Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is kind of a social engineering question -- my local law enforcement agency sent out this email today:

Help us by keeping identifying information about your valuables safe and accessible – Use ReportIt - it’s web-based and FREE.

In just minutes, you can help the Police Department and other Law Enforcement Agencies in the battle to recover and return stolen property to the rightful owners!

As part of our ongoing public safety partnership, we are recommending a tool that you, our community, can use to help us stop and solve crime…and it’s FREE!

Through the website www.reportit.leadsonline.com, community members can safely and securely store important information to identify and recover lost or stolen property. You can store descriptions, photos, and other identifying information for up to 100 valuables through Reportit – for FREE. Leadsonline is a property recovery system used by us and other Law Enforcement agencies to help identify and recover stolen property sold to second-hand dealers. However, recovery of stolen items is only possible when victims of crime can provide the police with specific identifying information about their stolen property.

Because the system is web-based, ReportIt accounts and their information can be accessed by any computer. Log in through the web from anywhere with internet access and retrieve critical information that Law Enforcement can use through the Automated Property System

I've removed local identifying information, but it was sent from the police department online alert system, so I trust that it's really from them, other police departments also recommend the system. If it didn't come from the police department, I would have assumed it was a social engineering attack.

Encouraging citizens to hand over a list of valuables to a third party seems like an exceptionally bad idea since the unending news of data breaches makes it clear that if there's valuable information to be had, it won't remain out of reach of hackers for long. (

Perhaps making it worse is that the URL in their email for www.reportit.leadsonline.com results in an SSL warning because their *.leadsoline.com wildcard cert doesn't include that URL, so the PD is training users to ignore certificate warnings when they give out personal data.

My question is, is this serious enough for me to mention to my police department that it's a bad idea (not that they'll listen to me), or is it not really a big deal?

share|improve this question
1  
Police departments should have a system like this of their own and not direct people to a company that is not held responsible in the same way that they are. –  Dan D. Jan 28 at 21:06
    
This is a bit of a subjective question, but here's a worst-case scenario: the data on the server is poorly encrypted and the hackers get it all. They now know where a lot of people's valuables used to be. Whoop dee doo. –  KnightOfNi Jan 30 at 22:39

1 Answer 1

You should most certainly warn your police department this is a bad idea. We are a facility in Florida who is being told by our law enforcement that we MUST report all our customers sensitive information (including ID, fingerprint, address, phone, and more) to this company. As constitutionalists we've been researching a legal leg to stand on against this requirement. The fact that their certificates are provoking warnings is all the more reason to be concerned.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.