AllYouCanTech

Deputies Do Not Face Consequences for Distributing Woman’s Nude Images Following Unlawful Phone Search

# **The Case of Haley Olson and Qualified Immunity: A Disturbing Fourth Amendment Breach**

In 2019, Haley Olson, a Grant County, Oregon resident, became embroiled in a worrisome violation of privacy. Nude photographs stored on her phone had inexplicably come to the attention of individuals in her community, including members of the local sheriff’s department. This incident raised significant alarms regarding digital privacy, law enforcement overreach, and the doctrine of **qualified immunity**, which ultimately protected those accountable from facing legal repercussions.

## **The Incident: What Led to Private Photos Going Public?**

Olson, who operated a legal marijuana dispensary in Oregon, was pulled over by Idaho state police while traveling outside the state in January 2019. She was arrested on charges of marijuana possession, and during the arrest, Idaho police sought her consent to access her phone. Olson signed a **consent form**, permitting them to create a full digital copy of her phone’s contents.

Although the charges against Olson were eventually dismissed, she quickly realized her private information had somehow resurfaced in Oregon. Members of her community, including law enforcement officials, seemed to have viewed and circulated her images. Some even approached her with explicit remarks, one sheriff’s deputy commenting, *”I heard there are some pretty hot pictures of you floating around the sheriff’s office.”*

## **Law Enforcement’s Involvement in the Data Breach**

Olson suspected that her phone’s data had been improperly disseminated across state lines. She submitted a **public records request** to Grant County to find out who accessed her information. The answer she received was shocking.

Grant County Sheriff Glenn Palmer had requested a copy of Olson’s phone data from Idaho authorities, claiming to be investigating whether a deputy—who was in a relationship with Olson—was engaged in illicit conduct. When Idaho police denied the data request, Palmer sought help from Grant County Attorney Jim Carpenter, who successfully obtained the phone image from Idaho prosecutors.

Despite Carpenter’s written assurance that the data would not be shared with outside parties, he went ahead and examined the phone’s contents utilizing **Cellebrite**, a digital forensics tool. He discovered nude images of Olson and her boyfriend but found no signs of criminal activity in Oregon. Carpenter later contended that he deleted the data after a “brief glance,” but by then, the harm was already inflicted—Olson’s private images had somehow spread throughout the sheriff’s office and the local populace.

## **The Legal Battle: A Fourth Amendment Breach**

Olson took legal action against both Sheriff Palmer and Attorney Carpenter for **unlawful search and seizure** under the **Fourth Amendment**, which safeguards individuals against warrantless searches. The case ultimately reached the **9th Circuit Court of Appeals**, which ruled in favor of Olson, declaring:

> *”Olson’s consent in Idaho did not encompass a search by a distinct law enforcement agency, in another state, and the search did not meet any exceptions to the warrant requirement.”*

The court vehemently condemned the actions of Grant County officials, labeling the scenario a **”troubling instance of the infringement on Fourth Amendment rights.”** The judges underscored that law enforcement entities cannot perform warrantless searches merely due to “curiosity” or speculation of misconduct without evidence.

## **Qualified Immunity: The Absence of Accountability**

Despite the court determining that Olson’s rights were infringed, neither Sheriff Palmer nor Attorney Carpenter experienced any legal accountability. The reason lies in **qualified immunity.**

Qualified immunity is a legal principle that offers protection to government officials from lawsuits unless they violate “clearly established” constitutional rights. In this instance, the court found that while Carpenter’s conduct was unconstitutional, the legal precedents regarding digital searches were not **clearly established** in 2019. Due to this legal ambiguity, Carpenter was granted immunity from any legal action.

Sheriff Palmer was also protected from liability because he had not personally executed the search—Carpenter had.

## **The Broader Implications: Digital Privacy and Law Enforcement Overreach**

Olson’s case underscores the **risks of unchecked law enforcement access to digital information**. With contemporary forensic tools such as Cellebrite, authorities can extract extensive personal data from a mobile device. In the absence of stringent legal protections, this information can be misappropriated, leading to breaches of privacy similar to what Olson endured.

The **9th Circuit’s ruling** clarified that law enforcement agencies **are required to obtain a warrant** before examining a suspect’s phone data for unrelated inquiries. However, due to qualified immunity, this ruling has implications only for future cases—it does not rectify the situation for Olson.

## **Conclusion: A Disturbing Lack of Responsibility**

Although the court recognized that Olson’s rights were compromised, the absence of accountability for those implicated is profoundly troubling. This case highlights the **critical necessity for legal reforms** to avert similar occurrences in the future.

For individuals, it serves as a poignant reminder: **Once your phone is imaged, your data is no longer secure.**

Russian Operatives Utilize Device Code Phishing to Breach Microsoft Accounts

# **Russian Spies Utilize Device Code Phishing to Take Over Microsoft 365 Accounts**

## **Introduction**
Cybersecurity experts have identified a complex phishing initiative led by Russian state-backed hackers. This operation employs a relatively obscure tactic known as **device code phishing** to infiltrate Microsoft 365 accounts. The attack, which has been active since at least August, specifically targets notable organizations, such as government entities and research institutions.

## **Understanding Device Code Phishing**
Device code phishing takes advantage of a valid authentication method referred to as **device code flow**, which is integral to the **OAuth standard**. This authentication mechanism is intended for devices such as **smart TVs, printers, and IoT gadgets** that do not have conventional web browsers. Instead of entering usernames and passwords directly, users authenticate these devices by:

1. Receiving an **alphanumeric device code** and a login link.
2. Inputting the code on a different device that is browser-enabled.
3. The system subsequently allows access to the requesting device.

While this approach is user-friendly for legitimate individuals, **malicious actors have discovered how to exploit it**.

## **How the Attack Operates**
As reported by security firms **Volexity** and **Microsoft**, Russian hackers have been leveraging this method to **circumvent multi-factor authentication (MFA)** and secure unauthorized entry into Microsoft 365 accounts. The attack unfolds in the following manner:

1. **Impersonation** – Cybercriminals mimic trusted officials or organizations through messaging apps like **Signal, WhatsApp, and Microsoft Teams**.
2. **Social Engineering** – They interact with targets, cultivating trust before asking them to participate in a **Microsoft Teams meeting** or a secure chat.
3. **Phishing Link** – The assailant provides a **device authorization link** along with a **code**.
4. **User Action** – If the victim inputs the code on their browser-enabled device, the attacker gains entry to their Microsoft 365 account.
5. **Persistent Access** – The attacker remains logged in as long as the authentication tokens are valid.

## **Targeted Organizations**
The campaign has primarily directed its efforts toward **government agencies, research institutions, and international organizations**, including:

– **United States Department of State**
– **Ukrainian Ministry of Defence**
– **European Union Parliament**
– **Notable research institutions**

## **Why This Attack Works Effectively**
Unlike traditional phishing schemes that depend on counterfeit login pages, **device code phishing does not necessitate that victims input their credentials**. Instead, it capitalizes on the trust users have in the **OAuth authentication process**. Furthermore, the attack proves challenging to identify because:

– **It bypasses MFA** – Since the victim is the one entering the code, MFA safeguards are ineffective.
– **It seems legitimate** – The login procedure resembles a standard Microsoft authentication request.
– **It is infrequently employed in cyberattacks** – Numerous organizations remain unaware of this technique, rendering them more susceptible.

## **How to Safeguard Against Device Code Phishing**
To reduce the threat of device code phishing, organizations and individuals should adhere to these security best practices:

1. **Verify Authentication Requests**
– Always scrutinize the **source of login requests** prior to entering a device code.
– Confirm that the **Microsoft Azure prompt** accurately identifies the anticipated application.

2. **Enable Conditional Access Policies**
– Limit device code authentication to **trusted devices and networks**.
– Implement **geofencing** to prohibit logins from dubious locations.

3. **Educate Employees and Users**
– Provide **security awareness training** focused on phishing techniques.
– Motivate users to **report suspicious login requests**.

4. **Monitor and Audit Logins**
– Regularly assess **Microsoft 365 login activity** for odd access patterns.
– Employ **security tools** to identify unauthorized logins.

5. **Implement Additional Security Measures**
– Utilize **hardware security keys** for authentication.
– Disable **device code authentication** if it is unnecessary.

## **Conclusion**
The **device code phishing scheme** attributed to Russian hackers underscores the shifting landscape of cyber threats. By taking advantage of a legitimate authentication process, attackers can **evade conventional security measures** and unlawfully access sensitive accounts. Organizations must **remain alert, inform employees, and establish robust security controls** to protect against this emerging threat.

For further information, consult the official reports from **[Microsoft](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)** and **

Investor Tries to Acquire City Landfill to Regain Lost $800M in Bitcoins

# **James Howells and the Lost Bitcoin Fortune: A Desperate Attempt to Retrieve Millions**

## **Introduction**
James Howells, a British IT expert, has embarked on a decade-long journey to recover a misplaced hard drive that harbors around 8,000 bitcoins—currently valued at nearly $800 million. His most recent effort to reclaim his digital wealth incorporates an ambitious proposal: acquiring the landfill where the hard drive was unintentionally disposed of. Nevertheless, despite his relentless pursuit, the Newport City Council in Wales remains unwavering in its decision to deny him access.

## **The Saga of the Lost Bitcoins**
In 2013, Howells inadvertently discarded a hard drive containing the private key to his bitcoin wallet. At that moment, bitcoin was still nascent, and the worth of his assets was relatively low. However, as the cryptocurrency market popped, the value of his lost bitcoins soared, transforming his error into one of the most notorious mistakes in crypto history.

Since then, Howells has made numerous attempts to secure permission to excavate the landfill where he suspects the hard drive lies. He has suggested utilizing state-of-the-art technology, including AI-driven scanners and magnetic belts, for locating the device. Despite his initiatives, the Newport City Council has persistently turned down his requests, pointing to environmental issues, logistical complications, and the hefty costs associated with excavation.

## **A Final Attempt: Acquiring the Landfill**
Following a judicial setback in January 2025, which many thought was his last chance to search for the hard drive, Howells received a glimmer of hope when Newport City Council revealed intentions to close the landfill. Viewing this as a possible opportunity, he proposed to buy the landfill altogether. His strategy involves clearing all waste from the area, which he claims would benefit the city by saving it cleanup expenses.

Howells imagines leveraging advanced technology to sift through the refuse and retrieve his hard drive. He has even enlisted investment partners ready to support the venture. If successful, he asserts he would convert the site into a park or keep it operational as a landfill.

## **Newport City Council’s Opposition**
Despite Howells’ resolve, the Newport City Council continues to reject his proposal. The council has already secured permission to develop a solar farm on the landfill site, which aligns with the city’s environmental objectives. The solar farm initiative aims to create renewable energy to run electric waste trucks, thereby cutting fuel costs and enhancing air quality.

The council has repeatedly emphasized that Howells forfeited ownership of the bitcoins the instant the hard drive was disposed of. Officials also contend that excavation would be excessively costly and harmful to the environment. A spokesperson reiterated the city’s position, stating, “We have been very clear and consistent in our responses that we cannot assist Mr. Howells in this matter. Our stance has not changed.”

## **Public Sentiment and the Outlook**
Howells remains resolute, asserting that his plan is not only sensible but also advantageous for the city. He holds that public backing could influence the council’s decision, especially since the solar farm initiative has met with mixed reactions from locals. However, with the council’s firm position and the solar farm project already in progress, the odds are not in his favor.

Should Howells fall short in this last endeavor, his bitcoins may remain interred indefinitely—ironically lying beneath a solar farm intended to generate renewable energy, a stark contrast to the energy-heavy process of bitcoin mining.

## **Conclusion**
James Howells’ tireless chase for his lost bitcoin fortune exemplifies the significant worth of cryptocurrency and how far individuals are willing to go to reclaim lost digital assets. While his latest proposal to acquire the landfill represents a daring and inventive solution, it seems improbable that the Newport City Council will alter its viewpoint. Regardless of whether he prevails, his narrative stands as a cautionary tale regarding the importance of protecting digital holdings in a time where a single misplaced hard drive can result in the gap between financial disaster and extraordinary wealth.