A Police App Exposed Secret Details About Raids and Suspects

guest · Jan 15, 2023

SweepWizard left sensitive information about hundreds of police operations publicly accessible
By Dhruv Mehrotra @dmehro - January 11, 2023

Last September, law enforcement agents from five counties in Southern California coordinated an operation to investigate, raid, and arrest more than 600 suspected sex offenders. The mission, Operation Protect the Innocent, was one of the largest such raids in years, involving over 64 agencies. According to the Los Angeles Police Department, it was coordinated using a free trial of an app called SweepWizard.

The raid was hailed as a success by Chief Michael Moore of the LAPD at a press conference the following week. But there was a problem: Unbeknownst to police, SweepWizard had been leaking a trove of confidential details about the operation to the open internet.
Click to expand...

The data, which the LAPD and partners in the regional Internet Crimes Against Children (ICAC) Task Force uploaded to SweepWizard, included private information about the suspects as well as sensitive details that, in the wrong hands, could tip off suspects as to when they were going to be raided and cast suspicion on people who had not yet been convicted of any crime.

The exposed data contained the location and names of 5,770 suspects, mostly located in California. In some instances, the data included their height, weight, and eye color and indicated whether they were experiencing homelessness. For more than 1,000 of these suspects, SweepWizard also exposed their Social Security numbers.
Click to expand...

After verifying the data exposure, WIRED notified ODIN Intelligence, which quickly took down the app and began an investigation. After declining an interview, Erik McCauley, the CEO and founder of the company, said in a statement, “ODIN Intelligence Inc. takes security very seriously. We have and are thoroughly investigating these claims.”

WIRED received a tip that there was a flaw in SweepWizard’s application programming interface, or API, that allowed anyone with a specific URL to retrieve confidential law enforcement data from the app.
The data could be viewed in any web browser simply by visiting a SweepWizard URL.
Click to expand...

ODIN Intelligence advertises itself as a company that develops high-tech solutions for law enforcement that “enable our communities to be safer, better informed, more organized, and crime free.”
Click to expand...

guest · Jan 15, 2023

ODIN Intelligence website is defaced as hackers claim breach
By Zack Whittaker @zackwhittaker - January 15, 2023

The website for ODIN Intelligence, a company that provides technology and tools for law enforcement and police departments, was defaced on Sunday.
Click to expand...

The apparent hack comes days after Wired reported that an app developed by the company, SweepWizard, which allows police to manage and coordinate multi-agency raids, had a significant security vulnerability that exposed personal information of police suspects and sensitive details of upcoming police operations to the open web.

ODIN provides apps, like SweepWizard and other technologies, to law enforcement departments. It also provides a service called SONAR, or the Sex Offender Notification and Registration system, used by state and local law enforcement to remotely manage registered sex offenders.
Click to expand...

It’s not clear who defaced ODIN’s website or how the intruders broke in, but a message left behind quoted ODIN founder and chief executive Erik McCauley, who largely dismissed Wired’s recent reporting that found the SweepWizard app was insecure and spilling data.

“And so, we decided to hack them,” the message left on ODIN’s website said.
The text of the defacement is ambiguous as to whether the hackers exfiltrated data from ODIN’s systems or if, as it claims, “all data and backups have been shredded,” suggesting that there may have been an attempt to erase the company’s stores of data.
Click to expand...

The defacement also included a set of Amazon Web Services keys, apparently belonging to ODIN. TechCrunch could not immediately confirm that the keys belong to ODIN, but the keys apparently correspond with an instance on AWS’ GovCloud, which houses more sensitive police and law enforcement data.
Click to expand...

guest · Jan 23, 2023

A hack at ODIN Intelligence exposes a huge trove of police raid files
Leaked files reveal tactical plans for police raids, surveillance, and facial recognition
By Zack Whittaker @zackwhittaker - January 21, 2023

Detailed tactical plans for imminent police raids, confidential police reports with descriptions of alleged crimes and suspects, and a forensic extraction report detailing the contents of a suspect’s phone. These are some of the files in a huge cache of data taken from the internal servers of ODIN Intelligence, a tech company that provides apps and services to police departments, following a hack and defacement of its website over the weekend.
Click to expand...

The breach not only exposes vast amounts of ODIN’s own internal data but also gigabytes of confidential law enforcement data uploaded by ODIN’s police department customers. The breach raises questions about ODIN’s cybersecurity but also the security and privacy of the thousands of people — including victims of crime and suspects not charged with any offense — whose personal information was exposed.

The cache of hacked ODIN data was provided to DDoSecrets, a nonprofit transparency collective that indexes leaked datasets in the public interest, such as caches from police departments, government agencies, law firms and militia groups. DDoSecrets co-founder Emma Best told TechCrunch that the collective has limited the distribution of the cache to journalists and researchers given the vast amount of personally identifiable data in the ODIN cache.
Click to expand...

TechCrunch reviewed the data, which not only includes the company’s source code and internal database but also thousands of police files. None of the data appears encrypted.
Click to expand...

Log in or Sign up

A Police App Exposed Secret Details About Raids and Suspects

guest Guest

guest Guest

guest Guest

Log in or Sign up

A Police App Exposed Secret Details About Raids and Suspects

guest Guest

guest Guest

guest Guest

Useful Searches