Ask HN: Email catch-all is getting sensitive financial documents from Pakistan

[throwaway2600Hz]

I registered a domain for one of my upcoming projects, and I set up an email catch-all to manage it.

To the noobs out there, a catchall is a great way to send all email, like info@catchall.com or investors@catchall.com or complaints@catchall.com or shadyserviceprovider1@catchall.com, to an email address you don't want spammed.

A few months later, an individual from Pakistan sent all kinds of attachments to an address at the catch-all. Bank slips, checks, things with MICR writing on the bottom.. hundreds of thousands of dollars' worth. It'd probably be an identity thief's dream, but hell if I want any of that stuff.

Let's call the individual "nimrod" and the email address nimrod@catchall.com.

Nimrod operates a business called, say, catchcall.com.

Since his business is in the "more exciting" part of Pakistan, I forward the information to the CIA (which itself took some doing, because typical government, their tip submission page doesn't work).

The CIA guy on the phone sends me an email address to forward tips to and something to the effect of "thanks and goodbye".

I did forward them for a while, then it just started to seem like unpaid work. I'm still getting a couple per month, and I've given up forwarding them.

I'm at a loss what to do. This EDIT: (feels like) the first five minutes of a Hollywood action movie I don't want to appear in. Part of me wants to let nimrod know what's been going on, if only to shut him up. What would you recommend?

[isr]

Ok. so we have:

- (s)he's from Pakistan

- they stupidly mistyped an email address, and haven't checked it since

Aside from that, what have they done to warrant them being spied upon by the CIA (something which you yourself initiated and put into motion). I guess we're all missing some context here, and you do mention some "excitement" in your initial post.

Whats that alluding to? If there is no indication of any illegal activity, then in your opinion is being Pakistani a sufficient crime, in and of itself, to warrant being spied upon and potentially harassed by the CIA or other nefarious arms of the US government.

(should I remind you that the CIA are an organisation which ACTIVELY pursues foreign nationals, including Pakistanis, kidnaps them, and holds them in numerous off shore dungeons where torture is routinely and systematically conducted)

So, with all this in mind, I have to interrupt your mini Oscar acceptance speech with a simple question ...

why?

[throwaway2600Hz → isr]

A little late to the conversation, aintcha?

First, I assume I'm being watched at all times, particularly considering this is internationally wired e-mail through a public email hosting service with less privacy protection than a glass-walled dressing room facing a public street. And a flashing red neon sign. Less than that. The spy agencies already have it and know this stuff exists, so I disadvantage nobody by sharing it with them.

Second, I know the U.S. government has it out for me. If I throw this garbage in the trash and do nothing, it will arouse a lot more suspicion than if I report it like a good little internet user.

I'm not above opposing the U.S. government's other agencies if the cause is just, but in this instance, fighting to protect the colossally stupid (so colossally stupid it makes the whole thing feel like a set-up) is pretty low on my list.

[isr → throwaway2600Hz]

> The spy agencies already have it and know this stuff exists, so I disadvantage nobody by sharing it with them.

Strikes me that you're feeling a little guilty for what you did, and are trying to rationalise it away by claiming you really did nothing at all. Which is a pretty pathetic way of trying to have your cake and eat it too.

> Second, I know the U.S. government has it out for me.

I couldn't care less about you. My response wasn't about you. Last I checked, the CIA weren't kidnapping, holding hostage, and torturing Americans (or at least, not en masse). They have been doing so, on a regular enough basis, to other nationalities, including Pakistanis.

So whether you feel the CIA is hiding under your bed and waiting to tickle your nose at night is just an issue for you and your shrink. I couldnt care less, and it has nothing to do with this story.

I was only concerned about why YOU felt the need to INFORM about others, to an agency who has a proven and declared track record of kidnapping and torturing said others.

And I was prompted to reply (yes, I read your submission a few days late - Hacker News has more than one page, so it happens ...) by the obvious self-conglatulatory tone in your initial post.

Have you already written up your Oscar acceptance speech, to go along with that mega-blockbuster thriller movie you're imagining yourself to be an integral part of?

...

[davelnewton]

The first five minutes are great.

It's the few minutes right after the ominous orchestral music starts that I'd start paying very... close... attention... to what's going on around me.

Stay out of the storm drain.

[throwaway2600Hz → davelnewton]

Mine was a serious post. The "this is the first five minutes" probably would have been better written "this feels like the first five minutes".

I'm going to hope that your comment didn't realize that and wasn't just taunting me.

[davelnewton → throwaway2600Hz]

What kind of input do you want? Do you think telling the person will reduce the chances of being drawn into something you may not be able to escape? You did what you could. Start bouncing those emails.

[xamarinthrw]

How do you tel CIA?