ODIN Intelligence Hack Exposes Massive Amount of Police Raid Files TechCrunch

Detailed tactical plans for impending raids, confidential police reports with descriptions of alleged crimes and suspects, and a forensic extraction report detailing the contents of a suspect’s phone. These are some of the files in a huge cache of data from the internal servers of ODIN Intelligence, a tech company that provides apps and services to police departments, following a hack and defacing from its website over the weekend.

The group behind the breach said in a message left on ODIN’s website that it hacked into the company after its founder and chief executive Erik McCauley dismissed a report by Wired, which uncovered the company’s flagship application, SweepWizard, used by police to coordinate and plan multi-agency raids. , was insecure and dumped sensitive data about upcoming police operations on the open web.

The hackers also released the company’s Amazon Web Services private keys to access its cloud-stored data and claimed to have “shredded” the company’s data and backups, but not before exfiltrating gigabytes of data from ODIN systems.

ODIN develops and delivers apps, like SweepWizard, to police departments across the United States. The company is also developing technologies that allow authorities to remotely monitor convicted sex offenders. But ODIN also came under fire last year for offering authorities a facial recognition system to identify homeless people and for using demeaning language in its marketing.

ODIN’s McCauley did not respond to multiple emails seeking comment before publication, but confirmed the hack in a data breach disclosure filed with the California Attorney General’s office.

The breach not only exposes large amounts of internal ODIN data, but also gigabytes of confidential law enforcement data uploaded by ODIN’s police department customers. The breach raises questions about ODIN’s cybersecurity, but also the safety and privacy of the thousands of people – including victims of crime and suspects not charged with any offense – whose personal information has been exposed. exhibited.

The cache of the hacked ODIN data was provided to DDoSecrets, a non-profit transparency collective that indexes datasets released in the public interest, such as caches from police departments, government agencies, law firms, etc. lawyers and militias. DDoSecrets co-founder Emma Best told TechCrunch that the collective limited distribution of the cache to journalists and researchers given the large amount of personally identifiable data in the ODIN cache.

Little is known about the hack or the intruders responsible for the breach. Best told TechCrunch that the source of the breach is a group called “All Cyber-Cops Are Bastards,” a phrase he refers to in the disfiguring post.

TechCrunch reviewed the data, which includes not only source code and the company’s internal database, but also thousands of font files. None of the data appears encrypted.

The data included dozens of files containing full tactical plans of the upcoming raids, as well as suspicious snaps, their fingerprints and biometric descriptions and other personal information, including details of people who may be present at the time. of the raid, such as children, cohabitants and roommates, some of them described as having “no crime[inal] history.” Many of the documents were labeled as “confidential law enforcement only” and “controlled document” not to be disclosed outside of the police department.

Some of the files were labeled as test documents and used false officer names like “Superman” and “Captain America”. But ODIN also used real-world identities, like Hollywood actors, who probably didn’t consent to their names being used. A document titled “Fresno House Search” bore no markings suggesting the document was a test of ODIN’s front-end systems, but did state that the purpose of the raid was to “find a house to live in”.

The leaked cache of ODIN data also contained its Sex Offender Monitoring System, which allows police and parole officers to register, supervise and monitor convicted criminals. The cache contained more than a thousand documents relating to convicted sex offenders who are required to register with the state of California, including their names, home addresses (if not incarcerated) and other personal information.

The data also contains a large amount of personal information about individuals, including the surveillance techniques used by the police to identify or track them. TechCrunch found several screenshots showing people’s faces being matched against a facial recognition engine called AFR Engine, a company that provides facial recognition technology to police departments. A photo appears to show an officer forcibly holding a person’s head in front of another officer’s phone camera.

Other files show police use automatic number plate readers, known as ANPR, which can identify where a suspect has been driving in recent days. Another document contained the full contents – including text messages and photos – of a convicted offender’s phone, the contents of which were extracted by a forensic extraction tool during a compliance check while the offender was on probation. One file contained audio recordings of police interactions, some where officers are heard using force.

TechCrunch contacted several US law enforcement agencies whose files were found in the stolen data. None responded to our requests for comment.

The ODIN website, which went offline shortly after being downgraded, remains inaccessible as of Thursday.

---

If you know more about the ODIN Intelligence breach, contact the Security Office on Signal and WhatsApp at +1 646-755-8849 or email zack.whittaker@techcrunch.com.