Hacker wipes Romania's land registry database
news.risky.biz622 points by speckx 17 hours ago
622 points by speckx 17 hours ago
> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania.
So it seems not all has been lost. I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided.
This happened in a 50k people town where my father is from in 1982 with a BIG flood that destroyed the town land registry documents (among a lot of the town). Since he's a lawyer, had first hand experience and I was always curious I asked many things about this a while back. Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people. You can never get to 100% recovery like that, but everyone knows who their neighbor is, at least in a town that is small like this.
So they rebuilt it first from first hand proof, then by testimonies, with a period of counter claims available IIRC. For sure there were some false claims, but given the magnitude of the disaster, this is the best solution within that context.
> Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people
In a similar vein, I was once curious how you would prove your identity if ALL of your relevant documents (passport, driver's license, birth certificate etc) were lost in some kind of cataclysm e.g. a house fire pre-digital etc
Turns out there is actually a mechanism for this:
- get multiple people to sign sworn affidavits that you are who you say you are
- that begins the "paper trail" of evidence that allows you to start getting the rest of the document chain
- you rebuild from there.
If you're married, there is already a similar process for when a spouse takes the last name of the other spouse. The marriage certificate is the first step and then it goes from there for driver's license, passport, credit cards and so on.
It depends on the country. The US has the ability to do the equivalent of deep "duck typing" with almost no documentation even if you've been off the grid in the developing world for a long time. This is a case where the intelligence apparatus works in your favor. They can know you are a US citizen with high probability absent obvious evidence of such.
Of course, if you fall into a crack that is beyond their reach you will almost certainly have a more difficult time. For a variety of historical reasons, there has been relatively little reliable documentation of American citizenship so the system adapted to that reality.
Fun fact, if you're unlucky enough to replace your Social Security card 10 times, they will no longer issue them to you anymore. It is a lifetime limit, and they fan it out to 3 per year.
Oddly enough, if you legally change your name, they will send you a new one regardless of the limit.
The circumstances in which you actually need to physically present your Social Security card are quite rare indeed. In fact, that is the first thing I was told by the ssa dot gov site, when I applied to receive a new card.
It is very unlikely that you will be asked, even by a prospective employer, for your actual card, because let's face it: it doesn't even have a photo, or anything but that unique number on it. Anyone trying to authenticate your number should be satisfied if you can give them the correct number.
And just for review: SSNs are not a "national ID" and you're typically not required to divulge it to private parties, and they can make up some other unique ID for you in their database. It's usually just a shortcut for them to do a background or credit check on you. And that's not something for which they would need your physical card.
That being said, I've replaced my card about 3 times now, and it was comparatively difficult this time around. The first time, I did it all through the mail (the process of building up from no ID to get birth certificate from out-of-state, to the SSA card, to the in-state driver license.) and the second time it arrived by mail, no hassle.
But this time around, even though I applied online, I was directed to make an appointment at the field office and physically walk in there, to prove my humanity. I had never been to an SSA Field Office in my life! The experience was very chill, and there were a dozen windows serving people, while about 4 of us waited in the lobby, and I was in-and-out half an hour early. The civil servant was a lady in good spirits who was a military veteran. Big props to them!
> The circumstances in which you actually need to physically present your Social Security card are quite rare indeed.
In my state, it's one of the allowed document types for proof of social security number, required to get a real ID drivers license.
https://www.mass.gov/doc/ma-real-id-documents-checklist/down...
Here's a pretty good video about a somewhat similar challenge, that of proving your citizenship in ancient Rome: https://www.youtube.com/watch?v=LTt0qwncDXI .
I no longer have an SS card--which was in a wallet stolen years ago--or, perhaps, a birth certificate which I looked for recently but couldn't find. I do have a passport.
But this time around, even though I applied online, I was directed to make an appointment at the field office and physically walk in there, to prove my humanity.
I'm curious when this happened. The phrase "but this time around" makes it sound fairly recent. However, my wife had this very procedure required back in the 1990's.
She also had the same experience as you: Very friendly civil servants eager to help, and things were cleared up quickly once she understood the process.
> SSNs are not a "national ID"
That's not what they are, but that's what they've defacto become. I hate it.
Is that still true?
Except for certain industries where the government has a direct interest (banking, healthcare, real estate), I don't think anyone has asked for my SSN in at least a decade. It's not like the old days when you'd fork over your SSN to rent videos at Blockbuster.
> Except for certain industries where the government has a direct interest (banking, healthcare, real estate)
That's still a massive dependance on "ID" for SS...? Blockbuster tho.. phew it's been a while.
Afterwards, you have to make an appointment to see them in person. Until then, you can order them online or via snailmail.
I tend towards being cautious with my information which has led to beauricracies doubting my existence.
I got my first passport at a formative period of my life (international travel does that). I looked nothing like the photo within aa year. It served as a passport until it expired but only created skeptisism as a photo ID.
I don't know how to drive, so do not possess a driver's licence. I am in a 35+ year relationship, but unmarried.
The only purchase I have made on finance was a bed that I immediately paid off because the the only reason I did it was to establish a record. This was surprisingly difficult to do because they were reluctant to let me have the bed on finance because I had no credit record.
I finally had to renew my passport when I bought a house. It was the only way I could meet the id requirements.
Prior to that I was leveraging non-photo id that could only be acquired with photo-id. It seen that will be accepted in lieu in many instances and allows you to get more similar forms of non-photo ID. All you need to get started is to find a staff member fed up with the ridiculous rules enough to click the checkbox to say that they saw a photo ID. It helps that many of the staff in these positions are more aware of security theater than the general public.
Being a land owner means a lot of those days are peassed, I can't really prove I am the person who is recorded as owning the land, but mostly organisatipns are happy that I am claiming to be someone they know exists.
Linkedin has stopped asking. I'm not sure if that means they think I am a lost cause or that anyone not on their books by now doesn't actually exist.
So for many years I only paid cash for everything, but I hit a point at which I wanted to start establishing credit. What I did was to open a secured credit card at my bank. They actually had me put it in a CD which was used to secure it. After I think 2 years of paying on time they removed the security requirement. I don’t know if that’s still a viable method but I used it in the early 2000s.
Yeah it's actually not that bad, because for example the BMV will likely upon request send you a duplicate driver's license to your address of record. Same for getting replacement credit cards. If you had utility services at that address in your name that's additional documentation. Also historical tax returns, bank accounts, etc.
"why's he asking for a new dl? "
"Oh volcano exploded, his home is under 5 ft of ash."
"Gotcha, mail him the copy"
Fun fact: If your house is under 5 ft of ash, it's not covered by volcano insurance. That only covers you if your home is destroyed by the actual eruption/explosion.
What you need is "pyroclastic event" insurance to cover you for ash and lahar.
/ It cost something like $15/year when I lived in Seattle.
// The macOS spell checker doesn't know "lahar."
This basically covers the financial model of the whole insurance industry;
- get insurance to cover you for X
- get hit by X
- realise you actually got hit by Y after reading the policy small print (or you really did get hit by X, but your policy only covers you for Y)
Brb, gotta camp on top of the ash at the same lat/long coordinates to catch the mailman.
At least you can restore it. Imagine all your devices are lost in a massive fire, is there a way to get back your apple account?
I have a 'bootstrap' system... I have recovery codes and a backup for critical things encrypted and stored in a public git repo I push to both gitlab and github. If I lose everything, I can use those recovery codes to access the things I need to recover my digital identity.
Phone number and email access, if you can regain access to them.
It is definitely a good idea to plan in advance and set up a recovery contact: https://support.apple.com/en-us/102641
But email access is protected by MFA based on your destroyed device. Recovery codes are also stored in the same destroyed building.
You can get back your phone number once you have a photo ID and buy a new phone. Then you should hope that your service providers aren't secure enough to have disabled SMS-based account recovery.
If you're married and Jewish, the wife's mother keeps the marriage document, so even if there is a house fire and all documents are lost, your mother in law usually lives in another house, so you can pick it up from there.
I’m married and Jewish. It would be pretty surprising to me if my wife’s mother had even seen our marriage paperwork let alone possessed it. This also isn’t a tradition I’ve ever heard of in my family.
Or did a joke about overbearing mother in laws just go right over my head.
Ask your mother in law. At least in Israel, during the ceremony, the Rabi gives the ktuba to the bride's mother for safe keeping.
Sort of the plot of Banana Joe.
Everytime I get stuck with some kind of circular bureaucracy I shout "it's Banana Joe all over again!" and no one understands.
Hadn't heard of that one before. It's a Bud Spencer film!
And now I also know that he has a law degree, has several registered patents, and was a certified airline pilot. Pretty impressive.
Do the people who sign sworn affidavits already have to have proven identities? If so, then they're unable to recover from a situation where they lost everyone's identity.
In Austria, there is the concept of "Amtsbekanntheit", meaning if the government officer knows you, that's also valid proof of identity.
You start with the queen. Everyone knows who she is.
While in jest, It does remind me of the time Dolly Parton entered a Dolly Parton look alike contest and lost.
There is little alternative.
A great-great grandfather of mine was mayor of a town through which the front passed twice during WWI. All that survived were basements. Your father's account more or less describes the process by which the land was reparceled.
This is where "possession is 9/10ths of the law" comes from.
I actually think our discussion came from there! Or at least, there was a previous/later discussion about this exactly related to that.
It's one of those "programmer misconceptions" - we want to make reality fit our neat and tidy list of rules/laws/code; but it's the other way around most of the time.
There are also physical markers in the ground at the corners of most properties. So if you had to, you could send a surveyor out to recertify boundaries. That would get very expensive quickly, however.
This is not true anywhere I've lived, and I'm curious where it is true.
Generally, those markers are placed by the person who did the previous survey. They’re not really official designations of anything. However, if you look around, you will find things called survey monuments. Sometimes they’re embedded in the sidewalk, or the middle of the road. Out in the boonies sometimes there’s a little concrete pedestal that has the marker on it. Anytime you look at a recorded deed you will see a legal description of the land and generally that description will start from one of those monuments.
It's usually a piece of steel rebar/round stock or pipe, maybe with a yellow plastic cap, or maybe not. Usually buried or not very visible, I'd guess the surveyors find them with a metal detector.
This is true most places in the us. Have you looked? You often have to dig up the stake. It helps to have an idea of where it should be before you start digging.
Most of the us has it like that. Some of the early states still do 'nw to the stump', a stump that rotted away before 1800... The newer states learned that lesson and land is to something more likely to last and hard to move. Metal stakes are most common. Though most people are not aware of the stake since there is no reason to look for it.
I'm not aware of corner markers being the standard, at least in the central and western US. For rural and undeveloped land, oftentimes you can pay the surveyor extra to put up corner markers though, which is a good investment if you plan on fencing the property
Wouldn't work in a city like NYC where nobody knows their neighbours and a chunk of houses are empty and only owned by shady shell companies as investments...
Shady shell companies do an excellent job of proving ownership -- it's the only reason they exist! So if NYC is hit by an asteroid, you'll find backups of all the important papers neatly filed away in Delaware.
Not saying that this is the only reason, but it is a big reason why we have a land survey of our property on hand on paper and stored online. If something ever happened to the registry, we could at least establish our claim to our land.
Don't you have a land title, which of course is more evidence than a survey which anyone can pay for and get?
The title proves ownership (kinda), but does not define the outline of the property itself.
If the you need to know if the fence is on your property or the neighbor’s, a title or deed won’t help you find that line.
So if the official survey is lost and you need to know where the land you own is, you will need a survey.
Recorded deed will more or less universally contain a legal description of the land. This does, in fact, defined the illegal outline of the parcel.
A survey is little more than marching out into the field and putting at the location where you believe the boundaries to be based on your review of the legal description.
Of course that’s not the end of the discussion as to boundaries for reasons like adverse possession or busted titles but on his own a surveyor is going to tell you basically nothing.
Very place dependent and not so universal in my experience. Where I live the title/deed just has street address. A completely separate agency holds the plot map that links addresses to physical measurements.
Surveys, at least here and I assume everywhere, also contain parcel numbers, the neighbor's parcel numbers, and the legal owner of each parcel's name right on the survey. Along with the date of the survey. I live in a pretty rural area where 20 acres is a small lot, so having proof of where the property lines are tends to be just as important as the title.
I always wonder how things would be reconciled if something similar happened to a bank. What would be the simplest way to ‘download’ one’s balance whilst proving that the downloaded files were signed by the bank?
I'm good with starting from 0 if the bank is (my mortgage is a lot bigger than my balance)
Your balance is at a bank. If the bank is gone your balance at it doesn't matter.
In my country, titles are always issued in duplicate. The land registry gets one of these originals, and the landowner the other. Just about every landowner has their original on their person, or held by a bank if it's mortgaged.
So all is not lost if the registry goes up in flames.
Happened here about 30 years ago with a fire in a council planning office. All building plans and records were lost. It was enormously useful because there was no way to prove that that house addition there wasn't approved or in any plans. Fans of Yes Minister will know the appropriate quote from Sir Humphrey.
Remember the xerox-scandal years back, that invalidated officially scanned documents. You already life in a world where "scanned before" means you can legally challenge the validity of a document.
Is this the scandal to which you are referring?
Yes, that is what they're referring to. The technical details behind it are kind of cool. It's a "bug" of the JBIG2 compression algorithm. See 1, 2
[1] https://community.apryse.com/t/jbig2-compression-issue/1814
[2] https://en.wikipedia.org/wiki/JBIG2#Character_substitution_e...
There‘s also a great conference talk [0] on this, with an english translation [1].
Yes, several national archives where affected on all settings. If a institution scanned and archived documents with these- these documents are - in theory challenge-able in court- within reason..
I am pretty sure I was bitten by this bug, or a similar bug, on an IRA transfer form that I uploaded to a bank. On the scan that I uploaded, one digit in the account number was a clean "5", but the customer service person said it looked like a good clean "6". I presume their document management system was an outcropping of a system originally set up for dealing with faxes, and used that or a similar compression algorithm.
Thus - one could assume that all transfers stored by the bank- before the update would not hold up in court.
I don't know what you mean by "hold up in court". This seems to be an instance of software engineers making sweeping prognostications about legal matters.
"Hold up in court" as in was it duly executed and filed by a certain date, regardless of the time and extra management required for the bank's performance? Yes, why not.
"Hold up in court" against someone claiming it was an unauthorized transfer? Even without the bug, that can be contested in many straightforward ways!
But unless there is a specific legal claim that hinges on the bug being significant, it's pretty irrelevant "in court". I knew about this precisely because the transfer failed to go through due to redundancy - one digit in account numbers is generally a check digit, plus account titles and whatnot.
In general you can always challenge the validity of scanned documents, regardless of known software bugs or not! Just like you can always challenge that a paper document is a forgery. You need a specific argument and some evidence though!
One should assume the outcome of one's case in court is at least partially, if not heavily, influenced by one's political (influential-ness) standing.
I'd bet money the offline copy is far from up-to-date, given the state of the network. It still has potential to be mayhem
If its at least somewhat recent hopefully those affected still have paperwork for any property ownership transfers. Finding proof of property you bought decades ago would be a huge pain.
The problem is that everything will potentially be under dispute, since anyone can claim they purchased a patch of land whose registry was missed in the restoration
Don't know exactly on it works in Romania, but proving you purchased a patch of land is a different question -- for that you have the deed. You then submit the deed to the land registry. So this situation could at most result in the seller being able to sell the land more than once or disputes over the priority of sales over liens and other competing acts subject to registration.
The United States is rare. Most countries (seemingly including Romania[1]) have adopted either a cadastral/Torrens title system in which the land registry is definitive legal evidence of who owns a particular piece of land. If you purchased a piece of land and that wasn't recorded in the registry, you are SOL because registration is what conveys title.
The United States on the other hand has a massive title insurance industry, which wouldn't exist if this system was implemented. So you can make random handshake agreements all you'd like and sue over it.
[1] https://www.elra.eu/the-principles-underlying-the-land-regis...
Here in Brazil lots of people deal land by word of mouth. The country is just too big and there isn't enough state present to make every transaction official, so people shake on it, draft an unofficial document and actually living and developing the land over a long period of time is what consistitutes ownership.
It doesn't take much. A neighbor and I just had to deal with a bunch of property line confusions in the US where a property subdivision 25 years ago wasn't handled correctly. None of us really cared but it would matter in the event of an eventual sale and it cost thousands of dollars in surveyor and legal fees.
ADDED: We also had a bunch of easements and cooperative maintenance agreements that were only partially documented in the deed and mostly done via a handshake. So we got that all squared away in the expensive binder from the lawyer.
The public public land record in Croatia is notorious for being outdated and poorly maintained. Basically, the last time it was properly maintained was during Austria-Hungary a century ago, or at least that's the popular opinion. Right now we have the cadastre and the land registry and they do not always align. And for your example of unofficial agreements, the land my father and his brothers inherited is still in my grandfather's name, he died over 20 years ago, now my parents are aging, and there is just a verbal agreement on how the property is divided.
This is well documented in the the book "The Mystery of Capital" by Hernando de Soto. When it was published I thought it would change the world, but apparently nobody cared. :-)
In his thesis, this is the reason capitalism cannot work well in Latin America and other nations around the world. He says that registered land ownership is the foundation of capitalism. This is how one can borrow money against your land and invest it to make more capital. Very common for example with farmers in N. America to borrow against their farm, for machines, seeds and fertilizer.
(I am not an economist)
The reason capitalism cannot work well is that it assumes endless resources and infinite growth, not because people don't like electronic transfers. Capitalism is failing in all countries and those that are not are already transitioning to some form or another or post consumerism.
Sure at the "end game" stage you are correct. But on the way to that stage it does what it does really well, meaning it makes lots more capital.
De Soto is talking about why it "cannot" get started in a place without government controlled land registry.