Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Story:

Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the past (only noise complaints though) because he is in a band, and plays in his garage; however, it was not me who broke the glass on the van. As soon as he came home, he immediately marched across the street to me while I was exercising in my garage. Upon arrival he raises his voice, and presumptuously threatens to call the cops even though he had no idea who did it in the first place. I, being responsible, told him I did not do it, and will show him video evidence (I have a camera mounted above my garage). Since my camera covers nearly five houses, it can clearly see his house. So as I'm returning from the house with the USB at hand, a cop is walking towards me from his house, and my neighbor was pointing at me. Without any hesitation I told the cop I may have video evidence of who did it. He was interested in the footage, so without thinking twice he plugged it straight into his laptop (running windows XP), and there wasn't anything on it useful (the light just so happened to be at the right spot and the right time). So he simply returned the flash drive to me, and told my neighbor that he couldn't do anything about, regarding the evidence. The day ended there.

Conclusion:

Nonetheless last night I sat up thinking about what had happened, and the fact he hates me. It didn't strike my attention, however, that the cop plugged the device into his laptop in his cop car, the one he uses on-duty. I just thought to myself... could this have been all a setup, and could have sensitive data been compromised?

Questions:

  1. Should an officer directly plug an "outside" USB device directly into their on-duty laptops?

  2. If this is an issue, what security concerns does it raise, and what damage could this have caused?

  3. Do most police officers receive training to prevent Social Engineering?

Also, sorry for the verbose story, but it helps to undertsand whats going on. I'm a student in Computer Science, but know only the basics of security (for programming). With this being a real life story that happened yesterday, I'd really like to understand the risk this may have produced for others.

share|improve this question
    
It'd be useful wrt. training to indicate your country of residence. It might vary wildly. I've never heard of IT security training in France/the UK but I'm not a cop so what should I know? :) –  Steve DL Jul 14 at 9:43
    
In my experience cops are generally clueless when it comes to security. A few years ago I worked in IT, and occasionally had to prepare data for the police. Sometimes they would supply us with a USB HDD to copy data on to, and they were invariably infected with all sorts of nasty malware that indicated the cop's computer must also have been infected. –  MoJo Jul 14 at 9:53
    
Depending on the laptop configuration, plugging in a USB device may have limited risk. In this case there is clearly a benefit to plugging it in - potentially, he could have solved a crime. –  paj28 Jul 14 at 13:01

1 Answer 1

up vote 5 down vote accepted

While it is within the realm of possibility that it was some sort of setup it is extremely unlikely, it's much more likely to be exactly as it appears to be. You offered to show the officer something which could help with an investigation, and he took you up on it. Your neighbor would have little to gain from trying to game the officer. As per your questions:

  • Should an officer directly plug an outside USB device? NO! There's no telling what malware is on a USB stick with the potential to expose confidential information. He should have taken it and given it to a tech to open in some sort of sandbox environment
  • There are 2 security concerns here. One is that the officer's computer could have been compromised, giving access to police records and databases. The other concern is you could have picked up malware that was on the officer's machine. That would enable criminals to access your data.
  • Do police officers receive training to prevent Social Engineering? Yes, extensive. Think about their job - a police officer will have daily contact with many people who have an interest engineering the police. Perps are desperate to get the police to think it wasn't them, and some people try to use the police as a tool by accusing others of crimes they may not have committed. Most police officers quickly develop a sensitivity to manipulation, and learn to not trust people's motives. As for whether they have specific training about IT it depends where it is, some PDs have training and some don't

As for what's the actual risk it's probably very low. It doesn't like anyone has much to gain in this situation.

As an aside, it may be best checking your local laws for camera surveillance, in many places across the world it's illegal to have a camera without either a permit or some sort of posted notice. You don't want to expose yourself, even if it seems harmless, or even helpful.

share|improve this answer
1  
Last paragraph in particular is interesting, not so much as far as your own garage is concerned (that's non-public, private ground, and arguably even allowed in countries with strict surveillance laws) but the other 5 houses covered and the public street between them. Which is very clearly not non-public, private property (or, someone else's private property, e.g. the mean neighbour's). –  Damon Jul 14 at 14:37
    
The one thing I'd suggest adding is that the initial "did the camera see anything useful" check could have been performed on your laptop without having to go through the time involved in taking it to the station, having an IT person make sure it's clean, and then returning it to you. –  Dan Neely Jul 14 at 15:07
    
@Damon, that's exactly the point I was trying to make, good point. –  GdD Jul 14 at 15:28
    
@DanNeely, that's very true, the only issue is that then you are inviting the police to subpoena your laptop if there is anything there. Better to use a cheapo USB stick you don't mind losing. –  GdD Jul 14 at 15:43
    
I was thinking in terms of plugging it into your laptop not having the only copy there. Also, unless your camera software only used the USB drive for storage, whatever computer you stored the data on would potentially be of interest to them even if you initially showed a copy on a USB drive. –  Dan Neely Jul 14 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.