Police are buying access to hacked data, including passwords, IP addresses, and more to help with investigations in an end-run around the usual legal processes
The sale is “an end-run around the usual legal processes.” — Joseph Cox — Hackers break into websites, steal information …
Context & Ripple Effects
Joseph Cox's reporting puts law enforcement on the buying side of the breach-data trade: rather than serving a subpoena or warrant, investigators purchase access to stolen password and IP databases directly. The market has a documented history — LeakedSource sold access to billions of compromised credentials before it was taken offline following an alleged police raid, meaning the state has simultaneously raided this trade and shopped in it.
The traffic runs both ways. Later coverage showed hackers hijacking law enforcement email accounts to fire off Emergency Data Requests that ISPs and social networks honor quickly — so criminals exploit police legal shortcuts while police exploit criminal loot. A breach of police-app vendor ODIN exposed raid plans and AWS keys, underscoring how porous both sides' systems are.
First-order effects
- Investigators gain immediate access to credentials, IP addresses, and account data without a subpoena, warrant, or paper trail, and the targeted individuals get no notification because no legal process was ever triggered.
- Every company whose user database has been breached becomes an unwitting police data source, with its users' information queried by agencies under commercial terms instead of legal ones.
Second-order effects
- Breach-data brokers face escalating legal exposure on the LeakedSource precedent — raids shut sellers down — pushing the trade toward more opaque resale chains that make provenance and consent checks impossible.
- Platforms receiving Emergency Data Requests now have to treat the request channel itself as attackable, since compromised police mailboxes have been used to extract user data fraudulently.
Third-order effects
- If both directions hold — cops buying stolen data, hackers spoofing cops — the warrant-and-notification framework stops being the operative boundary between state surveillance and crime, and pressure builds for verified, auditable channels for government data requests.
- Breach disclosures acquire a second cost beyond remediation: leaked credentials become reusable investigative inputs, giving companies a structural incentive to limit what detail reaches any third party, legitimate or not.
The trend: Law enforcement and criminal actors are converging on the same illicit breach-data markets, with formal legal process becoming optional for both sides.