Re: Cryptopia Cryptocurrency Platform Services and Development
And can anyone explain why police seal access to a building for a FULL MONTH in a robbery case.
Code:
While the NZ Police can state that they have handed our building back to us and that they are placing no constraints on the company resuming trading, there are a number of things that the company must consider first before any trading could recommence.
It is important to consider the timeline of this event: Firstly, the crime/hack/breach was identified on the evening of 14 January 2019. The company staff that identified the event immediately froze the exchange and locked down the platform; they then notified the NZ government authorities, first the NZ Police High Tech Crime Group and second, the National Cyber Security Centre (NCSC, a division of the Govt Communications Security Bureau or GCSB), third, the NZ Financial Management Authority.
Members of the NCSC flew from Wellington first thing the next morning at were in the Cryptopia office conducting interviews and gathering evidence by 08:30am NZST. The NZ Police High Tech Crimes Group, also from Wellington were in the Cryptopia office from noon on the same day and issued search and seizure warrants effectively taking control of the building and all of the systems.
In cooperation with NZ Police and NCSC they identified key specialist staff who were tasked with working with the investigators to clone systems to preserve forensic evidence for investigation.
This took 3.5 weeks to complete and our specialist staff have now turned to carrying the work that is necessary to ensure that assets are retained in a secure environment.
While the Police statement that they are no longer constraining our return to operations and trading, it would be extremely reckless for us to do this until we can fully identify the losses and ensure that the balance is absolutely secure. NZ legislation makes it a serious crime for a company or a director of a company to allow that company to trade recklessly thereby placing creditors assets and property at further risk. That work is now underway.
It is important to consider the timeline of this event: Firstly, the crime/hack/breach was identified on the evening of 14 January 2019. The company staff that identified the event immediately froze the exchange and locked down the platform; they then notified the NZ government authorities, first the NZ Police High Tech Crime Group and second, the National Cyber Security Centre (NCSC, a division of the Govt Communications Security Bureau or GCSB), third, the NZ Financial Management Authority.
Members of the NCSC flew from Wellington first thing the next morning at were in the Cryptopia office conducting interviews and gathering evidence by 08:30am NZST. The NZ Police High Tech Crimes Group, also from Wellington were in the Cryptopia office from noon on the same day and issued search and seizure warrants effectively taking control of the building and all of the systems.
In cooperation with NZ Police and NCSC they identified key specialist staff who were tasked with working with the investigators to clone systems to preserve forensic evidence for investigation.
This took 3.5 weeks to complete and our specialist staff have now turned to carrying the work that is necessary to ensure that assets are retained in a secure environment.
While the Police statement that they are no longer constraining our return to operations and trading, it would be extremely reckless for us to do this until we can fully identify the losses and ensure that the balance is absolutely secure. NZ legislation makes it a serious crime for a company or a director of a company to allow that company to trade recklessly thereby placing creditors assets and property at further risk. That work is now underway.
Source: Cryptopia discord
http://www.legislation.govt.nz/act/public/2012/0024/latest/DLM2136633.html
Quote
Issuing officer may issue search warrant
An issuing officer may issue a search warrant, in relation to a place, vehicle, or other thing, on application by a constable if the issuing officer is satisfied that there are reasonable grounds
(a)
to suspect that an offence specified in the application and punishable by imprisonment has been committed, or is being committed, or will be committed; and
(b)
to believe that the search will find evidential material in respect of the offence in or on the place, vehicle, or other thing specified in the application.
An issuing officer may issue a search warrant, in relation to a place, vehicle, or other thing, on application by a constable if the issuing officer is satisfied that there are reasonable grounds
(a)
to suspect that an offence specified in the application and punishable by imprisonment has been committed, or is being committed, or will be committed; and
(b)
to believe that the search will find evidential material in respect of the offence in or on the place, vehicle, or other thing specified in the application.
Quote
Duty of persons with knowledge of computer system or other data storage devices or Internet site to assist access
(1)
A person exercising a search power in respect of any data held in a computer system or other data storage device may require a specified person to provide access information and other information or assistance that is reasonable and necessary to allow the person exercising the search power to access that data.
(2)
A specified person may not be required under subsection (1) to give any information tending to incriminate the person.
(3)
Subsection (2) does not prevent a person exercising a search power from requiring a specified person to provide information or providing assistance that is reasonable and necessary to allow the person exercising the search power to access data held in, or accessible from, a computer system or other data storage device that contains or may contain information tending to incriminate the specified person.
(4)
Subsections (2) and (3) are subject to subpart 5 of this Part (which relates to privilege and confidentiality).
(5)
In this section,
specified person means
(a)
a user of a computer system or other data storage device or an Internet site who has relevant knowledge of that system, device, or site; or
(b)
a person who provides an Internet service or maintains an Internet site and who holds access information
user, in relation to a computer system or other data storage device or an Internet site, means a person who
(a)
owns, leases, possesses, or controls the system, device, or site; or
(b)
is entitled, by reason of an account or other arrangement, to access data on an Internet site; or
(c)
is an employee of a person described in paragraph (a) or (b).
(1)
A person exercising a search power in respect of any data held in a computer system or other data storage device may require a specified person to provide access information and other information or assistance that is reasonable and necessary to allow the person exercising the search power to access that data.
(2)
A specified person may not be required under subsection (1) to give any information tending to incriminate the person.
(3)
Subsection (2) does not prevent a person exercising a search power from requiring a specified person to provide information or providing assistance that is reasonable and necessary to allow the person exercising the search power to access data held in, or accessible from, a computer system or other data storage device that contains or may contain information tending to incriminate the specified person.
(4)
Subsections (2) and (3) are subject to subpart 5 of this Part (which relates to privilege and confidentiality).
(5)
In this section,
specified person means
(a)
a user of a computer system or other data storage device or an Internet site who has relevant knowledge of that system, device, or site; or
(b)
a person who provides an Internet service or maintains an Internet site and who holds access information
user, in relation to a computer system or other data storage device or an Internet site, means a person who
(a)
owns, leases, possesses, or controls the system, device, or site; or
(b)
is entitled, by reason of an account or other arrangement, to access data on an Internet site; or
(c)
is an employee of a person described in paragraph (a) or (b).