The Outwrite Podcast

Amazon’s Law Enforcement Portal Is Partially Visible to Public on the Web


Listen Later

Welcome to "The Outwrite Podcast". This article is published on www.theoutwrite.com by Varun Singh Rajput.

For some reasons, Amazon’s Law Enforcement request portal is partially visible to everyone on the web. It could be a bug, as the portal should only be accessed by law enforcement officers once they create an account with a verified email address and password.

The portal allows investigators to ask for customer data under non-emergency requests. Account registration is mandatory for law enforcement so Amazon can authenticate the officer’s credential prior to submit the formal request.

However, time-sensitive emergency requests don’t require an account or registration. The law enforcement officers need to “declare and acknowledge” to take the complete responsibility that they have the authorization as an officer to ask for customers data and create the request for the same.

Along with the formal requests federal agents need to submit a legal order such as a search warrant, a subpoena etc.

Amazon’s law enforcement portal doesn’t seem to be compromised, and there is no need to panic – basis what we have so far. The portal doesn’t allow the public or any user to access existing law enforcement requests or customers data in any form.

The only concern is the partial view access of the non-emergency request form to everyone, which should only be visible to law enforcement or federal agents after clearing the authentication layer.

The portal somehow has shared what kind of details (including Amazon Web Services) investigators can ask for, here are some listed down:

  • Amazon Order ID Number
  • Email Address
  • 16-digit Amazon Devices Serial Number ( such as Amazon Echo & Kindle)
  • Domain Name
  • AWS Domain URL
  • AWS IP Address
  • Credit/Debit Card Number
  • Bank Account Number
  • Billing Address
  • Amazon Gift Card Number
  • Name, Address, Social Security Number (Employee)
  • There are much more data points federal officers can collect details for through Amazon’s law enforcement portal. For now, Amazon hasn’t commented on this bug (most probably) reported by TechCrunch. We expect Amazon, and other major tech giants like Facebook, Google, Twitter to be more sensitive for their law enforcement portals by restricting access to the public in any form to avoid any misuse.

    Thanks for your time, please share your valuable feedback & comments - our email address is: [email protected].

    ...more
    View all episodesView all episodes
    Download on the App Store

    The Outwrite PodcastBy Varun Singh Rajput

    • 5
    • 5
    • 5
    • 5
    • 5

    5

    6 ratings