Perhaps not exactly TJX, but big, with the potential to be a great “Bad example” for the textbooks.

http://www.pogowasright.org/article.php?story=20080318175429785

Hannaford and the evolution of the data breach

Tuesday, March 18 2008 @ 05:54 PM EDT Contributed by: PrivacyNews News Section: Breaches

As the rash of large data breaches and thefts continues unabated, it’s important to resist the urge to lump them all together. Not all breaches are created equal, and the latest one, at Hannaford supermarkets, illustrates this point perfectly. A lot of people are comparing the incident to last year’s breach at TJX, but the two stories have far less in common that it appears at first blush.

Source - Security Bytes

[From the article:

The details of the Hannaford incident are still pretty murky, but the language in the statement from the company’s CEO and other bits of data that have emerged today suggest that the chain may have been the victim of a man-in-the-middle attack.

Related

http://www.pogowasright.org/article.php?story=20080318180218605

Hannaford Bros. Was in Compliance with PCI When Hacked

Tuesday, March 18 2008 @ 06:02 PM EDT Contributed by: PrivacyNews News Section: Breaches

Fraudsters obtained payment card data originating with Hannaford Bros. Co. while the regional supermarket chain was compliant with the Payment Card Industry data-security standard, or PCI. The disclosure may mark the first publicly known breach of a PCI-compliant merchant.

“We were certified [as PCI-compliant] last spring and we were recertified in February,” Hannaford vice president of marketing Carol Eleazer tells Digital Transactions News. She could not identify Scarborough, Maine-based Hannaford’s PCI assessor. Some 4.2 million credit and debit card numbers were exposed in a breach that happened between Dec. 7 and March 10 (Digital Transactions News, March 17). Some 1,800 cases of fraud are believed linked to the breach.

Hannaford’s president and chief executive, Ronald C. Hodge, indicated in a statement on Monday that the hacker or hackers obtained card numbers and expiration dates during the authorization process, implying possible illicit access as data moved between point of sale terminals, electronic cash registers, or servers. The PCI standards require encryption of data that are in transit. Older payment-processing technology can leave wireless data exposed to interception for a fraction of a second during authorizations.

Eleazer did not have further details on Tuesday about exactly how the fraud happened, saying it is under investigation by the U.S. Secret Service and experts inside and outside the company. But she does say that Hannaford had been using data encryption all of last year. In fact, she adds, “in 2007 we had just recently upgraded our wireless encryption.”

Source - Digital Transactions

Related only because the mention Hannaford, but it would be interesting to compare policies. Where do they see the risk?

http://www.pogowasright.org/article.php?story=20080319071900534

The pros and cons of data breach insurance

Wednesday, March 19 2008 @ 07:19 AM EDT Contributed by: PrivacyNews News Section: Breaches

Security incidents at the Hannaford Bros. Co. supermarket chain and elsewhere illustrate the importance of a good response plan, but industry experts are less than enthusiastic when asked if such a plan should include data breach insurance.

Some experts say it doesn't hurt to include the insurance as part of a larger data breach response program. But in general data breach insurance is an immature product that lacks uniformity from one provider to the next, others warn.

Source - SearchSecurity.com

Related? Scene of the next big data breach?

http://www.bespacific.com/mt/archives/017845.html

March 18, 2008

Study of Worldwide Airports Reveals Wireless Security Risks for Travelers and Airport Operations

Press release: "...AirTight® Networks, the global leader for wireless intrusion prevention systems...issued the findings from its study to assess information security risk exposure of laptop users at fourteen airports in the United States, Canada and Asia. The company set out to understand the risks to business travelers and their corporate networks of data leakage while those airline passengers are sending sensitive information using unsecured wireless access points while at the airports. It found surprising results, however, regarding the security posture of private Wi-Fi networks in these airports as well as the rapid spread of viral Wi-Fi networks.

One of the most surprising findings of this initial study was that some ticketing systems, baggage systems, shops and restaurants were using open or poorly secured wireless networks. Of the Wi-Fi networks detected by AirTight researchers, 77 percent were non-hotspot (i.e. private) networks and of those, 80 percent were unsecured or using legacy WEP encryption, a fatally flawed protocol. Based on detailed analysis of these access points, there is a high probability that some of these networks are used for critical airport logistics and operations. The consequences of this lack of security could result in disruption of baggage or passenger ticketing systems."

Another hack! Perhaps they should take my Computer Security class?

http://www.pogowasright.org/article.php?story=20080319072437119

UK: Credit details stolen in Carshalton internet fraud

Wednesday, March 19 2008 @ 07:24 AM EDT Contributed by: PrivacyNews News Section: Breaches

Hundreds of customers have had their credit card details stolen after a Carshalton homeopathic store was hit by internet fraudsters.

Naturally Thinking in Carshalton High Street was targeted by hackers in October 2007 who gained access to customer details via the store's 24 hour online shopping website.

....hackers were able to get hold of customers' credit card numbers and personal details, including addresses.

One customer found a £4000 watch on his credit card bill which he had not bought and several other customers reported between £600 and £800 worth of unaccounted expenditure on their cards.

Source - Wimbledon Guardian

Another interesting (double-secret-probation type) business model.

http://www.pogowasright.org/article.php?story=20080319074029652

Don't Want A Debit Card? Key Bank Will Charge You $1 A Month

Wednesday, March 19 2008 @ 07:40 AM EDT Contributed by: PrivacyNews News Section: Businesses & Privacy

After hearing about Hannaford's giant customer data breach yesterday, Brian decided to cancel the debit card he'd used there. That's when he found out that Key Bank really wants you to have a debit card. In fact, they'll charge you a small monthly fee to not have one linked to your "free checking" account. We figure that this means Key Bank makes about $12 a year more off of customers who have linked debit cards—and that if you want greater security on your account, it's going to cost you.

Source - The Consumerist

This falls into the category I call “Don't let 'em gather no evidence!”

http://www.pogowasright.org/article.php?story=20080318170855308

UCLA hospital bans cellphones, laptops

Tuesday, March 18 2008 @ 05:08 PM EDT Contributed by: PrivacyNews News Section: Breaches

UCLA’s neuropsychiatric hospital has banned all cellphones and laptop computers after a patient posted group photos of other patients on a social networking website, officials confirmed Monday.

Dr. Thomas Strouse, medical director of the Resnick Neuropsychiatric Hospital, said in a statement that the decision was part of “UCLA Health System’s ongoing efforts to enhance patient privacy and confidentiality in compliance with California’s patient rights law.”

[…] UCLA spokeswoman Dale Tate said the hospital became aware of the posted photos coincidentally from a nurse’s family member. The patients apparently all gave their consent to be photographed, Tate said.

“I was concerned about the potential covert use of such cameras, without the consent of those being photographed, or under circumstances where someone’s agreement to be photographed might not be well-reasoned or fully competent,” Strouse said in the statement.

[…] Other hospitals have banned cellphone cameras as well. Rady Children’s Hospital in San Diego forbade employees from carrying cellphones in patient-care areas after investigators found images of children, taken at the hospital, on a respiratory therapist’s computer and cellphone. The therapist later pleaded guilty to child molestation and exhibiting a minor in pornography.

Source - Los Angeles Times

Another first for New Jersey?

http://hosted.ap.org/dynamic/stories/C/CAMPUS_GOSSIP?SITE=VALYD&SECTION=HOME&TEMPLATE=DEFAULT

College Gossip Site Under Scrutiny

By BRAD HAYNES Associated Press Writer Mar 18, 8:36 PM EDT

TRENTON, N.J. (AP) -- New Jersey prosecutors have subpoenaed records of JuicyCampus.com, a Web site that publishes anonymous, often malicious gossip about college students.

Language on the site ranges from catty to hateful and offensive. One thread, for example, on the "most overrated Princeton student" quickly dissolves into name-calling, homophobia and anti-Semitism.

JuicyCampus may be violating the state's Consumer Fraud Act by suggesting that it doesn't allow offensive material but providing no enforcement of that rule - and no way for users to report or dispute the material, New Jersey Attorney General Anne Milgram said Tuesday.

I frequently rant about reliance on passwords. Here is a site (one of many) where you can determine how difficult your passwords would be to guess (using password cracking software) and why...

http://www.killerstartups.com/Web-App-Tools/PasswordMetercom---Test-Your-Password-Strength/

PasswordMeter.com - Test Your Password Strength

The Password Meter is a free program that will assess the general strength of any password you enter, so you can get an idea of how secure your password really is.

http://www.passwordmeter.com/

No doubt this will solve everything!

http://www.pogowasright.org/article.php?story=20080319064300233

Facebook adds privacy features

Wednesday, March 19 2008 @ 06:43 AM EDT Contributed by: PrivacyNews News Section: Internet & Computers

Facebook Inc. is tweaking the privacy settings on its popular online hangout to let users exert greater control over which of their friends are allowed to see personal details they post.

The Palo Alto-based company said it would add features Tuesday night that will give its 67 million active users the option of selecting individual users who can or can't access certain parts of their pages.

Source - Forbes

Electronic devices are merely “containers,” and searching them increases national security, and the moon is made of cheese, and politicians have no hidden agenda, and....

http://www.pogowasright.org/article.php?story=20080319064023831

Handhelds, laptops are next privacy frontier

Wednesday, March 19 2008 @ 06:40 AM EDT Contributed by: PrivacyNews News Section: In the Courts

William Leask may seem an unlikely and unseemly poster child for the privacy rights of Canadian travellers, considering he will appear in a Fort Erie, Ont., courtroom today to learn his sentence for crossing the Peace Bridge with child pornography on his laptop computer.

But legal experts say his case raises a larger and often overlooked issue – the power police and security officials have to probe the vast amounts of personal information contained on mobile electronics. They can now get access to mountains of digital information without a search warrant by confiscating or searching physical devices such as laptop computers or cellphones equipped with e-mail, such as BlackBerrys, something experts believe represents a gaping hole in Canadian law.

Source - globeandmail.com

[From the article:

The situation in the U.S. has reached the point where some businesses, such as Toronto-based law firm Blaney McMurtry LLP, now require that employees ensure their laptops are “wiped clean” of any sensitive information before they cross an international border. The firm is drafting a similar policy for its BlackBerry devices.

... Most experts agree that the U.S. Constitution states that normally, government officers would need a warrant to search through the contents of someone's BlackBerry, cellphone or laptop. However, Orin Kerr, a law professor at George Washington University, says border crossings are an exception.

This is interesting – but ultimately useless.

http://techdirt.com/articles/20080317/162504563.shtml

Ohio E-Voting Machines Declared A Crime Scene?

from the good-luck-trying-to-pull-out-the-evidence dept

While it's difficult to believe some of the more conspiracy-minded theories that have gone around concerning voting results from Ohio in 2004, the simple fact that there's absolutely no way to go back and review the results highlights exactly the problem with e-voting machines. Ohio's current secretary of state has now declared some of the machines used in the '04 election as a crime scene to be investigated, but everyone admits that there's little to no chance of being able to recreate what actually happened on election night, and no way to tell if the machines acted properly or if they malfunctioned. And, if they did malfunction, there's no way to tell if it was due to an accident or something underhanded. In other words, whether or not everything worked great or everything worked terribly, there's simply no way to tell. That is why so many of us have trouble with the concept of e-voting machines. Even if they work perfectly, there's no way to confirm that -- and it just leads to more speculation and conspiracy theories about "stolen" elections

Always a topic of interest – how far behind the industry is the government?

http://www.bespacific.com/mt/archives/017844.html

March 18, 2008

DHS Privacy Office - 2008 Data Mining Report

2008 Data Mining Report (PDF, 46 pages), February 11, 2008. "This is the third report by the Privacy Office to Congress on data mining. This report identifies the data mining activities deployed or under development within DHS, as defined by the Data Mining Reporting Act, and describes the framework the Department will use to report on such activities in the future pursuant to Section 804 of the Implementing Recommendations of the 9/11 Commission Act of 2007, entitled, “The Federal Agency Data Mining Reporting Act of 2007” (Data Mining Reporting Act)."

• 2007 Data Mining Report (PDF, 42 pages). "This is the second report by the Privacy Office to Congress on data mining. This report describes data mining activities deployed or under development within the Department that meet the definition of data mining as mandated in House Report No. 109-699 - Making Appropriations for the Department of Homeland Security for the Fiscal Year Ending September 30, 2007, and for Other Purposes."

The world, she is a-changing

http://news.wired.com/dynamic/stories/Q/QWEST_BUYOUTS?SITE=WIRE&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2008-03-18-14-08-13

Qwest Land-Line Workers Offered Buyouts

By P. SOLOMON BANDA Associated Press Writer Mar 18, 5:30 PM EDT

DENVER (AP) -- Up to 700 technicians and other Qwest Communications employees who work on traditional land telephone lines have been offered voluntary buyouts, the company announced Tuesday.

Related. Indications another “industry” is dying?

http://techdirt.com/articles/20080318/074802570.shtml

Science Journal Won't Publish Papers Because Authors Want To Put Them On Wikipedia

from the mine,-all-mine! dept

Over the last few months, we've been hearing more and more stories concerning some of the ridiculous levels of control that academic journals exert over the copyrights on the various papers and research they publish. Since many of those journals are ridiculously expensive, much of this important research is basically locked up entirely. This is especially troublesome when it comes to publicly funded research, which you would think should be available to the taxpayers who paid for it. While we've definitely seen a trend towards more open rules to publishing, many journals are still behind the curve. Reader parsko writes in to alert us to the news of the American Physical Society, which withdrew the offer to publish two recent studies in the Physical Review Letters because the authors wanted to be able to publish parts of the study in Wikipedia. Since the APS requires you hand over the rights to the study, they wouldn't allow it, and turned down the papers because of it. Not surprisingly, various scientists are upset about this, pointing out that it seems totally contrary to the purpose of the journal to hide such information using copyright claims. The APS has now said that it will reconsider the policy at its next meeting, but the fact that it even got this far suggests how locked down many of these journals are.

So Bear Sterns is in good hands?

http://slashdot.org/article.pl?sid=08/03/18/1928245&from=rss

JP Morgan's Insider Trading How-To On Wikileaks

Posted by kdawson on Tuesday March 18, @10:38PM from the ten-bee-five-dash-one dept. Businesses The Almighty Buck

An anonymous reader writes

"In an internal JP Morgan document published recently, Wikileaks exposes JPM's efforts to circumvent insider trading regulations, enabling their wealthy clients to profit even when others are losing. The document reads like a how-to and explains how to take advantage of SEC Rule 10b5-1, which has long been considered ripe for abuse. Now this abuse is publicly documented and will be hard to ignore."

Psst! Pass it on!

http://googleblog.blogspot.com/2008/03/google-for-non-profits.html

Google for Non-Profits

3/18/2008 01:15:00 PM Posted by Chris Busselle, Investments Manager, Google.org

Many of you spend your days making this world a better place, and we want to do our part to help. Today, we're excited to launch Google For Non-Profits, a one-stop shop for tools to help advance your organization's mission in a smart, cost-efficient way.

This is an interesting model – do you suppose they have a rep on each campus or work through the schools?

http://kaaltv.com/article/stories/S374305.shtml?cat=10728

INTERNET INSITE: Take virtual college tours online

Posted at: 03/11/2008 07:46:25 AM By: Justin Piehowski, Web Manager

... Instead of shelling out the cash to visit the campuses all around the country, try heading first over to ecampustours.com. The site has 360 degree virtual tours of just about every college campus in the country (the University of Minnesota--Twin Cities, my alma-mater, is one campuses that's noticeably absent).

You must first register on the site before looking, but after that, it is fairly easy to use. Just do a search for the college you'd like to see by name or by selecting a state.

https://www.ecampustours.com/virtualtours/manageaccount/createaccount.aspx

Won't this amaze my Statistics students! (You don't suppose the researchers too have a high “to much beer” correlation?) Perhaps we should get a government grant to study wine, Jack Daniels, etc

http://science.slashdot.org/article.pl?sid=08/03/19/0211242&from=rss

Scientists' Success Or Failure Correlated With Beer

Posted by kdawson on Wednesday March 19, @05:34AM from the malt-does-more-than-milton-can dept.

mernil sends in an article from the NYTimes that casts a glance at a study done in the Czech Republic (natch) on what divides the successful scientists from the duffers.

"Ever since there have been scientists, there have been those who are wildly successful, publishing one well-received paper after another, and those who are not. And since nearly the same time, there have been scholars arguing over what makes the difference. What is it that turns one scientist into more of a Darwin and another into more of a dud? After years of argument over the roles of factors like genius, sex, and dumb luck, a new study shows that something entirely unexpected and considerably sudsier may be at play in determining the success or failure of scientists — beer."

I wonder what the Swim Suit issue looked like 53 years ago?

http://www.bespacific.com/mt/archives/017837.html

March 18, 2008

Sports Illustrated Poised to Release Free Searchable Archive Dating Back 53 Years

New York Times: On Thursday [March 20, 2008] Sports Illustrated "will introduce the Vault, a free site within SI.com that contains all the words Sports Illustrated has ever published [over 53 years] and many of the images, along with video and other material, in a searchable database."

A legend is gone.. He wrote: “Any sufficiently advanced technology is indistinguishable from magic.” And “When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.”

http://science.slashdot.org/article.pl?sid=08/03/18/2214208&from=rss

Arthur C. Clarke Is Dead At 90

Posted by kdawson on Tuesday March 18, @06:27PM from the pod-bay-doors-are-open dept.

Many readers are sending in word that Arthur C. Clarke has died in Sri Lanka. He wrote over 100 books including 2001: A Space Odyssey and Rendezvous With Rama, and popularized the ideas of geosynchronous communications satellites and space elevators.

Because I like lists...

http://c4lpt.co.uk/recommended/top100.html

Top 100 Tools for Learning Spring 2008

Interim rankings as at 19 March 2008

Please tell me this isn't deja vu all over again?

http://www.wpri.com/Global/story.asp?S=8027693&nav=menu20_3

Mass. bankers say retailer hit by big data breach in New England

Associated Press - March 17, 2008 12:54 PM ET

BOSTON (AP) - The Massachusetts Bankers Association is warning consumers about another data breach involving a major retailer.

The association said Monday about a third of its 200 member banks have been contacted by Visa and MasterCard. The alerts advised that some of the credit and debit cards the banks issued could be at risk.

Credit card companies haven't named the retailer in the breach, which is believed to affect consumers in Massachusetts and northern New England states.

MasterCard said in a statement it could not name the retailer because the breach is the subject of an ongoing investigation by law enforcement.

The bankers association says the breach reportedly occurred from Dec. 7 to March 10.

This is NOT the breach in the previous article

http://www.pogowasright.org/article.php?story=20080317161650243

Supermarket data breach affects 4.2 million accounts

Monday, March 17 2008 @ 04:16 PM EDT Contributed by: PrivacyNews News Section: Breaches

The Hannaford Bros. supermarket chain said a breach of its computer system led to the theft of about 4.2 million credit and debit card numbers from its Hannaford and Sweetbay stores and other locations.

Hannaford, based in Maine, said about 1,800 cases of fraud have been tied to the breach, [Commendable honesty! (and indication of significant delay in reporting?) Bob] but no personal information -- such as names or addresses -- was accessed, and it has contained the breach.

Source - Boston.com

[From the article:

The company said in a statement posted to its website that the stolen data was "illegally accessed from our computer systems during transmission of card authorization.'' [Another case of no encryption? Bob]

This is related

http://www.pogowasright.org/article.php?story=2008031717363788

Credit card numbers stolen from Sweetbay grocery stores

Monday, March 17 2008 @ 05:36 PM EDT Contributed by: PrivacyNews News Section: Breaches

1.6 million customers of Sweetbay have had their credit card numbers stolen. Sweetbay's parent company Hannaford blames a "data intrusion" of its computer network. No personal information, like names or addresses, were accessed.

The numbers stolen between December 7, 2007 and March 8, 2008.

The company asks Sweetbay customers to carefully review credit card statements, and call your credit card company right away if you spot a problem.

Hannaford has opened a hotline for customers to received more information or ask questions about the security breach. that number is 866-591-4580.

Source - TampaBays10.com

For those of us who track this kind of stuff...

http://www.news.com/Police-Blotter-Murderer-nabbed-via-tracking%2C-Web-search/2100-7348_3-6234678.html?part=rss&tag=2547-1_3-0-5&subj=news

Police Blotter: Murderer nabbed via tracking, Web search

Husband's death is discovered through a vehicle-tracking device and a search for "decomposition of a body in water."

By Declan McCullagh Staff Writer, CNET News.com Published: March 18, 2008, 5:41 AM PDT

What: Woman sentenced to 25 years in prison for murdering her husband, in part because of Internet searches and GPS tracking, appeals on Fourth Amendment grounds.

When: Texas appeals court rules on March 13.

Outcome: Sentence upheld.

What happened, according to court documents:

I never would have expected the FTC to do this.

http://www.pogowasright.org/article.php?story=20080317173811712

FTC Deal Suggests Enterprises Could Be Liable for Poor Security

Monday, March 17 2008 @ 05:38 PM EDT Contributed by: PrivacyNews News Section: Businesses & Privacy

The Federal Trade Commission settled a lawsuit against ValueClick today for making email and advertising claims that were deceptive and misleading. But as with many other legal documents, the real impact of the decision might be in the fine print.

... But there's a twist : ValueClick was also found guilty of violating its own privacy policy, which promises to protect customer data and implement "reasonable security measures." The FTC nailed ValueClick for failing to encrypt data when its privacy policy promises encryption, and even for failing to fix vulnerabilities to SQL injection attacks.

In a nutshell, the decision means that enterprises could be found negligent for promising to protect user data but subsequently failing to implement the security precautions required to meet those promises. If you promise good security and then fail to provide it, it could weigh against you in court, the decision says.

Source - Dark Reading

Speaking of poor security? What manager thought of sending a letter like this?

http://www.freedom-to-tinker.com/?p=1265#comments

Interesting Email from Sequoia

March 17th, 2008 by Ed Felten

A copy of an email I received has been passed around on various mailing lists. Several people, including reporters, have asked me to confirm its authenticity. Since everyone seems to have read it already, I might as well publish it here. Yes, it is genuine.

Sender: Smith, Ed [address redacted]@sequoiavote.com

To: felten@cs.princeton.edu, appel@princeton.edu

Subject: Sequoia Advantage voting machines from New Jersey

Date: Fri, Mar 14, 2008 at 6:16 PM

Dear Professors Felten and Appel:

As you have likely read in the news media, certain New Jersey election officials have stated that they plan to send to you one or more Sequoia Advantage voting machines for analysis. I want to make you aware that if the County does so, it violates their established Sequoia licensing Agreement for use of the voting system. Sequoia has also retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis. We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property.

Very truly yours,

Edwin Smith

VP, Compliance/Quality/Certification

Sequoia Voting Systems

Is Microsoft's move to compliance about to backfire? http://www.informationweek.com/news/showArticle.jhtml?articleID=206904001

Internet Explorer 8 Could Break Applications, Gartner Warns

Microsoft's support for Web standards in IE 8 could hurt apps built to work with the company's own protocols, the research firm says.

By Paul McDougall InformationWeek March 17, 2008 09:12 AM

(They can't mean “personal” drives, can they?) Interesting take on securing them however...

http://it.slashdot.org/article.pl?sid=08/03/18/0518242&from=rss

State Agency to Destroy Unauthorized USB Drives

Posted by Zonk on Tuesday March 18, @05:21AM from the what-they-don't-know-won't-hurt-you dept. Data Storage Government Privacy IT

Lucas123 writes

"The State of Washington's Division of Child support has forced hundreds of workers to turn in personal USB flash drives and has instead begun issuing corporate-style USB drives. The goal is to centrally monitor, configure and prevent unauthorized access to storage devices. So far about 150 common drives have been issued. The agency eventually plans to destroy all existing thumb drives collected as part of the security policy change."

[From the article:

Brian Main, the division's data security officer, said the new drives promise to help officials keep better track of mobile data by integrating them with Web-based management software that can centrally monitor, configure and prevent unauthorized access to the miniature storage devices.

... The software, which relies on a Web connection to directly communicate with agents on the tiny flash drives, can also remotely monitor and flush any lost drives, he said.

Employee monitoring, the next wave? “If our employes aren't happy we beat them until they are!”

http://tech.yahoo.com/xb/hughes?blogpost=24619

Watch tells the boss how you're feeling at work

Fri Mar 14, 2008 2:57PM EDT

Remember that spying mouse with bio-sensors that tells you boss if you're stressed out at work? IO9 found another gadget that gives the boss even more insight into your emotional and physiological well-being while you're in the office. Exmocare's monitoring watch, called the BT2, can measure a person's heart rate, location, body temperature, and skin moisture levels then sends all that information to a central database using a Bluetooth connection.

This letter nicely sums up the dilemma.

http://www.pogowasright.org/article.php?story=20080317150228499

UK: Phorm Pharce — FIPR open letter

Monday, March 17 2008 @ 03:02 PM EDT Contributed by: PrivacyNews News Section: Internet & Computers

... an open letter on the subject from the Foundation for Information Policy Research to Britain’s information commissioner.

[...] We therefore consider that even if third party scanning obtains the fully-informed and explicit consent of a user, it simply cannot hope to obtain all the consents necessary from others. It therefore involves unlawful interception; and it therefore cannot comply with either the first or the second of the data protection principles.

Source - p2pnet.net

Related - BBC: Phorm 'illegal' says policy group

Shouldn't every shop owner have this ability? After all, when did health care become a right?

http://online.wsj.com/article/SB120580305267343947.html?mod=hpp_us_inside_today

Why Hospitals Want Your Credit Report

Many Are Using Personal Data To Assess Your Ability to Pay; Concerns About Denial of Care

By SARAH RUBENSTEIN March 18, 2008

In a development that consumer groups say raises privacy issues, a growing number of hospitals are mining patients' personal financial information to figure out how likely they are to pay their bills.

... Hospitals have "a limited amount of resources that are available to actually execute the collection process," says Karen Godfrey, who runs revenue management at Baptist Health South Florida, a Miami system of five nonprofit hospitals that is likely to adopt one of these systems soon. "You want to concentrate on the ones that have the ability to pay."

Consumer advocates say the practice creates the potential for hospitals to misuse the information by denying or cutting back on patients' care if they can't pay.

Protecting drivers or profits? Easy call...

http://techdirt.com/articles/20080313/231629539.shtml

Yet Another Study Shows Red Light Cameras Cause More Accidents And Aren't Needed

from the it's-all-about-the-money dept

Over and over again, we've seen studies that have shown that red light cameras tend to increase, not decrease auto accidents, and certainly don't do much to improve safety. The Agitator points us to yet another study, this time from researchers at the University of South Florida, who again point out that red light cameras tend to increase the number of accidents. The research also points out that accidents from running red lights are rather rare, and it's hardly a problem that requires automation. As for the few studies that have shown better safety from red light cameras, every single one came from a group poised to make money off of the cameras -- and they certainly do make money. It's just unfortunate that it seems to come at the expense of more car accidents, all in the bogus name of public safety. Update: Of course, just after publishing this, I see a story on Engadget about how Dallas has found that red light cameras are effective in preventing red light violations (no word on rear end collisions from people slamming on the brakes however). Yet, here's the irony: because of that, the city gov't doesn't want to install any more, as it's cutting into revenue.

Tools & Techniques: How to muzzle your problem clients. (Interesting that the credit card companies can even talk to these people before they testify...

http://blog.seattlepi.nwsource.com/consumersmarts/archives/134417.asp

Testify, but first waive your privacy

Last week, a House subcommittee invited ordinary citizens, consumer advocates and credit card issuers to testify on a proposed credit card bill of rights that would ban abusive practices, such as arbitrary rate hikes or charging interest on balances already paid off.

Four consumers never got to testify, when they declined to sign waivers allowing credit issuers to make public their information.

Elizabeth Warren, a Harvard University law professor who did testify Thursday, explained in this blog post:

They had flown in from around the country with their credit card bills in hand, only to learn that they couldn't talk unless they would sign a waiver that would permit the credit card companies to make public anything they wanted to tell about their financial records, their credit histories, their purchases, and so on. The Republicans and Democrats had worked out a deal "to be fair to the credit card lenders." These people couldn't say anything unless they were willing to let the credit card companies strip them naked in public.

See, it's not the thought that counts! (Business model: Build cell phones into ear warmers...)

http://techdirt.com/articles/20080316/153047550.shtml

Best Excuse Ever For Using A Mobile Phone While Driving: It Was Just To Warm My Ears

from the gotta-remember-that-one dept

It's become quite common these days for various local governments to pass laws forbidding the use of mobile phones while driving (though, most allow the use of a hands free kit, which might not be any safer). However, one truck driver in Germany figured out a loophole that got him off the hook: he claimed he wasn't talking on the phone, but just using a recently charged mobile phone to warm his ears -- and the court believed him after he showed an itemized bill that showed no phone call at the time (found via Fark, of course). The man claims he had an earache, and that the heater in the truck cab took too long to warm up, so he was using the phone instead -- though, you can understand why the police officer might not have believed him.

For my web site class...

http://www.news.com/8301-13577_3-9895536-36.html

CBS to bloggers: Install our widgets, and we'll split the profits

Posted by Caroline McCarthy March 17, 2008 7:47 AM PDT

CBS Television Stations has launched a new program to get its local news headlines onto blogs and social-media sites, the CBS division said Monday.

Called the CBS Local Ad Network, it's a way for participating region-focused blogs to pull in extra cash by embedding CBS news widgets on their sites and splitting the revenue of accompanying ads with CBS.

On Monday, the program was launched in a selection of the TV network's regional markets: Boston, Dallas-Fort Worth, San Francisco, Denver, and Chicago. Within the next few weeks, CBS has said, the CBS Local Ad Network will come to New York, Los Angeles, Philadelphia, Minneapolis-St. Paul, Miami, Sacramento, Pittsburgh, and Baltimore.

Ditto

http://www.killerstartups.com/Web-App-Tools/BasicStatecom---Free-Web-Monitoring/

BasicState.com - Free Web Monitoring

... BasicState runs a website monitoring service which ensures that your site is up and running properly. It will alert you whenever there’s a problem with your site via email and SMS text message. The service checks your site every 15 minutes and you’ll be sent a daily email report of your site’s performance.

http://basicstate.com/

Ditto

http://www.killerstartups.com/Web-App-Tools/ReadTheWordscom---Convert-Documents-Feeds-into-MP3s/

ReadTheWords.com - Convert Documents, Feeds into MP3s

ReadtheWords is an absolutely free service which converts text into MP3. All you’ve got to do is sign up and select what files you want to convert. Read works with PDF documents, Word, HTML files, and even RSS feeds.

... Finally, download your mp3 to your iPod, post your reading on your blog, make a podcast, or simply listen to it online.

http://readthewords.com/

Our Security is so strong, you'd need years of schooling to break it. (Somewhere between 9 and 12 years by my calculations) Fortunately, we have managers with several weeks of experience on the job!

http://www.pogowasright.org/article.php?story=20080316090513765

FL: Student Hacks Into School District Computer

Sunday, March 16 2008 @ 09:05 AM EDT Contributed by: PrivacyNews News Section: Breaches

Broward School District officials are asking employees to closely monitor their financial records after a Coconut Creek high school student hacked into a district computer and collected personal data.

The Atlantic Technical High School senior collected Social Security numbers and addresses of district employees. The school district employs more than 35,000 people. A district spokesman said the student has been suspended for two weeks, pending expulsion.

Source - Local6.com

...because...

http://www.pogowasright.org/article.php?story=20080317070213285

Data “Dysprotection:” breaches reported last week

Monday, March 17 2008 @ 07:02 AM EDT 4Contributed by: PrivacyNews News Section: Breaches

A recap of incidents or privacy breaches reported last week for those who enjoy shaking their head and muttering to themselves with their morning coffee.

Source - Chronicles of Dissent

Sort of like having a tag on your house key that says “If found, please mail to...” Another reason to use a surrogate identity...

http://www.pogowasright.org/article.php?story=20080317070356512

GPS may 'lead thieves' to your home

Monday, March 17 2008 @ 07:03 AM EDT Contributed by: PrivacyNews News Section: Other Privacy News

Motorists are being warned that thieves who steal GPS devices from cars could then use the device to find out where the car owner lives and rob their home as well.

Most users program the electronic mapping devices with their home address so the gizmo can map out the quickest route to where the owner lives.

... The RACV is warning motorists of the potential threat after reports from Britain of homes being ransacked and a $45,000 sports car being stolen by thieves who followed directions using a stolen GPS to owners' houses.

Source - The Age

No false positives? (Now that everyone knows the cards can be hacked, we should go public with the monitoring story before someone puts two and two together... )

http://yro.slashdot.org/article.pl?sid=08/03/16/1612203&from=rss

UK's MI5 Wants Oyster Card Travel Data

Posted by Soulskill on Sunday March 16, @01:15PM from the you-can-trust-us dept. Privacy

Boiled Frog from a Nation of Suspects writes

"The Oyster card, an RFID single-swipe card (which was recently cracked), was introduced to London's public transport users purportedly to make their lives easier. Now, British Intelligence services want some of the benefits by trawling through the travel data amassed by the card to spy on the 17 million Britons who use it. The article notes, "Currently the security services can demand the Oyster records of specific individuals under investigation to establish where they have been, but cannot trawl the whole database. But supporters of calls for more sharing of data argue that apparently trivial snippets — like the journeys an individual makes around the capital — could become important pieces of the jigsaw when fitted into a pattern of other publicly held information on an individual's movements, habits, education and other personal details. That could lead, they argue, to the unmasking of otherwise undetected suspects."

No Privacy issues here. No medical benefits either?

http://www.dailybulletin.com/ci_8596444

State bill may open medical records

Dan Abendschein, Staff Writer Article Created: 03/16/2008 06:17:34 PM PDT

Pharmaceutical companies could gain access to medical records to send reminders to patients to refill prescriptions, if a state bill is passed.

It allows pharmaceutical companies to purchase the information from the pharmacies that serve individual patients. But it does force those companies to disclose on mailings to the patient that the pharmacy profited from selling the information.

... The proposed amendment would force pharmacies to get written consent from customers on receiving mailings when they fill their prescriptions.

Calderon said, however, he does not support the amendment.

"It would make the bill meaningless," said Calderon. "It's been demonstrated that people won't sign up voluntarily." [“We have to force people to do this even if they repeatedly tell us they don't want to...” Bob]

Searching for a viable business model... (This is a bit puffy, so you'll have to search for the meat in the article.)

http://www.rollingstone.com/news/story/18064095/the_future_according_to_radiohead

The Future According to Radiohead

How Radiohead ditched the record business and still topped the charts

MARK BINELLIPosted Feb 07, 2008 6:00 AM

... In Rainbows, Radiohead's seventh album, was released in October, and any talk of its content was immediately overshadowed by its method of delivery. As everyone knows, the band, in a surprise announcement, decided to release the album as a download on its Web site, where fans could pay whatever they wished, anywhere from nothing to £99.99 (about $212). Though Radiohead have refused all requests to release official numbers, even the estimates of the online survey group comScore — estimates that the band dismisses as low — would make the experiment a success. According to comScore, a "significant percentage" of the 1.2 million visitors to Radiohead's Web site in October downloaded the album, and while comScore claims only two out of five downloaders paid anything at all, the payers averaged $6 per album — which, factoring in the freeloaders, works out to about $2.26 per album, more than Radiohead would have made in a traditional label deal. And that's just downloads: Released on January 1st, the CD version debuted at Number One in the U.S. and Britain.

What is going to happen when thousands of cellphone video recorders start reporting on the Olympics? Can China block them all?

http://www.news.com/8301-10784_3-9895277-7.html?part=rss&subj=news&tag=2547-1_3-0-5

China blocking YouTube to suppress Tibet rioting?

Posted by Steven Musil March 16, 2008 5:13 PM PDT

People all over China are reporting that access YouTube.com has been blocked, possibly in connection with a Chinese government crackdown on Tibet, according to a colleague of mine at CNET Asia.

Every few months my friend buys lunch for 30-50 potential terrorists – okay, lawyers – but how could any tell the difference? Now we know this is getting reported. (NOTE: This explains why Gov. Spitzer's transactions were flagged even though they were all under the statutory limit... )

http://www.bespacific.com/mt/archives/017823.html

March 16, 2008

Gov't Requirements for Banks to Provide Suspicious Activity Reports

Newsweek: Unintended Consequences - Spitzer got snagged by the fine print of the Patriot Act

• "The Patriot Act gave the FBI new powers to snoop [“We don't need no stinking permission!” Ghost of J. Edgar Bob] on suspected terrorists. In the fine print were provisions that gave the Treasury Department authority to demand more information from banks about their customers' financial transactions. Congress wanted to help the Feds identify terrorist money launderers. But Treasury went further. It issued stringent new regulations that required banks themselves to look for unusual transactions (such as odd patterns of cash withdrawals or wire transfers) and submit SARs—Suspicious Activity Reports—to the government. Facing potentially stiff penalties if they didn't comply, banks and other financial institutions installed sophisticated software to detect anomalies among millions of daily transactions. They began ranking the risk levels of their customers—on a scale of zero to 100—based on complex formulas that included the credit rating, assets and profession of the account holder." [“If you're rich and in politics, we look at everything. No telling when we might need your vote.” Ghost of J. Edgar Bob]

Close to home, but discovered only when they notified the New Hampshire AG. Who says no one learned from TJX...

http://www.pogowasright.org/article.php?story=20080315101134617

Server stolen from Starling Insurance contained customers's personal information

Saturday, March 15 2008 @ 10:11 AM EDT Contributed by: PrivacyNews News Section: Breaches

A server stolen from the locked offices of Colorado-based Sterling Insurance and Associates contained names, addresses, and Social Security numbers, dates of birth, driver's license numbers, and/or account information for an unspecified number of customers. The type of information varied by customer.

In its March 5th notification letter to the New Hampshire Department of Justice, Ray Starling, the president of the firm, did not indicate when the password-protected server was stolen.

Those whose were affected were notified by letter dated March 5th and offered free credit monitoring for two years.

Source - Starling Insurance & Associates Notification to NH DOJ [pdf]

I'm sure the paper is interesting but my question is: Where did they get 30 billion conversations to analyze?

http://www.news.com/8301-13953_3-9894881-80.html?part=rss&subj=news&tag=2547-1_3-0-5

March 15, 2008 2:35 PM PDT

Proof of six degrees of separation

Posted by Dan Farber

In a research paper from June 2007, titled "Worldwide Buzz: Planetary-Scale Views on an Instant-Messaging Network (PDF)," Eric Horvitz of Microsoft Research and Jure Leskovec of Carnegie Mellon University analyzed 30 billion conversations among 240 million people using Microsoft Instant Messenger in June 2006. It turned out that the average path length, or degree of separation, among the anonymized users probed was 6.6.

There is a simple post on this article ( http://www.pogowasright.org/article.php?story=20080315133253395 ) but I found the editorial more amusing... (It seems one of our themes today is Customized Law...)

http://www.pogowasright.org/article.php?story=20080315144740774

Editorial: Virginia plays "shoot the messenger" and targets a privacy advocate

Saturday, March 15 2008 @ 02:47 PM EDT Contributed by: PrivacyNews News Section: State/Local Govt. A PogoWasRight.org editorial:

The Associated Press reports that in order to stop a privacy activist from posting Social Security numbers on her web site that she finds on her state's own web pages, Virginia has enacted the Personal Information Privacy Act. The law makes it illegal to "intentionally communicate an another individual's social security number to the general public." The Commonwealth might have more accurately named the bill the "My God, Stop BJ Ostergren Act of 2008." Their bill has little to do with promoting privacy of personal information and more to do with protecting themselves from embarrassment.

The bill, already signed into law by Governor Kaine, makes it clear that it is perfectly fine for the Commonwealth of Virginia to intentionally communicate millions of individuals' social security numbers to the general public on their web pages or as required by their laws, but it is not okay for anyone who actually sees or obtains a SSN from the state's web site to then publish it on their own web site or to (further) share it with the general public. The legislature has its collective head up its search engine if it does not already realize that whereas Ms. Ostergren generally publishes a few "celebrity" SSN to get public attention to her issue, nothing stops cybercriminals from downloading and sharing all of the SSN that Virginia continues to make easily available. If Virginia is serious about protecting the privacy of personal information, it will stop making it available on their web pages.

On her own web site, The Virginia Watchdog, Ostergren takes the Commonwealth to task over the constitutional issues and her rights as she sees them. The ACLU of Virginia has also gotten involved in this case. ACLU of Virginia Executive Director Kent Willis summarized the issue nicely when he said, “The ACLU is a staunch supporter of laws that prevent the government from allowing Social Security Numbers to appear on publicly accessible websites, but the government can’t put the numbers online and then turn around prevent the public from using those numbers.”

In an April 2007 commentary on Ostergren's tactics in Chronicles of Dissent, I disagreed with her tactics in publishing SSN on her web site. But my objection to her tactics were based on personal ethics. I never suggested and do not believe that she has done anything illegal. Nor do I think that making it illegal to republish information obtained from a state web site where the data have been intentionally made public is constitutional or right.

It is to the Commonwealth's great shame that rather than redacting or protecting SSN properly, they continue to grant themselves permission to put citizens at risk of ID theft while enacting laws to stop one person from advertising their foolishness.

-- Dissent

Always amusing... Perhaps related to the articles that follow?

http://www.pogowasright.org/article.php?story=2008031512245031

Article: Privacy Decisionmaking in Administrative Agencies

Saturday, March 15 2008 @ 12:24 PM EDT Contributed by: PrivacyNews News Section: Other Privacy News

Bamberger, Kenneth A. and Mulligan, Deirdre K., "Privacy Decisionmaking in Administrative Agencies" . University of Chicago Law Review, Vol. 75, No. 1, p. 75, 2008 Available at SSRN: http://ssrn.com/abstract=1104728

Abstract:

Administrative agencies increasingly rely on technology to achieve substantive goals. Often this technology is employed to collect, exchange, manipulate and store personally identifiable information, raising serious concerns about the erosion of personal privacy.

Congress has recognized this problem. In the E-Government Act of 2002, it required administrative agencies to conduct privacy impact assessments (PIAs) when developing or procuring technology systems that handle personal information. Despite this new requirement, however, agency adherence to privacy mandates is highly inconsistent.

In this paper, we ask why. We first explore why both process requirements and traditional means of political oversight are often weak tools for ensuring that policy reflects privacy commitments. We then consider what factors might, by contrast, promote agency consideration of privacy concerns.

Specifically, we compare decisions by two federal agencies - the Department of State and the Department of Homeland Security - to use RFID technology, which allows a wireless-access data chip to be attached to or inserted into a product, animal, or person. These two cases suggest the importance of internal agency structure, culture, and personnel, as well as alternative forms of external oversight, interest group engagement, and professional expertise, as important mechanisms for ensuring bureaucratic accountability to the secondary privacy mandate imposed by Congress.

The analysis speaks to debates in both public administration and privacy protection. It implicates disputes over the efficacy of external controls on bureaucracy, and the less-developed literature on opening the black box of administrative decisionmaking. It further offers insight into pre-conditions necessary to advance privacy commitments in the face of social and bureaucratic pressure to manage risk by collecting information about individuals. Finally, it offers specific proposals for policy reform intended to promote agency accountability to privacy goals.

Free full-text article available at SSRN ; free reg. required.

Like the strategic goals of many governments, 1984 came later than originally planned...

http://www.phiprivacy.net/?p=102

Mar-16-2008

UK: Put young children on DNA list, urge police

Mark Townsend and Anushka Asthana write in The Observer:

Primary school children should be eligible for the DNA database if they exhibit behaviour indicating they may become criminals in later life, [Like breathing or having parents that vote conservative... Bob] according to Britain’s most senior police forensics expert.

Gary Pugh, director of forensic sciences at Scotland Yard and the new DNA spokesman for the Association of Chief Police Officers (Acpo), said a debate was needed on how far Britain should go in identifying potential offenders, given that some experts believe it is possible to identify future offending traits in children as young as five.

Related? (What hath Spitzer wrought?) This is where everyone (male and female) names the ministers who proposed this policy.

http://www.pogowasright.org/article.php?story=20080315093005550

AU: Ministry staff told to reveal details of sex life

Saturday, March 15 2008 @ 09:30 AM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

MINISTERIAL staff in the Rudd government are being forced to list their history of sexual partners, reveal extra-marital affairs and detail homosexual experiences before gaining security clearance.

More than 300 ministerial and electorate staffers have been ordered to fill in a 25-page form and attend an in-depth interview into their personal finances, drug habits and sexual history before gaining high-level security clearance.

Senior staff say they have been told the security form is designed to protect them from blackmail.

But several have told The Sunday Telegraph they were affronted at the personal information they had been forced to divulge.

Friends are also interviewed, and information about drug use and sexual history is cross-checked.

Source - news.com.au

I would call this “Get out of jail free” rule if it was directed at industries or other non-governmental groups. As it is, consider it business as usual. After all, which is easier: Solving a problem or Writing a rule that says it's not a problem? Is it a problem?

http://www.pogowasright.org/article.php?story=20080315125501409

OH: Plans to hide court records cut back

Saturday, March 15 2008 @ 12:55 PM EDT Contributed by: PrivacyNews News Section: State/Local Govt.

Birthdays, home addresses and the last four digits of Social Security numbers of people whose names show up in court files likely will remain public information, after an Ohio Supreme Court panel yesterday backed away from plans to close off the records.

The judge-dominated panel rolled back much of the secrecy that it had proposed for court records across Ohio last year. Those proposed changes -- which court officials said were spurred by fears of identity theft -- drew sharp protests from media organizations, private investigators and other advocates of open court records.

Source - Columbus Dispatch

Perhaps we'll see another custom law?

http://yro.slashdot.org/article.pl?sid=08/03/15/2021257&from=rss

Wikileaks Publishes FBI VoIP Surveillance Docs

Posted by CmdrTaco on Saturday March 15, @06:40PM from the watching-the-watchers dept. Communications United States

An anonymous reader writes

"The folks on wikileaks have published a new interesting and shocking report: FBI Electronic Surveillance Needs for Carrier-Grade Voice over Packet (CGVoP) Service. The 88 paged document, which is part of the CALEA Implementation Plan was published in January 2003 and describes in detail all needs for surveillance of phone calls made via data services like the internet. Wikileaks has not published any analysis yet, so maybe some of the techies hanging around this end of the internet are interested in taking that one on."

Lots of fun quotes!

http://www.bespacific.com/mt/archives/017819.html

March 15, 2008

The Diverse and Exploding Digital Universe

The Diverse and Exploding Digital Universe, An Updated Forecast of Worldwide Information Growth Through 2011, March 2008, By International Data Corporation.

• "In this companion to last year's EMC-sponsored white paper, IDC again calibrates the size (bigger than first thought) and the growth (faster than expected) of the digital universe through 2011. IDC also explores new dimensions of the digital universe (e.g., the impact of specific industries on the digital universe; your digital shadow) and discusses the implications for individuals, organizations, and society. The tools are in place—from Web 2.0 technologies and terabyte drives to unstructured data search software and the Semantic Web—to tame the digital universe and turn information growth into economic growth."

• Download the complete 2008 paper

• Download the 2008 executive summary

• Download the complete 2007 paper

Anything new?

http://yro.slashdot.org/article.pl?sid=08/03/15/1915249&from=rss

Class Action Complaint Against RIAA Now Online

Posted by CmdrTaco on Saturday March 15, @05:35PM from the stuff-to-read-if-you're-insane dept. The Courts

NewYorkCountryLawyer writes

"Recommended reading for all interested in the RIAA's litigation war against p2p file sharing is the amended class action complaint just filed in Oregon in Andersen v. Atlantic. This landmark 109-page document (pdf) tells both the general story of the RIAA's campaign against ordinary folks, and the specific story of its harassment of Tanya Andersen, and even of her young daughter. The complaint includes federal and state RICO claims, as well as other legal theories, and alleges that "The world's four major recording studios had devised an illegal enterprise intent on maintaining their virtually complete monopoly over the distribution of recorded music." The point has been made by one commentator that the RIAA won't be able to weasel its out of this one by simply withdrawing it; this one, they will have to answer for. If the relief requested in the complaint is granted, the RIAA's entire campaign will be shut down for good."

Another use for the logs no one seems to keep. If you have 200 logons from the same IP address, get suspicious! (Even criminals can outsource...)

http://www.theregister.co.uk/2008/03/14/captcha_serfs/

Russian serfs paid $3 a day to break CAPTCHAs

Semi-automated attack or chain-mail gang

By John Leyden Published Friday 14th March 2008 17:54 GMT

Why should miscreants bother to develop cutting edge programming techniques when they can pay $3 to somebody to set up spam-ready webmail accounts on their behalf? Evidence has emerged that people as well as malware are being used to defeat CAPTCHAs, challenge-response systems that are often used to stop the automatic creation of webmail accounts by spammers.

CAPTCHAs typically help ensure that online accounts can't be created until a user correctly identifies letters depicted in an image. The tactic is designed to frustrate the use of automated sign-up tools by spammers and other miscreants.

Over recent months security firms have reported that first the Windows Live CAPTCHA used by Hotmail, and later the equivalent system at Gmail, have been broken by automated attacks.

... Google's contention that low-wage workers are been paid to break watchers is supported by anecdotal evidence unearthed by Websense, which has been active in researching the issue over recent months. The firm found Russian language documents instructing modern day serfs on the art of CAPTCHA breaking.

Beware the living Tux! (Another USB toy)

http://hardware.slashdot.org/article.pl?sid=08/03/15/2244250&from=rss

Hacking the Tux Droid

Posted by Zonk on Saturday March 15, @07:33PM from the cutest-robot-ever dept. Hardware Hacking Robotics

Rockhopper writes

"Ars Technica has a combo review/hack guide for the Tux Droid, a programmable penguin. 'Tux is completely programmable at practically every level, and all of the source code of the firmware and software used by the droid is available from Kysoh's version control repository. There are several ways to program the droid's behavior, ranging from modifying the firmware to coding a gadget in Python.' There's a sample Python script that will cause Tux to speak IRC messages out loud when the user's name is mentioned."

Understandable. We are a nation of snoops... (It could have been worse. They could have videoed the file and put it on Youtube)

http://www.phiprivacy.net/?p=96

UCLA workers snooped in Spears’ medical records

Charles Ornstein reports in the Los Angeles Times:

UCLA Medical Center is taking steps to fire at least 13 employees and has suspended at least six others for snooping in the confidential medical records of pop star Britney Spears, who was recently hospitalized in its psychiatric ward, a person familiar with the matter said today.

An additional six physicians also face discipline for peeking at her computerized records, the person said.

Wholesale snooping?

http://www.pogowasright.org/article.php?story=20080314082902511

UT: Laptop with patient information stolen from University Health Care

Friday, March 14 2008 @ 08:29 AM EDT Contributed by: PrivacyNews News Section: Breaches

Thousands of people are being cautioned to keep their eyes on their credit reports tonight. A laptop with names, Social Security numbers and personal health information was stolen from University Health Care in Salt Lake City.

The laptop was reported missing Feb. 25. University Health Care began mailing out letters to people affected by it this week.

... Some 4,800 patients are feeling that frustration tonight because their personal information was on a laptop stolen from a locked office. "In some cases, there were names and addresses of patients. In some cases, names and Social Security numbers, [and] in some cases, names and health policy information," Nelson said.

Source - KSL

Interesting (Look at about 12:45 on the video)

http://www.phiprivacy.net/?p=100

Mar-15-2008

IOM Project Survey Findings on Health Research and Privacy

From the 15th National HIPAA Summit, Dr. Alan Westin’s talk is now online for free viewing.

So perhaps there is a (peta)bit of disagreement?

http://www.eff.org/deeplinks/2008/03/law-checking-wsj-article-domestic-spying

Law-Checking WSJ Article on Domestic Spying

Posted by Kurt Opsahl March 10th, 2008

The Wall Street Journal's detailed article on domestic spying (Wall Street Journal, NSA's Domestic Spying Grows As Agency Sweeps Up Data (March 10, 2008), p. A1) provides critical detail and confirmation of the NSA's wholesale acquisition of domestic communications, and helps us understand the Administration's word games. It also shows that the Administration is relying upon erroneous views of electronic communications privacy law, including some that contradict the Department of Justice's own published interpretations.

The article contains an infobox listing material that "the NSA can look at without a judicial warrant." Contrary to the NSA's claim, information like email subject lines, internet searches and cellphone location information all require a warrant under law. Moreover, even where a "probable cause" warrant is not necessary, the NSA still needs to obtain an appropriate court order.

Couple this with the ban on drug testing student athletes and perhaps the pendulum is swinging back?

http://www.pogowasright.org/article.php?story=20080314194904158

Court ruling limits employment drug testing

Friday, March 14 2008 @ 07:49 PM EDT Contributed by: PrivacyNews News Section: Workplace Privacy

A city can't require all job applicants to be tested for narcotics and must instead show why drug use in a particular job would be dangerous, a federal appeals court ruled Thursday.

The Ninth U.S. Circuit Court of Appeals in San Francisco ruled against the city of Woodburn, Ore., which argued it was entitled to maintain a drug-free workplace by requiring job candidates to be screened for drugs and alcohol.

The city was sued by Janet Lanier, whose job offer as a part-time page at the city library was withdrawn in 2004 when she refused a drug and alcohol test. A federal judge ruled the policy unconstitutional and awarded Lanier $12,400 in damages and $44,000 in legal fees, her lawyer said.

Source - San Francisco Chronicle Related - Court Opinion [pdf] h/t, The Canadian Privacy Law Blog

Forward this one to your CIO. (I may need to suspend my programmed trading)

http://www.infoworld.com/article/08/03/14/Just-patched-Excel-makes-calculation-mistakes_1.html?source=rss&url=http://www.infoworld.com/article/08/03/14/Just-patched-Excel-makes-calculation-mistakes_1.html

Just-patched Excel makes calculation mistakes

One of the patches issued Tuesday causes Excel to make incorrect calculations when a Real Time Data source is used

By Gregg Keizer, Computerworld March 14, 2008

... In a warning posted Thursday, Bill Sisk, security response communications manager, said that the fixes outlined in the MS08-014 bulletin "causes Microsoft Excel 2003 calculations to return an incorrect result when a Real Time Data source is used."

Tools & Techniques: For my Security class...

http://it.slashdot.org/article.pl?sid=08/03/15/1242252&from=rss

Man-in-the-Middle Attack on MySpace with Cain

Posted by CmdrTaco on Saturday March 15, @09:00AM from the caught-with-yer-pants-down dept. Security The Internet IT

Slimjim100 writes

"Last year at ChicagoCon 2007, Brian Wilson gave a great talk entitled "Cain & Abel: Windows Can Hack, Too!" Although the presentation and audio recording of the talk can be downloaded from the ChicagoCon site at Library, I had totally forgotten to publish his videos. Just in case things didn't go as planned during the live event or his laptop crapped out on him, Brian made a video of the MITM attack he demonstrated using Cain. You get to see how Myspace and other social networking sites are not designed with security in mind."

For my graphic arts students. Import this, remove all the “Specimen” junk, and print me a few thousand copies...

http://www.moneyfactory.gov/newmoney/files/5_Materials/5_Glossy%20FRONT.pdf

A most interesting area. Encrypting your backups should keep them secure, so the big question is: How quickly do you need to recover when things head south?

http://www.midmarket.eweek.com/c/a/News/Online-Backup-by-the-Numbers/

Online Backup by the Numbers

DATE: 2008-03-14 By Karen D. Schwartz

Backing up data online can mean less hassle, more reliability and lower costs. Here are some things to consider when looking at online backup options.

... Good candidates are companies with RTOs (Recovery Time Objectives) of less than one day for a full recovery, little or no backup infrastructure, little or no IT staff to manage backup operations, and compliance or litigation support requirements that can't be easily met with the current set-up.

... Data protection—the very reason to consider online backup in the first place—also should be examined closely.

"You would think every online backup vendor keeps more than one backup of customers' data, but that's not always the case," Taneja said. "They have a backup of your data at their location, but do they have a system that backs their environment up as well? That's an important question to ask."

Youtube isn't surprising, but Fox is #2???

http://venturebeat.com/2008/03/14/comscore-youtube-dominance-grows/

Comscore: YouTube dominance grows

Anthony Ha March 14th, 2008

... Google (which owns YouTube) accounted for 34.3 percent of the online videos watched in January, up 1.7 percent from December, according to ComScore. Not surprisingly, YouTube videos made up almost all of that viewership — 96 percent, to be exact.

Google’s closest competitor was Fox Interactive Media, which accounted for 6 percent of videos watched. (See the the chart below.)

Of course I am bias free... No matter what those ignorant liberal democrats say...

http://politics.slashdot.org/article.pl?sid=08/03/14/2048236&from=rss

Microsoft Developing News Sorting Based On Political Bias

Posted by ScuttleMonkey on Friday March 14, @09:21PM from the next-measure-the-magnitude-of-political-affiliation dept. Microsoft Politics

wiredog writes

"The Washington Post is reporting that Microsoft is developing a program that classifies news stories according to whether liberal or conservative bloggers are linking to them and also measures the 'emotional intensity' based on the frequency of keywords in the blog posts."

If you would like to jump right to the tool you can check out "Blews" on the Microsoft site.

Economics: Why does the UK have the lead?

http://www.bespacific.com/mt/archives/017812.html

March 14, 2008

The Knowledge Economy: How Knowledge is Reshaping the Economic Life of Nations

News release: "The Work Foundation today publishes a report outlining its research thus far into the knowledge economy, 18 months into a three-year, £1.5 million research programme which will conclude in April 2009. The Knowledge Economy: How Knowledge is Reshaping the Economic Life of Nations argues that the phenomenon of the knowledge economy is driven by the demand for higher value-added goods and services created by more sophisticated, more discerning and better educated consumers and businesses. These pressures have interacted with both technology and globalisation, accelerating the process of change and enabling new and disruptive patterns of supplying consumers. The report covers:

• Work: knowledge-based industries and knowledge-related occupations have provided most of the new jobs over the past decade

• Trade: The UK has emerged as a world leader in trade in knowledge services with the biggest trade surplus of the major OECD economies. While the City of London and financial services remain important, two thirds of this trade comes from business services, high tech, and education and cultural services.

• Innovation: innovation in the knowledge economy comes from both the successful exploitation of R&D undertaken in the UK and overseas and from wider forms of innovation design and development, marketing and organisational change.

• Small firms: Provisional findings show that in the decade between 1995 and 2005, small and medium sized enterprises (SMEs) have become much more concentrated in ‘knowledge intensive sectors’ - high skill, high tech sectors, such as accountancy, legal and consultancy services, architectural, engineering and technical services, and advertising. They have increased the numbers of people they employ by 17 per cent or 445,000 people.

• Offshore Outsourcing: Thus far, offshoring has had no measureable impact on knowledge economy jobs. Occupations theoretically at risk from offshore outsourcing continue to add numbers overall in the UK. Meanwhile, the trade in knowledge services remains overwhelmingly with richer countries, rather than developing nations such as India."

Related?

http://www.bespacific.com/mt/archives/017810.html

March 14, 2008

Celebrating James Madison and the Freedom of Information Act

DOJ Office of Information and Privacy: "On March 16 we celebrate the anniversary of James Madison's birthday. Madison, traditionally viewed as the Father of the United States Constitution, is also seen by many as a defender of open government. He once wrote, "[a] popular Government, without popular information, or the means of acquiring it, is but a Prologue to a Farce or a Tragedy; or, perhaps, both. Knowledge will forever govern ignorance: And a people who mean to be their own Governors, must arm themselves with the power which knowledge gives." In a similar vein, he asserted that "the advancement and diffusion of knowledge" is "the only Guardian of true liberty." ... With Madison's views on the importance of an informed citizenry in mind, the occasion of James Madison's birthday is an excellent opportunity for federal agencies to review their FOIA operations to ensure that this vital government function is receiving the attention it deserves."

How to sound like you did the research?

http://www.killerstartups.com/Web-App-Tools/LexiSumcom---Browse-Wikipedia-as-you-Type/

LexiSum.com - Browse Wikipedia as you Type

Lexisum is a innovative new site that does something oddly useful. It browses Wikipedia as you type. So, let’s say you’re writing an article on fungus. Type in the word, ‘’Fungus’, and the wikipedia entry of fugus immediately pops up. It’s helpful if you’re writing a paper and need a little extra help. If you happened to forget a term, or didn’t fully understand what your professor meant by suzerainty, type it in and Wikipedia will help you out. Only a partial imprint of the article appears. If you want to read the full thing, click on a link below the article to bring you to the actual Wikipedia page.

... and it’s also available in nine languages.

http://www.lexisum.com/

...or perhaps Hustler is simply using the media hype for publicity?

http://www.accesshollywood.com/article/8771/prostitute-in-spitzer-scandal-scores-million-dollar-offer-to-bare-all/

Prostitute In Spitzer Scandal Scores Million Dollar Offer To Bare All

Mar 14, 2008 NEW YORK, New York -- ORIGINAL ARTICLE: Mar 14, 2008 14:34 PM

As her instant celebrity status continues to climb in the wake of the Eliot Spitzer prostitution scandal, Ashley Alexandra Dupre has now received a $1 million offer to bare it all.

Virgin clearly is...

http://www.news.com/8301-10784_3-9893529-7.html?part=rss&subj=news&tag=2547-1_3-0-5

Virgin Mobile turns Spitzer woes into ad copy

Posted by Leslie Katz March 13, 2008 1:35 PM PDT

Virgin Mobile Canada knows how frustrated people can get with the lack of personalized service these days. Faster than Eliot Spitzer could say, "Um, oops," the company came out with a print ad that features the newly former New York governor, aka Client #9, musing as follows under a thought bubble: "I'm tired of being treated like a number..."

Of course, a lawyer would never stoop so low...

http://www.pogowasright.org/article.php?story=20080315074610407

A Lawyer's Call for Privacy

Saturday, March 15 2008 @ 07:46 AM EDT Contributed by: PrivacyNews News Section: Other Privacy News

.... Don D. Buchwald, working for $100 an hour as a court-appointed attorney for Ashley Dupré, the prostitute linked with Gov. Eliot Spitzer, defended his client’s privacy in this letter sent to the media. He says that Dupré was “thrust into the public glare at age 22 without her consent” and that “some publications, in violation of journalistic norms, have used the occasion as an excuse to exploit Dupré’s persona for commercial purposes by, among other things, displaying a montage of suggestive photographs of Ms. Dupré that has nothing to do with the Spitzer story,” and in “violation of her privacy rights and federal copyright law.”

Source - innovationnewspapers.com

Note -- copy of press release by lawyer to media reproduced in story.