Close to home... and some fairly basic security failures

http://www.denverpost.com/news/ci_9822063

DMV puts Coloradans at risk of ID theft

By Jessica Fender The Denver Post Article Last Updated: 07/09/2008 06:10:43 AM MDT

The Division of Motor Vehicles put 3.4 million Coloradans at risk of identity theft due to flaws in the way driver's-license information is handled, lawmakers learned Tuesday at an interim transportation committee hearing.

The DMV regularly sends large batches of personal information over the Internet without encryption and has failed to properly limit access to its database, according to a recent audit. At one point, 33 former DMV employees could access names, addresses, dates of birth and Social Security numbers — some workers more than a year after their departure, auditors found.

... Colorado ranks eighth in the nation in identity-theft complaints per person and first in the nation when it comes to general fraud reports.

... Auditors said the DMV's method for handling sensitive information was "fragmented, disorganized and poorly planned," partly because the division is made up of a number of decentralized offices scattered across the state. No one person is responsible for security.

This is as small an ID Theft as you can get (one person) but I wonder how often this trick is tried/successful? It is Social Engineering at its worst – yet it still worked! Do you think this could happen thousands of times every day?

http://blog.karppinen.fi/2008/07/apple-just-gave-out-my-apple-i.html

Apple just gave out my Apple ID password because someone asked

By Marko Karppinen on July 8, 2008

... Based on the emails that have appeared in my .Mac mailbox, this was accomplished by sending this classy one-liner to Apple:

am forget my password of mac,did you give me password on new email marko.[redacted]@yahoo.com

Should make an interesting CASE for my security class. What would you do, if...?

http://www.phiprivacy.net/?p=524

Jul-9-2008

KS: Medical Group Investigates Allegations of Stolen Records

Denise Hnytka reports:

The Wichita Radiological Group received an anonymous call saying their patient records may have been stolen. On Monday, the executive director reported the information to Wichita police.

According to the police report, the caller claims a former employee stole patient records before being fired from the Wichita Radiological Group. The caller said the former employee is now using patients’ personal and financial information to pay bills.

The radiological group is not sure how much, if any information was stolen. So far, they have not found any evidence of the theft. But tens of thousands of patient records were in the database could have been compromised.

Read more on KansasCW.com

[From the article:

An attorney for the Wichita Radiological Group tells Eyewitness News they have launched an internal investigation. The group changed internal passwords to make sure no more records are accessed.

Wichita police say they need identity theft victims from the case to come forward before they can proceed in their investigation.

Not sure from the article how this was discovered, but it wasn't by the investment firm.

http://www.pogowasright.org/article.php?story=20080709060744305

Justice Breyer Is Among Victims in Data Breach Caused by File Sharing

Wednesday, July 09 2008 @ 06:07 AM EDT Contributed by: PrivacyNews

Sometime late last year, an employee of a McLean investment firm decided to trade some music, or maybe a movie, with like-minded users of the online file-sharing network LimeWire while using a company computer. In doing so, he inadvertently opened the private files of his firm, Wagner Resource Group, to the public.

That exposed the names, dates of birth and Social Security numbers of about 2,000 of the firm's clients, including a number of high-powered lawyers and Supreme Court Justice Stephen G. Breyer.

The breach was not discovered for nearly six months. A reader of washingtonpost.com's Security Fix blog found the information while searching LimeWire in June.

Source - Washington Post

[From the article:

What users may not be aware of is that the software that facilitates file sharing may be configured to allow access to a portion, if not all, of a user's documents.

... they're not paying attention to the default settings that come with the application," Cabri said.

Interesting that the videos are only now being released. Perhaps it takes this long to sort through all the videos and identity people in the right place and time? (Do these guys look like “Master Hackers” to you?)

http://www.pogowasright.org/article.php?story=20080708170717794

2 sought in debit card skimming thefts

Tuesday, July 08 2008 @ 05:07 PM EDT Contributed by: PrivacyNews

Authorities have released video surveillance photos of the suspects believed to have stolen motorists' debit card information at convenience stores gas pumps in Pennsylvania and Delaware.... Trooper Christopher Shoap, of the Pennsylvania State Police, said these skimmers have turned up inside gas pumps in Concord Township, Downingtown, Bristol Township and Uwchlan Township in Pennsylvania, and in New Castle, Del.

Shoap said the skimmers have primarily been used at Wawa Food Market locations in New Castle County, Delaware, and in Delaware, Chester, Montgomery and Bucks counties in Pennsylvania.

Source - DelawareOnline

[From the article:

The investigation into this debit card fraud dates back to April, when it was discovered that thieves were rigging gas pumps with skimming devices to capture the customers’ debit card information and empty their bank accounts.

The skimming devices are being used on local gas station fuel pumps' credit card readers and are not easily detected.

... The suspects were believed to have placed a device inside the pump, where it would not be visible to customers, and later retrieved it, Shoap said.
With the stolen debit card information, these thieves have then made fraudulent withdrawals from ATM machines at Wawa and 7-Eleven convenience store locations throughout the area and even at casinos in Atlantic City.

So small as to be trivial, but the article includes an interesting proposal for compensating Class Action Lawyers... The coupon idea is similar to the “penalty” TJX paid.

http://www.pogowasright.org/article.php?story=2008070817083973

Stein Mart Settles Personal Data Breach By Offering... Coupons

Tuesday, July 08 2008 @ 05:08 PM EDT Contributed by: PrivacyNews

Stein Mart was caught "printing expiration dates and/or more than the last five digits of credit cards on receipts," and was subsequently hit with a class action lawsuit for exposing sensitive customer data. Now they've settled by agreeing to run coupons in local newspapers.

Source - The Consumerist

[From the article:

We need a new federal law that says class action lawyers have to be compensated in the same manner as their clients. Give those hard working guys and gals some $30-off coupons, please!

Anything that reduces phishing is good.

http://news.cnet.com/8301-10784_3-9985605-7.html

July 8, 2008 11:03 AM PDT

Gmail now blocking fake eBay, PayPal e-mails

Posted by Elinor Mills

... The technology, DomainKeys, uses cryptography to verify the domain of the sender of an e-mail. It allows e-mail providers to validate the domain from which an e-mail originates, and it enables easier detection of phishing attempts by helping identify abusive domains.

Note that there is no requirement to prevent Identity Theft – these rules deal with records of transactions the thief made with your credit card...

http://www.bespacific.com/mt/archives/018748.html

July 08, 2008

‘Red Flag’ Regulations Require Financial Institutions and Creditors to Have Identity Theft Prevention Programs

Federal Trade Commission: "Financial institutions and creditors are now required to develop and implement written identity theft prevention programs under the new Red Flags Rules.

The Red Flags Rules are part of the Fair and Accurate Credit Transactions (FACT) Act of 2003. Under these Rules, financial institutions and creditors with covered accounts must have identity theft prevention programs in place by November 1, 2008, to identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft.

The Commission staff is launching an outreach effort to explain the Rules in greater detail. It has now published a general alert on what the Rules require, and, in particular, an explanation of which businesses - financial institutions and creditors - are covered by the Rules."

Tools & Techniques Stephen Rynerson submitted this one. It's so scary that I'm planning to move to Australia (by boat)

http://www.washingtontimes.com/weblogs/aviation-security/2008/Jul/01/want-some-torture-with-your-peanuts/

Want some torture with your peanuts?

Aviation Security

POSTED 2:18 PM BY P. JEFFREY BLACK & JEFFREY DENNING

By Jeffrey Denning

Just when you thought you’ve heard it all...

A senior government official with the U.S. Department of Homeland Security (DHS) has expressed great interest in a so-called safety bracelet that would serve as a stun device, similar to that of a police Taser®. According to this promotional video found at the Lamperd Less Lethal website, the bracelet would be worn by all airline passengers.

This bracelet would:

• take the place of an airline boarding pass

• contain personal information about the traveler

• be able to monitor the whereabouts of each passenger and his/her luggage [Does the luggage get its own bracelet, or is it attached to the passenger? Bob]

• shock the wearer on command, completely immobilizing him/her for several minutes [What a fun hack! Think of it: “Welcome aboard, Congressman!” ZAP “Welcome aboard, Senator!” ZAP Bob]

[I still like my idea – make everyone fly nude. Bob]

Detailing the governments efforts to “help you?”

http://www.pogowasright.org/article.php?story=2008070813042020

Tax-related identity theft rose 644%, IRS official says

Tuesday, July 08 2008 @ 01:04 PM EDT Contributed by: PrivacyNews

Tax-related identity theft grew more than seven times over a four-year period ending Sept. 30, according to a new report that said efforts by the Internal Revenue Service to deal with problem are further hurting victims.

Source - New York Daily News

[The report: Fiscal Year 2009 Objectives Report

Fiscal Year 2009 Objectives Report Supplement

No surprise. This is hard to do!

http://www.bespacific.com/mt/archives/018746.html

July 08, 2008

New GAO Report Reveals Agencies are Not Complying with Requirements to Preserve E-mails

Committee on Oversight: "Rep. Henry A. Waxman, Rep. Wm. Lacy Clay, and Rep. Paul W. Hodes released a new GAO report that finds that senior federal officials are failing to comply with requirements to preserve e-mail records. On Wednesday, the House is expected to consider legislation (H.R. 5811) to modernize the Federal Records Act and the Presidential Records Act to ensure the preservation of these important federal records.

The new GAO report, Federal Records: National Archives and Selected Agencies Need to Strengthen E-Mail Management, finds:

• All four of the agencies examined — the Department of Homeland Security, the Department of Housing and Urban Development, the Environmental Protection Agency, and the Federal Trade Commission — are relying on outdated and unreliable “print and file” systems for preserving e-mail records.

• Senior agency officials did not fully comply with key requirements for preserving e-mail records. GAO reviewed the practices of 15 senior agency officials in the four agencies and found that a majority of these officials failed to manage their e-mail records in accordance with regulatory requirements. E-mails were not retained in adequate recordkeeping systems, making the e-mail records easier to lose, harder to find, and vulnerable to deletion or other tampering. Inadequate oversight and training within agencies contributed to the inconsistent compliance with preservation requirements..."

Very light on details...

http://www.pogowasright.org/article.php?story=20080708064442955

Florida Organ and Tissue Registry security flaw exposes 55,000 donors' details

Tuesday, July 08 2008 @ 06:44 AM EDT Contributed by: PrivacyNews

Q: What happened?
A: We learned of a potential security flaw in the state’s Organ and Tissue Registry. We stopped all access to the database, identified the flaws and corrected them.

Q: What information was potentially accessed?
A: The database includes names, addresses, social security numbers, dates of birth, and driver’s license numbers.

Q: How do I know whether my records were affected?
A: The system has identified approximately 55,000 individuals whose information may have been viewed by unauthorized persons. We are in the process of contacting each person affected by mail.

Source - Florida Agency Healthcare Administration FAQ on Organ and Tissue Database breach

Note: According to a report by ABC, the breach occurred on June 20th and was fixed the next day. [This makes it sound like a hacker attack Bob]

BreachBlog makes some amusing (and very familiar) comments on the breaches it reports...

http://breachblog.com/2008/07/07/usfoodservice.aspx

Laptop containing personal information is stolen from U.S. Foodservice

Posted by Evan Francen at 7/7/2008 11:28 PM

... Reference URL: New Hampshire State Attorney General breach notification

Old news I thought. Everyone knows the job sites are skimmed... Don't they?

http://www.pogowasright.org/article.php?story=20080707101918952

Trojan trawls recruitment sites in ID harvesting scam

Monday, July 07 2008 @ 10:19 AM EDT Contributed by: PrivacyNews

Hackers have turned the harvesting of personal information from Monster.com and other large US jobsites into a lucrative black market business

A Russian gang called Phreak has created an online tool that extracts personal details from CVs posted onto sites including Monster.com, AOL Jobs, Ajcjobs.com, Careerbuilder.com, Careermag.com, Computerjobs.com, Hotjobs.com, Jobcontrolcenter.com, Jobvertise.com and Militaryhire.com. As a result the personal information (names, email addresses, home addresses and current employers) on hundreds of thousands of jobseakers has been placed at risk, according to net security firm PrevX.

Source - The Register

Thanks to Brian Honan for this link.

...because... (I can't be everywhere and do everything!)

http://www.pogowasright.org/article.php?story=20080707074528459

Data “Dysprotection:” breaches reported last week

Monday, July 07 2008 @ 07:56 AM EDT Contributed by: PrivacyNews

A recap of incidents or privacy breaches reported last week for those who enjoy shaking their head and muttering to themselves with their morning coffee.

Source - Chronicles of Dissent

http://www.technewsworld.com/rsstory/63696.html

5 Ways to Build an Indestructible Customer Data Fortress

By Kristin Lovejoy E-Commerce Times Part of the ECT News Network 07/08/08 4:00 AM PT

On June 30, data security standards set by the Payment Card Industry (PCI) became mandatory for organizations that handle online credit card payments. This is a significant milestone in the ongoing push to strengthen online security as these important standards have moved from recommendations to hard and fast mandates.

Key Issues [These are far from new Bob]

As it pertains to efforts around PCI DSS compliance and protection of customer data, there are five key issues that organizations must not overlook to improve their overall security stature:

1. First, retailers need to be vigilant in managing the chain of custody and closely monitoring how business partners are handling data.

2. Privileged user access also is important. This means monitoring the activities of those individuals who have root access to sensitive data and implementing necessary controls to ensure information is protected.

3. Another major security hazard lies in "unstructured" data -- information outside of databases, typically stored in documents.

4. Additionally, shared accounts and passwords are often culprits of security breaches. Shared passwords are used 73 percent of the time to manage network devices, according to the Password Research Institute. This makes it impossible to track and monitor user activity, prove segregation of duties, restrict access to cardholder data based upon principle of least privilege, etc.

5. Lastly, default passwords and settings left unchanged -- particularly at the organization's perimeter -- are an open invitation to hackers. Organizations should do a thorough check for default settings. Although most organizations have a "no default" mandate in their written policies, enforcement is not always vigilant.

They capture ans index everything, why should this be different?

http://www.pogowasright.org/article.php?story=20080707180614650

Stolen data live on in Google searches

Monday, July 07 2008 @ 06:06 PM EDT Contributed by: PrivacyNews

A Colorado woman logged on to her computer in April, voted on a CNN poll, shopped for airline tickets and calculated payments for a $25,000 car loan from Wells Fargo.

She didn't suspect that a malicious software program was recording every keystroke - frequent-flier numbers and passwords, her home address and phone number, an online conversation she was having with some friends.

But it was, and months after authorities were alerted to the breach and disabled the server in Malaysia where her data were being stored, the information was still available online - in a Google search.

Source - SFGate

[From the article:

Finjan reported the stolen data to a variety of authorities, but one of them, the FBI, said it wasn't concerned with the cache - only the evidence on the server.

"We tell people we can't be responsible for protecting data or ensuring that whatever is happening is all cleaned up," said Joe Schadler, a spokesman for the FBI's San Francisco office. "We're not security experts."

[I wonder if there is a business model here. Sell a “locate and destroy” service to breach companies so they can protect the victims – like credit monitoring but more immediate... Bob]

It has started. No doubt this will become much more interesting during the Democratic Convention...

http://thinkprogress.org/2008/07/07/librarian-with-mccainbush-sign-kicked-out-of-public-campaign-event/

Librarian with ‘McCain=Bush’ sign charged with trespassing at public campaign event

Sen. John McCain (R-AZ) was in Denver, CO, today for a town hall meeting. The event, at the Denver Center for the Performing Arts, was billed as “open to the public.” Yet Carol Kreck, a 61-year-old librarian carrying a “McCain=Bush” sign, was taken away by police for trespassing. A police officer told Kreck:

You have two choices. You can keep your sign here and receive a ticket for trespassing, or you can remove the sign and stay in line and attend this town hall meeting.

[Wouldn't all those who voted for Bush think the sing pointed out a good thing? Bob]

Interesting, but I suspect you don't need an close approximation of a signature to commit fraud.

http://www.pogowasright.org/article.php?story=20080707080142160

NZ: Watchdog warns against posting signatures online

Monday, July 07 2008 @ 08:01 AM EDT Contributed by: PrivacyNews

The Privacy Commissioner says the posting of signatures in online registers is a matter of concern, after an Auckland-based IT contractor found his published and available to anyone at the Charities Commission website.

Privacy Commissioner Marie Shroff says signatures posted online present some concerns. She encourages agencies to obscure, suppress or pixelate them wherever possible.

Source - Computerworld

Asking the question from a reverse perspective, How important (risk level) must it be before it is appropriate to take fingerprints (or other biometrics)

http://www.pogowasright.org/article.php?story=20080707074638224

Ca: Hands off LSAT students' fingers

Monday, July 07 2008 @ 07:46 AM EDT Contributed by: PrivacyNews

A recent decision by the Privacy Commissioner of Canada found that taking finger/thumb prints from those writing the Law School Admission Test (LSAT) is a privacy breach and must be stopped.

Source - David Canton, in CANOE

[From the article:

The Commissioner considered this four-point test:

- Is the measure demonstrably necessary to meet a specific need?

- Is it likely to be effective in meeting that need?

- Is the loss of privacy proportional to the benefit gained?

- Is there a less privacy-invasive way of achieving the same end?

I guess remaining anonymous is no longer an option? Perhaps anonymous equals sex offender? Perhaps terms of service has the force of law? (Does that work both ways?)

http://yro.slashdot.org/article.pl?sid=08/07/07/1824228&from=rss

User Charged With Felony For Using Fake Name On MySpace

Posted by ScuttleMonkey on Monday July 07, @03:53PM

from the understand-before-you-prosecute dept.

Recently a user, Lori Drew, was charged with a felony for the heinous crime of pretending to be someone else on the Internet. Using the Computer Fraud and Abuse Act, Lori was charged for signing up for MySpace using a fake name.

"The access to MySpace was unauthorized because using a fake name violated the terms of service. [Which is a felony? Bob] The information from a "protected computer" was the profiles of other MySpace users. If this is found to be a valid interpretation of the law, it's really quite frightening. If you violate the Terms of Service of a website, you can be charged with hacking. That's an astounding concept. Does this mean that everyone who uses Bugmenot could be prosecuted? Also, this isn't a minor crime, it's a felony punishable by up to 5 years imprisonment per count. In Drew's case she was charged with three counts for accessing MySpace on three different occasions."

[A (up till now) useful site: http://www.bugmenot.com/ Bob]

Looks interesting for the e-Discovery crowd...

http://www.cs.ucl.ac.uk/staff/S.Attfield/desi/DESI_II_agenda.html

DESI II

Second International Workshop on Supporting Search and Sensemaking for Electronically Stored Information in Discovery Proceedings

Wednesday June 25, 2008 - University College London, U.K.

The full proceedings as a zipped pdf

This could be useful...

http://www.killerstartups.com/Web-App-Tools/sisense-com-business-intelligence-dashboard/

Sisense.com - Business Intelligence Dashboard

Sisense, a company which specializes in business intelligence or decision support, has just launched Prism an information analysis tool which supports out of the box connectivity to different data sources. Prism allows data to be picked apart, processed, and scrutinized from a WYSIWYG interface with emphasis on visuals and instant results. Users can easily create dashboards, reports, widgets and charts; Sisense connects to Excel, SQL, and Oracle. They’ve also got a beta Amazon S3 Dashboard which basically makes it easy to make sense of Amazon’s S3 data with visualizations of your service’s stats. Developers can receive data as charts, in tabular format, and they can schedule key performance indicator reports. Prism is a free 10meg download which comes with video tutorials and a learning center for beginners.

http://www.sisense.com/default.aspx?AspxAutoDetectCookieSupport=1

You never know what your are buying... Why would any company voluntarily cripple their product? Do they see the $99 option as a money maker (like the airlines charging to check a bag?)

http://digg.com/hardware/Bend_Over_Dude_You_re_Getting_A_Dell

Bend Over Dude, You’re Getting A Dell

ripten.com — Some Dell laptops come with dissabled audio ports, after pressure from the RIAA. Dell will enable them for you for only $99. Bargin.

http://www.ripten.com/2008/07/07/bend-over-dude-youre-getting-a-dell/

From the comments, this could become a hot discussion topic, but since the lobbying is all on one side, all we can do is complain.

http://tech.slashdot.org/article.pl?sid=08/07/07/2351252&from=rss

Telecoms Suing Municipalities That Plan Broadband Access

Posted by kdawson on Monday July 07, @08:04PM from the buggy-whips-mean-jobs dept.

Law.com has up a review of ongoing and historical cases of telecoms suing municipalities that plan broadband networks. In many cases those same telecoms have spent years ignoring as potential customers the cities and towns now undertaking Net infrastructure projects, only to turn around and sue them. One lawyer who has defended many municipalities in this position says, "This is similar to electrification a century ago when small towns and rural areas were left behind, so they formed their own authorities." Bob Frankston has been writing for years about the financial model of artificial scarcity that underlies the telecoms businss plans. This post gives some of the background to the telecoms' fear of abundance.

I don't often get to say nice things about Comcast! This should be a natural reaction to new technologies – figure out how to monitor them and how to use them to enhance the organization.

http://www.boston.com/business/technology/articles/2008/07/07/hurry_up_the_customer_has_a_complaint/

Hurry up, the customer has a complaint

As blogs expand the reach of a single voice, firms monitor the Internet looking for the dissatisfied

By Carolyn Y. Johnson Globe Staff / July 7, 2008

When C.C. Chapman noticed a blemish in his high-definition television's reception during the NBA playoffs recently, he blasted a quick gripe about Comcast into the online ether, using the social network Twitter.

Minutes later, a Twitter user named ComcastCares responded, and within 24 hours, a technician was at Chapman's house in Milford to fix the problem.

"I was so floored," said Chapman, who runs a digital marketing agency and advises companies to do what he experienced with Comcast - listen to what customers are saying about them online and respond. "When it actually happened to me, it blew me away," he said. "Now I have a case study."

... Other companies are moving in the same direction.

At Southwest Airlines, the social media team includes a chief Twitter officer who tracks Twitter comments and monitors a Facebook group, an online representative who fact checks and interacts with bloggers, and another who takes charge of the company's presence on sites such as YouTube, Flickr, and LinkedIn. So if someone posts a complaint in cyberspace, the company can respond in a personal way.

Tools & Techniques Adding the “I'm being coerced” option.

http://it.slashdot.org/article.pl?sid=08/07/08/027220&from=rss

TrueCrypt 6.0 Released

Posted by kdawson on Tuesday July 08, @05:36AM from the plausible-deniability dept. Encryption Security

ruphus13 writes

"While most of the US was celebrating Independence Day, the true fellow geeks over at TrueCrypt released version 6.0 of TrueCrypt over the long weekend. The new version touts two major upgrades. 'First, TrueCrypt now performs parallel encryption and decryption operations on multi-core systems, giving you a phenomenal speedup if you have more than one processor available. Second, it now has the ability to hide an entire operating system, so even if you're forced to reveal your pre-boot password to an adversary, you can give them one that boots into a plausible decoy operating system, with your hidden operating system remaining completely undetectable.' The software has been released under the 'TrueCrypt License,' which is not OSI approved."

http://news.cnet.com/8301-1023_3-9985074-93.html?part=rss&subj=news&tag=2547-1_3-0-5

July 7, 2008 5:02 PM PDT

Geeks get a word in with Merriam-Webster

Posted by Michelle Meyers 4 comments

Geek culture is once again showing its influence over the mainstream lexicon in the latest version of the Merriam-Webster Collegiate Dictionary, which includes word additions such as webinar, malware, netroots, pretexting (thank you Hewlett-Packard), and fanboy (thank you Apple).

Another large list of free stuff. How can I resist?

http://www.opensourcewindows.org/

Open Source Windows

Is this an indication that the government wants to tax your ancestors?

http://www.bespacific.com/mt/archives/018734.html

July 07, 2008

USA.gov’s Family History and Genealogy page

Family History and Genealogy page includes the following topical links:

• Genealogy resources, by state

• Gravesite locator for veteran cemeteries

• Ship passenger arrival records, 1820-1982

• Census finder

Something for my Process Engineering Class... (Perhaps you should check the design your apprentice architect came up with?

http://digg.com/comedy/Is_There_Something_Wrong

Is There Something Wrong?

flickr.com — Can you find what is wrong with this building?

http://www.flickr.com/photos/14309899@N08/2647737270/sizes/o/

Ditto

http://news.yahoo.com/s/nm/20080707/tc_nm/usa_education_technology_dc

Technology reshapes America's classrooms

By Jason Szep Mon Jul 7, 10:42 AM ET

... Education experts say her school, the Lilla G. Frederick Pilot Middle School in Boston, offers a glimpse into the future.

It has no textbooks. Students receive laptops at the start of each day, returning them at the end. Teachers and students maintain blogs. Staff and parents chat on instant messaging software. Assignments are submitted through electronic "drop boxes" on the school's Web site.

... Classwork is done in Google Inc's free applications like Google Docs, or Apple's iMovie and specialized educational software like FASTT Math.

... "Our projections show that 50 percent of high school courses will be taught online by 2019. It's about one percent right now," said Horn, executive director of education at Innosight Institute, a nonprofit think tank in Massachusetts.

Ditto. Perhaps some ideas (at least a list of risks)

http://tech.slashdot.org/article.pl?sid=08/07/08/0116238&from=rss

Handling Flash Crowds From Your Garage

Posted by kdawson on Tuesday July 08, @02:50AM from the to-scale-or-not-to-scale dept. The Internet Networking IT

slashdotmsiriv writes

"This paper from Microsoft Research describes the issues and tradeoffs a typical garage innovator encounters when building low-cost, scalable Internet services. The paper is a more formal analysis of the problems encountered and solutions employed a few months back when Animoto, with its new Facebook app, had to scale by a factor of 10 in 3 days. In addition, the article offers an overview of the current state of utility computing (S3, EC2, etc.) and of the most common strategies for building scalable Internet services."

How to gain a reputation... (Strange that they didn't blame it on the courier...)

http://www.pogowasright.org/article.php?story=20080706105410777

Hk: HSBC hit by new lost data scandal

Sunday, July 06 2008 @ 10:54 AM EDT Contributed by: PrivacyNews

Hongkong and Shanghai Banking Corp says it has failed to find a tape containing confidential customer information that was discovered missing on June 19 but not reported until Wednesday.

... "Fifty-five tapes were dispatched, but only 54 arrived in Hong Kong. It is a backup tape that contains a total of 25,000 recorded calls." The lender said the missing tape contained records of calls made between April 18 and April 24. The calls were related to "credit card inquiries, business internet banking for commercial customers, and general outbound calls to customers." It will advise affected customers once they have been identified.

Source - The Standard

I will need to study this carefully, since I have little comfort based on what has happened so far...

http://news.slashdot.org/article.pl?sid=08/07/07/0232234&from=rss

Avi Rubin Has Some Optimistic Words About E-Voting

Posted by timothy on Monday July 07, @07:38AM from the let-the-las-vegans-run-the-show dept. Government Security Politics Technology

An anonymous reader writes

"For more than a decade, Aviel "Avi" Rubin, a professor of computer science at Johns Hopkins University in the US and an e-voting activist, has been a vocal critic of e-voting systems. In this interview Rubin talks about the recent US presidential primary election cycle and his thoughts on e-voting going into the November US elections."

[From the article: Most states have switched to paper records, Rubin notes

A topic for my Business Continuity class. As thousands of companies move to “Cloud Computing” the cost of a major outage skyrockets...

http://tech.slashdot.org/article.pl?sid=08/07/06/1719251&from=rss

Keeping an Eye Out When Sites Go Down

Posted by timothy on Sunday July 06, @02:08PM from the he-said-go-down dept. The Internet Communications Networking IT

miller60 writes

"Are major web sites going down more often? Or are outages simply more noticeable? The New York Times looks at the recent focus on downtime at services like Twitter, and the services that have sprung up to monitor outages. When a site goes down, word spreads rapidly, fueled by blogs and forums. But there have also been a series of outages with real-world impact, affecting commodities exchanges, thousands of web sites and online stores."

“I was a COBOL programmer” is equivalent to saying “I was a Mastodon hunter.”

http://www.eweek.com/c/a/Application-Development/COBOL-Dont-Call-it-a-Comeback/

COBOL: Don`t Call it a Comeback

By Darryl K. Taft 2008-07-07

... According to some estimates, there are about 200 billion lines of COBOL code in business applications still running today, with 5 billion new lines of COBOL code developed each year.

... A few companies that are focusing on helping organizations upgrade their COBOL applications include Veryant, Micro Focus and Microsoft -- working to move legacy COBOL applications to the Java and Microsoft platforms.

So rather than a full-fledged “comeback,” many are focusing on ensuring that COBOL code continues to run in modern environments.

The future?

http://www.killerstartups.com/Video-Music-Photo/veetle-com-live-video-content-in-hd/

Veetle.com - Live Video Content in HD

The Tour de France, that most renowned of all cycle races, just recently began. Now of course, many fans can’t actually make it France to watch the event, but they can get all the latest coverage from the web. Veetle, an online broadcasting site with 14 channels and over 25,000 viewers from all over the world, is the perfect place to go. Not only can you catch the Tour de France, you can also catch Wimbledon highlights, and for those with different interests, there’s anime, movies (James Bond, the Departed, and La Vie en Rose are just some of the films in line today), music, travel programs, and news. As a member of the site, you can upload your videos in TV and HD quality or broadcast live using DVD, a tuner card, webcam or your own TV. To watch programs, you will have to download the Veetle TV player [Somewhat of a negative... Bob] (it’s rather slim at 3.9mb); from there, you can watch from your browser.

http://www.veetle.com/channelList.php

Business model: This should be easy to automate...

http://news.cnet.com/8301-13772_3-9984218-52.html?part=rss&subj=news&tag=2547-1_3-0-5

July 6, 2008 7:31 AM PDT

Making a living taking digital snapshots of passers-by

Posted by Daniel Terdiman

... They park their cars at strategic curves in the road where they can shoot pictures of drivers coming from either direction, and then they sell the drivers--at least some of them--the pictures.

... He said that he routinely shoots thousands of pictures a day and sometimes, if there's a motorcycle rally in the area, can take as many as 17,000 in one shift.

Clear illustration of the effect taxes have on prices...

http://digg.com/travel_places/Heat_Map_of_US_Gas_Prices

Heat Map of US Gas Prices

gasbuddy.com — Now you can see what gas prices are around the country at a glance. Areas are color coded according to their price for the average price for regular unleaded gasoline.

Remember, Iraq was not interested in nuclear weapons...

http://hardware.slashdot.org/article.pl?sid=08/07/06/1637205&from=rss

550 Metric Tons of Uranium Removed From Iraq

Posted by Soulskill on Sunday July 06, @01:01PM from the war-on-gas-prices dept.

Orion Blastar tips us to an AP report that 550 metric tons of "yellowcake" uranium has successfully been removed from Iraq. The operation lasted three months, and it required 37 separate flights and an 8,500-mile trip by boat to reach a port in Montreal. Quoting:

"While yellowcake alone is not considered potent enough for a so-called 'dirty bomb' -- a conventional explosive that disperses radioactive material -- it could stir widespread panic if incorporated in a blast. Yellowcake also can be enriched for use in reactors and, at higher levels, nuclear weapons using sophisticated equipment. The Iraqi government sold the yellowcake to a Canadian uranium producer, Cameco Corp., in a transaction the official described as worth 'tens of millions of dollars.' A Cameco spokesman, Lyle Krahn, declined to discuss the price, but said the yellowcake will be processed at facilities in Ontario for use in energy-producing reactors."

Another fun case to follow!

http://www.pogowasright.org/article.php?story=20080706061945100

How America is snooping on YOU ... and may soon be snooping a whole lot more

Sunday, July 06 2008 @ 06:19 AM EDT Contributed by: PrivacyNews

Dutch Liberal MEP Sophie In’t Veld was becoming irritated. Whenever she tried to board a flight in America – something she does several times each year – she was delayed by special security checks, subjected to questioning, additional searches of her bags and screening for explosives.

.... Last week, she filed a US lawsuit, the first of its kind, demanding access to her records.

... Her case comes at a critical juncture. Since the start of this year, operating almost entirely beneath the public radar, the US Government has been making a concerted, multi-faceted push for unrestricted access to vast volumes of personal data held by governments on this side of the Atlantic.

What the US is after goes far beyond the ability to make requests case by case. They seek the ability to go on electronic fishing expeditions among British and other European databases held by law enforcement, immigration, financial and other official bodies – without even having to inform the databases’ custodians, let alone their subjects.

Source - thisislondon.co.uk

[From the article:

The report says such ‘automated decisions’ can be taken ‘without human involvement’, as long as there are ‘appropriate safeguards in place, including the possibility to obtain human intervention’.

‘In the real world, such protection is meaningless,’ said Tony Bunyan, Statewatch’s director. ‘If there’s no right to be informed what a database says about you, the first you’re going to know is when you’re wrongly arrested, when you don’t get that job, or when you can’t get on that plane.’

Editorial cartooning goes viral?

http://www.eff.org/deeplinks/2008/07/mark-fiore-cartoon-compromise

July 3rd, 2008

Cartoon: The Return of Snuggly, the Security Bear

Posted by Hugh D'Andrade

A few months back, SF Gate cartoonist Mark Fiore introduced his character Snuggly, the Security Bear, with a brilliant take on telecom immunity. Now, Snuggly is back, and he has a few words to say about "compromise."

http://www.markfiore.com/constitutional_compromise_0

It's not the limit – it's being told your service is unlimited...

http://tech.slashdot.org/article.pl?sid=08/07/05/2033201&from=rss

In Japan, a 900 Gigabyte Upload Cap, Downloads Uncapped

Posted by timothy on Saturday July 05, @04:45PM from the no-such-luck-in-tennessee dept. The Internet

Raindeer writes

"While the Broadband Bandits of the US are contemplating bandwidth caps between 5 gigabyte and 40 gigabyte per month, the largest telco in Japan has gone ahead and laid down some heavy caps for Japan's broadband addicts. From now on, if you upload more than 30 gigabyte per day, your network connection may be disconnected. Just think of it ... if you're in Japan and want to upload the HD movie you shot of yesterday's wedding, you soon might hit the limit. The downloaders do not face similar problems."

Next: Ride the Rockies?

http://mobile.slashdot.org/article.pl?sid=08/07/05/1711221&from=rss

Google Creates Tour De France Video Maps

Posted by timothy on Saturday July 05, @01:32PM from the now-now-let's-not-gush-too-much dept. Google Transportation

An anonymous reader writes

"In honor of the Tour de France's start today, Google has used its awesome Street View technology to compile amazing Tour de France route views. A great description of the technology that went into creating this can be found in this LinuxDevices article. At least, I'm assuming these are the cameras — Google acknowledged using Elphel cameras for book scanning and 'capturing street imagery in Google Maps.' And from the article, the cameras have come along way from the days when crazy cat ladies and other privacy freaks scuppered Street View in San Francisco a couple of years back."

An article studying the anthropologists...

http://www.technewsworld.com/rsstory/63666.html?welcome=1215346012

Meet Motorola's In-House Tech Anthropologist

By Wailin Wong Chicago Tribune 07/06/08 4:00 AM PT

Related. “What's good for Coke is good for America?”

http://www.economist.com/world/africa/displaystory.cfm?story_id=11670946

Index of happiness?

Jul 3rd 2008 | NAIROBI From The Economist print edition

... “We see political instability first because we go down as far as we can into the market,” says Alexander Cummings, head of Coca-Cola’s Africa division. The ups and downs during Kenya’s post-election violence this year could be traced in sales of Coke in Nairobi’s slums and in western Kenya’s villages. Events in the Middle East, such as the 2006 war between Hizbullah and Israel, can dent sales in Muslim parts of Africa, though anti-American feeling usually wears off quite quickly.

You thought it would be bad to have someone run up charges on your credit card. How would you like this on your medical records?

http://www.phiprivacy.net/?p=521

Jul-4-2008

ID fraud reported at hospital

Officials at South Coast Medical Center are still trying to figure out how a woman was admitted under a 72-hour psychiatric hold using another woman’s identity — and insurance card.

[...]

Kofl said it is the first known incident [it's the unknown that worry me... Bob] of insurance identity theft in the Adventist Health chain of 18 hospitals.

Full story - Coastline Pilot

[From the article: Hospital officials were shocked to learn the patient and the woman whose insurance was billed for the $13,000 hospital stay were not the same. [Almost as shocked as realizing they weren't going to be paid. Bob]

... The hospital had no way of knowing the woman was using another person’s insurance card, Kofl said.

“The patient had a valid insurance card [Perhaps “valid looking?” Bob] and the address matched what was in the system,” she said.

What goes around comes around?

http://www.pogowasright.org/article.php?story=20080704093044920

Daily Mail publisher is red-faced after laptop with personal data is stolen

Friday, July 04 2008 @ 09:30 AM EDT Contributed by: PrivacyNews

Daily Mail publisher Associated Newspapers has admitted that a laptop containing financial and personal details of thousands of staff, suppliers and contributors has been stolen.

...Even those who no longer work for either Associated Newspapers, which also publishes the Mail on Sunday and the Evening Standard, and regional newspaper publisher Northcliffe Media have been affected and contacted.

... The letters from the Associated Newspapers group finance director, Simon Dyson, and his Northcliffe counterpart, Martyn Hindley, tell recipients that their "name, address, bank account number and bank sort code were the sensitive data lost" when the laptop was stolen last week.

Source - Guardian

So, can I legally install an anti-virus program that blocks, detects and/or removes it?

http://news.slashdot.org/article.pl?sid=08/07/04/1343214&from=rss

Bavarian Police Can Legally Place Trojans On PCs

Posted by kdawson on Friday July 04, @12:34PM from the trust-us-we-would-never-abuse-this-power dept. Government Privacy Security

An anonymous reader writes

"The Bavarian Parliament passed a law that allows Bavarian police to place 'Remote Forensic Software' (Google translation) on a suspect's computer as well as on the computers of a suspect's contacts. They may break into houses in secret to install the RFS if a remote installation is not possible; and while they are there a (physical) search is permitted too. The RFS may be used to read, delete, and alter data."

The translation says that RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person... Even where there is a reasonable assumptions on concrete preparatory acts for such serious offenses."

Strange that none of the defense lawyers paid as much attention to what was being blogged about this case as the Judge did.

http://yro.slashdot.org/article.pl?sid=08/07/04/1851218&from=rss

NC Judge Takes "A Fresh Look" At RIAA Subpoenas

Posted by ScuttleMonkey on Friday July 04, @05:56PM from the doing-their-part dept. The Courts Education

NewYorkCountryLawyer writes

"When some North Carolina State students recently brought to the attention of the Court the apparent illegality of the RIAA's investigations by unlicensed investigators, they also caught the attention of the judges. After reading these new papers, District Judge Louise W. Flanagan, who admits that she's been routinely signing the RIAA's ex parte discovery orders in the past, has indicated that she is now going to take 'a fresh look' at the RIAA's tactics. She issued a stay of the subpoena, ordering NC State not to respond to it, and referred the motions to dismiss the cases to a Magistrate Judge for him to take that 'fresh look' at what has been going on."

Mot that anyone will ever read it...

http://bits.blogs.nytimes.com/2008/07/04/google-changes-home-page-adding-link-to-privacy-policy/

Google Changes Home Page, Adding Link to Privacy Policy

By Saul Hansell UPDATED | 7/4, 10:07 AM

The word “privacy” now appears on Google’s home page, with a link to the company’s privacy policy.

With that one word, the Web search giant heads off the growing controversy over whether its previous practice ran afoul of a California law, the California Online Privacy Protection Act of 2003, which requires the operator of a commercial Web site that collects personal information to link to its privacy policy from its home page.

I see this as an interesting question for the White Hat club

http://tech.slashdot.org/article.pl?sid=08/07/04/1247249&from=rss

Best Way To Get Back a Stolen Computer?

Posted by kdawson on Friday July 04, @10:26AM from the aiding-lawn-forcement dept. Social Networks

davidphogan74 writes

"I have some stolen computers checking in with a server we have (software pre-loaded), and I have full access to the systems. What's the best way to deal with this situation? The local police (to the theft) have been contacted several times and seem to be clueless. I personally have no financial interest in these computers, I just don't like atom-thieves. What's the best way to handle knowing the IPs, email addresses, MySpace sites, the Google login, etc. when working with law enforcement? The officer I spoke with (who genuinely seemed to care) didn't know an IP address from a mailing address, so I called others. Nobody cared. Anyone have any ideas?"

e-Discovery Even with the small amount of data listed here, and assuming reasonable compression, 12 terabytes seems small to me.... (Do you suppose they will print the log for them?)

http://www.washingtonpost.com/wp-dyn/content/story/2008/07/03/ST2008070304015.html

YouTube Ordered To Release User Data

Viacom Had Sought Access to Database In Copyright Battle

By Ellen Nakashima Washington Post Staff Writer Friday, July 4, 2008; Page D01

... On Tuesday, U.S. District Judge Louis L. Stanton granted Viacom's request that YouTube release its 12-terabyte "logging" database -- a database that is larger than the Library of Congress's collection of about 10 million books, to Viacom. Every minute, 13 hours of video are uploaded to YouTube servers. The site logs hundreds of millions of views a week.

The database contains the unique login ID of the viewer, the time he began watching, the Internet Protocol, or IP, address of the user's computer and the identification of the video. That database is the only existing record of how often each video has been viewed during various time periods, the opinion said. Its data can recreate the number of views of a video for any particular day.

You must make a conscience effort to look for ALL sensitive information, ask yourself if you really need it and if so, how you will protect it.

http://www.pogowasright.org/article.php?story=20080704053350603

NV: Juror data breach is reported

Friday, July 04 2008 @ 05:33 AM EDT Contributed by: PrivacyNews

In a District Court security breach, a contracted vendor released personal information on about 380 potential jurors to an employee's private e-mail address, court officials said Thursday.

Clark County court officials said the people affected were notified by letters sent out Monday. Court officials did not specify whether the breach was intentional or accidental. They also didn't specify when the incident occurred.

The information was transferred from the printing company that prepares jury summons notices to an unidentified employee's e-mail account.

Source - Las Vegas Review-Journal

[From the article: Court officials said they have since removed all personal identifiers from the jury summons list... [Probable that no one even thought of doing this before the incident. Bob]

“We're your government and we're here to protect you!”

http://www.pogowasright.org/article.php?story=20080703173717194

Passport record system open to abuse, IG finds

Thursday, July 03 2008 @ 05:37 PM EDT Contributed by: PrivacyNews

A State Department passport record system that holds personal data on more than 120 million Americans is wide open to abuse and unable to prevent or detect unauthorized access, investigators said Thursday.

The review by the department's inspector general was ordered after revelations in March that State Department employees and contractors had accessed the files of presidential candidates Hillary Clinton, John McCain and Barack Obama.

The IG report found a much broader problem.

Source - McClatchy

[From the article:

Investigators surveyed the records of 150 high-profile Americans, whose names were selected from Forbes and Sports Illustrated magazine lists and Internet search engine Google's most-searched names.

Of the 150 — who weren't named in the report — 127, or 85 percent, had had their passport files accessed a total of 4,148 times, strongly suggesting attempts at unauthorized access.

... Investigators said they were unable to determine precisely how many individuals had access to the system or how many breaches had occurred.

If not a trend at least a more common scenario

http://mobile.slashdot.org/article.pl?sid=08/07/04/1228208&from=rss

Irrigation Controller Stolen, Wirelessly Rescues Itself

Posted by kdawson on Friday July 04, @08:46AM from the visionary-solutions-to-water-management-through-technology dept.

wooferhound sends along an amusing piece about thieves who got run over by technology and never knew what hit them. "A Rain Master Eagle-i Irrigation Controller recently stolen out of a housing development just outside of Tucson traveled nearly 80 miles before rescuing itself. The smart controller is now back in place on the wall where it was originally pinched... In this day and age, something that may look passive like an irrigation controller may not be so passive. The thieves didn't realize they were removing equipment that features 2-way wireless communications via the Internet. Three weeks later, the unexpected happened. The Maintenance Supervisor noticed a signal coming in from the stolen controller. He thought it was kind of odd that it was up and running... Whoever had stolen it had plugged it back in."

Repeat after me: Passwords do not provide adequate security.

http://houseofhackers.ning.com/profiles/blog/show?id=2092781%3ABlogPost%3A58655

Pass-The-Hash

Posted by hitechpo on July 3, 2008 at 4:30pm

For this blog, I wanted to give you some instructional material. Some of this stuff has been around for awhile, but there is some new stuff out there specifically, a new version of pass-the-hash toolkit. In a nutshell, the instructions that follow will allow you to gain full control of a windows domain without ever lifting a finger at cracking a password.

... Some rules to follow to prevent this type of attack are: lock down your workstations. Do not allow users to have local admin rights. Make sure they are not able to download programs they aren't supposed to. If you can, go to the computer that needs support instead of connecting remotely - don't be lazy. Utilize your network devices to assist in filtering and providing access control levels to your systems and assist in remote access control.

Still think it can't happen in your organization? What does this say about the effectiveness of Data Breach disclosure laws?

http://mobile.slashdot.org/article.pl?sid=08/07/03/2143254&from=rss

12,000 Laptops Lost Weekly At Airports

Posted by timothy on Thursday July 03, @06:02PM from the dignity-lost-even-more-often dept. Portables Security Transportation United States Hardware

kthejoker writes

"Apparently companies are even worse about losing our data than we suspected. From the article: 'According to a study of 106 major US airports and 800 business travelers published by the Ponemon Institute and Dell Computer, about 12,000 laptops are lost in airports each week. Only 30 percent of travelers ever recover the lost devices. Nearly half of the travelers say their laptops contain customer data or confidential business information.' Kinda scary..."

[From the article:

Sixty-five percent of the business travelers admit that they do not take steps to protect the confidential information contained on their laptops when traveling on business, according to the study. Forty-two percent say they don't back up their data before going on a trip. Fewer than 20 percent of respondents said they have whole disk encryption or file encryption on their machines.

[The Study: http://www.dell.com/downloads/global/services/dell_lost_laptop_study.pdf

Crooks in the computer age: Another Estonia? Would Tony Soprano be able to do (conceive) this?

http://news.cnet.com/8301-10789_3-9983940-57.html?part=rss&subj=news&tag=2547-1_3-0-5

July 3, 2008 1:35 PM PDT

Hundreds of Lithuanian Web sites defaced

Posted by Robert Vamosi

Last weekend, several hundred Lithuanian Web sites were defaced with pro-Soviet and anti-Lithuanian slogans, according to The New York Times.

Last Friday, Lithuanian government sites were warned of an impending Web attack and mounted appropriate defenses. Several hundred commercial sites did not do so and over the weekend took the brunt of the attack. By Monday, most all of the sites had been restored.

... Early evidence suggests a group of criminal hackers may have organized the attacks. The IPs used in the attacks appear to be from a variety of nations, but Reston, Va.-based iDefense told the Washington Post that one site, hack-war.ru, appeared to have organized the protest.

Fairly dull, but someone to quote?

http://interviews.slashdot.org/article.pl?sid=08/07/03/1913245&from=rss

Lt. Col. John Bircher Answers Your Questions

Posted by timothy on Thursday July 03, @03:35PM from the questions-that-dan-savage-won't-touch dept.

A few weeks ago, you asked questions of Lt. Col. John Bircher, head of an organization with a difficult-to-navigate name: the U.S. Army Computer Network Operations (CNO)-Electronic Warfare (EW) Proponent's Futures Branch. Lt. Col. Bircher has answered from his perspective, at length, not just the usual 10 questions, but several more besides. Read on for his take on cyberwar, jurisdiction, ethics, and more.

Don't you love it when a Judge “get it?”

http://techdirt.com/articles/20080703/0336421589.shtml

Lawyer Seriously Slapped Down For SLAPP Attempt Against Librarian Blogger

from the ouch dept

We've covered the concept of SLAPP (Strategic Lawsuit Against Public Participation) suits plenty of times before. These are bogus lawsuits filed to try to bully a critic into shutting up. In one such case, involving an incredibly broad subpoena against a librarian blogger compiling information on the potential link between mercury and autism, a magistrate judge has seriously smacked down the lawyer who filed the subpoena.

... Shoemaker has not offered a shred of evidence to support his speculations. He has, he says, had his suspicions aroused because she has so much information. Clearly he is unfamiliar with the extent of the information which a highly-competent librarian like Ms. Seidel can, and did, accumulate

All this, and it's free! This looks verrry interesting. All the normal “suite” applications, plus graphic design and image manipulation tool, flowcharts and diagrams, even project management. (and for us Math teachers -- for mathematical formula editing.

http://linux.slashdot.org/article.pl?sid=08/07/04/0624208&from=rss

Review of KOffice 2.0 Alpha 8 – On Windows

Posted by timothy on Friday July 04, @05:28AM from the didn't-see-that-coming-did-you dept. KDE Software Windows Linux

4WebChimps writes

"As featured previously on Slashdot, the KOffice project is working towards a cross-platform, open source office suite for Linux, Windows and Mac OS X. The most recent release, KOffice 2.0 Alpha 8, achieved that goal by being the first release for all three operating systems simultaneously. Want to try KOffice on Windows? TechWorld has a review (with screenshots) of KOffice on Windows, including the installation process which is as simple as clicking a few buttons (the online installer does the rest). Hopefully it won't be long before KOffice sits alongside OpenOffice.org as a usable cross-platform open source productivity suite."

976 free movies, including several episodes of Flash Gordon Conquers the Universe. How can you go wrong!

http://www.publicdomaintorrents.com/

Download Movies - Classic Movies and B-Movies For FREE!

Or, you could watch brief excerpts to choose you TED video

http://www.ted.com/index.php/talks/top10

Announcing the Top 10 TEDTalks