Instances of sketchy deals on online marketplaces, such as eBay, are common. It is not surprising to come across counterfeit, stolen, broken, or falsely advertised goods being sold by third parties. However, discovering that your stolen item has resurfaced is entirely different.
This is precisely what happened to an employee working at SAP, a software company. According to a report by The Register on Wednesday, the employee stumbled upon one of the four stolen solid-state drives (SSDs) from SAP data centers in Baden-Württemberg, Germany, being sold on eBay. As per undisclosed “sources close to the incident,” the device contained personal information belonging to numerous SAP employees.
The Register reported, “One of the disks later turned up on eBay and was bought by an SAP employee. They were able to identify that it belonged to SAP. The disk contained personal records of 100 or more SAP employees.” According to The Register, it was revealed that the data centers housing the stolen SSDs did not have proper “physical checks” in place. This allowed an individual to transfer the devices from a secure location to a less secure building elsewhere on the campus, as per sources cited by The Register.
SAP is currently investigating the matter but has reportedly not yet located the whereabouts of the other three stolen SSDs. The Register further mentioned that SAP’s European data centers had experienced five burglaries in the past two years.
Challenges in Identifying and Preventing Sale of Stolen Goods on Online Marketplaces
To gather more information, Ars Technica contacted SAP regarding the report. Ars Technica and The Register received the same statement from SAP in response to their inquiries. The statement says, “SAP takes data security very seriously. Please understand that while we don’t comment on internal investigations, we can confirm we currently have no evidence suggesting that confidential customer data or PII [personally identifiable information] has been taken from the company via these disks or otherwise.”
The details regarding how the SAP employee discovered the storage device on eBay, identified it as belonging to SAP and verified this information remain unclear. It is possible that the employee actively searched on eBay with the intention of locating the stolen property and happened to stumble upon it by chance.
Major online marketplaces like Amazon and Walmart face challenges in effectively identifying and blocking questionable activities due to the anonymity of sellers and the relatively minimal requirements for using these platforms. Consequently, these retail giants struggle to track and remove a sufficient number of dubious sellers, allowing criminals, ranging from individuals to organized groups, to profit from the sale of stolen goods through third-party marketplaces.
eBay has frequently made headlines due to the presence of stolen goods being sold on its platform. Within the technology industry, there have been recent reports of stolen Tesla car computers containing personal data being listed for sale on eBay. Additionally, crime rings have been accused of selling electronics and printer cartridges valued at over $12 million. Even federal authorities have not been immune to having stolen items appear on the auction site. In 2008, the US Government Accountability Office documented cases of military items sold on eBay [PDF].
Addressing the Need for Enhanced Seller Verification and Accountability
eBay’s seller policy explicitly prohibits the sale of stolen property, and the company claims to cooperate with law enforcement in cases involving stolen goods. They provide resources on their website for reporting organized retail crimes and suspicious activity to law enforcement.
When asked about their efforts to prevent stolen items from being listed on the site, eBay stated that they have “zero tolerance for criminal activity” and actively support criminal prosecutions against those attempting to sell stolen goods. They have a dedicated Proact team that collaborates with 70 retailers to identify potentially fraudulent sellers and refer them to law enforcement.
However, the question remains about how individuals can repeatedly use eBay as a black market for stolen items. Additionally, considering the ease of selling things online, it raises doubts about whether it is possible to eradicate stolen goods from eBay completely.
The INFORM Consumers Act, set to be introduced next week, aims to address the problem of illicit activities on online retail marketplaces. It will require retailers like eBay to verify the credentials of third-party sellers engaged in significant sales volumes. This means sellers must provide personal information such as government ID and Social Security numbers, deterring illegal activities and preventing duplicate accounts. There is growing pressure on retailers to take a proactive approach in combating bad sellers and listings. Some suggest going beyond the INFORM Act by requiring all sellers to provide detailed credentials.
The Need for Stronger Measures and Improved Accountability on eBay
Companies like eBay and Amazon face skepticism regarding their vetting processes for third-party sellers, as evident scams continue to thrive on their platforms. Obvious signs, such as sellers offering large quantities of the same item or listing new items at extremely low prices, can raise suspicions of stolen goods.
While eBay claims to disapprove of stolen property, it could take a more assertive stance. Though consequences for violating their stolen property policy are listed, none explicitly ban users from the platform, except for potential account suspension.
Accidental purchases of stolen property can lead to complications for buyers. Difficulties in obtaining refunds for stolen goods have been reported, exemplifying the challenges faced in such situations.
Stolen goods, while not posing a tangible danger, contribute to a moral hazard and can result in financial losses for individuals and industries, as highlighted by the National Retail Federation’s report on the substantial theft costs in the retail sector.
