Simpler than that: Google links to the originals. So he finds a link on Google, follows it, and his IP address is in their server logs. No mystery there.

What he should have done is save a screenshot or PDF of the search results page rather than re-publish the docs himself. But he's not a professional activist nor investigative journalist so that's not really a surprise.

If these docs have actually been indexed by Google then someone at Leathermarket needs to be given a Police caution for wasting police time at the very least.

"If these docs have actually been indexed by Google then someone at Leathermarket needs to be given a Police caution for wasting police time at the very least."

I'd suggest that the board need to have a dawn raid, followed by arrest, interrogation then release under caution for a few months.

Might sharpen a few minds.

"He was taken into custody and later released under investigation. Following a review of all available evidence, it was determined no offences had been committed and no further action was taken."

Is it too much to ask that the "available evidence" be reviewed BEFORE depriving someone of their liberty? Or is that too much to ask.

> Is it too much to ask that the "available evidence" be reviewed BEFORE depriving someone of their liberty? Or is that too much to ask.

It's a subtle way to say you did nothing wrong but don't ever do it again

AC because I received this very message

how diligent Leathermarket will be in seeking out the source of the breach from their side? Particularly if it turns out to be due to some poor IT security that they declined to pay to be upgraded? Having a Pa55w0rD protected web site is all very well, but there are far too may articles on the Register to refer to them all on how these things can easily fail.

Only time will tell.

Even if the password was "password", that would be sufficient for a CMA prosecution.

The fact that it was indexed on Google and directly accesible means that no password was required at all to access the data.

I often look up tech, suprsing how many in house documents etc end up being indexed, if not on the companies own website often on someone else's it has been shared with. I had to backtrack who made some rebadged tech once (ended up being some company on China) , found it because one company who had rebranded hadn't changed some info on their page and it was displaying in Chinese at the top.

Slack web security would not be a suprise.

Upvote, my thoughts exactly.

A careful re-read of the screengrab shows the Google links lead directly to Leathermarket's own web servers, not some hacker / third-party. So the "breach" was either incompetence or someone intentionally setting the document's permissions to public.

I wonder if it could be someone internal to Leathermarket that, due to lack of proper security policy, was able to leave certain data accessible without (legal) repercussion. Someone quietly supportive of the opposition to LM's plans, but also wishful of continued employment.

If so, beers to them.

*Personal conspiracy theory not related to any hard data provided in article*

It is illegal for them not to have proper security.. but hey, no consequence for that.

Is there any recourse, or do the property firm get away with the "punishment" that they have given someone for having them arrested and questioned?

Seems that some compensation should be in order, partly from the property company and partly from the Policy (or the CPS) for not doing any form of checks before arresting someone?

No - the police appear to have done everything correct here.

The property company however...

I was thinking the same thing - at the very least I would want assurances (and confirmation) that any subsequent entries on my 'record' in the police database would make the situation for my arrest and subsequent release without charge crystal clear.

Then I would turn my lawyers on the housing developers.

"the police appear to have done everything correct here."

Is it not usual practice to investigate before arresting? They could have even asked him what happened as part of their investigation. I think he'd would have happily helped.

Otherwise, what's stopping anyone naming a culprit on zero evidence and getting them arrested?

Not necessarily - preservation of evidence is likely a key determination of when people are arrested or just questioned - additionally there was pretty clear evidence that the files had been downloaded and shared.

"No - the police appear to have done everything correct here."

The Police arrested someone just on the basis that a company said their documents had been stolen, without checking what policies were in place to make sure the data was secure in the first place.

Clearly, the property developer should have also immediately self reported to the ICO, did the Police advise they do this or just ignore that part?

Because if there is no self reporting, there is potential here for companies to set up so called 'Honeypots' of data to draw in their opponents, by placing controversial documents online in an insecure manner, then make their opponents life hell, by reporting the IP Addresses of anyone that downloads them, so called 'leaks' to the Police.

Something doesn't add up here, with this case.

My thought exactly.

If they exposed confidential data to Google, such as a list of their targets, they should get a serious smack from the ICO.

Has the look of a setup to me, or at least malicious accusation.

Rule of thumb, 99% of property developers are scum

Rule of thumb, 99% of property developers are scum

Sadly I have only one upvote to give.

The ones plaguing my neighbourhood have at least been jailed for money laundering.

The article mentions that the docs disappeared from Google 3 months before the arrest so it is possible, almost a certainty actually, that the company fixed the issue and then reported the 'theft of documents'. This would mean that when the police checked they could not be accessed without logging in through the site hence they must have been 'hacked'

Guilty until proven innocent - with all of the above that it brings...

then sets the police on those who object on the basis that they're supposed to have illegally gained access to stuff that could be found with a simple Google search.

Lovely.

Please do let them know if there's any orphanages or hospitals they can make money out of bulldozing. Alternatively, I'd hope that the police might not be too keen on wasting their time investigating any more allegations made by this bunch of you know whats..

I googled and found a picture of the LeatherMarket CBS board meeting. Anonymous because I don't want plod coming around.

http://thedarkcrystal.weebly.com/uploads/4/0/5/4/4054921/9153356.png?669

Robert Hutchinson asked why the "Met police cybercrime unit" didn't check the website's security before arresting him. Does the Met Police even have a cybercrime unit? I thought that cybercrime was investigated by the National Crime Agency (they run the ActionFraud report-line) rather than individual forces.

Gven that most of the information on the NCA's site is about serious organised crime, I somehow doubt that they were involved with this. So who in the police did check the website logs?

For "serious" matters yes. I think it is City of London Police that do the actual investigating. The Met does terrorism for the whole country, including Scotland.

But someone downloading "confidential" board minutes isn't that serious when there is a huge epidemic of ransomware attacks going on, so I guess it would be done at a very local level.

(AC above). I agree that the NCA (or City of London Police) wouldn't have been involved, and it would have been done at a very local level. But does the Met have cybercrime specialists at the local level?

Isn't it more likely that, as Hutchinson himself said "it doesn't add up", and that the initial inspection of the website logs was more along the lines of someone from the CBS saying to a Met officer "look, this IP address accessed the documents. You need to arrest them." Then, after his arrest, and him saying "I just googled them and downloaded it" the officer went back to the CBS, who shuffled their feet and finally admitted "Ah. We did reorganise the website a few months ago for... reasons. I suppose it's possible that they were publicly accessible for a bit from the old location..."

Officer rolls eyes, makes sharp remark about wasting their time, case closed, move along nothing to see here.

Which then begs the question, what did the CBS say to persuade the Met to take the case up in the first place? "Man reads meeting minutes" is hardly the crime of the century is it?

Bluetouff (https://twitter.com/bluetouff ) got access to documents via a google search. These documents were not protected, but the admin thought they were.

He was order to pay 3000€ and registration on his criminal record.

In French: https://www.lepetitjuriste.fr/laffaire-bluetouff-condamne-pour-vol-de-donnees-librement-accessibles/

In French with paywall from the news site he was working for: https://reflets.info/articles/notre-pourvoi-en-cassation-est-rejete

That's France though, and an excellent example of why businesses from all over the world come to England to use our courts to settle disputes; they produce outcomes that make sense.

"[the courts in England]... produce outcomes that make sense."

Not all of the time. The Daniel Cuthbert case from 2005 springs to mind. Don't go adding ../../../ to any web addresses you visit now.

care to drop a link to what you mean?

This is just yet another example of over reach.

Instead of the police working to safeguard its citizen the police brought harm to its citizen.

Being arrested and treated like a criminal is not harmless.

I'd like to see all authorities disclose all data they hold on each citizen.

been investigated by the police or any other authority then they should tell that person they've been investigated.

No one should be compiling secret, yes undisclosed is effectively secret, data sets on anyone.

" Board reports, none of which were marked confidential. So I have no question that it was in the public domain "

"Exposed to the public" is not quite what "public domain" means actually.

However if the documents were unprotected (even if accidentally or negligently) and not marked confidential it's not quite clear what statute has been breached. Indeed " Following a review of all available evidence, it was determined no offences had been committed ", so this was most likely a heavy handed response due to him being an "activist".

Interesting.

At least plod reviewed and decided no crime had been committed.

Silly question, why were the blessed things uploaded to a website?