the types of mistakes that commonly lead to people being caught?

I'm asking, uh, for a friend. :-)


Pretending to be asking for a friend on a public forum is a common one...


Yeah, asking on a public forum is how they got altoid (Ross Ulbricht).


And I would imagine that's a self-selecting population you're working with.


Here in Germany we had a few cases where persons worked as hospital doctors for a few years without a license or diploma or even any medical training. They usually submitted a fake license to the hospital. There was a spectacular case in the 1990s where a former postal employee named himself "Dr. med. Dr. phil. Clemens Bartholdy" and later worked as a senior physician in a psychiatric hospital, also giving lectures [0]

> By chance, a co-worker recognised him on July 10, 1997, forcing him to go into hiding. At that time, an appointment was already set for an interview with Hans Geisler, then Saxony's Minister of State for social affairs, health and family, on the occasion of Postel's appointment to a professorship and to the position of chief of medicine at Saxony's hospital for psychiatry and neurology at Arnsdorf near Dresden.

In another case, a former barber worked for 20 years as a doctor, eventually becoming chief physician in a children's hospital [1].

Back in the 2000s there was a case of a medical student who failed her final exams 3 times, and instead of leaving university as she had to, she just continued her studies without the possibility to take any exams. After a few years, she printed a fake license and a fake diploma and secured a job as an assistance doctor in the children's hospital of the Hamburg University Hospital, eventually becoming a respected colleague (she was, after all, actually trained to be a doctor). After a few years, she failed to hand in the original license and her fraud came to light [2].

Last year, a fake anesthesiologist was uncovered in Fritzlar. She had no formal training and had handed in a fake diploma to get the job [3]. No one noticed until last year, at which time she had already accidentally killed 4 people.

Given that there are several such cases each year, chances are very high that there are still some fake doctors practising here.

We also had the famous Captain of Köpenick [4], an ex-convict who in 1906 put on a uniform, rounded up a few soliders, occupied a city hall in Berlin, arrested several employees, had them transported to the main Berlin police station for interrogation, ordered to block all local telephone calls for an hour, confiscated 4000 marks and disappeared. It took 10 days to arrest him.

[0] https://en.wikipedia.org/wiki/Gert_Postel

[1] https://www.aerztezeitung.de/Panorama/Hochstapler-im-weissen...

[2] https://www.welt.de/welt_print/article1142757/Falsche-Kinder...

[3] https://www.fr.de/hessen/hessen-drei-falsche-aerzte-einem-ja...

[4] https://en.wikipedia.org/wiki/Wilhelm_Voigt


In Pakistan, apparently pilots would fly with fake licenses and it was known to the authorities: https://www.cnn.com/2020/06/25/business/pakistan-fake-pilot-...


Honestly, at least with private pilots, it's probably pretty common (there's a joke that people in Alaska aren't licensed at all). No one is checking your license when you get into and out of the plane. I've definitely flown with someone who wasn't legally allowed to fly me at night.


Yes but these were pilots flying national airlines and allegedly even loaned out to other international airlines.


Ferdinand Demara impersonated a surgeon on a Canadian naval ship during the Korean War. He performed a number of successful surgeries and was only caught because of a newspaper article about how he had successfully removed a bullet from a wounded soldier.

https://en.wikipedia.org/wiki/Ferdinand_Waldo_Demara


Highly interesting! Following a link from Wikipedia, I saw that his biography is available online at https://archive.org/details/greatimpostor010210mbp


Failure to verify such documents is totally on hospitals.

We've recently had a similar case here in Lithuania, where doctor claimed to studied something in US. When they've called the university, they've said they don't even have such programme.


As far as I understand it, in Germany you are required to hand in the original documents a few months after you have started your job. If you fail to do so, you are first being reminded, then you pay a fine, and than it increasingly escalates. But it will take several years until an actual investigation begins.


Yeah but what makes a document 'original'? There's no hashsum, NFC or anything in those fancy pieces of paper is it?


Actually, there is. Official diploma's are watermarked and numbered in the same way that money is. I used to work at a factory that produced the raw paper for such documents, and the amount of logging and auditing for each sheet/roll of paper that moved through the factory was immense.


Yeah but they are useless without some very intricate verification API/human.


There's also the saga of Malachi Love-Robinson: https://en.wikibooks.org/wiki/Professionalism/Dr._Malachi_Lo...


No one noticed until last year, at which time she had already accidentally killed 4 people.

It's really surprising that someone with basically no knowledge of the subject could work for that length of time and not be discovered sooner.


These stories are incredible to hear, thanks for sharing


I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit.

There was a story in WSJ like last week about how the Japanese red stamp / seal still survives and is a barrier to them adopting new technology for practical every day speeding up of tasks. And keeps things like faxes around unnecessarily.

Yet sometimes, these old checks are there to prevent maybe the worst case of bugs getting into the system. Maybe?


> I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit.

I used to work as a criminal defense attorney, and the job regularly required that I obtain subpoenas from the court in order to mandate a witness's appearance at court. My state courts have a template that subpoenas must follow, wherein you would include the case number, attorney name, witness name, and other basic details.

Once the template is completed, you take the original along with a certain number of copies to the court clerk for filing. All the clerks would do is make sure that the case number on the subpoena corresponds to a case that actually exists in the system, and that the names of the plaintiff(s)/defendant(s) are accurate.

The clerks never asked me any questions about my role in the case (e.g., whether I was a party to the case, an attorney, or a staff member of the law firm representing a party), nor did they ever ask me to provide any sort of identification. I just give the clerk the papers, they look at the papers, they stamp the original and copies, and then they return the copies to me (which are to be served on the witness and/or opposing counsel).

I don't think there's a ton of value someone could get out of obtaining a fake subpoena (other than perhaps issuing your own self a subpoena as an excuse to get out of work, or maybe just to screw with someone), but it was always pretty astonishing to me that anyone off the street can just dump some papers in front of a court clerk and receive a legal order mandating someone's appearance in court--no questions asked.


> I don't think there's a ton of value someone could get out of obtaining a fake subpoena

A subpoena can also order the production of documents (in many cases including business records about other people, such as log files). That could be pretty consequential if the private information turned over was very sensitive.

When I was working at EFF I filed some comments on an international law enforcement cooperation plan where one thing that bothered me a lot was that, if you formalize the idea that jurisdiction A has to directly enforce orders/process/formal law enforcement requests from jurisdiction B, people in jurisdiction A will have even less idea how to authenticate them, and there will be even less likelihood of a remedy in case of a deliberately fraudulent request. The domestic status quo (as you point out) is typically pretty low authentication, but at least there's a likelihood of some significant punishment for people who commit fraud on a court (judges really dislike that). Now imagine if you could do this without even being in the country where you're committing the fraud! :-(


That's a good point.

I think, generally, a subpoena issued as a request for production of documents would likely be vetted by an attorney; however, I could see how a small business owner (for example) may be likely to accept an official-looking subpoena at face value and seek to comply out of fear without first consulting a lawyer.


> I don't think there's a ton of value someone could get out of obtaining a fake subpoena (other than perhaps issuing your own self a subpoena as an excuse to get out of work, or maybe just to screw with someone)

That would make a great plot for George on Seinfeld.


I'm so sorry Mistah Steinbrenner I can't come in tomorrow, you see I've actually been subpoenaed to testify at a trial.

What trial? Uh, well, it's over a case with, um, an Architect, Art Vandelay, who, um, was was contracted to, uh, redesign the Lincoln Tunnel with a system of magnets so the cars would all go through at the same speed, but, uh his idea, you see, was stolen by a Mr. Pennypacker, a wealthy industrialist.

It's really a case of the century. Um. So, I actually have to go now.

(Proceeds to go home and eat a block of cheese the size of a car battery.)


A similar process exists in Australia. It is a bit strange that the burden is on the recipient to object to an unlawful subpoena. I understand that it’s pretty common for vexatious litigants to issue subpoenas requiring politicians, governors and other public figures to attend court for cross-examination about a perceived injustice, and there is a bit of work involved in arranging for these to be set aside so that nobody ends up formally in contempt of court.


Subpoena power is a hell of a lot of leverage, and probably the biggest reason why all these terms-of-service agreements including binding arbitration. Like, if you can convince a small-claims court judge that it is relevant, it's definitely possible to subpoena high-level executives of multibillion dollar companies over a $100 dispute.


"I guess this brings up and interesting issue -- once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit."

This was a regular narrative from the days of phone phreaking and toll fraud, etc.

Just speaking the correct lingo of a lineman or an operator or a toll office supervisor could allow one to navigate through all the depths of the telephone system. Not just to receive services without charge, but to actually build and teardown circuits, set up test numbers (ANACs), conference calls, etc.

It's incredible to think that a few lines of Twiml, or a Twilio function, can create something like an ANAC which was a rare, valuable, and jealously guarded secret 30 years ago ...


Yes. Phone phreaking in the 90s involved a ton of learning the lingo and the ins and outs of the phone company. It was even weirder to go work there later on and found how much that paid off and earned trust with a lot of the older folks there.


It's actually not too different these days in some parts. Eg job interviews for programmers to a large part just test the lingo.


One could argue the internal barriers are unnecessary if "trust but verify" works. In this case, it worked; she was able to play the system until verification identified something was wrong, and now she gets to go to jail over it.

(Technical systems often need more stringent protections because "screw around and go to jail" isn't a threat that, say, Facebook can bring to bear).


The mistake here is messing with the legal system itself. Lots of scams and schemes can fly under the radar, but as soon as you start committing fraud against the court, you're done.

Just ask the con artists at Prenda Law how lying to federal judges went:

https://en.wikipedia.org/wiki/Prenda_Law

https://www.popehat.com/tag/prenda-law/


Unless you're sufficiently large. The RIAA, Tobacco industry, ExxonMobile, POTUS.


Did it really work, or was it due to a happenstance:

In November, Hillsborough County prosecutors became suspicious when they heard from a state forensic examiner, who had been scheduled to perform a competency evaluation on Landon.

The examiner saw a notice in Landon’s court file that prosecutors had dropped charges; the examiner wanted to know if the examination should go forward.

How would it have been detected if there were no loose ends like this out there or anyone who cared enough about the case to prompt a double-check?


> Indictments allege Landon also filed an order falsifying a decision of retired Superior Court Judge Gillian Abramson to waive filing fees in a lawsuit she brought against Hillsborough County. And she allegedly filed an order on behalf of a relative to halt guardianship proceedings involving Landon’s child.

The loose ends aren't separable from her desired outcomes. They're integral. You can't "tie up the loose ends" while committing these acts of fraud.

"Hold on, why'd this case drop off the docket", says the DA. "I didn't file this", says the lawyer. "My ruling is due next week", says the judge.

Any one of those would be noticed and questions asked of the court clerk. And they all end in the same place.


> How would it have been detected if there were no loose ends like this out there or anyone who cared enough about the case to prompt a double-check?

> "Hold on, why'd this case drop off the docket", says the DA. "I didn't file this", says the lawyer. "My ruling is due next week", says the judge.

That's someone caring enough. The loose ends are entirely separable when discussing hypotheticals.


If her court date were the last day before a holiday weekend nobody would have asked any questions.


How many times have people gotten away with something similar without every being discovered, though? It could be very many.


There's no such thing as a perfect crime.


Plenty of “good enough” crimes though.

No such thing as a perfect crime detection system either.


Indeed. I think most people know of very many things they and their friends and family would've been ticketed or arrested for if an officer had been present and interested. Running red lights, speeding, media piracy, unreported income from side jobs, broken regulations, sharing prescription drugs, etc.


"The secret of a great success for which you are at a loss to account is a crime that has never been found out, because it was properly executed."

-- Balzac

https://quoteinvestigator.com/2013/09/09/fortune-crime/


I transported Durian on the bus in Singapore about two years ago. I was not found out. (And even my confession here won't get me into trouble.)


I lived in Taiwan in the 1990s when the "chop" (印章) was still alive and well for individuals and institutions. I remember a bank fraud that revolved around a bank employee using a bar of soap to make a copy of the bank's seal to authorize transactions or transfers and used the money for stock market investments which he or she then intended to pay back. IIRC it came to light when the 1997 Asian financial crisis hit.


Just wear a hardhat and carry a clipboard.


I used to participate in a city-wide water pistol assassination tournament. Skipped the hard hat, got white coveralls from Home Depot, pinned my work id to it, carried a clipboard. Got in everywhere I needed to be, including a heliport and a private boat dock. I forget where I read it, but the phrase "just act like you're supposed to be there" has stuck with me a long time, and paid dividends.


as a teenager, i remember marveling at a friend who could successfully walk into bars and order drinks. you have to both look the part and play the part (i could do neither).

even at places that carded, they wanted to serve you, so the ID had to only provide enough plausible deniability to the bouncer or bartender to credibly claim they were duped into serving you. i'm sure some bartenders secretly got a kick out of the cat and mouse game.


In college there was a beer delivery service that would even deliver directly to the dorm if you gave that as your address. If you paid with your debit card over the phone, they wouldn't even card you since the beer was already bought and paid for.

One time they did check, and my friend lied and said he didn't have his ID with him. Then the delivery guy who was probably only a couple years older than us just asked to see his actual underage ID to prove he wasn't a cop and handed us the beer anyway.


> Then the delivery guy who was probably only a couple years older than us just asked to see his actual underage ID to prove he wasn't a cop and handed us the beer anyway.

The liquor enforcement folks (usually not cops, AFAIK) could easily hire someone under 21 to attempt to purchase alcohol. In fact, I'm pretty sure that in some places they do exactly this.


They do get underage folks to try to do either "shoulder tap" operations or direct purchases from vendors. I was asked to do this once as a teenager. I refused, but not before asking a lot of questions about what I'd be doing. I can't say much about the shoulder tap operations, however, I believe there's still a couple of tells for the direct purchase attempts based on the conversations I had:

1. To ensure safety, there will be an adult (undercover cop) nearby. (This could be around the corner, or someplace sneaky, but usually they just pose as another customer.) They probably will maintain pretty close proximity to their underage undercover though.

2. They probably won't give you a fake ID, because it makes it harder to get any sort of definitive enforcement to stick. They aren't trying to catch people that are easily tricked by fake ID's so much as they are trying to catch people that are either knowingly selling booze to underage people or not making any attempt to verify.

So if someone presents a fake ID, even one that's sorta but not totally obvious, that's unlikely to be a sting operation.

3. I believe they typically will actually present ID when asked. Again this helps get charges to stick.


A news article about shoulder tap operations performed by my local police department said:

Police spokesperson Sgt. Riley Harwood said that during such sting operations, the underage decoys are not made to look older with different clothes or make-up, and they’re not taught any strategies of deception. “There are no tricks,” he said, explaining if a decoy is asked for a driver’s license or ID, they hand over a valid card that shows they’re under 21 years old. “There’s no math that needs to be done,” Harwood said of the obvious differences between underage and over-21 IDs. “People just need to do their jobs.”


I worked as a cashier at a place that sold liquor and we would occasionally get decoys. It was usually the same young guy who would try to purchase a single beer, without saying a word.

If the cashier asked for his i.d., the guy would silently hand them card that said something like, "Congratulations, you did not fail the underage liquor sales test", and then leave.

After the 4th or 5th time of the same person trying the same purchase most of the employees learned who he was. I think law enforcement did eventually switch to a different decoy towards the end of my time at the job.


They do actually do this. County sherrif mass emails the county employees if they have any teenage children who wanna ride in a police car for a week once a year as the pitch.


Yeah, that seems like ensuring you get convicted if the guy was a cop. At least without checking his underage id you could claim you believed him.


They just want to fine the business. Arresting delivery drivers for not giving a crap about underage drinking is how you create libertarians and that's the last thing the local police department wants.


Not sure about that. Law enforcement officers are an interesting bunch with a diverse set of views.


>plausible deniability to the bouncer or bartender to credibly claim they were duped into serving you

The "serving alcohol to minors" laws are strict liability in some states, for this reason.


yes, that and making IDs much harder to fake credibly.


What city was this in? Is it in a place where other people have real guns? Is it in a place where the cops have guns?

I both want to play and suspect that it would go really really badly.


For the most part, water pistols look nothing like firearms. I very much doubt that you'd be in danger of being treated as an armed threat when holding a transparent, green, plastic gun that's leaking water.


I dunno. Phones, canes, sunglasses, sandwiches, just hands have been mistaken for guns, with deadly consequences. Perhaps someone doesn't see the object itself, but the way it is being held, or even just reached for.

Especially if the "assassination" attempt involved in the game requires getting into environments you shouldn't be, getting close to someone in an unusual way, I could see this ending in tears even if the water pistol was never visible.

http://www.caralevine.com/this-is-not-a-gun-1 https://static1.squarespace.com/static/53d691ede4b0326a80e05...


In NYC its a crime to brandish a toy gun that looks like a real one. That's why all the water pistols are florescent green and orange. It's also a crime to paint a real gun to look like a toy.


Being illegal in NYC is like being known to the state of California for causing birth defects and other reproductive harm. It doesn't actually tell you anything about the matter in question.


* assuming you're white


People have been shot for less


If someone already suspects you have a firearm they don't need evidence... they need an excuse. See https://en.wikipedia.org/wiki/Shooting_of_Trayvon_Martin


You are reading into this too much. This is a case of Dead Men Can't Speak. Rather than leave evidence of a crime, opportunity cost of murder is getting off scot-free. The media turned it into primetime theater, but it was never about race. It is about stand your ground and ultimately how the dead can't defend themselves in court.


This is true. The prosecutor should have observed that Stand Your Ground applied to Trayvon Martin who has reasonable belief that he was being pursued by someone intending to do him harm. Martin was not afforded equal protection under the law.


No. Martin is dead. The prosecutor could not bring any affirmative defense for Trayvon Martin because he was not there to argue Stand Your Ground. Hence the statement "dead men can't speak". The prosecutor could and did bring circumstantial evidence, but ultimately Zimmerman could claim stand your ground and successfully argue it.

Whatever else you are applying to the situation is entirely in your mind and does not apply to facts of the case.


yes, Martin is dead and was unable to assert his rights. It then fell to the prosecutor to do so in his stead and he neglected to perform that duty. This is how a grown man was able to pursue a teenager to his home in contravention of the orders from the 911 dispatcher and kill him in the resulting physical confrontation without legal consequences.


Soooo if you cannot assert your rights you cannot stand your ground. What happens when you have two people claiming stand your ground?

Dead men can’t speak. Stand your ground is an affirmative defense. Or in other words, when in Florida carry a big stick and don’t be afraid to use it.

Honest question, are you saying the prosecution should have ignored years of case law and argued on purely circumstantial evidence? (Because Martin’s girlfriend was a baaaaaaaad witness. Like beyond bad. Like I would have been ashamed to have her as my star witness. Why would the one person who could hear the struggle of the fight have an attitude, on the stand, towards the prosecutor fighting for her bf?!?!!)


> What happens when you have two people claiming stand your ground?

One of them initiated the violence or the reason for justified violence, and that person (the aggressor) is in the wrong, generally speaking.

> Dead men can’t speak. Stand your ground is an affirmative defense.

Its an affirmative defense to charges of assault, yes. This is why it applies to Martin even if everything Zimmerman said is true.

> Honest question, are you saying the prosecution should have ignored years of case law and argued on purely circumstantial evidence?

No, they should have relied on the facts not in dispute, which is that Zimmerman followed a person home, that person was unknown to him and had every right to be there, and Zimmerman acted contrary to the wishes of the 911 operator when he exited the safety of his vehicle to pursue a teenager down the path. For this reason, Martin's alleged reaction to attack Zimmerman was an act of self-defense by a cornered juvenile.

> Because Martin’s girlfriend was a baaaaaaaad witness. Like beyond bad. Like I would have been ashamed to have her as my star witness. Why would the one person who could hear the struggle of the fight have an attitude, on the stand, towards the prosecutor fighting for her bf?!?!!

Yes, she was a bad witness because she lacked the signs of class and education that would have made her likely to arise sympathy in the hearts of the audience. and Martin was a bad victim because he was a young, healthy, skinny black kid.

None of that changes the part where an adult male followed a kid home and provoked an assault.


Trayvon Martin assaulted Zimmerman before Zimmerman shot him. This event is not germane to the discussion. No one thought Martin had a gun.


Zimmerman was following him home and Martin had a reasonable belief that he was in danger. Zimmerman was told by the police over the phone to remain in his car and he left his car and pursued Martin as Martin was walking home in a place he had every right to be. Whatever legal protection Zimmerman enjoyed for for being there did not extend to violating the instructions of the police and following a teenager to his home.


Wow that sounds like a ton of fun, could you go into more detail about how that worked?


Brother in law put himself through college working as a plumber at night. Said after that he could go and wasn't afraid to go anywhere.


>I used to participate in a city-wide water pistol assassination tournament

TIL that that's a thing!


This is in that category of activities that I assume no longer exists in a post 9/11 America.


Yes, getting very large tanks of medical grade nitrous oxide for parties worked like that, for me.



Can confirm that this works in more places than you'd hope.


Good point--judicial orders contain no security features and are printed on ordinary paper. They long ago did away with the embossed seals, so now copying these are trivial and normally not needed unless a certified copy of the order is required. The article shows surprise at the defendant's cleverness in filing electronically. Not so--in many jurisdictions, electronic filing is mandatory. Pleadings filed by parties have no security features either. In some countries, pleadings have to be filed using special paper that is taxed. The paper has security features and the tax feature is a way both to obtain revenue and discourage prolixity. Now imagine that in the 3141 counties in the US, each with different protocols, it's a wonder this isn't more frequent. Oh and each of those counties has its own system for counting votes. Good luck, USA.


The adversarial system used in US courts assumes the other side will discover such frauds and bring them to the attention of the court.

I think the frauds that appear to be legal but do not actually involve courts are where more harm is. These are the scams asking people to pay fines or else.


And it does, of course, very frequently. The US Court system's problem is not a matter of discovering such frauds and wrongdoing, and in some fields it's almost impossible to get away with this sort of conduct, but overall, there's little avenues of redress. Civil litigation is obviously the biggest area and the best positioned to both catch and remedy the fraud. Some criminal proceedings have similar robust checks, but that is really only on one side - the defense's side. Prosecutors are immune and protections like Batson (racially motivated jury selections justified under pretextual justifications that later are found unreasonable) or Brady (prosecutors hiding evidence favorable to the defense or misrepresenting its existence at all) exist but there's not real accountability outside of personal shame and possibly getting a conviction vacated. Administrative courts are overwhwlemingly immigration courts where the nature of the proceedings ensure that the aggrieved party pretty much is ensured to be unavailable in the legal sense to challenge most of the cases.

There's a lot of fraud, waste,a abuse, or other chicanery in the courts and luckily in my experience they're never simply kept hidden without anyone noticing. The problem is always redressability. So much of the system requires discretionary rulings but the laws that dictate how we handle misconduct is heavily skewed in favor of the state if they ar a party and fails to take into account the urgency in resolving these cases that very often it becomes obvious that there's fraud, yes, but there's no redressability, and therefore there's no real punishment.

A particularly egregious case of falsifying evidence and using prtextual reasons to elicit false testimony and racially-based jury selections is the US v. Flowers case in the Supreme Court last term. There's a podcast on it, but the decision itself is... excoriating to say the least as to how far and how egregious the conduct was to try to execute an innocent man. It's discovered all right, but there's no punishment. So courts can and do definitely figure out fraud pretty readily, but when it comes to doing anything about it, victims not on the side of the state frequently find it cold comfort.


I agree with everything you say here.

At least in the State of WA, I think prosecutors have qualified immunity and can be sued or charged for Brady violations.

I think one of the biggest 'frauds' is the churn in the lower courts. It often seems like judges, clerks, public defenders, and prosecutors are pretending they are doing something helpful or important while the repeat defendants think of the whole situation as a joke.

I get a kick out of seeing judges sternly reprimanding attorneys or defendants for being 10 minutes late to the start of a cattle call hearing while they must know the entire enterprise is meaningless kabuki theater.


Sadly, in theory this is true but over the last 20 years there had been two - yes, TWO - cases where a prosecutor was prosecutoed for misconduct that materially prejudiced the outcome of the trial. Both required more than just Brady but also outright fraud. For all intents and purposes under the current system, it's very much a case of two egregious outliers covering the entire dataset in terms of prosecutions. I will believe it when I see it if intentional bad conduct will actually get challenged, and I'm not holding my breath. Power tends to self-perpetuate and this is simply the apotheosis of the unchecked exercise of power.

The two cases mentioned above: https://digitalcommons.pace.edu/ cgi/viewcontent.cgi?article=1635&context=lawfaculty


> once someone knows the ins and outs of a system, sometimes there are very few barriers internally to check that an order/paperwork is legit.

It sounds to me like they are using security-by-obscurity, as well as easily forgeable proofs such as "signatures" or drivers licenses (they're only as secure as your ability to spot a forgery). Hence why anyone who is knowledgable and determined enough, can easily crack the system.

If you want to prevent such problems, you could either go really old-school. Require the person filing documents to show up in person, and be personally identified and recognized by someone in-house. Or go really new-school and only accept biometrics or digital paperwork that has been filed using a secure account accessible only by that person.

Using an in-between approach, like a signed paperwork that has been given to you by someone you don't recognize, is the worst possible solution.


The usual way to fix these sorts of things is to ensure there are multiple independent barriers to fraud. 2 factor authorization is an example. Double entry bookkeeping is another. Independent audits is another. Separate checks for unusual activity is another.


The latter two explicitly acknowledge that spotting fraud is a probabilistic activity.


If it was certain, one wouldn't need multiple layers of security.


Yes, definitely. It's just that much of the discussion about controls and checks is often framed in the language of certainty.


The government of Japan is rapidly abolishing the hanko.

http://www.asahi.com/ajw/articles/13789927


Years ago I was working somewhere and instead of getting a supervisor to approve some minor thing we would just put in a supervisor id that was known to people. Eventually, we got caught because that person had quit working there a few years ago and someone saw her code being used to approve things.


It's surprising when people casually admit to dishonest behaviour as if it's no big deal.


Maybe it’s not a big deal, unless you value honesty above all else. I am not always honest, especially when it’s obvious to me that the other party will only use my goodwill to their advantage. In the case of the parent, I can imagine many scenarios where it is difficult or untimely to get supervisor approval, but failure or delay in doing so results in the employee catching all the heat for it.


There’s a long history of accident, negligence, and criminal reports from various industries that have, somewhere in their narrative, some version of ‘X and Y worked the night shift and while the documented procedure mandated that whenever they did A they must also do B, they had gotten into the habit of doing C instead’.

Not actually counting all the bolts after replacing the window on the plane; not checking in with the supervisor before administering that drug; not double checking that the name on the ID matches the name on the passenger list...

And signing something off with someone else’s supervisor code goes well beyond cutting corners on a process, though - that’s falsifying records. At that point you’re subverting the process.

Sure, some approval processes are BS, but... generally, any time you’re in a role where you need a supervisor to sign off on stuff, you do not know enough about what matters to your business to tell the difference between BS and critical safety or security guarantees.


Fair point, but the parent.parent says this was to "approve some minor thing" The risk is that the "minor thing" isn't so minor, especially when the bypassing of the review process becomes routine.

I suppose put it this way. Imagine a software developer slipped in smaller code changes and circumvented procedures like QA or code review because they though it was "just some minor thing" Would you find that OK?


Where I work, making code changes after an approved review is pretty normal. Particularly because we aren’t all awake at the same time (different time zones). It’s quite common to see “feel free to merge after fixing.” Otherwise it would take days to merge something.


Somehow I don't think a bunch of retail employees processing returns without the manager's approval is gonna be a big deal. The manager will see the returns regardless of whether they approve them on an individual basis.


Unfortunately the parent up there never mentioned the type of job or any other context to help us understand if dishonesty could be an issue in their actions. In my code example, definitely an issue. In DanBC's comment below RE: regulated professionals? Definitely an issue.

We all know there are bad or stupid rules out there. But honesty's not a rule, it's more of a moral principle. Gray areas for sure, but when dishonesty becomes a habit, or makes one lose trust, or actually breaks a rule meant to prevent an issue, it's a problem.


> unless you value honesty above all else.

.

> I am not always honest,

I work with regulated professionals. Honesty is a big deal. Dishonesty is seen as a fundamental personal flaw. Healthcare professionals who've been dishonest struggle to show remediation.

It's really weird to me that I need to explain that forging someone else's name on documents is a bad idea.


Now imagine that the name field is only relevant to your employer (so it's not like forging a signature on a real document), and that the same employer punishes you for working too slowly if you don't write someone else's name.


What is the probability that everyone you work with is 100% honest, vs them figuring out how to be dishonest (in a "for the grater good" kind of way, as the comment you originally commented on) without you (or anybody else) noticing?


Not the parent, and its probably close to 100% that someone there is dishonest, but lets put this in context: The police enforce laws against murder. What are the chances that a police officer has murdered someone? (100%). Does that mean our prohibition against murder is too strict?


I don't know too much about the red seal system, but it doesn't strike me as something that would be very difficult to forge. I model Japanese workers as being pretty meticulous, but it strains credulity to believe they are carefully authenticating such stamps. (How would you even?) I suspect that system is vulnerable to a similar attack to this one, it's just that the risks outweigh the benefits.

Which also goes for the situation we're discussing. I've never heard of an attack like this and I doubt it is frequently attempted or succeeds.


The Hacktober thing seemed to demonstrate this.

I apparently was involved with some project on github, got flooded with emails with read me changes.

It never ocured to me how available such things are.


A manual sanity check is ofent nice. Also it makes it easy to override stupid bugs.


System resilliance is valuable. But ossified systems are resilient, simply inert.


It's amusing that the reason this was caught was a human picked up the phone and said, hey, is this right?

She would have gotten away it, too, if it weren't for that meddling forensic examiner!


A RISKS Digest classic:

A prisoner was wrongly released after a fax was received from a grocery store stating that the Kentucky Supreme Court had demanded his release

http://catless.ncl.ac.uk/Risks/24/65#subj7.1

https://web.archive.org/web/20070426034707/http://www.cnn.co...

There are numerous examples in news reports.

"Who are you?" is the most expensive question in information technology. No matter how you get it wrong, you're fucked.



Thanks. I'm visiting the UK, and I'm astonished at how many sites are blocked.


They're not blocked, they're blocking themselves.


Yep, so far "We can't serve you for legal reasons AKA we won't comply with the reasonable provisions of data protection" has been met with a broad shrug.


What's anyone supposed to do about it? GDPR didn't exactly provide funding to help anyone get compliant and it's hard to argue that GDPR compliance is a priority for a struggling local media site. It's a bummer, but I think it was inevitable in the way the law is structured.


Doesn't take much money or effort to just not sell my data.


I have no reason to assume they are selling user data. I wish complying with GDPR were as simple as not selling user data.


> What's anyone supposed to do about it?

Show a basic level of respect for your users' privacy whether or not it's not a legal requirement.


Put your business at risk of total destruction unless a court believes that you show a basic level of respect, etc.


Is there evidence that they aren't besides not being confident about GDPR compliance? There's a lot more to GDPR than not selling data.


If you just aim to provide static content, i.e. public web pages and articles I think you’d really have to “go out of your way” to break GDPR (which in this case is likely tons of ad network code among other shady things).


Does your web server create logs that contain IP addresses (as most do by default)? Now you’re processing PII according to GDPR. Do you include any assets at all that are hosted by a third party who therefore have access to IP addresses? Do you have the necessary DPA with them plus your web host?

Do you have a compliant privacy policy, data retention policy, breach notification policy? Have you named a data privacy officer? Do you have a written process for erasure requests?

You’re probably right that the ads are a problem but ain’t nobody getting GDPR compliance for free.


GDPR compliance is no different from any other kind of compliance. If you're a big publication then you've got more than enough legal people walking around the office to make sure you aren't accidentally printing something that can be construed as libel, to ensure that you're paying your taxes correctly, to check new employee contracts, etc.

Besides, most websites need to update their privacy policy to be accessed in California anyway. The Californian privacy protection rules aren't as strict as the GDPR, but they are very similar. I don't really buy the "it's expensive to comply" argument a lot of American companies seem to use because of this.

The companies want to collect and trade your personal information to the highest bidder, the GDPR got in their way and now these companies are acting out.


Does the site also give that error if you are in California? To meet the requirements for CCPA, a news site (that isn't doing anything untoward) is most likely also going to be GDPR compliant.


For US-based news sites they might well only get a few European visitors. I only ever get this problem for trending stories like this.


If a US site does not have any presence in the EU and is not selling anything to the EU visitors, why would they even bother adding the blocking? They can... do nothing instead. (Or disable buying subscription to the EU)


Fear that it'll haunt them should they ever enter the EU, probably.


GDPR doesn't depend on whether you're selling something. Just visiting the website from the EU is enough to require the business to comply with the privacy laws.


It does depend on whether the law of the country applies for any reason though. Unless you're saying they should also comply with whatever CCP, Thailand, Iran, and many other countries have to say about allowed online content?


This is already the case. Yes, you have to comply with CCP laws for _China residents_ if you want to have your website available in China. It doesn't say you have to apply the laws to all people around the world. But GDPR vs. China isn't a perfect comparison, because GDPR isn't blocking any content. It is not even _about_ the content. It's about following the privacy rights that I as an EU resident have and you as an US company might be breaking.


China has the jurisdiction over the Chinese resident, their ISP and other local infrastructure. It doesn't have jurisdiction over foreign companies and foreign companies don't have to comply with anything. (Unless they want to do business with Chinese residents or operate in China) Same applies to the EU situation.

You may want to be nice to the foreign visitors otherwise and comply with the foreign laws, but that's it.


> Unless they (...) operate in China

Exactly. If you're operating in the EU, you are bound by the EU laws. But "operating" doesn't mean you have to sell something:

> The GDPR applies to US businesses, regardless of their size in terms of revenue or staff, if at least one of the following two conditions are met:

> 1. The company offers good or services (even in the absence of commercial transactions) to EU/EEA residents.

> 2. The company monitors the behavior of users inside the EU/EEA.

So yes, if the news website in this thread tracks me without my consent, they are violating my rights and the EU laws. I am not sure how realistic enforcing this law actually is, though, unless they have a EU branch (what you described as jurisdiction).

Source: https://termly.io/resources/articles/gdpr-in-the-us/


The website you linked brings up 2 out of 4 examples where the EU data is collected, the business is not aimed at the EU residents, and says (verbatim) "GDPR does not apply". Same reasons seem to apply to the context discussed here (news site aimed at the US region). Specifically:

> Although such a website would likely track the user behavior of EU/EEA citizens, as the website would attract native speakers of several European languages, the GDPR does not apply here because:

> the service does not target EU/EEA residents, and

> the tracked user behavior is not occurring within the EU/EEA.


Nice catch - I didn't expect the examples to somehow contradict the general statement from the same section. TIL.


They're still blocked, regardless of who is doing the blocking.


Thanks. Can't believe sites still do the 'we're unable to show you a page because ... GDPR'.


I love the ones that show a big notice like "Your country is very important to us....you're blocked".


"Our treatment of your private data is so bad, it's literally illegal in large swathes of the world" is what I read when I see one of those messages.


It makes you wonder how incompatible they are to GDPR when they find it better to block EU than fix the issues


The forensic details are lacking. Sure, it would be natural to suspect the person benefiting the most from the charges being dropped. However, do they have her personal home IP address shown accessing the system? Also, if the court system can be so easily manipulated, it might be time to take a look at that.


I give her 40% odds of beating the headline charges. Not a chance in hell she's walking away without at least a misdemeanor of some sort though.

On one hand:

It's not exactly a stretch to imagine her boyfriend doing it on her behalf or something similar. A middling defense lawyer should be able to create enough doubt (barring some unreported facts that are damning for the defense). If the government's processes are so broken that this could happen as they say it did then she deserves to walk free for giving them the free audit. If she's really such a bad person they'll catch her again for something else.

On the other hand:

Hillsboro county is the second worst jurisdiction in NH in which to be accused of committing a crime against the government (Cheshire county is hands down the best any day). It's going to be almost impossible for a jury to not have at least a few people who take the view "I don't care if she did it, there's a reasonable chance she did and someone must pay for this". This is assuming it goes to jury trail (only a moron would go for a bench trial when the crime is against "the system" though).


Can you expand on the part about various counties and what you mean? Just in case I ever decide to commit a crime round these parts.


> In several instances, she used the New Hampshire court system’s electronic system to file documents.

This suggests that there is either no authentication (insane), or any display of the authenticated sender is being ignored by people just looking at the claimed sender in the headings of papers (disappointing, a failure of the court processes at the human level, and probably a UX shortcoming.)


People have pulled the same trick to get themselves released from jail.

https://www.nbcnews.com/news/world/florida-killers-arent-fir...


Not that far off from the scene in Idiocracy.


When you kobayashi maru the legal system.


I gotta try that in my next interview....

For those of you who missed it: https://en.wikipedia.org/wiki/Junior_Salesman


The Kobayashi Maru is actually from Star Trek.

Original context:

The Kobayashi Maru refers to a no-win scenario given to the command-track students of Starfleet Academy. They aren't told it's a no-win situation, the goal is to make sure they can keep calm and see how they cope with the situation.

In the scenario, they're in command of a starship and have to rescue another ship, named the Kobayashi Maru, but in doing so they fall into a trap that results in both ships being destroyed and all crew killed.

TOS-era Captain Kirk was the first to win the no-win scenario. He did so by cheating: reprogramming the computer.


In that episode of The Office, Clark uses that Star Trek reference and his superior knowledge of the position he's applying to to get the job instead of Dwight's friends. I'm aware that it's from Star Trek (that's also mentioned in the episode), but I appreciate your detailed explanation!

Kobayashi Maru + the word "interview" makes it a double reference :)


this is the most hilarious thing i've seen on HN and your comment made me roflmao more


"Please tell us about the time you (...) most successfully hacked some (non-computer) system to your advantage"


With the improvements in speech recognition, NLP, speech generation, I wonder how long before we can quickly spin up a network of false personas simply to provide "witnesses" or verify false information, or even provide alibis.


A competent hacker could deep fake zoom hearings and communications and have the actual prosecution dismissing the case on video.


This depends on the actual prosecutor never attempting to participate in the case. Plus, I imagine that the penalty for getting caught defrauding a court is pretty steep.


So maybe you submit motion to dismiss request for a number of random cases. You become hidden among the others.


Difficult tradeoff because that multiplies the chances of detection.


I wonder how often this actually works.

Especially now with virtual systems. It’s a pretty amazing hack if you can pull it off.

And also, couldn’t be that hard to hide your tracks so it’s not clear if it was you or someone who supports you.

You could see this being done by activists or others.


amusingly enough, coming from the EU the site told me: "451: Unavailable due to legal reasons"


451 is a great status code, right up there with 418.


It is a reference to the book/movie Fahrenheit 451 [1].

[1] https://en.wikipedia.org/wiki/Fahrenheit_451_(disambiguation...


My favourite part of GDPR is getting to use 451 legitimately everywhere.


I'm not sure it is really though is it?

It's legitimate in the same way that '451: we want to load up our site with so much javascript your computer catches fire and burns your house down, but that's illegal in your jurisdiction so this site is Unavailable for Legal Reasons' is.

To me 451 is like 404 (nothing here) and 410 (was something here but now there isn't) - it's a further progression/specificity to 'was/sort of is something here but it's not presently available for legal reasons'.

Common obvious one is DMCA takedown notices, but it might also be an injunction, or even accidentally published while still under embargo - or deliberately to prime SEO (not advice) - or NDA, etc.


It’s a Carol business decision that letting Alices & Bobs view content for free isn’t cost effective if Carol isn’t allowed to track Alice and Bob without their permission and make money by letting Eve, who is unknown Alice and Bob, to build up a detailed profile of Alice and Bob.

Project Guttenberg in Germany (and The Pirate Bay in the USA, I think) would be 451.


Why is Project Gutenberg illegal in Germany?


Court order regarding blocking specific books, the project itself isn’t a problem: https://cand.pglaf.org/germany/index.html


I don't know. "Our site is so hostile to user privacy that it's illegal in some places" isn't exactly something I'd be proud of. Nor is, "We might be in violation of GDPR and we might not--we have no idea so we're going to just block you."


> Nor is, "We might be in violation of GDPR and we might not--we have no idea so we're going to just block you."

It’s not something to be proud of, but it is something I am sympathetic about. Modern laws (not just GDPR) are long and the language is often hard to understand.

I believe that laws must be simple enough to comprehend, or else they will not be comprehended and thus will be violated even by people who want to follow them — the phrase would be better if it was “ignorance of the law cannot be an excuse”, because that works both ways.


Even if you never actually did anything wrong, demonstrating compliance with GDPR delays releases and adds costs that never end.


451 F = the temperature at which fire burns


It's the ignition temperature for paper. Fire burns at different temperatures depending on the fuel source, even paper will each a much hotter temperature after ignition.


<pedant>

It's an approximate and somewhat mythical value, popularised by Ray Bradbury's novel. Actual ignition point varies bu 100+ °F. Experience this past year with sourdough baking --- on parchment paper at 290°C (550°F) --- shows that though the paper browns, it does not combust. (Possibly affected by thermal mass / moisture of bread loaf.)

https://slate.com/technology/2012/06/ray-bradbury-death-does...

</pedant>


Not better than 420. You could say that 420 is the highest of all status codes


It's just bulk distributed townnews dot com generated content. Search the name "Lisa Landon" to find the verbatim story in dozens of tabloid rags. Some of them are east of the Atlantic.


I thought it was suspicious that the Useless Leader managed to publish an interesting piece.


Good to know that their business model is illegal in 27 countries.


GDPR requires far more than a compatible business model.

In practice, you need a consultant and maybe a lawyer to help with the paperwork and that's assuming all the processes are basically in compliance.




Interestingly, I get this from my US corporate VPN as well


Even if any tracking your site does already fully complies with GDPR as does your handling of personal data, it still takes some effort and costs some money if GDPR actually applies to your site.

If you are not in Europe, the main thing that determines whether or not GDPR applies to your site is Article 3 of the GDPR, "Territorial Scope", and the corresponding Recitals.

A big factor there is whether you are offering goods or services in the Union, irrespective of whether or not users have to pay. Mere accessibility from the Union isn't enough to show you are offering things in the Union. What matters is whether or not the site "envisages offering services to data subjects in one or more Member States in the Union".

There are several things that can show you are envisaging offering in the Union. Having localized versions of your site in languages that are used in the Union but not in your own country, accepting payment in Euros or the national currencies of Union members, targeting Europeans with ads for your site, and many others.

If you aren't doing those things, it gets more subjective. If your site should be of no interest to Europeans, and you don't expect to make any money from whatever Europeans happen to somehow end up on it, it is simplest to do a geoip block on Europe. That should conclusively establish that you do not envisage offering services to people in the Union.


It's not only offering goods and services but also "monitoring of behaviour" so analytics and tracking, which, strictly speaking, makes the GDPR applicable to most websites on this planet.

In practice, if you don't have high visibility (i.e are small enough, which probably means 90% of websites) and don't have any presence in the EU then just ignore GDPR because no-one is going to go after a website on another continent because it tracks visitors and sometimes people from the EU visit it.


[flagged]


Well, if the prices are

1. the legal tools to make Spotify not lockin ones personal content and 2. Read some random article on the internet where the publisher actively does not want to protect the readers privacy

then I think I know what price I want.


I really don’t. You’re telling me some music app is more important than being able to access local news from other regions?


Actually, no. Try to reread the comment.


A vpn is always an option, and it's commoditized enough. Eventually all regions that pretend to care about their citizens freedom should adopt a GDPR like law.


> Eventually all regions that pretend to care about their citizens freedom should adopt a GDPR like law.

But unless they all adopt the same one, the requirements will all be different, which means they'd each have independent compliance costs, which means local news providers like this will still block everybody outside of their own jurisdiction so that they only have to pay one set of compliance costs instead of sixteen or a hundred.


Exactly. Attempting to regulate the internet will always end in failure, as we've seen again and again. The EU's initiatives are very noble but I think: as they try to keep enforcing their laws and fines, they're just going to end up with less content being available to people in their jurisdiction. You thought copyright region-restrictions were bad.. just wait until Spotify refuses to serve your continent because compliance is costing more than the profits you generate.


If spotify stops taking my money I and millions others will go buy music somewhere else. Spotify is not exactly popular with non-superstar musicians either.


Like where? It's not exactly a bustling market -- Google is dead since they killed Play Music and tried to force everyone to YT, Apple Music pretty much only appeals to Apple users, and all the other alternatives have relatively small catalogs.

I'm not trying to be combative, I'm legitimately asking: what alternatives to Spotify are there?


The premise was that Spotify would decide it wasn't worth the bother to service the EU (or another market) due to GDPR (or a similar law). In that event, I have no doubt that an alternative or two would emerge.


There are lots of regulations governing all the stuff you use and consume. They are different between regions but often regions band together and synchronize their regulations.

It's really not a big deal and yes if the tradeoff is that forcing the web monopolies into consumer friendly behaviour means that some tiny services are region limited (in name, not necessarily in practice due to vpns) then it's a net good.


> They are different between regions but often regions band together and synchronize their regulations.

This is, as a general rule, catastrophically worse. Because then the only parties with input into the rules are the largest organizations who can successfully lobby an inter-governmental body and they (unintentionally or on purpose) promote rules that work for the largest organizations and annihilate smaller ones.

It also tends to make the rules much more complicated, because each of the individual jurisdictions have their pet issues they want to graft onto the unified system, so now instead of having some obscure and poorly conceived rule only applying in Russia or Egypt, it ends up on page 641 of the unified rules.

Compare this to some kind of rational system where the rules that apply are those of the jurisdiction where the server is located and then if you don't like the rules in Iran or California, you use the services hosted somewhere else. And the services that really are targeted at your jurisdiction end up locally-hosted anyway for the efficiency advantage unless your jurisdictions rules are so oppressive that they overcome it, in which case "Chinese dissidents use servers in the US or South Korea" is a valuable release valve.

And if you're fine with people using a VPN to use services that don't comply with their own jurisdiction's rules anyway, you should be fine with that. Because the only difference is to deprive the majority of their agency if they can't figure out how to work a VPN.


> where the publisher actively does not want to protect the readers privacy

You don't know that. They may take privacy very seriously, but don't see any point in risking possible GDPR issues, especially if they get no income from people in Europe.


GDPR FTW


For local news organizations who don't get any revenue from foreign viewers, it's much cheaper (and more profitable) to just block Europeans than to try and comply with GDPR.


this isn't correct, and i wish it would stop being repeated on HN. if you don't target/do business with Europeans specifically, there is nothing to comply with. what jurisdiction does Europe have?

however, a lot of "small", local news organisations are actually owned by huge (multi-national) corporations. they might work hard to preserve that small appearance, but do have a reason to fear the GDPR.


> if you don't target/do business with Europeans specifically, there is nothing to comply with. what jurisdiction does Europe have?

Because as you said yourself, they're part of a large organization that DOES do business with Europe, but that part of the business doesn't get any money from Europe, so there is no reason for that part of the business to go to the effort of complying.


sure, if they do business with Europe, they should be complying with the laws. i don't think that's controversial.

you said "local news organizations", and i was simply pointing out if that is what they truly were, they wouldn't have to comply. so i think we agree?


What does "doing business" mean here? I've read Recital 23 and at best it is vague and seems up to the discretion of the various member states.

It would be a great service to everyone if the EU could clarify which type of sites do not have to comply. Otherwise, you can hardly blame organizations that it would be cheaper to block EU traffic than even just to pay a lawyer to try to figure out of GDPR is applicable.


It is vague; I believe this is an issue of trying to apply a US law perspective to Europe (common law vs civil law). The main problem with letter of the law interpretations is they go out of date quickly, and there might be significant loop holes - so they didn't do that. Do you think it's possible to come up with a definitive list of "type of sites" that don't have to comply? Might be tricky.

And I definitely don't blame organisations blocking EU traffic; it's at least an honest admission they won't protect your privacy. (Although it may not be a decision of the site itself, I'll get to that in a second.)

Recital 23 is spot on though. Can a New Hampshire-based local news site be said to offer goods or services to members of the Union? It sure sounds like you could say "no" in good faith (which is a defence, IANAL etc).

Can the same be said for either a huge multi-national, or trackers and ad-flinging networks a local site might use? Probably not...


Even for a truly local news org, it might make more sense to just block Europeans then allow them, because Article 3(2) of the GDPR, which gives the EU extraterritorial powers to prosecute.

While it's never been tested, there is a good chance the USA would cooperate with an extraterritorial prosecution, and so it's easier to just avoid it altogether by blocking Europeans.


GDPR also apply to websites that process personal data to "monitor behaviour" irrespective of whether they target or do business with EU residents as long as the person being monitored is within the EU. So your claim is also incorrect...


They might use an ad network that automatically provides geo-targeted ads to Europeans. I'm not sure if that would qualify at targeting/doing business with Europeans under the GDPR, but it wouldn't surprise me.


The GDPR does not prohibit showing an ad to someone on the sole basis that they live in a particular country.


They should give her time off for creativity and perhaps some money for college, but I suspect they will not have a sense of humor about this.


Wow, now that's an odd thing to see on HN: Non-tech local news from the small town you grew up in. And an article in the "Union Liar" no less! One of only a dozen times on HN.


That smirk on her face seems well deserved, even in what might be a mugshot


That is the smirk of someone that is just getting started.


She looks like John Belushi doing a Saturday Night Live sketch


Good effort. I wonder if she would have been able to ascertain whether the evaluation was scheduled and in doing it over could have covered that base proactively, or if there was no way of her knowing about that angle (even in doing it over again, no way she could have known about that in order to address it). In other words, was this defeated because of an oversight on her part, or was this an unknown unknown for her.


She could forge a letter from the prosecutor saying that there was no need for an exam because the case was nolle prossed. The problem is when the forensic examiner sends in a bill, unless they are on a retainer and don't have to submit timesheets.

One issue not addressed is scale. Law doesn't scale. A prosecutor with more than 500 cases will have difficulty staying on top of them all; if you had to deal with Google or Twitter numbers (tens or hundreds of thousands) you wouldn't notice if a case disappeared off your docket.


My brother is a Public Defender. He tells me that this wouldn't work in California because it requires a court appearance here.


451: Unavailable due to legal reasons

Does it work for anyone?



So in a case like this, can the filing be reversed or did she get away with her prior charges?


Off topic. This website blocks me as I try to access from Germany, because they don’t want to comply with the GDPR. To me this equal as saying that, as a website, you don’t care about my privacy at all, and therefore disqualifies you in all regards. No matter what you’ll write and say, you’re running a website that has no clue or does not care about protecting user privacy.


Can’t find a reference online, but in 1993/1994 a Russian fabricated paperwork to place him in charge of a newly formed Ministry. He was about to have a building assigned in Moscow and he got caught.


The legal system should really have a bug bounty program...


Illegality aside, this is quite impressive! and creative!


Mirror for people in Europe (451: Unavailable due to legal reasons).

https://outline.com/3jtrdR

Side note : why are some sites still not GDPR complient ?


Here one which does not require JS [1]

[1] https://archive.is/YR1YO


Who knew it was that easy? I wonder if her new charges are worse than her previous charges.


But can she do it again?


This was amazingly well thought out for a meth head.

Points for effort.


It amazes me that two and half years after the introduction of GDPR, sites like this still block EU residents.


Incentives matter - if there is no profit from it and they are outside their domain anyway why would they waste any time on the IT project alone? Let alone the business model changes causing at least short term negative profits (even if better behavior could help user base growth).

Apparently empathy of all things is useful to soldiers ironically because being able to understand how others would react to movements and attacks gives a big edge in predicting them. You don't have to sympathize with the targets but it can help prevent being caught off guard by incorrect assumptions. In law knowing how the subjects would react helps predict and mitigate perverse incentives and loopholes or lure them into doing what you really wanted in the first place.


I don't think the goal was ever to avoid sites blocking the EU. The bill was clearly aimed at not contributing to bad practices with the EU GDP, what it isn't.

Besides, the news can be found elsewhere (all news can nowadays), and the GP isn't much worse (I dunno, maybe even better off?) because of that blocking. At the same time we are here indirectly discussing tracking, and this is not the only thread about it.


451: Unavailable due to legal reasons


Incredible.


clever girl


With smarts like that she could make something of herself, rather than go down the path of criminality.

Edited for typos.


Not necessarily.

For one, it probably doesn't take much smarts to fill out the paperwork or trick the system. The system is full of people who don't know their job and have no real incentive to (can be difficult to fire government employees).

For example, I am involved with a case in which a state trooper made 4 or 5 mistakes, including mis-citing a statute so badly that the court system shows it as invalid and he lacked probable cause to write the citation under the statute that he tried to cite, and thus we were subjected to unjust restrictions for weeks. The trooper even lied to the judge. I filed a complaint and the subsequent investigation confirmed his mistakes, yet he still has a job... after lying to a judge in court to cover up his mistakes... Did I mention that the judge in the case was replaced because he was arrested on multiple charges (gambling with campaign funds, perjury, etc). The courthouse will not give us replies to many of our requests, such as our petition under the pertainate judicial rule to dismiss the case. They can't even issue a correctly formed subpoena duces tecum.

So yeah, I feel disillusioned with the effectiveness and legitimacy of the system. Our lives are ruled by morons. I'm considering contacting a civil rights lawyer so this stuff doesn't happen to others in the future.

Second, intelligence is often the most overstated component to success according to many studies on the topic.


A traffic case? De minimus non curat lex. If it was a murder case, they would correct the trooper's errors. It's easy to fix typographic errors in indictments.


It's a non-traffic summary offense. These are more than typographical errors (did you read the above?). Willful concealment of exculpatory evidence (his lie to cover his mistakes) is a civil rights violation, depriving the accused of a fair trial as prescribed under Brady vs Maryland. This is not de minimus as it should fit the definition of official oppression or malicious prosecution, much greater issues than the summary offense citation. So if you give a free pass on misdemeanor offenses of the trooper as de minimus, then surely the summary offense should be dismissed?

Not to mention that it does not matter what the severity of the offense is. The same protections of the law and adherence to rule of law is necessary at all levels to ensure the integrity of the system and the protection of the people's rights. If you contend that a traffic violation doesn't merit the same attention and protections by the system, then I would contend that the traffic violation would be a de minimus infraction and doesn't merit any attention at all - better a legitimate outcome that some half-ass fuckery that violates the rights of the citizenry.


There is also an issue of "specialities" and overlap of skills involved. Being good enough at forging and placing court documents doesn't necessarily translate to something with legitimate demand.


Judging from the outside is always easy.


Prime r/madlads material.



She should now sweep in to save herself as her own defense attorney, then become the court reporter to ensure the correct story is told, finally accepting the plea for all charges to be dropped while impersonating her judge.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: