Friday, July 16, 2010

Update. Fixing a large “data spill” is expensive and takes years to complete.

http://www.databreaches.net/?p=12507

MasterCard: Most banks agree to breach settlement

July 15, 2010 by admin

The Associated Press reports:

MasterCard Inc. said Thursday nearly all of the banks with claims related to a 2008 data security breach have agreed to accept a settlement.

The settlement, agreed to by MasterCard and credit card payment processor Heartland Payment Systems Inc., required at least 80 percent acceptance by MasterCard issuing banks. MasterCard said more than 99 percent agreed.

[...]

As part of the settlement, Heartland Payment Systems will pay MasterCard issuers $41.4 million to settle claims over the breach.

Read more on Businessweek.


(Related) Even the medium-small ones ain't cheep. (and may cost more on a “per victim” basis)

http://www.databreaches.net/?p=12522

(follow-up) TN: BlueCross completes analysis of data theft

July 16, 2010 by admin

Emily Bregel reports:

BlueCross BlueShield of Tennessee has wrapped up its assessment of customer data that was stolen in an October 2009 robbery of its abandoned Eastgate Town Center office.

The state’s largest health insurer has concluded that nearly 1 million BlueCross members were affected by the theft, the same number stated in an earlier report on the incident.

[...]

BlueCross has spent about $10 million contacting affected enrollees, investigating the theft and arranging for credit restoration services for affected members.

Read more in the Chattanooga Times Free Press.


(Related) If you don't store Primary Account Numbers, they can't be stolen.

http://www.databreaches.net/?p=12499

Visa To Acquirers: Stop Forcing PAN Retention

July 15, 2010 by admin

Evan Schuman writes:

Visa on Wednesday (July 14) sent a direct message to acquiring banks: Stop making retailers retain credit card information unless you want to stop servicing Visa. A key Visa security executive (Eduardo Perez, the head of global payment system security) said the brand is now merely “strongly encouraging [acquirers] to not require” retailers to store PANs but, by September, that might become an official edict.

Read more on StorefrontBacktalk.



“Hey, we can't figure it out – so it must be completely anonymous!”

http://www.pogowasright.org/?p=12155

AOL Responsible for Mass Disclosure of Data

July 16, 2010 by Dissent

More on the recent court opinion involving the lawsuit over AOL’s 1006 release of search query data that wasn’t as anonymous as they thought. Maria Dinzeo reports:

A federal judge found AOL accountable for disclosing personal information of 658,000 of its customers. U.S. District Judge Sandra Armstrong ruled that AOL’s accidental posting of its customers’ Social Security numbers, addresses, phone numbers and credit-card numbers violated its own privacy policy.

“Obviously, a reasonable consumer would have serious reservations about disclosing such sensitive data – or entering certain such queries – if he or she were aware that AOL, contrary to its privacy policy, would make such information readily available to the public, without the members’ knowledge or consent,” Judge Armstrong wrote.

Read more on Courthouse News. A copy of the court opinion can be found here (pdf). Previous coverage from 2006 – 2009 can be found in PogoWasRight.org’s archives.



It took them a while, but I think they are beginning to understand...

http://mainlinemedianews.com/articles/2010/07/14/main_line_times/news/doc4c3dd365ca352515264425.txt

All screenshot images nixed for LMSD

Published: Wednesday, July 14, 2010

In a 180-degree reversal, Lower Merion School District officials say they will now ban staff from taking screenshots to track lost or stolen computers.

Two weeks ago school officials said staff would still be able to take screenshots from stolen computers, under new guidelines being developed.


(Related) Now you too can spy on crooks – just like the Lower Merion School District!

http://www.makeuseof.com/tag/track-down-recover-stolen-laptop-the-thief-with-prey/

Track Down and Recover Your Stolen Laptop with Prey

Open source program Prey can do this for your computer quickly and easily, giving you the location of your computer via your on-board GPS chip or by analyzing nearby WiFi networks. Not only that, it will show you screenshots of what the thief is using your computer for. And if you have a webcam, even take a picture of them before they realize it, before you recover your stolen laptop.

We’ve reviewed similar programs before — Lalarm, Adeona and Firefox plugin Firefound, just to name a few. Prey differs from these in a few ways, but the most important one to keep in mind is that Prey is cross platform — meaning it works on Linux, Mac and Windows.



Beyond “Behavioral Advertising” As we begin to hook “things” into the internet, we have a greater ability to access, measure and record data. If that data is related to a particular individual, we can not only document behaviors (stepping on the gas rather than the brake) but begin to predict behaviors. Would you “opt in” to save 30% on your car insurance?

http://www.pogowasright.org/?p=12127

Pennsylvania balks at car insurer’s habits-based plan

July 16, 2010 by Dissent

Jeff Gelles reports:

If you’ve ever seen “Flo,” the cheerfully offbeat cashier in Progressive Insurance’s ad campaign, you probably know her shtick: that when it comes to auto insurance, Progressive strives to be a little bit different, too.

But Progressive’s latest attempt to distinguish itself in Pennsylvania – a plan to offer rates based on drivers’ habits, determined by connecting wireless monitors to their cars’ computers – has run into a roadblock.

The Ohio company says its usage-based “MyRate” plan offers drivers in other states, including New Jersey, discounts of up to 30 percent if they drive fewer miles, stay off the roads during the accident-prone hours after midnight, and avoid hard braking.

But Pennsylvania officials and Philadelphia’s consumer advocate raised questions about the plan, which Progressive says it has temporarily withdrawn.

Read more on Philly.com



A “special victims” list? Use their Ids in commission of a crime the government (Federal or Arizona) will assume they are guilty and deport them.

http://www.pogowasright.org/?p=12121

Utah database breached for suspected political motives

July 15, 2010 by Dissent

For those readers who do not also read DataBreaches.net, there’s a situation in Utah that is worthy of note here.

Yesterday, a list of 1300 allegedly illegal aliens was leaked to media outlets and others. By tonight, the state had determined that the list came from a database maintained by the state’s Department of Workforce Services. Over 1200 state employees have access to that database on a daily basis.

It is bad enough when state employees snoop in databases out of curiosity about celebrities, politicians, friends, and family. It is quite another thing when people are being named as illegal aliens — and there is already some indication that at least one of those named is a naturalized citizen. Latino groups have referred to this incident as “domestic terrorism.”

I’m not sure what I would call it, but this cannot stand. Those responsible for this breach need to be identified, fired, and prosecuted to the fullest extent of federal and state laws. No excuses. Government databases must be secured so that the public can trust them and this type of breach is particularly egregious in terms of destroying trust in the government’s ability to protect personal information.



Resources we should link to... Once again, I didn't make the cut.

http://mastersinhealthinformatics.com/2010/top-50-sites-to-learn-about-information-privacy/

Top 50 Sites to Learn About Information Privacy



Now define “personal” and “not always”

http://www.chicagotribune.com/news/chi-ap-wi-e-mailrecords,0,7816181.story

Wis. court says teacher e-mails are private

The Wisconsin Supreme Court says not all e-mails sent by public employees on their work computers should be made public.

In a 5-2 ruling on Friday the court says the content of government workers' personal e-mail messages are not part of government business and are therefore not always subject to the state open records law.

[The Opinion in HTML: http://www.wicourts.gov/sc/opinion/DisplayDocument.html?content=html&seqNo=52285

[The Opinion in PDF: http://www.wicourts.gov/sc/opinion/DisplayDocument.pdf?content=pdf&seqNo=52286



Tell us something we don't already know guys. What else does the Times think “isn't fair?”

http://www.businessinsider.com/no-the-government-should-not-regulate-googles-search-algorithm-2010-7

The New York Times Goes Nuts, Says The Government Should Regulate Google's Search Algorithm

The New York Times wants the government to start regulating Google's search business.

To be fair, the Times admits that forcing Google to get approval every time it tweaks its search algorithm -- as it does constantly -- would be impractical and stifling.

But, that aside, the Times thinks "it is worth exploring ways to ensure that the editorial policy guiding Google’s tweaks is solely intended to improve the quality of the results and not to help Google’s other businesses."

No, it really isn't.


(Related) Google had already responded to a similar article in the Financial Times (is the NYT guilty of editorial plagerism?)

http://googlepublicpolicy.blogspot.com/2010/07/our-op-ed-regulating-what-is-best-in.html

Do not neutralise the web’s endless search


(Related) Be careful what you wish for...

http://searchengineland.com/regulating-the-new-york-times-46521

The New York Times Algorithm & Why It Needs Government Regulation



1) This clearly create a business opportunity: A free website that allows anonymous comments. 2) If I pay to have my comments carried by the newspaper, under what circumstances can they refuse? If they don't refuse, do we go to court together to defend against slander charges?

http://tech.slashdot.org/story/10/07/15/1848236/Leaving-a-Comment-Thatll-Be-99-Cents-and-Your-Name?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Leaving a Comment? That'll Be 99 Cents, and Your Name

Posted by timothy on Thursday July 15, @02:54PM

"Anxious to lift a ban on comments brought about by incessant trolling and anonymous slander, a Massachusetts newspaper has begun requiring two things of online readers who want to leave their thoughts on stories: a one-time fee of 99 cents and a willingness to use their real names. Says the publisher: 'This is a necessary step, in my opinion, if The Attleboro (MA) Sun Chronicle is going to continue to provide a forum for comments on our websites.'"



Huge lawsuits cost big bucks! (and the sun rises in the east.)

http://techcrunch.com/2010/07/15/google-viacom-100-million-lawsuit/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

Google Spent $100 Million Defending Against Viacom’s $1 Billion Lawsuit

No comments: