what do you suggest... (you won't believe the stupidity)

yesterday i found a thrown-out computer on the street... i just plugged in the hd into my system and found **** load of doc's on it from

South Jamaica Services For Families & Children, Inc.
106-10 Jamaica Avenue, Richmond Hill, NY 11418
tel: (718) 805-6495 fax: (718) 805-0216

just a quick look and i estimate around 500 SS numbers in various applications and letters... i can't believe this how they handle information of others. should i notify someone about this.. the system was in front of a private apartment block so this person took "work" home and then trew it out for everyone to see

Play see no evil, hear no evil, speak no evil. Wipe the hd and pretend you never saw the info.

make that SS#' amount around 2 times more .... i just realize that all the account #'s in one of the folders are SS#'s w/out dashes among the series of digits.

Exactly...do a government wipe on the HD, or even safer, do that, then replace the drive...remove all serial numbers you see that aren't product-specific (like asset tags for most companies).

I'd replace the HD then scavenge the machine for good parts and trash/burn/nuke the rest.

Well...................I guess you are in a bit of a "situation"..............you may have broken the law by picking up the computer?

If you want, try the purple PM tab..................I can talk to them on your behalf?

:)

this is to ICE


no disrespect, but it could've been my SS just a easily and I it kinda insults me

... lot of these "goverment contractors" especially here in NY are really milking the system... at least they should be held responsible

Yes, it could've been - and if you feel that adamantly about it, then feel free to contact the company to whom the computer is registered and let them know what's happened. Perhaps the police will believe your 'I found it' story when they come to your home investigating the burglary where it was taken...perhaps they won't.

[edit] fixed a typo [/edit]

i think i will contact them

my girlfriend was w/ me when i saw the computer... it was almost in the avenue but not yet off the curb anyone knows if that's illegal

anything on the curb is public property here in the usa, this includes your trash once you take it out (if its on the sidewalk)

You could set up a dummy email account just for this purpose and then surface mail them the details of what you found. Then if they wish to contact you they would have to go through the dummy account, and that would provide you with at least one layer of aninomity (sp?).

Hmmmm, are any of those SSNs California residents? If so then the company who lost the information has to notify all of their clients that reside in California of the compromise. (If memory serves me correctly)

Just speculating.

I work for a non-profit.... Which I'm sure this is..... This is typical of small non-profits... They have no technical know-how or understanding.... They probably own 1 computer and just got a grant to buy a new one to run software that this one can't run... They can't think of a use for the old one so they just threw it away without a thought for what someone _could_ do with the information held on it.... It's not the way they think.... :(

Contact them, tell them what they did and point out that if anyone other than you had got the machine then the probability is high that the result may have ruined their reputation so badly that they would have been forced out of business. Tell them that you have erased the contents and overwritten them so they cannot be retreived and that the drive will remain in your posession so that the data cannot _ever_ be retreived. Tell them to wipe their drives in future before they throw them away.....

If they give you _any_ crap PM me and I will be very happy to talk with them. They are a very small non-profit, (500 SSN's is small.... I have about 50,000 on my network..... I can convince them to sit down and do the right thing... ;))

Quote:

---

Originally posted here by Tiger Shark
I work for a non-profit.... Which I'm sure this is..... This is typical of small non-profits... They have no technical know-how or understanding.... They probably own 1 computer and just got a grant to buy a new one to run software that this one can't run... They can't think of a use for the old one so they just threw it away without a thought for what someone _could_ do with the information held on it.... It's not the way they think.... :(

Contact them, tell them what they did and point out that if anyone other than you had got the machine then the probability is high that the result may have ruined their reputation so badly that they would have been forced out of business. Tell them that you have erased the contents and overwritten them so they cannot be retreived and that the drive will remain in your posession so that the data cannot _ever_ be retreived. Tell them to wipe their drives in future before they throw them away.....

If they give you _any_ crap PM me and I will be very happy to talk with them. They are a very small non-profit, (500 SSN's is small.... I have about 50,000 on my network..... I can convince them to sit down and do the right thing... ;))

---

Just a quick question, TS...why aren't companies like that held accountable for gross negligence in dealing with the improper disposal of company data, which is confidential regardless of profit or not-for-profit? I know that any of them in said company (if this were the case) would definitely not want to have their SSN perused at and used without their knowledge or approval if a computer was found on the side of the road and someone picked it up.

I mean, it's pretty simple IMHO...we didn't know anything about fire as kids, but the minute we touched our hands to the flame or the eye of a stove that was on, we learned not to do that again. Put some hefty fines up and no longer allow "We didn't know" as an excuse...

Quote:

---

anything on the curb is public property here in the usa, this includes your trash once you take it out (if its on the sidewalk)

---

I do not believe you are entirely correct.

I believe what you are referring to is what the courts look at as “abandoned” property. Anything abandoned can be claimed by someone else, with exceptions.

First, it could have been mislaid or misplaced. Under some state laws the finder would have the obligation to return it if they knew who it belonged to, unless the finder was sure it was abandoned. Otherwise it might be incumbent on the finder to contact the owner to determine if it was abandoned.

Second, the property must be abandoned knowingly and voluntarily. You would think that garbage should fit into this category, but that isn't necessarily so. States differ on how they treat their garbage: some consider it abandoned only once it has been mixed in with other garbage, others at the time it is placed at the curb, etc. And some consider the garbage the property of the municipality, especially when it comes to recyclable materials.

I can't get over the stupidity ( I think I've mentioned this before ) of New Jersey. ( This comes from U.S. and N.J. State Supreme Court decisions ). There the Feds can come and take your garbage, look through it, use whatever they find as evidence against you. But for local and state agencies the rules are different: they can take your garbage, but need a warrant to look through it, unless, ( possible exception left open for further consideration in original decision ) they are looking through it to determine if you have thrown away something that should have been saved and put out for recycling!
And no, they can not have the Feds look for them because that would make any evidence tainted because the Feds would now become extensions of the state.
:confused:

cross: legality on trash picking is state-by-state

here in CT, no one will bother you...unless they are *****s...technically. it is illegal.

A_T

as for what to do. i say to write a letter to them. make it anonymous so they don't call the police...just in case. let them know that the HDD could have been compromised, but you are going to wipe it by gov't standards and probably destroy the disk (even if you don't, it makes them feel better).
this is similar to finding someone's ATM card in the machine..which i have done. you could withdraw the entirety of the account, and they are insured anyways, so the bank pays. but i destroyed the card, and called the bank to give them the numbers and let them know i destroyed it.

just my $.02

A_T

OverdueSpy is correct. If any of the identity information contained on the drive belongs to a California resident, this constitutes doing business in California. This places the entiry under the requirement to report any and all compromises, exposure of information and hacks. Been on the books since last summer, IIRC.

The right thing to do would be to contact the organization. If they give you any static, contact the local media. They will definitely make a big stink about it.

;)

nihil

Quote:

---

Well...................I guess you are in a bit of a "situation"..............you may have broken the law by picking up the computer?

If you want, try the purple PM tab..................I can talk to them on your behalf?

---

i don know about american law but isn't a legal owner supposed to loose all his rights on his moveable property once his stuff hits the thrash

(FBI files , discover channel )

Why not bring it to the police? You make a statement on where and how you found it and give the details of the information you found on it. Then contact the company concerned explaining what you found, how dangerous it is and where you brought the computer. At the same time you could ask them if they want some basic pointers on computer security.
The fact that you brought the computer to the police once you found the information would normally be enought to prove you acted in good faith.

We had something simmilar in the Netherlands earlier this year..

Turned into a major scandal... The guy that found the box didn't get prossecuted btw..

http://www.theregister.co.uk/2004/10...utor_dumps_pc/

Quote:

---

Dutch public prosecutor Joost Tonino was condemned yesterday for putting his old PC out with the trash. It contained sensitive information about criminal investigations in Amsterdam, and also his email address, credit card number, social security number and personal tax files. Tonino dumped the computer, which he hadn't used for two years, because he thought it contained a virus. The operating system wouldn't start.

A taxi driver found the PC on the steet just outside Tonino's home, got it working again and informed a crime reporter, who yesterday revealed on television what was on the hard disk. Based on information eft on the PC, the reporter also managed to gain access to Tonino's email account.

---

So you could perhaps go to a major crime reporter person and get something simmilar going...
Makes the public servants mind privacy and security once again..

Quote:

---

Originally posted here by AxessTerminated
cross: legality on trash picking is state-by-state

here in CT, no one will bother you...unless they are *****s...technically. it is illegal.

A_T

as for what to do. i say to write a letter to them. make it anonymous so they don't call the police...just in case. let them know that the HDD could have been compromised, but you are going to wipe it by gov't standards and probably destroy the disk (even if you don't, it makes them feel better).
this is similar to finding someone's ATM card in the machine..which i have done. you could withdraw the entirety of the account, and they are insured anyways, so the bank pays. but i destroyed the card, and called the bank to give them the numbers and let them know i destroyed it.

just my $.02

A_T

---

Well I saw this and I am pretty sure it can be used as presidence (sp?) on the state level as it was a decision in the supreme court that trash is trash:
http://caselaw.lp.findlaw.com/script...l=486&invol=35

Here is a SANS news item on a California Blood Bank:

http://news.com.com/2102-1029_3-5500...=st.util.print

Keep in mind that the California law is pretty open ended. All you have to do is conduct business in California for the law to apply. That includes online transactions, distance learning (that's a big one for me), and any other relationship where your customer is residing in the state of California. No matter where you may be, that constitutes doing business in California.

As I understand it, other states are seriously considering this type of legislation.

nihil would call this a sticky wicket, with twinkies on top.

Here in Michigan, it is illegal to steal someone's property, including trash. Be very careful if you wish to contact this organization, if it were me, I would press charges against you for larsony. Even though trash is obviously trash, it is still property, and the same laws apply to it as do normal belongings.

If I were you, I would do a gutmann wipe on the hard drive and forget about the whole thing. I would definitely NOT be bragging about it on a public message board that if the company searches for there name on the internet will find and trace back to you. But they say all criminals want to be caught, so good luck with that.

Quote:

---

Originally posted here by The3ntropy
Here in Michigan, it is illegal to steal someone's property, including trash. Be very careful if you wish to contact this organization, if it were me, I would press charges against you for larsony. Even though trash is obviously trash, it is still property, and the same laws apply to it as do normal belongings.

If I were you, I would do a gutmann wipe on the hard drive and forget about the whole thing. I would definitely NOT be bragging about it on a public message board that if the company searches for there name on the internet will find and trace back to you. But they say all criminals want to be caught, so good luck with that.

---

bottom of page 2, link to supreme court ruling that trash is trash, I have found no other federal rulings to state that trash is not public property, please post a reference?

Wow, this thread has grown pretty big over this kinda topic. Good dive unhappy, you found a new box and it is yours. No one is going to leave a computer on the side of the road if they didn't want it. If you hadn't taken it, the next person that walked by would have. As for the hardrive, if you want to keep it, format and reinstall.

Local ordinances can make dumpster diving illegal in any area in the US, ignorance of the law is no excuse and you can and will still be prosecuted if it turns out to be illegal in your specific area. Trespassing is also illegal, and if anybody sees you and instructs you not to return, it would be trespassing if you did.

Bottom line is that ordinances can and do in many areas make stealing trash illegal. If I were you, I would learn about law before you sadly attempt to use it.

And again, if I were a member of the organization you listed, I would notice you posting about stolen property and subpoena AntiOnline for your IP address, then goto your ISP with that IP address and time log information about when you made the posts to find your name and addres, then I would contact a local police agency to charge you with larsony.

And by the way, you should be banned for posting about this:
(from the AUP)
a) Transmit any message, information, data, text, software or images, or other content ("Material") that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, or otherwise objectionable that may invade another's right of privacy or publicity;
h) Violate any applicable local, state, national or international law;

Quote:

---

Originally posted here by The3ntropy
Local ordinances can make dumpster diving illegal in any area in the US, ignorance of the law is no excuse and you can and will still be prosecuted if it turns out to be illegal in your specific area. Trespassing is also illegal, and if anybody sees you and instructs you not to return, it would be trespassing if you did.

Bottom line is that ordinances can and do in many areas make stealing trash illegal. If I were you, I would learn about law before you sadly attempt to use it.

And again, if I were a member of the organization you listed, I would notice you posting about stolen property and subpoena AntiOnline for your IP address, then goto your ISP with that IP address and time log information about when you made the posts to find your name and addres, then I would contact a local police agency to charge you with larsony.

---

Whoa there partner, did you read the 1st post? He said that the box was out on the street, which as far as I know, streets are public property and you can't tresspass there... As I said in my posts, once trash or property is set on the street/curb/sidewalk it IS public property according to our US supreme court. If there are local ordinances against taking trash, they would have to file a case, and the court would most likely take the supreme court ruling as presidence (sp?). Please correct me if i'm wrong and post references.

Ordinances are not applicable to supreme court rulings. Ordinances such as no loud verbal obscenities in public do not violate some dumb little kid's freedom of speech. And I highly doubt that the trash was sitting 'on' the street. I have never seen trash that gets set out on the actual street for pickup.

One more thing, ordinances do not have to file 'cases' to penalize someone. You are not going to have 'your day in court' because you broke an ordinance. The judge would throw it out before you got anywhere with that. Just as an officer does not need to file a case to give you a traffic ticket, neither does he need to do it to give you a fine for violating an ordinance. Or in this case it would be a misdemeanor for larsony which could give you some jail time.

Contact a your local attorney or law enforcement agency to verify what the local ordinances are in your area.


precedence

Quote:

---

I have never seen trash that gets set out on the actual street for pickup.

---

We do it here.............for TVs, computers, refrigerators, washing machines etc. There are special collections for domestic appliances, recyclables and stuff that contains dangerous materials.

Let's not get our collective tails in a twist. We all live in different jurisdictions, so our takes on some concepts may be a bit different. What is important here isn't that unhappy found a computer on the side of the street, but that the contents on that computer have far-reaching potential consequences.

He was asking for our opinions on what the "right thing" to do would be. Remember, the information on the hard drive could be yours!

I think unhappy should contact the company or the media. Maybe an atttorney first. But, the company, in some way, needs to be informed of the potential breach. unhappy should be held harmless in this case. It was, after all, found property--for all we know it may have been left behind by a thief. If it was on public property, it was the responsible citizen's duty to secure it. If unhappy wants to keep the found computer, imaging the drive before destroying the information may be a good idea. This way, the data can be returned to the company, if required.

All in all, the right thing to do is to find a way to inform the company of the breach. unhappy does not need to do this personally, but may retain a proxy (attorney or the media) to perform this action. In the US, broadcast media have no protections under the law to maintain source secrecy. Print media does have that protection under the Constitution.

So, unhappy, those are my thoughts.

I think it's a little harsh to talk about how one would go about filing charges, subpoenaing AO for ISP info, then getting the police involved, etc...all over a PC that was on the road. It's a computer. In this day and age, it's common (in my area at least) to see people putting all kinds of things on the curb/etc. Sometimes there's even signs saying "TAKE THIS, FREE OF CHARGE!". I've seen couches, chairs, tables, furniture, tvs, AND computers. People will take things for free or they'll pick them up if it's sitting on the curb. One man's trash, another man's treasure, et al...

And to get into the semantics of "Well, it was tilted off the grass onto the street of which 73.6% of the machine was in the road which is public property so by default the item in question is now considered 'free for all'."...well, that's kind of useless.

He found a PC, picked it up, just as Lansing_Banda said if he didn't, the next guy in line would have, could've been of the "dubious" sort, and started having a field day with those SSNs.

cross the case in New Jersey I was speaking of is State of New Jersey v. Hempele a 1990 decision, which by the way does reference the “Greenwood” case you linked to. I checked the Rutgers Law School Site ( where findlaw directs inquiries of this type to ) and the decisions only go back to 1994.

As it has been said, the laws are different depending on where you are, and apparently are applied differently depending on who you are ( as mentioned in my previous post that is ;) )

DO NOT GO TO THE LOCAL PD!!!!

(sorry about the caps)

They will dump the case and/or harass/detain you regarding where the HDD came from in the first place.


Contact the Inspector General's Office via: http://www.socialsecurity.gov/oig/guidelin.htm

They are the agency trained to deal with these issues and this type of concern falls entirely in their jurisdiction. This is a very serious matter, and they will treat it as such.

"But they say all criminals want to be caught, so good luck with that." ... thanx a lot for that one entropy

If any of you are familiar w/ NYC than you know what Jamaica Ave. looks like. It's a pretty wide street w/ a subway over it. The houses are on both sides connected together so ALL THE TRASH GOES ON THE SIDEWALK (therefore I wasn't traspassing) The system WASN'T in front of company in question but far away from their address, which leads me to believe that a person took this information to their home computer which SHE threw out if front of her apartment. This woman is such a dumbass that she left her name and payroll records in some of the files.

I never said that I want to use this for anything illegal and I WON'T. I have contacted the company via e-mail earlier this afternoot. I'm not some kind of savior but I do feel strongly about this issue especially after I found out that there are medical histories, SS#, account# in the files. If you haven't noticed this deals w/ families and childen (it's in the name) If they throw thier systems out on the street, imagine their security policy. (anyone for an nmap scan) What's stop some skiddie from getting a credit card in a name of some 8 year old. (I'm taking it a bit far, Iknow) But I'm just trying to do the right thing (what's to bragg about ) and I asked your opinions because this has to do something w/ the field we cover on this website.

I don't believe anyone here thinks you did anything wrong nor intend to use the info wrong, but I believe they were trying to give you advise on how to protect yourself, based on their experience's and knowledge.

My guess is you are correct, some dumb fool tossed it out for trash. But there is always the slight possibility that it got there another way. Since you said you found it near the person's residence I doubt anyone stole it and just happened to dumped it right there ( though that is probably what her attorney would say ), but SHE could of stolen it from work ( that is what the company's attorneys will say ) and thrown it out when she stole, I mean borrowed, a newer one for use while working at home. ( she may even hire out to different companies to do work at home on the computer ).

I any case, it is up to you to decide, and personnaly I fell strongly that such carelessness should not be tolerated. I do however agree with 11001001

Quote:

---

DO NOT GO TO THE LOCAL PD!!!!

---

They are not equiped to handle such things. Since there was medical information on the drive you might also try Department of Health and Human Services Office of Inspector General

One thing on-one has mentioned:

What sort of computer was/is it?

Like a P4/ 3.2 with a Gig of RAM and XP Pro has been stolen and dumped.
A 486 with 32Mb and Win95 has been thrown out.

Just a thought...............the Police and Courts generally take the value of items into consideration, at least over here.

AMD K6-2 64MBRAM - 2.5 or so GIG HD windows 2000

abviously garbage but win2000 is a corporate OS ... so that suggest it's from the company

Not guilty?

Quote:

---

abviously garbage but win2000 is a corporate OS ... so that suggest it's from the company

---

Dont count on it bud. Im running 2k myself

I have Win2000 as well.

Go into Control Panel, System, General Properties. That should tell you who the OS is registered to?

Nihil... not to nit pick but a simple right click on "my computer" then down to properties will get you the info as well