I'm sorry....but the OP is being naive and is wrong to slam Amazon here. The protocol Amazon has established here is sound...are they supposed to deliver details of a device just because someone who was once registered to it demands so? In 99% of the cases, sure, no harm can come from it...but it's better for Amazon to adopt a clear line on this, so that their customer reps don't f--k up on the 1 percent of requests that are actually malicious social engineering attempts
* I'm not without sympathy...I was once liberated of much more expensive devices at gunpoint...and it is frustrating that the tracking capability is limited, even with a police order.
I also think if Amazon did give the information, the HN crowd would be up in arms about a violation of privacy (correctly). This is exactly the kind of channel that easily gets hacked in social-engineering efforts.
The only thing that was wrong here was that the initial customer service rep. said that a police report would be enough, but... that's it. One mistake by one customer service rep.
(P.s. if the op is reading this - sorry about the stolen Kindle, I'd be upset too in your situation. I just don't think you should be upset with Amazon - I'd rather large corporations not go into spying and crimefighting)
The protocol Amazon has established here is sound...
The story I read could be summarized as: "Amazon has no protocol for stolen Kindles and flies by the seat of their pants instead, even if that means telling paying customers things that are not true."
I'm sorry, but paying customers of what, exactly? Amazon's Kindle device? Amazon's Kindle store?
Which of these products comes with a service which helps you find your stolen goods? Amazon offers this as a convenience feature, not as part of your purchase price of the Kindle. A purchaser of a Kindle is not entitled to this service.
Okay yeah that was not kosher, but I was more addressing his sense of entitlement that, how DARE they not give him everything he wants and more?!
When you buy an item that is capable of being tracked (iPhone, car) you generally pay for a service to locate it (iCloud, onStar). Otherwise you have to get law enforcement actively involved, not just you, which raises the bar a bit for those who qualify.
Imagine the Amazon nightmare: "Hey Amazon? Yeah I misplaced my Kindle, is it at my house or Grandma's?"
The OP did get misled but I'm not so sure it's jus Amazon making things up. Given the international boundaries involved here it is not a huge stretch to say that the initial rep was mistaken.
What is the functional difference between running an organization that doesn't have protocol X and running an organization in which the boots on the ground - the people charged with implementing protocol X - do not know or follow protocol X?
isn't that why they ask for details of the police case? (so it's not just at the whim of the owner; it has to be associated with an official investigation)
A police report is different than a court issued warrant. With a police report you can file with your insurance as proof for reimbursement. But in the OP's case, he is asking for Amazon to do a form of surveillance...I.e tell me who's name is on a device that is not in my possession. A warrant is a higher level of justification
You do understand that you don't have to have warrant to get details or records from someone? If a police officer asks me for an associate's address, I always have the option of just giving it to them. Sure there are compliance issues when it comes to things like HIPAA and the like, but Amazon probably wouldn't have any problem selling your information to another business.
Oh, right, there's no money in helping law enforcement. There's the problem.
1. I think it's fair to assume that data on websites is for them to use as they see fit and not how the customer sees fit. I expect nothing less of any corporation.
2. Yes, give police the data of someone who is in possession of stolen property.
He obviously could prove he had it in the first place. After that it's not up to Amazon to determine whether a crime took place, the police can handle that.
no money in helping law enforcement
It's a cost center only, I understand that. I doubt their 'law enforcement group' is heavily staffed or has any power within the organization at all. It's probably running as close to zero for resources.
Who is allegedly in possession of stolen property.
At this point there is no evidence that this is a case of theft - it could just as easily have been sold on, be a case of disputed ownership or whatever.
I agree that Amazon have little incentive to do much here but that doesn't necessarily mean inaction is the wrong thing to do - the easiest thing to do and the right thing to do can be the same.
I know for a fact that they don't fully cooperate even when law enforcement is involved. Most LEO's won't jump through the hoops over and over when there are more important cases to work on.
> I know for a fact that they don't fully cooperate even when law enforcement is involved.
Nor should they. Let's construct a little far-fetched case where police officer X tries to spy on woman Y and asks amazon to retrive information for account of Y. That's what a court order is supposed to restrict. The police actually can do very little without a warrant, and that's for a reason.
Far-fetched and irrelevant. In the original case, a police officer isn't asking for information about a random person. They are asking about stolen goods and who now owns the account of the stolen item.
I have little knowledge about the US state of affairs but I was always under the impression that most of the extended permissions mostly apply to the FBI (warrantless wiretaps, ...) and not to the regular police - hence my cautious wording. I might be flat out wrong with this.
Anyhow, the assertion is still true for germany. Unless there's an emergency they're not allowed to enter your house, ask for anything more than your name (well, they can ask, but you don't have to answer) and so forth. These regulations get ignored on a regular basis, but that's a different matter completely.
I think it's good that Amazon is not disclosing any information about anybody without a court order. I'd be worried if they were disclosing their customers information to any police agent without a warrant!
The author's story is unfortunate. But this is not the tip of the iceberg. It is not a tragedy, either.
A kindle costs about $100. The FBI won't get involved - even if you live in the United States. A person is lucky if local law enforcement cares. The expectation that a corporation should devote significant resources to international law enforcement over each petty theft is absurd.
saying that this is not a tragedy is a bit insensitive.
Compared to being robbed, raped, beaten, abused, starved, or murdered, I think that losing a luxury device to a non-violent theft is most definitely not a tragedy.
Wednesday, I received an email saying that David and Joanna had taken their son off life support. There was a car crash. He was a passenger in the other vehicle. Eric was twenty. It is beyond unfortunate. It wasn't particularly fair either.
[edit] And downvoting this comment wasn't insensitive.
This is not exactly a surprise to me, and I don't believe is purely Amazon fault, we have today in the world some very abrasive legal systems where liability is really dangerous.
It is like the thief here in Brazil that broke his leg after his victim roof gave away, sued the owner of the house, and won.
The thief tried to break into the a trailer but it had electric fences. The thief died electrocuted and the owner of the trailer is being accused of murder (facing charges and trial).
I remember reading several others like this one, so this is real in Brasil.
"And so simple that I found lots of more or less similar stories..."
It is a hallmark of urban legends.
This story seems to originate with the case Bodine v. Enterprise High School, which involves a 19 year old on the roof of a high school who fell through a skylight covered with tar.
Not in the UK ("Filing his claim yesterday in California [...]"), and it seems that he didn't successfully sue (nothing reported, but I imagine it would get decent coverage if he won). Just a frivolous lawsuit by the looks of it.
More than likely this is just the police being overly cautious. The duty of care owed to a trespasser is fairly narrow, and the fact that it is a burglar may limit this further (e.g. if the burglar are injured by glass they broke, rather than an inadvertent trespasser falling onto exposed broken glass).
> it's still your Kindle and Amazon should therefore disclose any information they have stored on your Kindle.
What's to stop me from mentioning to a group of friends that I hardly use my Kindle anymore, and one of them offering me $50 for it? Is it still my kindle? Do I have to specifically de-register it before the exchange takes place?
What if I beat my wife nightly and she takes off one day into hiding, taking our Kindle with her? Am I legally allowed to recover any location or usage information (assuming it contains that, like a Fire) to teach her a lesson that leaving me is a bad choice?
One should be forced to obtain a warrant to obtain any information about a digital device (kindle/ipad/surface/galaxy) that is not the kind of information readily given by the operator of the underlying service to end users by default. It'll prevent a lot of shitty "edge cases" that unfortunately aren't uncommon, including unwarranted digital spying by law enforcement in the first place.
I agree on the second point though. When one encrypts a disk on OSX, it requires a complete and painfully (to a lay-user) manual process to wipe that disk to reuse unencrypted if the encryption key is no longer available. The same process should be employed for re-registering any device without the knowledge of the previous registrant's information.
What's to stop me from mentioning to a group of friends that I hardly use my Kindle anymore, and one of them offering me $50 for it? ... Do I have to specifically de-register it before the exchange takes place?
Yes?
Is this so different from selling someone a car, a cell phone, a video game console, etc.?
What if I beat my wife nightly and she takes off one day into hiding, taking our Kindle with her? Am I legally allowed to recover any location or usage information (assuming it contains that, like a Fire) to teach her a lesson that leaving me is a bad choice?
You are attempting to confuse a pretty simple issue of property rights by throwing some over-the-top moral issues and potentially bad outcomes into the mix, as if either the morals or the outcomes have a bearing on the property rights situation or the law. You might as well say "What if I steal a Kindle from Adolf Hitler? Should he be allowed to track me down?" The way things "should" be doesn't have a lot to do with this.
In any case, if your abused wife took off with your LoJack or OnStar equipped car, I would expect the theft recovery people would, you know, recover the theft. They wouldn't ask you if you had stopped beating your wife first. They wouldn't first tell you to get the cops involved, then tell you they actually required a court order, then tell you that all data related to your car had been lost.
For a relatively low-value item like a Kindle, perhaps it would have been a fair compromise to tell the owner "Sorry, all we can do is ban the unit from the Amazon network." But that's not what happened in this story.
The bottom line is that it's not the customer service reps place to get involved. Giving private user information out every time it is requested would be reckless. For every stolen device, there's at least one that was lost, given away, or sold.
A car that costs thousands of dollars is a little different. That's why cars have titles. You don't officially transfer anything when you sell a phone or a Kindle, other than a bit of cash and the device itself.
You're also confusing the situation by brining up LoJack or OnStar. A major part of those services is providing location data. Similar to Find my iPhone. If you want to argue why doesn't Amazon have a "Find my Kindle" feature, then I wouldn't disagree. If you're arguing that Amazon should trust anyone who asks for private user information with a compelling story, well...
A car that costs thousands of dollars is a little different. That's why cars have titles. You don't officially transfer anything when you sell a phone or a Kindle, other than a bit of cash and the device itself.
You would hand your American-style locked-to-a-carrier cell phone, that you're paying a monthly service contract on, to another person for a sum of cash? Without wiping your address book, without de-registering the device from the provider account, etc.? Really? And you'd keep paying the contract for the cell phone you don't have anymore?
I can see why you'd imagine that cars are different because of their high value. That's not what I was getting at, though.
I chose cars as an example because of the registration. Even the lowest value cars are tied to an elaborate network of rules - tax laws, operation and licensing laws, environmental laws, financing and insurance contracts, and property rights. A cell phone is a lot like that; without those ties to the network, the cell phone is worthless. A Kindle is a lot like that too.
I'm not arguing that Amazon should necessarily get involved or that they should necessarily have a "find my Kindle" feature. But if law enforcement requests information that Amazon has already promised to hand over to law enforcement I can't see any excuse for not making good on that promise.
Even if you think requiring a warrant is the best policy, the story here is that Amazon now claims the information is lost, permanently beyond the reach of a warrant or anything else.
I don't think Amazon needs amateur defenders and in this case I don't think they even deserve them. Do you think that if the FBI knocks on Amazon's door and demands account information for all customers who read certain books (on doing chemistry at home, on radical fundamentalist religions, etc.) that they will chase the FBI away, or is it more likely they'll cave instantly, without even asking about a warrant? I find it far-fetched that Amazon is refusing to help with petty thefts as a way of looking out for our privacy. They're just doing what most businesses do: the easy thing.
I'm afraid I don't understand your point. I never said anything about wiping data or canceling a contract because that's totally and completely irrelevant. The point is a car title shows proof of ownership. Beyond paying a bill, you don't have that proof of ownership for a cell phone. But even last month's Verizon bill isn't proof to Verizon or Apple that I didn't just sell my iPhone today. You certainly don't have anywhere near that proof of ownership with a Kindle.
Amazon isn't doing the easy thing. Amazon is doing the thing that isn't going to make them liable. If they don't hand over personal information, it's going to piss off an internet commenter. If they hand over information (not required by law), they are opening themselves up to liabilities as a result of releasing private information.
If law enforcement follows the proper channels, it's a non-issue. If we're arguing that an Amazon rep provided the wrong information to the customer, well, then there's nothing to argue about.
I find it mildly humorous that we jump from an individual claiming their Kindle was stolen to the FBI requesting information from Amazon. I'm not arguing what Amazon should or shouldn't do. I'm simply sharing my perspective on why they don't do it for everyone that comes asking.
I'm afraid I don't understand your point. I never said anything about wiping data or canceling a contract...
You said:
You don't officially transfer anything when you sell a phone or a Kindle...
But that's not really true. That's my point. You would follow some procedures, involving the phone company officials (not government officials) to avoid paying the buyer's phone bills or Kindle bills. In this way, the phone and the Kindle are like a car. The transfer of ownership requires official help because the Kindle, the phone, and the car are in a sense just nodes on a network. Other goods, from pencils to diamond rings, are fundamentally different, and don't require the involvement of officialdom when they change hands.
You believe that you can cleave the car example off as a special category of property, different because it's encumbered by government papers. My point is that a lot of electronic gadgetry is already encumbered in the same way. The papers don't have to be government ones.
I don't see the problem as one of proof of ownership. Information that could have helped an investigation supposedly existed, was offered, then the offer was rescinded, then the information was "lost." If a police department had behaved this way, the readers of HN would call it corruption.
How is being able to register again the problem? If not for that, there is no scope of finding the device, right?
If I lost my kindle, I would be hoping someone is foolish enough to register the device again. Or rather, after reading this, I would have been the fool.
I would have hoped when i got my kindle stolen to have a way to declare it stolen at amazon and block it maybe ?
after all it's paid with my account and my credit card, it's quite easy to find out.
"That's a nice e-reader you have there ... it'd be a shame if someone reported it stolen and it stopped working. Maybe you should send me another fifty bucks."
In the UK there was a problem of people reporting their phones stolen so they could break the contract.
One police station I walked into had a sign saying that they investigate all reported phone theft, and would vigorously prosecute anyone making a false report.
In general you report the phone to your service provider (so they can block the IMEI (and there's a potential 5 year prison sentence for people who change that) and then the police to get a crime reference number and then whoever has insured the phone (sometimes the provider) to give them the reference number.
Perhaps this is a niche for a specialist to enter. Create some tool that gives law enforcement and phone providers easy to use data-mining to allow them to track stolen phones and catch thieves. (I haven't described it well, but this would be something with tight integration between law enforcement and providers; it'd have some kind of auditing to ensure correct legal documentation; it would allow data on many phones to be displayed so you could heat map where phones are stolen from or where stolen phones are ending up, etc.)
I just don't understand how reporting the phone as stolen would allow them to break the contract without having to pay the fee, or allow them to get a new phone without paying full price ( without going through the insurance).
I know little about IMEI resetting (which is a good thing I guess), but I thought it was a separate thing from phone unlocking?
Network providers can give you current information of location, once you show them report that you have registered the device as 'lost' with the police.
If you have Ford's version of OnStar, then yes you do and they lock the damn car down.
Amazon has control over the devices they sell you. They seem to use this power to purge books from your device. They could be a bit more helpful and lock the device and provide law enforcement the information. Asking for a warrant or other court order is just making an economic decision not a moral one.
Yes, but Apple's find my phone isn't, and Amazon expects to continue earning money and providing services to Kindle owners long after the purchase. It is a simple case of maximizing profits over customer service. Much like PayPal and eBays foolishness from a customer perspective, but great from a bottom line.
Fair enough but Apple advertise the feature, Amazon don't.
The primary issue here for me is actually around data protection and privacy.
Amazon are being asked to give up private data to the police without the owners permission (remember the data now on the Kindle is owned by the thief) based on nothing more than an allegation (at this point how do the police know that the device has been stolen, that it's not disputed ownership or been sold on?).
I can see why the owner is frustrated but I can also see why Amazon are doing what they're doing. We're very quick to give organisations grief when they start giving out personal details unreasonably (and rightly so) but one consequence of that is organisations will likely move to a safety first model which seems to be happening here.
What's the point of this analogy? Technology has advanced and it's normal to expect geolocating. If it was a tesla instead of a ford, i 'm pretty sure the owner would call them.
Amazon should have a way to mark Kindles as stolen, just as a purely commercial decision -- it makes people more willing to buy Kindles, and thus Amazon will make more money on books. Really, anyone selling expensive portable property which connects to a central registry as part of normal operation should want to do so, without being pushed by the government. It does reduce some replacement purchases, and might cut back on the secondhand market, but it's going to make people more willing to carry/use their devices, so it's probably a net win. I'd also be WAY more likely to buy used devices if there were a simple check for "has not yet been reported stolen" and then wait some days to finalize a purchase and "still has not been reported stolen", than I am now (where you can safely assume that almost any recent model device being sold used is stolen)
(I suspect I buy enough Kindle books that if I reported one of my Kindles as stolen or unrecoverable-and-damaged, I'd get a free replacement, but I've probably got >$5k in Kindle books since I stopped buying paper books when the first Kindle came out. The irony is I pretty much use my iPad with kindle app as reader, now, because I really like backlighting and reading in a dark room.)
Probably, because I use the account a lot. Just not the devices (I probably have...12?) I use the DXes a fair bit, and use kindles when I'm outdoors, but I prefer to remain indoors generally.
The issue is surely that the police are asking for data without the owners permission (and which isn't the original owner's data - the device yes, the data now on it, no).
Are we saying that a third party should hand over data to the police without the owner of that data giving permission based solely on an allegation? Personally I'm not wild about that idea, it feels like something that could be very easily abused.
We're very quick to demand full legal due process when someone wants access to private data held by a third party and we don't feel it should be surrendered it, but a consequence of that is that it pretty much becomes necessary to follow legal process in all instances because very few of them (including this one) are completely clear.
People are talking about getting a warrant. Would police go to so much bother for such a low value device?
Especially considering how the new owner of the device probably brought it off the thief at a market or something. It is unlikely the thief is actually using the device.
Before modern day phones where you had direct control of GPS (circa 2004ish), I had my phone stolen and filed a police report. I called my phone company at the time (Sprint) and they would not lift a finger to use the built in GPS to find where it was despite the police standing in front of me at the time after I had filed the report. The police were willing to do something, but Sprint said they couldn't.
Such things always made me question why they bothered mandating having GPS in "dumb phones" in the first place. Obviously there's other reasons, but none that seem to help consumers.
>Such things always made me question why they bothered mandating having GPS in "dumb phones" in the first place. Obviously there's other reasons, but none that seem to help consumers.
The main purpose of GPS in dumbphones (and one which clearly is intended to help consumers) was to fulfill the enhanced 911 mandate so your geographic location can be transmitted to dispatchers when you dial 911.
I'm not sure Amazon can give away your personal information without a court order. I think it breaks their terms and conditions and could get them in legal trouble. Unfortunate but really not Amazon's fault.
That's meaningless. I wish I could be more sympathetic, but the reality is, you're expecting them to open up loopholes in their system that could be easily exploited.
And there's no real reason why you should count on Amazon's help. There are all sorts of risks providing this information, what if the request comes from a corrupt policeman working for a private detective (it happens). Requiring a warrant creates a paper trail.
In the real world, if your stuff gets stolen, you're responsible, not the company you bought the product from.
"You're responsible" is a terrible thing to say. In "the real world"? So assuming you mean with non-digital/electronic goods? If someone steals my bag they don't go and register it with some central bag authority, so of course I don't go calling my bag's manufacturer. Of course I'm responsible. Unless it's on CCTV. I expect /those/ guys to be sane, to help me and to show the CCTV to the police. They have clear evidence of a crime sitting right in front of them - if I flag it up to them, it should be damn near their /duty/ to give that evidence to the police.
Surely Amazon have pretty clear evidence in front of them. Someone's reported their kindle stolen, they see the kindle registered in someone else's name shortly after that report, the police have contacted them. Amazon can surely create their own paper trail - verifying the identity of the police first.
Besides, the other post implies that they're saying there's no hard link between the kindle and the account. That's probably front-line support failing to get a message higher than their lazy supervisor.
Anyway, I disagree with the sentiments here and in other replies. There are privacy warriors - quite rightly so - but there's also blatant common sense. Amazon should be applying that here. Putting on a tin-foil hat and saying "but what if..." isn't always a sensible thing to do.
If you commit a crime and submit evidence of it to my web service, you can be damn sure I'm passing your details to the police, so long as it's legal for me to do so.
"Surely Amazon have pretty clear evidence in front of them. Someone's reported their kindle stolen, they see the kindle registered in someone else's name shortly after that report, the police have contacted them. Amazon can surely create their own paper trail - verifying the identity of the police first."
The contents of a police report are allegations not facts. The evidence is ambiguous. Persons sell items and then report them stolen. It is quite reasonable for Amazon to refuse to adjudicate disputed ownership of $100 worth of hardware.
Amazon's responsibilities differ with respect to the digital goods in their care. Those are tied to an individual in a way that a physical device is not.
The police are the official investigative arm. It's their job to be doing this.
The position that amazon should not cooperate with the police because the police may be wrong is ridiculous.
They are not adjudicating anything, they are being asked by a law enforcement officer to provide information they said they would provide to law enforcement.
In the real world as opposed to in an ideal world.
The unfortunate fact is that police have more pressing issues to deal with than petty theft, no-one is going to be taking more than a second glance at any CCTV footage, and you're certainly not going to see it.
Also with respect to 'privacy warriors' you have to way up the weights of the possible pros and cons. In the best case scenario you retrieve a piece of low value electronic equipment. Whoop-de-do. In the worst case, violent ex-husband finds the whereabouts of his ex-wife and assaults her, or worse.
> The unfortunate fact is that police have more pressing issues to deal with than petty theft …
This is not strictly true. Police forces have divisions and staff dedicated to all types crime and petty theft is no exception. They might be understaffed compared to the workload but it's not necessarily true they have more pressing issues to deal with. Someone on the bulglary team is supposed to work on bulglaries, not, say for instance, murder or vice or whatnot.
Ok yeah, that's probably true. But what I imagine the burglary team would do is collect evidence of patterns of thefts, and then do work to prevent thefts where there is the highest number of incidents. This might involve investigating and stopping a particular gang, or it might be as simple as putting up signs telling people to be careful of bag snatchers.
What they are not going to do is go all CSI Miami to retrive a Kindle.
* I'm not without sympathy...I was once liberated of much more expensive devices at gunpoint...and it is frustrating that the tracking capability is limited, even with a police order.