Donate for the Cryptome archive of files from June 1996 to the present


19 November 2014

NL Secret Documents Leaked by Police


Date: Wed, 19 Nov 2014 15:06:44 +0100
Subject: update
From: "Matthijs Koot" <koot[at]cyberwar.nl>
To: cryptome[at]earthlink.net

NRC Handelsblad reports that a sysop placed confidential police investigation documents on an unsecured (part of a?) personal website of a family member, and those documents were subsequently indexed by Google:

http://www.nrc.nl/nieuws/2014/11/19/geheime-documenten-op-straat-door-groot-veiligheidslek-bij-de-politie/

Translation follows.

--------------------------------------------------

Secret documents compromised due to security leak at police

As the result of a security leak at the police, dozens of confidential documents were out in the open. The documents concern police investigations into murder, robbery, criminal organizations and jihad suspects. The sensitive information could be found using search engine Google, NRC Handelsblad found.

The police confirm the security leak and immediately took the documents offline. Until yesterday afternoon the documents could be seen by simply searching Google for the name of one of the suspects. The information from police investigations was stored on a personal website of an accountant. A family member of the accountant is a system administrator with the police and has placed the information on an unsecured part of the website. It is unclear why and how the system administrator did this.

Jihadis shadowed for months

The leaked documents concern criminal cases in which suspects are being observed. For instance, the social network around a leader of a criminal organization was mapped, as was the network of a foreign ex-diplomat who would be involved in criminal activities. The documents sometimes contain information obtained from the Criminal Intelligence Unit, a strictly secret police department that uses informants. A group of young people suspected of wanting to travel to Syria for jihad was shadowed for months. In a report dated October 15th, the police writes that the observation takes a lot of resources of regional units. "We are already noticing that it gets increasingly difficult to get this done."

Photos and addresses of dozens of suspects

The leaked information also contains names, photos and addresses of dozens of suspects. Records were kept of which cars they drove, at what places they meet, whom they have contact with, and which phones they use. The documents also show how officers describe their observations in detail.

Concerning a 17-year-old suspect it was noted, for instance, how he left his home at 08:50, which clothes he wears and how he travels to school by bus. Around 11:00 he and his friends walk to a shopping mall. The officers write that they buy sandwiches and bottled drinks, and then drink "free coffee". A week later, a new observation report notes that the ten officers involved in the observation loose the suspect out of sight after he drove off on a scooter. But ten minutes later they have him back in sight, after localizing the suspect's cellphone through telephone poles.

Sensitive information about the police themselves was also online, such as names and phone numbers of detectives and prosecutors (in Dutch: "officier van justitie"). In some cases information was included about which criminal cases they are handling. The Public Prosecution Service  (in Dutch: "Openbaar Ministerie") and police are investigating whether the leaking of these names has consequences to other ongoing investigations.

Police response

The National Police Internal Investigation Department (in Dutch: "Rijksrecherche") started an inquiry into leaking confidential information about criminal investigations. "The Public Prosecution Service wants to know how this could have happened and who accessed the information", a police spokesperson states. The system administrator who put the documents on a personal website has been suspended.

The National Police Internal Investigation Department investigates what the intentions are of the man who put the documents online. The police can't say how long the information was accessible on the web.