This is kind of a social engineering question -- my local law enforcement agency sent out this email today:
Help us by keeping identifying information about your valuables safe and accessible – Use ReportIt - it’s web-based and FREE.
In just minutes, you can help the Police Department and other Law Enforcement Agencies in the battle to recover and return stolen property to the rightful owners!
As part of our ongoing public safety partnership, we are recommending a tool that you, our community, can use to help us stop and solve crime…and it’s FREE!
Through the website www.reportit.leadsonline.com, community members can safely and securely store important information to identify and recover lost or stolen property. You can store descriptions, photos, and other identifying information for up to 100 valuables through Reportit – for FREE. Leadsonline is a property recovery system used by us and other Law Enforcement agencies to help identify and recover stolen property sold to second-hand dealers. However, recovery of stolen items is only possible when victims of crime can provide the police with specific identifying information about their stolen property.
Because the system is web-based, ReportIt accounts and their information can be accessed by any computer. Log in through the web from anywhere with internet access and retrieve critical information that Law Enforcement can use through the Automated Property System
I've removed local identifying information, but it was sent from the police department online alert system, so I trust that it's really from them, other police departments also recommend the system. If it didn't come from the police department, I would have assumed it was a social engineering attack.
Encouraging citizens to hand over a list of valuables to a third party seems like an exceptionally bad idea since the unending news of data breaches makes it clear that if there's valuable information to be had, it won't remain out of reach of hackers for long. (
Perhaps making it worse is that the URL in their email for www.reportit.leadsonline.com results in an SSL warning because their *.leadsoline.com wildcard cert doesn't include that URL, so the PD is training users to ignore certificate warnings when they give out personal data.
My question is, is this serious enough for me to mention to my police department that it's a bad idea (not that they'll listen to me), or is it not really a big deal?