Comments on: Security Review - The USPS Mailbox http://cubist.cs.washington.edu/Security/2008/01/13/security-review-the-usps-mailbox/ Fri, 29 Aug 2008 00:38:47 +0000 http://wordpress.org/?v=2.5.1 By: rudd http://cubist.cs.washington.edu/Security/2008/01/13/security-review-the-usps-mailbox/#comment-26 rudd Mon, 14 Jan 2008 03:25:43 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/security-review-the-usps-mailbox/#comment-26 Very nice review. I wanted to add one point that might also help explain the low number of mail theft incidents: Since USPS is a federal organization, crimes against it are tried as federal crimes. Sentences for crimes related to USPS also tend to be high (<a href="http://www.usdoj.gov/usao/paw/pr/2006_november/2006_11_09_1.html" rel="nofollow">this</a> example notes that this particular person could be charged with 5 years in prison and/or $250,000 for mail theft). My hunch is that the fact that mailboxes are in public places <i>combined</i> with the fact that tampering with them is a federal crime is a significant deterrent to many potential adversaries. This is a nice example of how publicly visible assets combined with extremely high penalties can provide an effective layer of security. It should be noted, however, that severe penalties are <i>not</i> an effective deterrent against someone who is not concerned with the risks of their crime. Very nice review. I wanted to add one point that might also help explain the low number of mail theft incidents:

Since USPS is a federal organization, crimes against it are tried as federal crimes. Sentences for crimes related to USPS also tend to be high (this example notes that this particular person could be charged with 5 years in prison and/or $250,000 for mail theft). My hunch is that the fact that mailboxes are in public places combined with the fact that tampering with them is a federal crime is a significant deterrent to many potential adversaries.

This is a nice example of how publicly visible assets combined with extremely high penalties can provide an effective layer of security. It should be noted, however, that severe penalties are not an effective deterrent against someone who is not concerned with the risks of their crime.

]]> By: maxaller http://cubist.cs.washington.edu/Security/2008/01/13/security-review-the-usps-mailbox/#comment-18 maxaller Sun, 13 Jan 2008 21:30:36 +0000 http://cubist.cs.washington.edu/Security/2008/01/13/security-review-the-usps-mailbox/#comment-18 All good points -- I wouldn't have thought of insetting the box into pillars/buildings. Of course, this would also be difficult and would possibly require some legislature that required builders at certain sites to accommodate these special mailboxes. There are some other points to be had here. USPS is certainly not without competition; I believe for many things UPS/FedEx/DHL would also be plausible alternatives. USPS is really only popular for mailing letter-sized mail for two reasons: price and convenience. Mailing something costs less than 50 cents and there's probably a drop box somewhere that you have to walk. But that's just the thing -- the prevalence of these drop boxes makes it all the more likely that one will be in a secluded quiet part of town where mail theft is more likely. On the bright side, less people nearby probably means less people are using the mail box, but even one stolen identity is too much. Lastly, the statistics you cite in your conclusion suggest more about the volume of mail stolen each time mail is stolen than the frequency of thefts, so I did a little math (but the conclusion is the same as yours). For the average state, there is a volume mail theft once every 4 days (4545/365/50=0.24). Given that there are an average of 3 million locations per state...that's not much at all. Maybe next week you can do a review of those drop off points that the morning mailmen use that aren't for regular civilians... All good points — I wouldn’t have thought of insetting the box into pillars/buildings. Of course, this would also be difficult and would possibly require some legislature that required builders at certain sites to accommodate these special mailboxes.

There are some other points to be had here. USPS is certainly not without competition; I believe for many things UPS/FedEx/DHL would also be plausible alternatives. USPS is really only popular for mailing letter-sized mail for two reasons: price and convenience. Mailing something costs less than 50 cents and there’s probably a drop box somewhere that you have to walk. But that’s just the thing — the prevalence of these drop boxes makes it all the more likely that one will be in a secluded quiet part of town where mail theft is more likely. On the bright side, less people nearby probably means less people are using the mail box, but even one stolen identity is too much.

Lastly, the statistics you cite in your conclusion suggest more about the volume of mail stolen each time mail is stolen than the frequency of thefts, so I did a little math (but the conclusion is the same as yours). For the average state, there is a volume mail theft once every 4 days (4545/365/50=0.24). Given that there are an average of 3 million locations per state…that’s not much at all.

Maybe next week you can do a review of those drop off points that the morning mailmen use that aren’t for regular civilians…

]]>