When you don't control your data (inventory, access rules, a plan!) you wind up in situations like this – where you repeatedly announce ever larger volumes of lost data. In short, you sound like a fool (or at best , an incompetent manager.)

http://www.pogowasright.org/article.php?story=20070620165628541

Ohio Update: Strickland: Taxpayer info also on stolen computer tape

Wednesday, June 20 2007 @ 04:56 PM CDT Contributed by: PrivacyNews News Section: Breaches

Gov. Ted Strickland announced Wednesday that up to 225,000 taxpayers' personal information was also on the computer data tape that was recently stolen from a part-time intern's car. So far, information on nearly 500,000 Ohioans is confirmed to be on the stolen device.

Strickland disclosed Wednesday that the data tape included:

— up to 225,000 names and Social Security numbers of Ohioans with uncashed tax refund checks issued in 2005, 2006 and through May 29, 2007.

— 602 Ohio Lottery winners who have not cashed their checks

— 2,488 Ohioans with uncashed checks of unclaimed funds

— names and bank account numbers for 650 to 1,000 electronic fund transfer transactions that were rejected.

Source - Dayton Daily News

...for further investigation...

http://www.pogowasright.org/article.php?story=20070620184015203

American pilots protest security breach on company Web site

Wednesday, June 20 2007 @ 06:40 PM CDT Contributed by: PrivacyNews News Section: Breaches

Personal information including Social Security numbers of more than 300 pilots and other employees at American Airlines, including the chief executive, was exposed on a company Web site, according to the pilots' union.

The company said it determined that only pilots and union officials saw the information on a password-protected internal site.

Source - Associated Press

This is the future. Live with it!

http://www.pogowasright.org/article.php?story=2007062017191674

N.J. ID Theft Bill Stirs Insurers’ Ire

Wednesday, June 20 2007 @ 05:19 PM CDT Contributed by: PrivacyNews News Section: State/Local Govt.

New Jersey property-casualty insurance firms and other industries are objecting to a proposed regulation that would require the installation of what they term expensive and uniform information security systems.

The Division of Consumer Affairs recently closed the comment period on the new rule it has put forward to implement the Identity Theft Prevention Act of 2005.

Richard Stokes, regional manager for the Property Casualty Insurers Association of America (PCI), said his group and other industry trade groups have expressed concern about the security systems, based on federal standards, that must be emplaced by all businesses regardless of size.

Source - National Underwriter

Related - The New Jersey Consumer Affairs Division Has Gone Too Far, Says PCI

Before we laugh at “le frogs,” perhaps we should look around our own organizations. Would a threat of “immediate termination” stop tis practice?

http://techdirt.com/articles/20070619/173120.shtml

French Officials Can't Resist Their Crackberries, Even If It Means Giving Secrets To American Spies

from the must...-use...-crackberry dept

We've all heard the RIM Blackberry referred to as a "Crackberry" for its supposedly addictive nature... however, we never thought that it was true that anyone really couldn't do without their Blackberry mobile device. Apparently the French government has banned the devices for certain government officials who might email sensitive information. Since RIM has all emails run through its own servers, some of which reside in the US, the French government is worried (perhaps reasonably so) that American spies are snooping on their sensitive emails. However, apparently many French government officials just can't let go and are still using Blackberry devices on the sly... even if it means sending classified info. What's odd is that various officials say they can't find anything else that works quite like the Blackberry, even though there are more and more solutions that do -- and many of them don't require emails to go through special servers in the US.

Wow! This is like free money! If I sue 10 spammers a month, I'll be richer that Bill gates in 3.2 years!

http://www.pogowasright.org/article.php?story=20070620171535496

Lawsuit shows how to sue spammers

Wednesday, June 20 2007 @ 05:15 PM CDT Contributed by: PrivacyNews News Section: In the Courts

news analysis A recent decision in a lawsuit filed against a Florida credit counseling company offers a promising road map to follow for suing spammers.

After receiving at least nine unsolicited e-mail messages offering credit counseling services, Washington state resident Joseph Hylkema did more than just consign the spam to his junk mail folder: he decided to get even.

Source - C|net

Ubiquitous surveillance: This will continue to happen, I guarantee it!

http://www.pogowasright.org/article.php?story=20070620171733975

Belk employees' lawsuit over hidden cameras heads to trial

Wednesday, June 20 2007 @ 05:17 PM CDT Contributed by: PrivacyNews News Section: Workplace Privacy

Belk department store managers allowed four cosmetics employees to continue changing in a stockroom for months after installing a hidden video camera, an Athens lawyer said in court Monday.

A jury trial to decide a lawsuit the employees filed in 2005 against Belk and several managers began Monday afternoon with opening statements and witness testimony. Four women, who sold makeup for the cosmetics firm MAC at the Atlanta Highway Belk, are seeking unspecified damages. Belk management expressly allowed the MAC employees to change in a stockroom, even setting up a mirror and a rack to hold clothes, their attorney Jimmy Hurt said.

Source - Rome News-Tribune (Props, Flying Hamster)

A new twist!

http://techdirt.com/articles/20070620/164139.shtml

Judge Tells RIAA: Irreparable Harm Doesn't Mean What You Think It Means

from the try-again,-folks dept

The recording industry loves to throw around the term "irreparable harm" in its various lawsuits -- as if someone hearing a song they didn't pay for will mortally wound the industry. While some say that this is just standard legalese and we shouldn't read too much into it, it looks like a judge in New Mexico disagrees. In denying the RIAA's request to have the University of Mexico simply hand over info on someone using their network (without letting that individual fight back against the request for info), the judge notes: "While the Court does not dispute that infringement of a copyright results in harm, it requires a Coleridgian 'suspension of disbelief' to accept that the harm is irreparable, especially when monetary damages can cure any alleged violation." However, the judge argues, turning over someone's private info without giving them a chance to defend themselves and protest could cause irreparable harm: "the harm related to disclosure of confidential information in a student or faculty member’s Internet files can be equally harmful." Nice to see the judge recognize that just because someone may have listened to a song without paying for it, it doesn't mean that they lose all other rights.

Build your own robot lawnmower?

http://hardware.slashdot.org/article.pl?sid=07/06/20/2233224&from=rss

NASA Frees Their Robotics Software

Posted by samzenpus on Wednesday June 20, @07:19PM from the now-everyone-will-make-robots dept. Robotics Science

kremvax writes "It's a field day for robotics hackers everywhere, as NASA releases the first installment of their CLARAty reusable robotic software framework to the public. According to the JPL press release, these modules contain everything from math infrastructure to device drivers for common motors and cameras, and computer vision, image, and 3D processing."

You mean Al Gore might be wrong?

http://www.canada.com/nationalpost/financialpost/comment/story.html?id=597d0677-2a05-47b4-b34f-b84068db11f4&p=4

Read the sunspots

The mud at the bottom of B.C. fjords reveals that solar output drives climate change - and that we should prepare now for dangerous global cooling

R. TIMOTHY PATTERSON, Financial Post Published: Wednesday, June 20, 2007

... Climate stability has never been a feature of planet Earth. The only constant about climate is change; it changes continually and, at times, quite rapidly. Many times in the past, temperatures were far higher than today, and occasionally, temperatures were colder. As recently as 6,000 years ago, it was about 3C warmer than now. Ten thousand years ago, while the world was coming out of the thou-sand-year-long "Younger Dryas" cold episode, temperatures rose as much as 6C in a decade -- 100 times faster than the past century's 0.6C warming that has so upset environmentalists.

Old Identity Theft cases never die...

http://www.infoworld.com/article/07/06/19/FTC-looks-for-more-victims-of-ChoicePoint-breach_1.html?source=rss&url=http://www.infoworld.com/article/07/06/19/FTC-looks-for-more-victims-of-ChoicePoint-breach_1.html

FTC looks for more victims of ChoicePoint breach

Breach victims have until August 18 to file claims with the FTC and get reimbursed from a fund ChoicePoint set up as part of its settlement

By Grant Gross, IDG News Service June 19, 2007

The U.S. Federal Trade Commission (FTC) is looking for victims of a data breach at ChoicePoint announced in early 2005.

Victims with out-of-pocket expenses due to the breach have until Aug. 18 to file claims and be eligible for payments from a $5 million fund that ChoicePoint agreed to pay in its January 2006 settlement with the FTC.

The FTC has now mailed reimbursement claim forms to 2,400 consumers who may have been victims of identity theft due to the breach, the agency said in a speech. The FTC has mailed claim forms to 1,000 consumers since December 2006, it said.

In addition, the FTC has created a Web site where consumers who do not receive a claim letter can download a claim form and get more information about the claims process.

Data broker ChoicePoint announced in early 2005 that identity thieves had set up fake businesses as a way to buy personal information from the company. The breach, affecting about 163,000 U.S. residents, set off a debate in the U.S. Congress about data breach protections, but Congress has yet to pass a data breach notification bill.

In its January 2006 settlement with the FTC, ChoicePoint agreed to pay a $10 million fine in addition to the $5 million victims fund. The company also agreed to third-party security audits every other year until 2026.

ChoicePoint also agreed in May to pay a $500,000 fine and change the way it screens new customers in a settlement with 43 states and the District of Columbia.

Tip on encryption, but interesting statistics...

http://news.com.com/Locking+down+laptops+before+its+too+late/2010-1029_3-6192001.html?part=rss&tag=2547-1_3-0-5&subj=news

Locking down laptops before it's too late

By Bill Watkins Story last modified Wed Jun 20 04:00:02 PDT 2007

... During 2005, 20 percent of all banks, 18 percent of credit card companies, 13 percent of government organizations and 9 percent of health care companies reported data breaches--and that number is growing.

... On a state by state basis, 29 states thus far have enacted data protection legislation and 28 of these laws have provisions calling for the encryption of digital content.

The flaw with current legislation is that it does not specify how to encrypt data--and that's critical. If agencies and companies encrypt their data using software, it's like locking individual car engine components–-time-consuming, expensive and fraught with failure points. By contrast, hard drive full disc encryption is similar to a car key: it protects everything from the engine to the dashboard with a single mechanism and point of entry.

Wishing is not a very effective plan...

http://www.technewsworld.com/rsstory/57918.html

Massachusetts Far Behind on Open Document Format Adoption

By Eric Lai Computerworld 06/19/07 10:32 AM PT

Massachusetts' open formats policy is off to a slow start with only 250 of the government's 50,000 PCs outfitted with the necessary technology. Since the policy was publicly introduced last year, the plan has seen resistance from state employees and Microsoft, lobbying heavily against the format change.

Just an observation, but when the big boys start acquiring security companies it indicates (to me) that security is about to become a service differentiator.

http://www.securityfocus.com/brief/530?ref=rss

HP to acquire SPI Dynamics

Published: 2007-06-19

Hewlett-Packard announced on Tuesday that the technology giant has agreed to buy Web security assessment company SPI Dynamics for an undisclosed sum.

The Atlanta-based security firm develops technology to assess Web site and application risks from development to deployment. The number of vulnerabilities in Web applications has skyrocketed in recent years, making up the lion's share of software flaws disclosed each year.

"Today, HP Software provides solutions that ensure that business applications run well," Jonathan Rende, vice president of products for HP's Quality Management Software group, said in a statement. "Now with the addition of SPI Dynamics, we can make sure it is also secure.”

The acquisition news comes two weeks after IBM revealed it had agreed to buy compliance and security firm Watchfire. IBM did not disclose the terms of that deal.

I wonder if they would be available for seminars?

http://www.securityfocus.com/news/11471?ref=rss

Amero case spawns effort to educate

Robert Lemos, SecurityFocus 2007-06-19

A group of security professionals, legal experts and educators who helped former Connecticut substitute teacher Julie Amero overturn a conviction on charges of exposing her students to pornographic pop-up ads has formed a permanent organization that aims to educate the courts and legislators about technology, crime and digital forensics.

Taking the name of the person who brought them together, the members of the Julie Group intend to teach lawyers and end user about issues of technology and criminal law, lobby policy makers for fairness in criminal codes and regulations, and bring to light unfair prosecutions. The group will likely again offer their computer-security expertise to prosecutors and defense attorneys in future cases.

"Our helping Julie Amero was about two things: Getting Julie out of jail and making sure that something like this doesn't happen to other people," said Alexander Eckelberry, president of security firm Sunbelt Software. "We learned with Julie that giving people a voice makes a big difference."

On January 5, a six-person jury found Amero, a former substitute teacher at Kelly Middle School in Norwich, Connecticut, guilty of four counts of risk of injury to a minor, a Connecticut law that includes endangering a the morals of a minor. The charges stem from an incident on October 19, 2004, when Amero's classroom computer started displaying pornographic pop-up advertisements.

Prosecutors argued that the images appeared because Amero visited porn sites while in class, while the former teacher's defense attorney argued that spyware installed from a hairstyling Web site caused the deluge of digital smut. The four convictions could have resulted in a maximum of 40 years in prison for the former schoolteacher.

Following the conviction, Eckelberry and others formed a group to analyze the evidence, producing a digital-forensics report that refuted many of the statements made by the prosecution's cybercrime expert, Mark Lounsbury, a detective with the Norwich Police Department, Eckelberry said.

The analysis was not straightforward. Other people, including the middle school's information technology administrator, had accessed the hard drive of the classroom's computer -- a Windows 98 SE machine sporting Internet Explorer 5 and expired security software -- following the pop-up incident. [“Contaminating the e-Crime Scene” Might be an interesting paper... Bob] Moreover, the investigators only gave the defense a copy of the files on the hard drive, not a bit-for-bit copy of the disk, said Joe Stewart, senior researchers for security firm SecureWorks and a member of the Julie Group's forensic analysis team.

"We had to go with what the prosecution gave to the defense," Stewart said. "You couldn't tell after the fact what had happened. You could tell that things were changed, but you couldn't tell how they were changed."

The security researcher hacked together a Web server that could use the browser cache and temporary files to recreate the last Web pages that appeared on the computer. The researchers used that and other digital forensics techniques to piece together some of what happened and refute the prosecution's interpretation of events.

The independent group's analysis of the classroom computer, and vocal criticism from technology professionals across the Internet, convinced the prosecution to request its own digital forensics report from the state's crime laboratory. Following that analysis -- and after delaying Amero's sentencing four times to allow any new evidence to be uncovered -- the judge granted on June 6 a motion by the defense to overturn the verdict and allow a new trial.

... The Amero case would not the first time that confusion about technology has led problematic prosecutions. In 2002, a 29-year-old network administrator was convicted under the Computer Fraud and Abuse Act for sending 5,600 e-mail messages to customers of his former employer -- the now-defunct e-mail provider Tornado Development -- warning about a security hole in Tornado's service that left private messages vulnerable to unauthorized access. The prosecutors in the case argued, and the judge agreed, that McDanel was guilty of unauthorized access and abused Tornado's e-mail servers to send the messages. The prosecutors have since admitted their mistake and the case was overturned on appeal, but not before McDanel served 16 months in prison.

While such cases appear to account for a small number of prosecutions, the increased sophistication employed by bot masters and fraudsters in compromising victims' computer could mean that more muddled cases might be ahead.

"Thinking about the implications -- that any teacher could get infected after going online, have porn show up on their computer and go to jail for 40 years -- that's bad," said SecureWorks' Stewart.

I haven't seen details of the presentations yet, but I'll check back...

http://blogs.zdnet.com/Howell/?p=132

Global legal challenges: General Counsel Forum, Stanford’s E-Commerce Best Practices conference

Posted by Denise Howell @ 5:34 pm June 18th, 2007

... The session focused on legal issues related to doing business globally. My notes follow.

Unrelated?

http://www.bespacific.com/mt/archives/015196.html

June 19, 2007

May 2007 Global Legal Monitor Now Online

Law Library of Congress Global Legal Monitor, May 2007, Issue 5 (58 pages, PDF)

Should we abandon “need to know?” Very “Internet”

http://www.bespacific.com/mt/archives/015192.html

June 19, 2007

DNI McConnell's Foreign Affairs Article

DNI McConnell's Foreign Affairs Article, "Overhauling Intelligence" (10 pages, PDF): "Before World War II, the United States' defense, intelligence, and foreign policy apparatus were fragmented, as befitted a country with a limited role on the world state. With U.S. entry into the war, interagency collaboration developed out of crisis-driven necessity. Wartime arrangements, although successful, were ad hoc. And after the war, President Harry Truman and Congress realized that the United States could not meet its new responsibilities without a national security structure that ratinoalized decision-making and integrated the intelligence and military establishments."

I just love these lists. Always something new to check out...

http://www.webware.com/8301-1_109-9728770-2.html

Webware 100 winners announced!

By Rafe Needleman – June 18, 2007, 3:00 PM PDT

Dilbert's advice to drivers of gas guzzlers...

http://www.unitedmedia.com/comics/dilbert/archive/images/dilbert2004073470620.gif

A little too much “investigative reporting?” Is this now a trend at news sites?

http://www.wnep.com/Global/story.asp?S=6675365&nav=menu158_2

Computer Breach Exposes Students' Social Security Numbers

Monday, June 18, 5:44 p.m. By Andy Hirsch

The News-Item confirms one of its employees gained unauthorized access to the Shamokin Area School District's computer database. It is the same system that stores student's personal information, including social security numbers. That newspaper employee brought the security flaw to the attention of school officials.

... Superintendent James Zack sent a letter home to parents stating "Your son/daughter/student's Standardized Assessment scores, local assessment scores and Social Security numbers were contained in the system.

... Investigators said it was too early to know if any information was actually stolen. School officials pointed out there is no evidence that it was. They also said they've strengthened the security [If it only takes a few days to “strengthen security,” why wasn't it done in the years before? Bob] to the system to make sure something like this doesn't happen again.

... Late this afternoon the publisher of The News-Item released a written statement regarding the breach that read "we acknowledge that an employee of The News-Item is involved in this matter. The person identified and alerted school officials to a security flaw involving the district's web site. The person is cooperating and assisting police with their investigation."

http://www.pogowasright.org/article.php?story=20070618081211128

Data “Dysprotection:” breaches reported last week

Monday, June 18 2007 @ 08:12 AM CDT Contributed by: PrivacyNews News Section: Breaches

A recap of breaches reported last week on this site so you can get caught up with your morning coffee.

Data “Dysprotection:” breaches reported last week

Privacy Plus! Sounds like a great area for a law school paper... (hint, hint)

http://techdirt.com/articles/20070618/182802.shtml

Feds Need A Warrant To Search Email

from the well-that's-nice dept

Remember just last week we were looking at a court case that was trying to work out whether social networking messages were more private than email? Well, now a federal appeals court has strengthened the privacy of good old email as well. It turns out that federal investigators need to obtain a warrant before they can go snooping through your email. Many people probably assumed that was already the case, but the Justice Department felt differently about the matter -- and now have had both a lower court and an appeals court disagree. Of course, there will likely be another appeal, so this may end up in front of the Supreme Court eventually. However, in the meantime, it looks like at least some courts are recognizing that email users should have an expectation of privacy when it comes to their communications.

Privacy Minus? Would this work no matter who we accuse?

http://www.pogowasright.org/article.php?story=20070619050707985

Court allows release of clergy personnel files

Tuesday, June 19 2007 @ 05:26 AM CDT Contributed by: PrivacyNews News Section: In the Courts

A judge ruled Monday that confidential personnel files on Roman Catholic clergy accused of molesting children can be made public even if the clerics were never charged with a crime and legal claims against them were not proven.

"The rights of privacy must give way to the state's interest in protecting its children from sexual abuse," Los Angeles County Superior Court Judge Peter D. Lichtman said in his 22-page ruling.

Source - L. A. Times

Cooks can be temperamental...

http://techdirt.com/articles/20070618/110455.shtml

Australian Court Wipes Out Restaurant Reviewers

from the choose-your-words-carefully dept

A court in Australia has ruled that a critic's unflattering review of a restaurant in a Sydney newspaper constituted defamation (via The Grinder), and that the critic may now be responsible for damages. Writers in the US are afforded plenty of protection when writing reviews and criticisms since they're stating opinions, and decisions like these in other countries will have a chilling effect on all kinds of legitimate speech -- particularly as more and more people use the web to become critics. This isn't to say that no sort of speech should be regarded as defamation, or to say that operating under the guise of being a critic should give people free reign to commit libel or engage in other defamatory speech. However, most definitions of defamation hinge upon false claims being made, and opinions can't really be false. Given this decision, it's hard to see how any Australian writer, newspaper, web site or other outlet would publish any sort of review that's negative at all -- and it's similarly hard to see how that's in the public interest at all.

Attention employers!

http://it.slashdot.org/article.pl?sid=07/06/18/2343229&from=rss

Best Places To Work In IT

Posted by kdawson on Monday June 18, @08:30PM from the good-gigs dept. Businesses IT

jcatcw writes "Computerworld's annual summary of the best places to work in IT lists companies that excel in five areas of employment: career development, retention, benefits, diversity, and training. According to the scorecard, the top five retention methods are: competitive benefits; competitive salaries; work/life balance; flexible work hours; and tuition reimbursement. Of the top 100 companies, 64 expect the number of U.S.-based IT staffers to increase in 2007, on average by 7%. Here is the whole list. The top three are Quicken Loans, University of Miami, and Sharp HealthCare."

Now Matt is a pretty sharp guy, but my textbooks say you do the risk analysis BEFORE you determine what level of security you need.

http://hosted.ap.org/dynamic/stories/D/DATA_THEFT?SITE=VALYD&SECTION=HOME&TEMPLATE=DEFAULT

Ohio Hires Expert to Review Data Theft

By MATT REED Associated Press Writer Jun 17, 10:38 PM EDT

COLUMBUS, Ohio (AP) -- The state has hired a computer security expert to determine the likelihood of someone getting access to the data on a stolen backup storage device, Gov. Ted Strickland said Sunday.

Matthew Curtin, the 34-year-old founder of Interhack Corp., will begin Monday reviewing what's already known is on the device, whose theft was revealed on Friday.

Also on Sunday, Strickland said the device contained the names and case numbers of the state's 84,000 welfare recipients, who face "a remote threat of identity theft," and the names and federal tax identification number of vendors that receive payroll deduction payments from the state - about 1,200 records. Sixteen of those records contain banking information, he said.

.... Strickland and Curtin said the analysis of what's on the device should be finished on Monday.

Very interesting. Send a copy to everyone who shops at TJX

http://www.pogowasright.org/article.php?story=20070617194025977

Article: Civil Actions for Privacy Violations 2007: Where Are We?

Sunday, June 17 2007 @ 07:47 PM CDT Contributed by: PrivacyNews

Two threads in civil litigation over security breaches and privacy violations have emerged over the past two years. One is that private rights of action in the federal courts, based upon federal statutes, face very significant obstacles. The major obstacles include the lack of any private right of action under federal privacy-oriented laws and inability under many theories to plead an acceptable basis for damages. A second thread is that state courts, addressing state based causes of action, can often provide a more appealing forum for plaintiffs. Litigators need to be aware that creativity in both forum selection and pleading have a great deal to do with viability of private actions. Following is a brief review of some of the important decisions affecting rights to recover for violations of the confidentiality of personal data.

Source - HowardRice.com [pdf]

Looks like Bill wants to be Governor of New York!

http://politics.slashdot.org/article.pl?sid=07/06/17/2011226&from=rss

Microsoft Moves To Change NY State Election Law

Posted by kdawson on Sunday June 17, @04:54PM from the taking-a-page-from-the-telcos dept.

myspace-cn sends us to Bo Lipari's blog where it is revealed that Microsoft has moved forcefully into New York State with proposed changes to NY state election law drafted by Microsoft attorneys. A document has been circulating (PDF) among the legislators for a while now. The proposed changes would gut the source-code escrow and review provisions in current law that were hard-fought-for and passed in New York in 2005. Microsoft is siding with the makers of voting machines that run on Windows — the company doesn't want its code inspected by outsiders. From the article: "Now the software giant has gone a step further, not just saying 'we won't comply with your law' but actively trying to change state law to serve their corporate interests... Adding insult to injury, these changes are being slipped into a bill that may be voted on Monday or Tuesday, June 18 or 19."

One for the e-Discovery folks to follow. How much will they find?

http://www.bespacific.com/mt/archives/015160.html

June 17, 2007

Office of Special Counsel Directs 18 Agencies to Preserve E-Mail for Investigation

Daniel Pulliam at Govexec.com reportd, "Eighteen agencies have been asked by the Office of Special Counsel to preserve electronic information dating back to January 2001 as part of its governmentwide investigation into alleged violations of the law that limits political activity in federal agencies. The OSC task force investigating the claims has asked agencies, including the General Services Administration, to preserve all e-mail records, calendar information, phone logs and hard drives going back to the beginning of the Bush administration."

Privacy stands... Interesting.

http://www.iht.com/articles/2007/06/17/bloomberg/bxswift.php

Swift must defend itself in case about violation of privacy

By Andrew Harris Bloomberg News Monday, June 18, 2007

CHICAGO: Swift, the banking cooperative based in Belgium that has aided U.S. government efforts to trace terrorist financing, must defend a lawsuit accusing it of violating the privacy rights of U.S. citizens, a judge has ruled.

... Judge James Holderman of the U.S. District Court in Chicago said that the complaint brought by two bank customers contained sufficient allegations to support a claim that Swift had violated the U.S. Right to Financial Privacy Act, a law limiting the right of the government to view bank customers' records.

... The suit was filed last June, after The New York Times reported Swift's cooperation with the U.S. government.

... Holderman issued the ruling June 12. The judge dismissed claims that Swift's disclosures violated constitutional free speech guarantees or Illinois consumer fraud laws. He allowed the suit to go forward on the privacy claim and the accusation that Swift violated the Fourth Amendment of the U.S. Constitution, barring unlawful search and seizure.

Good technology does not guarantee good users...

http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20070616/internet_camera_070616/20070616?hub=CTVNewsAt11

N.S. family inadvertently got spied upon

Updated Sat. Jun. 16 2007 9:29 PM ET CTV.ca News Staff

A Nova Scotia family has inadvertently been on Internet "candid camera" for months without their knowledge.

Dale Gass became their peeping tom by accident.

"It is kind of disturbing these videos are being sent to me. It's an invasion of privacy," he said.

Gass used to own a wireless security camera. Unfortunately, it is now installed in the family's house, and no one seemed to have a clue where they lived.

"Thankfully they are a nice wholesome family, not doing anything too shocking," he said.

Gass's former camera sends an e-mail image every time it senses motion.

He was unsatisfied by the product and returned it to the retailer, but forgot to remove his e-mail address from its software.

Someone else bought the camera, but apparently didn't put in their own e-mail address, so now the camera is sending him images from their house.

"I received them at the rate of two to 10 a day," Gass said.

Staples Canada said it warns stores to make sure this particular model of camera is fully erased before resale.

However, retailer Tim Walker pointed the finger at Gass. "The onus is on him to make sure that camera had been reset," Walker said.

No matter who's to blame, one privacy expert said the case is yet another cautionary tale for consumers.

"It also raises the question of how many other cases are happening without other people know about it," said Philippa Lawson of the University of Ottawa's Canadian Internet Policy and Public Interest Clinic.

Gass eventually put out a public appeal and located the family.

Related... Frequently the only concern expressed is “they have a database” -- another perspective is: What controls are placed on the users of that database?

http://politics.guardian.co.uk/homeaffairs/story/0,,2105272,00.html

330,000 users to have access to database on England's children

Monday, June 18 2007 @ 06:34 AM CDT Contributed by: PrivacyNews

A giant electronic database containing sensitive information on all 11 million children in England will be open to at least 330,000 users when it launches next year, according to government guidance.

A final consultation on the plan reveals that the index, intended to help children's services work together more effectively following the death of Victoria Climbié, will be accessible through any computer linked to the internet, [let's hope it is only 330,000 Bob] whether at work or at home, providing users have the correct two-part security authentication.

Source - Guardian

Perhaps it could also mark those locations where using free wifi is illegal?

http://www.techcrunch.com/2007/06/17/wefi-an-easier-way-of-finding-wifi/

WeFi: An Easier Way Of Finding WiFi

Duncan Riley June 17 2007

WeFi is aiming to deliver a better outside internet experience by making WiFi as easy to use as a cell phone.

... The WeFi client replaces the Windows connection manager and finds and connects to free WiFi hotspots. The location of free hotspots is displayed on a map that also shows the location of other WeFi users. [Attention stalkers? Bob] The maps are regularly updated as users discover and connect to WiFi. This is delivered without changing or modifying access points, delivering a complementary service to other WiFi sharing initiatives such as fon.

... The service is currently in private beta and will be opened to the public Wednesday.

A video (of a slide show) I can use in my Statistics class, my Intro to Technology class, etc. etc. and so forth.

http://www.youtube.com/watch?v=1RXNWwGUsBU

future of technology

Added: February 19, 2007 From: tanjentsdotcom

Strange in so many ways...

http://www.caller.com/news/2007/jun/16/professor-loses-student-data/

Professor loses student data

By David Kassabian Saturday, June 16, 2007

A flash drive holding information on about 8,000 current and former Texas A&M University-Corpus Christi students was lost by a mathematics professor while on vacation in Madagascar, university officials said Friday.

The flash drive -- a thumb-sized memory data storage device -- may have contained Social Security numbers and other identifying information for students of all classifications and majors enrolled [Why did he have it? Why take it to Madagascar? Bob] during the spring, summer and fall of 2006, said Marshall Collins, assistant vice president for marketing and communications at the university.

... Sterba-Boatwright was using the information for a statistical study, and it wasn't immediately clear why he took the records with him on vacation or if a violation of university policy occurred, Collins said.

... Sterba-Boatwright returned to the United States during the weekend and told university officials shortly after arriving back in the country that he noticed the flash drive was missing, Collins said. University officials waited until Friday [traditional 'bad news' day Bob] to notify via e-mail students whose information may have been compromised because it wasn't immediately clear what may have been on the flash drive, he said.

"That is what took a while -- when someone says I cannot find a flash drive and I believe those files were on it, we had to re-create what they could be," [because we had no inventory! Bob] Collins said. "We can only go by what he's telling us."

Follow-up: Getting accurate information on a security breach sometimes seems harder than getting a politician to give you a straight answer... Oh, wait. We are trying to get a politician to give us a straight answer!

http://www.columbusdispatch.com/dispatch/content/local_news/stories/2007/06/17/DATAFOLO.ART_ART_06-17-07_A1_H271P45.html

Bank data on stolen tape

Ongoing analysis determines that governments, school districts among those who may be affected

Sunday, June 17, 2007 3:43 AM By Mark Niquette THE COLUMBUS DISPATCH

Bank-account information for local governments, school districts and certain state employees and vendors was among the data on a computer backup tape stolen from an intern's car last week, Gov. Ted Strickland announced yesterday.

The stolen tape also contains bank-account numbers for Medicaid providers, retirement account numbers for teachers, plus Social Security numbers for more than 75,000 dependents of state employees, the governor said.

And there could be more: Strickland said the state knows other sensitive data is on the tape and an analysis continues. [...we don't bother inventorying this stuff, because it's not important ... Bob He has scheduled a news briefing today to report any new findings.

... Strickland continued to say yesterday that there is no evidence the data has been used, and that it's unlikely the tape could be accessed without specialized knowledge or equipment.

... Greg Knieriemen, vice president of Chi Corp., a suburban Cleveland company that specializes in data storage, backup and protection, said any protocol sending backup copies home with an employee is "way out of date."

Knieriemen, whose firm's clients include the state of Nevada and Ohio State University, also disputed Strickland's claim that it would be difficult to access personal information on the stolen tape. Without a high level of encryption, the information on the tape could be readily retrieved, he said.

"Everything that's tape-formatted, if it's not encrypted, can be read by basic computer software," Knieriemen said. "If it wasn't encrypted, (Strickland's) statement is pretty much a stretch."

The state has confirmed that the data on the stolen tape is not encrypted, and Strickland has issued an executive order calling for the development of a new protocol to encrypt sensitive data.

Wasn't this obvious?

http://www.pogowasright.org/article.php?story=20070617040858729

Analysis: Privacy, Security, and the Regional Health Information Organization

Sunday, June 17 2007 @ 04:08 AM CDT Contributed by: PrivacyNews

Regional health information organizations (RHIOs), which promote electronic exchange of patient information among participants, are grappling with a variety of privacy and security issues as they evolve. This study, based on a literature review, interviews, and an informal survey, examines some of the key issues that nine RHIOs encountered and their strategies for managing them.

The study found that privacy and security challenges are surmountable. A RHIO’s unique characteristics—the types of data shared, who participates, and its specific needs and priorities, among others—influence how an exchange addresses these challenges. Solutions are diverse and evolving.

The study also found that consumers play a limited role in privacy and policy decisions, even though they are important RHIO constituents. [Is this bad management? Bob] RHIOs could benefit from the experiences of and collaboration with others, and policymakers can help RHIOs navigate privacy and security issues and move toward sustainability.

Source - California HealthCare Foundation Related - Download Report [pdf]

(Props, Australian Health Information Technology) (blog)

Interesting legal strategy? Lots of legal responses suggested in the comments...

http://yro.slashdot.org/article.pl?sid=07/06/16/1940231&from=rss

Student Blogger Loses Defamation Case

Posted by kdawson on Saturday June 16, @05:47PM from the small-claims-is-a-bear dept.

An anonymous reader writes to tell us about Yaman Salahi, a UC Berkeley student and blogger, who lost a lawsuit brought against him by Lee Kaplan, a journalist for FrontPageMag.com. Kaplan had sued Salahi in California small claims court for tortious business interference and libel, in response to a blog Salahi had set up about him called "Lee Kaplan Watch." Salahi lost in small claims court and then lost an "appeal" — which is essentially a retrial by another small-claims judge. No written opinion was offered with either decision, though all other court filings are available. From Salahi's update on his blog:

"...because [Kaplan] sued me in small claims court, I did not have the protections of the anti-SLAPP [Strategic Lawsuits Against Public Policy] statute... I will never know why I lost the initial hearing, or why I lost the appeal, because small claims judges are not obligated to release written opinions with their rulings.... I will never have the opportunity to take this to a real appellate court where my first amendment rights might be protected."

What have we been saying? (I think they might have a slight case of Google-hate going on here too)

http://blog.wired.com/27bstroke6/2007/06/torrentspy_case.html

TorrentSpy Case Shows Privacy Policies and Practices Protect Companies, Too

By Ryan Singel Email June 14, 2007 | 5:48:55 PM

A recent court ruling regarding the server logs of a torrent search engine makes it clear that privacy policies and privacy practices protect users and companies alike, a lesson that Google should have learned in its case against the government but has not.

TorrentSpy, a BitTorrent search and tracker hosting site, is being sued (.pdf) by Hollywood moviie studios for allegedly enabling and encouraging people to illegally trade copyrighted material. Hollywood's lawyers wants the company to turn over its server logs as part of the discovery process, but the site says it doesn't keep logs.

However the presiding federal district court judge ordered the company to begin saving their logs since the company's servers 'save' the logs in RAM memory for about 6 hours before the info is tossed or overwritten. Essentially the magistrate judge Jacqueline Chooljian of California's Central District is ordering the company to hold onto information it normally decided to toss as part of its privacy policy promises to its users. The ruling is the first to say that temporary server logs count as electronic evidence under new court rules about electronic data that went into effect in 2006.

... A strong privacy policy won't keep a judge from ordering a company to log data, but it is a strong deterrent to such an order since one can argue it will destroy your user's trust. TorrentSpy included language which said that the privacy policy could change at any time. A policy that included categorical language such as we will never turn IP address information over to anyone would have held up way better in court.

But most importantly, TorrentSpy's practice of not keeping server logs is the best protection they could have given their users.

Google could easily do something similar. For instance on the user sign-up page, instead of opting user's in to a Web tracking system, they could offer a range of options -- from "Keep my data for 18 months" to "Clean out my data weekly. I'm not interested in personalization." It's technically very simple for Google to implement via a series of scheduled comparisons of user preferences against logs, but they seem wholly uninterested in being a privacy leader. For evidence of that, one need to look no farther than its unwillingness to tell the public how often it is subpoenaed and the fact that the company has no chief privacy officer.

Interesting. Will reporters attempt to identify who is paying for videos like these? A possible new form of “attack ad?”

http://www.technewsworld.com/rsstory/57878.html

Obama Groupies, Image Control and the Veracity of Viral Video

By Christi Parsons and John McCormick Chicago Tribune 06/17/07 4:00 AM PT

An unauthorized -- and racy -- YouTube music video promoting presidential candidate Barack Obama has put his camp in an odd position. A woman dances half-naked while lip-syncing Obama's praises, and she's also warmly kissing his photograph, yet another reminder that candidates have less and less control of their own images and messages when everybody has bandwidth.

Young people can make a difference in politics, Sen. Barack Obama says in a new campaign video, by speaking up about "the things that are making you passionate."

Elsewhere on YouTube, a very scantily clad young woman is doing exactly that -- in an unauthorized music video about her "Crush on Obama" that features her pole-dancing in a subway car and wearing a pair of "Obama" shorts that barely contain her enthusiasm for politics.

Word of the new music video was spreading swiftly on the Internet Thursday, and, with more than 55,000 views after less than a day, [55.001 Bob] it was on its way to becoming one of the site's most popular clips.

Thanks, I Guess?

The music video, the launch gimmick of a new political Web site, barelypolitical.com, put the Obama camp in an odd position. True, the woman in the music video is clearly declaring Obama "the best candidate," arguably a message they'd like to see going viral on the Web.

Trouble is, she's half-naked while lip-syncing Obama's praises, and she's also warmly kissing his photograph, yet another reminder that candidates have less and less control of their own images and messages when everybody has bandwidth.

To be sure, the campaigns are happy to use venues like YouTube as low-cost alternatives to expensive television ads and mailings. However, when the barrier to entry is as low as the click of a mouse, there's no way for them to control where their images go or how they are used.

Controlling the Narrative

Just ask Democratic Sen. Hillary Clinton, who watched in March as a video spread across the Web depicting her as an Orwellian tyrant in a reprise of the 1984 Apple ad. Republican Sen. John McCain got his, too, with a video in which he sang "Bomb Iran" to the tune of "Barbara Ann."

While a video of former Sen. John Edwards perfecting his hair for a mirror was making the rounds, his latest talk about poverty got a little lost in the noise.

"This is definitely a sign of the emerging of the grass roots," said Democratic consultant Jenny Backus, who is not working for any of the presidential candidates. "Campaigns can't control their own narrative all of the time anymore."

In addition, such "volunteer" Internet videos are free of the strict standards that apply to political ads on radio and television. The Federal Election Commission in 2006 decided it would regulate only paid political ads on the World Wide Web, saying that "the vast majority of Internet communication" would be free from campaign finance regulation.

That leaves the Web as the hottest place for stealthy operations working outside the official campaign command.

Genuine Admiration

In this case, some political strategists say, those within the age demographic who would typically pass along and seek out the "Crush on Obama" video are probably inclined to like it and not find it offensive.

A generation raised on MTV is arguably less likely to respond to an old-school political ad than to one that looks more like a Pussycat Dolls video featuring Timbaland.

Ben Relles, 32, one of the music video's creators, said he's a big Obama fan but that he and a friend put the piece together mainly for the pleasure of it.

He said the effort was not coordinated with the Obama campaign and that his intent is not just to sell merchandise.

"It's mostly for fun," he said, between appearances Thursday on MSNBC and Fox News.

Relles said the video cost about US$2,000 to create.

... For voters under 30, said one Democratic media strategist, videos made by unpaid volunteers are the equivalent of the old-fashioned neighbor-to-neighbor recommendation over the back fence. They're proliferating like viruses on the Web.

... In this case, the Obama team wants it to be clear that it had nothing to do with the video, but they're not objecting to the product placement, either.

... Obama's team is making its own YouTube play this week. A video featuring him talking into the camera for two minutes and asking for volunteers to send in recordings of their work was also one of the top-watched videos Thursday.

"Send us your stories," Obama says on the video. "And what we hope to do is over the next several months to stitch together these stories to illuminate for the entire country how this next generation wants to grab the baton and lead us forward."

Some supporters are taking that exhortation more seriously than others.

Research tool?

http://www.bespacific.com/mt/archives/015146.html

June 15, 2007

Chronicling America Site Now Offers 310,000 Newspaper Pages

Press release: "Program to Put Digitized Newspapers Online Makes Eight Awards - "Approximately 310,000 digitized newspaper pages, dating from 1900 to 1910, are now accessible through the Chronicling America Web site... New features in Chronicling America include: 80,000 pages have been added (including 11 new titles); The page display has been revised. Adobe Flash Player is no longer needed for viewing; Persistent links are now displayed for every title record and page view; The persistent link enables a user to always return to the same place on the site, and it can be used for citations and hyperlinking to specific newspaper pages or newspaper title information; and Searches can be saved."

Equipping America to spy on itself! (Clearly, all phones could do this and probably will in a few months...)

http://www.nytimes.com/2007/06/14/technology/14phone.html?ex=1339473600&en=1243e21678e2244f&ei=5088&partner=rssnyt&emc=rss

A Phone for the Sly Can Record Calls and Store Them on a Computer

By ROY FURCHGOTT June 14, 2007

... The phone, which makes calls over the Internet, can record your calls and save them on the hard drive of your computer.

... Of course, secretly recording calls is illegal in many states, which the Free.2 addresses by posting a warning on the screen of the other person’s computer (or inserting an occasional beep on calls to phones), alerting people that they are being recorded.

Related. A tool for instant justice, I love it!

http://www.newlaunches.com/archives/new_system_detects_calls_while_driving.php

New system detects calls while driving

Statistics show that driving while talking on the cell phone increases the chance of an accident by 400%. Though speaking on the cell phone while driving is not a crime in many states as of yet taking into consideration the statistics it will eventually be banned in all the states. A new company Highway and Safety control is releasing a device to automatically detect drivers talking on their cell phones. [I wonder how it knows it isn't the passenger? Bob] Instead of police officer needing to observe a cellphone in use, the system automatically detects a cell phone call and records which car was making the call. Already in use in a few European countries the system will make it to the US this fall it is designed to detect, identify and cite drivers who break cell phone us laws." . The company attaches a paint gun to mark the car, or even an EMP gun that can disable the offending cell phone. [Could we upgrade to a bazooka? Bob]

Ditto Remember this next time someone “helps” you set up your computer... Good overviwe of “what's possible”

http://digg.com/tech_news/Stalking_2_0_The_Websites_that_Track_Your_Every_Move_Voluntarily

Stalking 2.0: The Websites that Track Your Every Move (Voluntarily!)

So, you don ’t mind being followed and tracked? You don’t care if your friends can see what websites you’ve been to lately, what software you’ve been running, or even what music you’ve been listening to? Below, we round up 12 services that want to track your every move - voluntarily.

http://mashable.com/2007/06/16/stalking2/