Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Accurint is a big one. The people selling SSN lookups have big DB collections, but the primary source tends be realtime access to DBs like these.

I'd imagine it's trivial to pretend to be a cop and just purchase access to this stuff, not that it's going to be hard to hack most police departments either.



Having looked at getting Accurint and Clear back in 2013, I can tell you the process is not trivial but not comforting either.

On the non-trivial side: I was doing a startup where we sublet from a law firm. We had an on-site audit by someone who came in and we were cautioned that we had to have an independently locking door on our office. We also had to give a reasonably thorough explanation of what we wanted to do with the data and certify, as well as convince the auditor, that we would be using it for GLBA (anti-fraud in financial transactions) purposes.

We actually failed one of the audits the first time because some paperwork wasn't in place (I think we had changed the Delaware company name and not re-filed something, like our local jurisdiction foreign corporate registration, in the new name).

On the not comforting side: the sales reps for these products have full access and will let you do lookups and surf through on whatever. 100% unmasked details on any numbers you want. DMV, aircraft, SSN, judgments, etc., all linked and at the ready.

Also, GLBA is a giant Sherman-tank sized loophole that means that essentially anybody can fully legally use these databases as long as there's some cognizable financial transaction that you're protecting from fraud (even proactively / research wise).

See https://risk.nexis.com/AMLSolutions/help/GLBA_Permissible_Us...

So no, you can't just "pretend to be a cop" but if you actually go to the trouble of being some sort of fraud-prevention business, you can just go wild.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: