Anyone can access parts of a web portal, used by law enforcement to request customer data from Amazon, although the portal should require a verified email address and password.
Amazon's Law Enforcement Request Portal allows police and federal agents to submit formal requests for customer data along with a legal order, such as a subpoena, search warrant, or court order. The portal is publicly accessible from the Internet, but law enforcement agencies must register an account on the site to allow Amazon to "authenticate" the requesting agent's credentials before they can make requests.
Only time-sensitive emergency requests can be submitted without an account, but this requires the user to "declare and acknowledge" that they are an authorized law enforcement officer before they can submit a request.
The portal does not show customer data or allow access to existing law enforcement inquiries. However, parts of the website continue to load without logging in, including the dashboard and the "standard" request form used by law enforcement to request customer data.
The portal offers a rare insight into how Amazon handles law enforcement requests.
This module allows law enforcement to request customer data using a wide variety of data points, including Amazon order numbers, Amazon Echo and Fire device serial numbers, credit card and account details bank cards, gift certificates, delivery and shipping numbers and even the Social Security Number of delivery drivers.
It also allows law enforcement to obtain records related to Amazon Web Services account by submitting domain names or IP addresses related to the request.
Assuming this was a bug, we sent Amazon several emails prior to publication but received no response.
Amazon isn't the only tech company with a portal for law enforcement inquiries. Many of the largest tech companies with millions or even billions of users around the world, such as Google and Twitter, have created portals to allow law enforcement to request customer and user data.
Motherboard reported a similar issue earlier this month that allowed anyone with an email address to access law enforcement portals created by Facebook and WhatsApp.