The Privacy Foundation brochure for their seminar on the “Legal Implications of Internet Advertising” has been added to their website: http://privacyfoundation.org/

Identity theft: “So easy, even a politician can do it?” I wonder if this will be the basis for yet another “Attack ad?”

http://www.databreaches.net/?p=14652

MA: Court papers allege Cahill camp laptops stolen

October 13, 2010 by admin

Dave Wedge reports on allegations that laptops containing personal information of campaign donors were stolen for political purposes:

Laptops containing personal information of Tim Cahill donors were reported stolen from aides to Paul Loscocco just days before the supporters received requests for contributions to the Charlie Baker campaign, a top Cahill aide claims in new court papers.

Read more in the Boston Herald.

What kinds of personal information were on the stolen laptops? Was there any donor credit card information on them? Were they left unattended? Have they been recovered? Anyone know or have the court papers?

You can't manage it if you don't know it exists...

http://yro.slashdot.org/story/10/10/13/144246/Feds-Discover-1000-More-Government-Data-Centers?from=rss

Feds Discover 1,000 More Government Data Centers

Posted by CmdrTaco on Wednesday October 13, @10:54AM

"The US government has 2,094 data centers, nearly 1,000 more than previous estimates, according to an updated inventory by federal agencies. The finding underscores the scope of the challenge facing the Obama administration as it seeks to streamline the government's IT infrastructure in a massive data center consolidation."

Dilbert continues the Master's level class on Privacy and Identity Theft

http://dilbert.com/strips/comic/2010-10-14/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DilbertDailyStrip+%28Dilbert+Daily+Strip%29

Now this could become an interesting Ethics case. Should you not sell technology directly to a “repressive regime” (definition left to politicians and media companies?) even if they can buy the same technology off store shelves and “customize” it themselves?

http://www.pogowasright.org/?p=15868

Holding Nokia Responsible for Surveilling Dissidents in Iran

Eddan Katz of EFF issues this call to action in a case mentioned previously on this blog:

EFF has long pointed out that technology companies are complicit in human rights violations when they knowingly sell customized human surveillance technologies to repressive regimes that are then used to target people for arrest, torture, and disappearance. Now a lawsuit filed recently against Nokia Siemens in Virginia by Isa Saharkhiz, an imprisoned Iranian dissident, and his son Mehdi Saharkhiz, brings this issue to the fore. The lawsuit accuses the Nokia Siemens Network of:

“knowingly, negligently and willfully provid[ing] the infamous, abusive and oppressive Iranian government with sophisticated devices for monitoring, eavesdropping, filtering, and tracking mobile phones.”

It doesn't take many stories like this to give an industry a bad name...

http://www.pogowasright.org/?p=15857

Debt collector broke the law by using MySpace photo to intimidate consumer

October 14, 2010 by Dissent

Evan Brown recaps a recent court decision in Minnesota:

Plaintiff fell behind on her car payments. The lender turned the debt over to a collection agency that used technology and some remarkably poor judgment in an attempt to get paid.

The first bad decision was to use a caller-ID spoofer to make it look like the collection call was coming from plaintiff’s mother in law. The next not-smart use of technology was to access plaintiff’s MySpace page, learn that plaintiff had a daughter, and to use that fact to intimidate plaintiff.

Read more about Sohns v. Bramacint on Internet Cases.

For my (future) Stalking 101 class and my Ethical Hackers

http://www.newstatesman.com/blogs/the-staggers/2010/10/foursquare-privacy-social

Need a new identity? Just steal someone else's

An opportunistic new website by the name of Wheretheladies.at should serve as a wake-up call to Foursquare and other social network users about the potential risks to their privacy and security - especially those who are crazy enough to publish such personal details as their home address.

Wheretheladies.at uses publicly-available information posted on social networking site Foursquare to find locations where a number of women are gathering -- from nightclubs to coffee shops. When it finds there's a correlation amongst a number of female Foursquare users it shows where they are and displays their Foursquare profile pictures so would-be stalkers - sorry admirers - can decide if it's worth turning up to 'meet' them.

It also sends the news out over a Twitter feed, for instance: "Bunch of ladies in yoga pants at The New Nail on Chestnut. They are talking about needing to find a man. Jackpot." Indeed.

… By way of illustration, I searched Foursquare for people who had "checked in" their home address -- telling the world exactly where they live and also displaying it on a handy map. I soon found an attractive 20-something year-old advertising agency executive, who had posted the address of her London flat. She had also "checked in" at her workplace, so I also knew where she worked and for whom.

She hadn't posted her full name on Foursquare, but I quickly found that on her Facebook page, along with her date of birth, which University she went to and what she studied. I also found that she likes house and trance music, her favourite film is Sex and the City 2 and she watches Louis Theroux and Come Dine With Me on telly.

I know from her Twitter feed about the trip she made to Paris for a couple of days last week, and where she goes to gym. I know, in fact, what she eats for breakfast, which bus she takes to work and when she is running late. I know that today she's at home in bed, with a heavy cold.

Now why would they want to keep your messages forever...

http://www.pogowasright.org/?p=15849

Facebook users can no longer delete chat history

October 13, 2010 by Dissent

Athima Chansanchai writes:

It’s starting to feel like anyone with anything to hide needs to find better hiding spots. For instance, people trying to keep their Facebook chats from prying eyes best find another IM program, because they can no longer erase chat history.

I discovered this while chatting the other day. Anyone who’s ever IM’d knows those conversations can go all over the place, and frankly, I like to think of each conversation as a fresh start.

Read more on MSNBC.

(Related) ...Oh, now I get it. (They even have the entire PowerPoint presentation in the article.)

http://www.pogowasright.org/?p=15852

Inside the Government’s Facebook Spy Operation

October 13, 2010 by Dissent

Ryan Tate writes:

Federal agents are infiltrating social networks via sneaky friend requests and monitoring them via a special command center, according to documents obtained by the Electronic Frontier Foundation. Who cares? Well, prospective citizens, for one.

The U.S. Citizenship and Immigration Services published a memo, below, encouraging agents to exploit the “narcissistic tendencies” of Facebook users and to “friend” prospective citizens on the social network, hoping targets wouldn’t realize they’d let a federal agent investigate their profiles for evidence of fraud, like a sham marriage.

Read more on Gawker.

Very interesting response.

http://tech.slashdot.org/story/10/10/13/216219/Big-Media-Wants-More-Piracy-Busting-From-Google?from=rss

Big Media Wants More Piracy Busting From Google

Posted by samzenpus on Wednesday October 13, @07:03PM

"Last month, executives from two music-industry trade groups, the Recording Industry Association of America (RIAA) and the International Federation of the Phonographic Industry (IFPI), asked Google if it could provide a means to help them track down pirated material more efficiently. Typically, copyright owners are responsible for finding pirated links and alerting Google, which is required by law to quickly remove the links. But Google's response raised eyebrows at some of the labels. James Pond, a Google manager, wrote in a letter dated September 20, that Google would be happy to help — for a price."

For my Ethical Hackers

http://www.smashingapps.com/2010/10/13/interesting-facts-you-might-not-know-about-spam-infographics.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SmashingApps+%28Smashing+Apps%29

Interesting Facts You Might Not know About SPAM [Infographic]

For my Ethical Hackers – So maybe the homework project was impossible. Okay, I'll change your grades.

http://io9.com/5662593/the-us-electrical-grid-is-too-crappy-to-be-vulnerable-to-terrorist-attack-say-physicists

The US electrical grid is too crappy to be vulnerable to terrorist attack, say physicists

Basically, the grid was set up so haphazardly that you'd have to take out a major node before you'd affect the entire thing. (Want to see a map of the US electrical grid? Check out this one on NPR.)

Science Daily sums up:

[The] electric grid is probably more secure that many people realize — because it is so unpredictable. This, of course, makes it hard to improve its reliability (in another line of research, Hines has explored why the rate of blackouts in the United States hasn't improved in decades), but the up-side of this fact is that it would be hard for a terrorist to bring large parts of the grid down by attacking just one small part.

Think this will work?

http://www.wired.com/autopia/2010/10/carwoo-takes-the-cheap-suit-out-of-car-sales/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

CarWoo Takes the Cheap Suit Out Of Car Sales

Here’s how it works. Shoppers pay a fee to CarWoo and select the car they want. Depending upon which plan they choose, CarWoo will facilitate quotes from two to five nearby dealerships. Buyers are free to negotiate the final price, but rather sitting in some cubicle while the saleman makes repeated trips to “talk to the manager,” it all happens anonymously online. The process is transparent, and both the buyer and the dealers involved see all of the offers that come in.

Think of it as eBay in reverse.

Buyers indicate how much they’re willing to pay and sellers decide whether the offer is acceptable. Dealers can see the negotiations in real time and — if they are able — can undercut their competitors directly to offer the best price. Company spokeswoman Renee Blodgett said CarWoo has about 3,200 dealers participating nationwide, with 50 more added each week.

For my Math classes... And the Accounting students. Produce some very interesting graphics too.

http://www.makeuseof.com/tag/5-free-calculator-apps-happy-windows-calculator/

5 Free Calculator Apps If You Aren’t Happy With The Windows Calculator

Is this merely another case of poor security management or do companies truly believe that “it can't happen to us?”

http://www.phiprivacy.net/?p=4327

Watch those portable devices, Tuesday edition

By Dissent, October 12, 2010

Maryland-based HomeCall Inc. recently notified the Maryland Attorney General’s Office that an employee’s portable point-of-care device was stolen. The device contained names, addresses, SSN, medical record number, diagnoses, and treatment information. HomeCall reports that the device was “multi-level password protected” (but not encrypted). In correspondence to those affected, HomeCall stated that the device required a user/pass to login and then a second user/pass to access the program containing the patients’ electronic medical records. Eleven Maryland residents were notified of the breach and the company subsequently encrypted all portable devices.

What a pity that so many entities wait until after they’ve had a breach to encrypt. After all this time, is there really still any excuse not to either have encrypted sensitive data on devices or have implemented some equally effective security?

Nothing says encryption solves all problems. Here the data was apparently encrypted with the wrong key.

http://www.databreaches.net/?p=14618

Encryption didn’t prevent this breach

October 12, 2010 by admin

A report to the Maryland Attorney General’s Office from ING gave me pause because I don’t remember ever seeing a security issue like this before in a breach report. In their notification, ING writes (emphasis added by me):

ReliaStar Life Insurance Company (RLIC) is responsible for premium administration for RLIC insurance products purchased by employees of our clients. An encrypted electronic file containing the personal information of one client’s employees, including several Maryland resident (sic), was inadvertently made available to another company’s Human Resources (HR) department due to an isolated administrative error. The encrypted file included the individual’s (sic) name and social security number. Our password-based registration encryption system prohibits the wrong addressee from opening an encrypted e-mail. Because the e-mail was addressed to the wrong client, that client was able to open the e-mail.

The receiving (incorrect) employer notified ING on June 3 and ING worked with them to securely delete the file and protect the data.

Of the individuals affected, 473 were Maryland residents.

Why different rules to cover the same data?

http://blog.securityarchitecture.com/2010/10/lots-of-health-data-breaches-reported.html

Tuesday, October 12, 2010

Lots of health data breaches reported to HHS, only trivial ones to FTC

With just over a year having passed since the health data breach notification rules mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act went into effect, and interesting contrast has emerged between the breaches disclosed to the Department of Health and Human Services (HHS) by HIPAA-covered entities and business associates and those disclosed to the Federal Trade Commission (FTC) by organizations that provide personal health records (PHRs) and associated services, but are not covered by HIPAA. As reported on Monday and evidenced by the complete listing of breaches posted by the FTC, as far as the FTC is aware there have been no major breaches (those involving 500 or more individuals) in the past year. All 13 of the breaches reported to the FTC involved lost or stolen credentials, which presumably could result in an unauthorized party gaining access to a user's personal health information, but no actual loss of data seems to have been involved. It may or may not be interesting to note that all the breaches reported also came from one company: Microsoft. [Perhaps they are the only ones in compliance? Bob] In contrast, the current count of breaches reported to HHS is 181, all of which involve 500 or more individuals, many of which apparently involve loss or theft of data (or laptops or other paper or electronic record storage devices).

It seems fair to ask, can any substantial conclusions be drawn from the paucity of breaches reported to the FTC or their relative triviality? No one appears to be suggesting that the data protection practices of organizations subject to the FTC's data breach rule are superior to those of those covered under HHS' rules, so why so few breaches reported to the FTC? Several possible explanations come to mind, only some of which have anything to do with security or privacy practices:

• The population of organizations subject to the rule is small. The FTC's Health Breach Notification Rule, following language in the HITECH Act (§13407), applies specifically to "vendors of personal health records" and third-party service provides who are not covered by HIPAA. The total number of these vendors is very small relative to the number of covered entities and business associates subject instead to HHS' rules.

• Breaches of encrypted data do not have to be reported. Following HITECH (§13402), Both the HHS and FTC data breach notification rules apply to breaches of unsecured data, meaning data that has not been "rendered unusable, unreadable, or indecipherable" through the use of recommended technologies such as data encryption. It is possible that some PHR vendors who might have suffered relevant incidents had no cause for concern, and no reason to disclose them, because the data in question was encrypted.

• Not many people use PHRs from non-HIPAA-covered vendors. This is not meant to imply that vendors like Dossia, Google, and Microsoft have so few users of their PHRs that there wouldn't potentially rise to the level of a major breach if a data loss occurred, but instead to suggest that there may be more attractive targets for malicious attackers to go after among health care organizations.

• Technology company employees (may) have better security awareness. Surely a suggestion open to challenge, but with the frequency with which health data breaches occur do to intentional or inadvertent misuse by employees (that is, authorized users), PHR vendors whose business depends to a great extent on their ability to secure customer's data might logically make security and privacy awareness a higher priority among the employees who have access to the data. Also, it shouldn't be overlooked that, unlike employees of health care organizations, PHR vendor employees have little or no reason to access personal health information stored in their systems.

I seems to learn more about the law reading articles that claim the judge got it wrong than I do when reading articles the attempt to summarize the entire field.

http://www.pogowasright.org/?p=15824

Romano and Facebook: Muddling Toward the Law of Privacy on Social Networks

October 12, 2010 by Dissent

David K. Isom writes:

Those of us who watch the development of the law of electronic discovery, information security and privacy usually have nothing better to do on a Saturday night (except last Saturday when we saw the movie “The Social Network”) than kibitz about how information on Facebook and other social networks is impacting and will likely impact civil lawsuits. Last month, a New York trial court in Romano v. Steelcase took a crack at some of these issues. While the New York court got the bottom line right — relevant information on Facebook and other social media is generally discoverable — some of its reasoning is baffling, some wrong and some spot on.

Read more on InfoLawGroup. I had previously commented as a non-lawyer that I thought the judge reached the right decision but via faulty logic. I am delighted to see David try to explain what was confusing or wrong from a legal perspective.

If they monitored social networks without a specific threat (granted, for a high profile event) why would they just stop after the inauguration?

http://www.pogowasright.org/?p=15835

New FOIA Documents Reveal DHS Social Media Monitoring During Obama Inauguration

October 12, 2010 by Dissent

Jennifer Lynch of EFF writes:

This is part two of a two part series. Read part one.

As noted in our first post, EFF recently received new documents via our FOIA lawsuit on social network surveillance that reveal two ways the government has been tracking people online: Citizenship and Immigration’s surveillance of social networks to investigate citizenship petitions and the DHS’s use of a “Social Networking Monitoring Center” to collect and analyze online public communication during President Obama’s inauguration. This is the second of two posts describing these documents and some of their implications.

In addition to learning about surveillance of citizenship petitioners, EFF also learned that leading up to President Obama’s January 2009 inauguration, DHS established a Social Networking Monitoring Center (SNMC) to monitor social networking sites for “items of interest.” In a set of slides [PDF] outlining the effort, DHS discusses both the massive collection and use of social network information as well as the privacy principles it sought to employ when doing so.

Read more on EFF.

Dilbert brilliantly summarizes the ethical and privacy implications of Behavioral Advertising.

http://dilbert.com/strips/comic/2010-10-13/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DilbertDailyStrip+%28Dilbert+Daily+Strip%29

Interesting. Why not add Starbucks, libraries and unsecured home wifi?

http://yro.slashdot.org/story/10/10/13/0044233/Dutch-Hotels-Must-Register-As-ISPs?from=rss

Dutch Hotels Must Register As ISPs

Posted by timothy on Tuesday October 12, @11:00PM

"The Dutch telecommunications authority OPTA has announced that Dutch hotels must register as internet providers (original version, in Dutch) because that is what they formally are, according to Dutch laws. It is well possible that once hotels are officially internet providers, they will also have to abide by the European regulations on data retention and make efforts to link email headers and other data traffic to individual hotel guests. Could this also happen in other European countries? This is probably not likely to lead to a more widespread adoption of free WiFi services in hotels."

A preview of things to come?

http://yro.slashdot.org/story/10/10/12/2234226/IRS-Servers-Down-During-Crucial-Week?from=rss

IRS Servers Down During Crucial Week

Posted by timothy on Tuesday October 12, @07:30PM

"A planned server outage turned into an unplanned glitch for the Internal Revenue Service, and it comes at a very bad time. The IRS planned the server outage for the holiday weekend ... but today they couldn't get the system back into operation. This week is the deadline for filing 2009 tax returns for taxpayers who got extensions. So far it's not having a huge impact since the shutdown only involves the updated version of the e-filing system, and most programs used by large tax companies like H&R Block will default to the older version. There's no estimate on when the system will be back up."

Security AND surveillance Fun for my Computer Forensics students.

http://yro.slashdot.org/story/10/10/12/2127229/Canon-Blocks-Copy-Jobs-Using-Banned-Keywords?from=rss

Canon Blocks Copy Jobs Using Banned Keywords

Posted by CmdrTaco on Tuesday October 12, @08:18PM

aesoteric notes that a future version of Canon's document management system will include the exciting breakthrough technology that will OCR your printed and scanned documents, and prevent distribution of keywords. Documents containing the offending words can be sent to the administrator, without actually telling the user just what word tripped the alarm. The article notes that simply using 1337 for example will get around it.

[From the article:

Uniflow allows printers, scanners, copiers and multifunction devices to be managed centrally.

This allows a record to be kept of how many documents have been printed and by whom for billing purposes - essential for professions that bill clients by the hour or by the amount of work done, such as lawyers and architects.

… Once configured by an administrator, the system can prevent a user from attempting to print, scan, copy or fax a document containing a prohibited keyword, such as a client name or project codename.

The server will email the administrator a PDF copy of the document in question if a user attempts to do so. [Perhaps a minor hack will allow me to receive a BCC copy of those emails... Bob]

(Related) The downside of a tool like this is huge. Think of it as “book burning” for e-book users. No more organizing political opposition via Twitter...

http://techcrunch.com/2010/10/12/apple-patents-anti-sexting-device/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

Apple Patents Anti-Sexting Device

Today the US Patent and Trademark Office approved a patent Apple filed in 2008, which, get this, prevents users from sending or receiving “objectionable” text messages.

… The “Sexting” patent background info states that the problem it solves is that there is currently “No way to monitor and control text communications to make them user appropriate. For example, users such as children may send or receive messages (intentionally or not) with parentally objectionable language.”

(Related) Lots of fun uses. Eliminate any sign of protesters, hide the assassin's face, etc.

http://tech.slashdot.org/story/10/10/13/0525245/Erasing-Objects-From-Video-In-Real-Time?from=rss

Erasing Objects From Video In Real Time

Posted by timothy on Wednesday October 13, @08:09AM

Smoothly interpolating away objects in still pictures is impressive enough, but reader geoffbrecker writes with a stunning demonstration from Germany's Technical University of Ilmenau of on-the-fly erasure of selected objects in video. Quoting:

"The effect is achieved by an image synthesizer that reduces the image quality, removes the object, and then increases the image quality back up. This all happens within 40 milliseconds, fast enough that the viewer doesn't notice any delay."

(Related) Or we can put you at the scene of the crime, or put your face on the assassin...

http://news.cnet.com/8301-17938_105-20019385-1.html?part=rss&subj=news&tag=2547-1_3-0-20

MovieReshape: New abs for old actors

Want giant biceps in all those home videos you're posting to YouTube? Forget hassling with barbells and simply adjust the muscularity control slider in MovieReshape, an image alteration program developed at the Max Planck Institut Informatik in Germany. The system allows for "quick and easy manipulation of the body shape and proportions of a human actor in arbitrary video footage"--without frame-by-frame manipulation.

Common errors people make with passwords translates directly into a lecture on “How to access password protected systems” for my Ethical Hackers. (Your security is only as strong as your weakest user)

http://it.slashdot.org/story/10/10/12/1756249/Survey-Shows-How-Stupid-People-Are-With-Passwords?from=rss

Survey Shows How Stupid People Are With Passwords

Posted by CmdrTaco on Tuesday October 12, @02:06PM

"Another study was released to today that once again shows how careless people really are online. When it comes to safeguarding personal information online, many people don't seem to care very much, or don't think enough about it. In the survey of more than 2,500 people, some interesting and scary trends were revealed in how users handle their online passwords..."

Welcome to the 21^st Century!

http://www.bespacific.com/mt/archives/025465.html

October 12, 2010

GAO Pilots New Web-Based Format for Reports - E-Report project offers enhanced navigation for users

"Beyond the usual findings and recommendations for improving federal operations, a new report from the U.S. Government Accountability Office (GAO) is the first to offer a web-based E-Report format to help users navigate content more easily... The new pilot format, which is part of a report on geostationary environmental satellites (GAO-10-799), allows users to quickly access those sections of the report that are of interest to them. Using links on the sidebar and within the pages of the report, users will have instant access to the report’s highlights, objectives, findings, recommendations, agency comments, and supporting evidence. A podcast discussing the report can also be played directly from the E-Report page. The traditional PDF version can be downloaded there as well. The pilot also allows for enhanced use of color in charts and graphics and GAO is seeking direct feedback from users about the new format. The pilot E-Report can be found at www.gao.gov/ereport/GAO-10-799."

If I knew THAT was what my students were saying, I'd have flunked them all.

http://www.makeuseof.com/tag/10-online-slang-dictionaries-learn-jargon-street-language/

10 Online Slang Dictionaries To Learn Jargon & Street Language

If I didn't mention this n my Ethical Hacking class, how would we know what rules to break? Mentions many useful resources.

http://news.cnet.com/8301-13880_3-20018998-68.html?part=rss&subj=news&tag=2547-1_3-0-20

The Internet and the death of ethics

Darn, darn, darn!

http://www.philly.com/inquirer/front_page/20101012_Lower_Merion_district_s_laptop_saga_ends_with__610_000_settlement.html

Lower Merion district's laptop saga ends with $610,000 settlement

The Lower Merion School District will pay $610,000 to settle lawsuits over its tracking of student laptop computers, ending an eight-month saga that thrust the elite district into a global spotlight and stirred questions about technology and privacy in schools.

School board members voted unanimously Monday night to pay $185,000 to the two students who claimed the district spied on them by secretly activating the webcams on their laptops.

The bulk of the money, $175,000, will be put in trust for Blake Robbins, the Harriton High School junior whose family brought the issue to light in February. Jalil Hasan, who filed his lawsuit this summer after graduating from Lower Merion High School, will receive $10,000.

The district will also pay $425,000 in legal fees to their attorney, Mark S. Haltzman.

… School Board President David Ebby said the board decided to settle after the district's insurance company agreed to cover $1.2 million of the costs. That insurer, Graphic Arts Mutual Insurance, initially refused to pay any claims because it said privacy-invasion claims were not covered under the district's multimillion-dollar liability policy.

… "Although we would have valued the opportunity to finally share an important, untold story in the courtroom, we recognize that in this case, a lengthy, costly trial would benefit no one," he said. [Sure they would... Bob]

… Still unresolved is how much the district will pay out of pocket. A team of lawyers and computer specialists it hired has submitted more than $1 million in bills. And the attorney for at least one other student has notified the district that he was contemplating a lawsuit.

[The school board's statement is here: http://www.lmsd.org/sections/news/default.php?m=0&t=today&p=lmsd_anno&id=1456

(Related)

http://www.pogowasright.org/?p=15807

Lower Merion School District and Blake Robbins Reach a Settlement in Spycamgate

October 12, 2010 by Dissent

Over on Forbes, Kashmir Hill discusses the settlement in the Lower Merion webcam civil suits that have been discussed on this site previously. As reported last night, the two civil suits settled for $610k, with the lawyer getting the bulk of the settlement, presumably to cover all his time in court seeking an injunction, payment for forensics and consultants, etc.

The case has had a number of repercussions. First, it made other schools and parents more aware of the capability of school-issued laptops to surveill students – with or without their knowledge. Second, it served as a useful call-to-arms to protect and preserve student and youth privacy. Whether Blake Robbins, the student at the heart of the civil suit, actually has experienced any lasting psychological injury or harm as a result of his experiences is unknown to me, as people may try to make light of a traumatic experience to help reduce their anxiety. I hope that if he has suffered adverse emotional consequences, he’s able to get help and put some of this behind him. Sadly, once trust is violated, it’s very difficult to rebuild it or ever be so trusting again. Discovering that your school is taking pictures of you while you were in your bedroom would be very disturbing for most of us, I suspect, and might leave us with a sense of unease in dealing with the school.

Hill suggests one take-home message from the case:

A lesson for others from all this: One of the biggest problems for Lower Merion was that school administrators did not disclose from the beginning to students and their parents that the school could remotely activate the laptop cameras and take photos. If they had, they likely would not have gotten into so much legal trouble of the civil variety. (They were fine on the criminal front — prosecutors declined to pursue a case against the district.)

Transparency pays off. Lower Merion’s lack of transparency now means it has to pay off.

While I agree with her completely that transparency would have helped, I don’t think that makes it okay to be taking pictures of students in their home. The school district’s right and need to track possibly stolen equipment can be accomplished in other ways that do not risk invading students’ or families’ privacy in their homes. And maybe the take-home message we want people to get is that students still do have some privacy rights.

It's one of them lawyer things: Storing email electronically does not make them “electronic storage”

http://www.pogowasright.org/?p=15798

Emails on laptop not protected by the Stored Communications Act

October 12, 2010 by Dissent

Evan Brown comments on Thompson v. Ross, 2010 WL 3896533 (W.D. Pa. September 30, 2010):

Messages from Yahoo and AOL email accounts saved on laptop computer were not in “electronic storage” as defined by Stored Communications Act.

Plaintiff’s ex-girlfriend kept his laptop computer after the two of them broke up. The ex-girlfriend let two of her co-workers access some email messages stored on the computer. Plaintiff filed suit under the Stored Communications Act. Defendants moved to dismiss. The court granted the motion.

Read more on Internet Cases.

Is this the best indication that “you have no privacy?”

http://www.pogowasright.org/?p=15767

The Slow Demise of Defamation and the Privacy Torts

October 11, 2010 by Dissent

Daniel Solove writes:

The ABA Journal reports that the number of libel suits has been steadily dropping in the United States

[...]

Why is this happening? Is it because there’s much less defamation or invasion of privacy today? I strongly doubt that’s the reason. Instead, I can think of several reasons for the decline in defamation and privacy trials.

Read Dan’s commentary on Concurring Opinions. As always, he provides a lot of food for thought.

(Related) ...but maybe not in Canada.

http://www.pogowasright.org/?p=15787

Mirror, mirror on the web

October 12, 2010 by Dissent

donalee Moulton discusses online reputation:

… The study, Digital Footprints: Online Identity Management and Search in the Age of Transparency, also discovered that fully 60 per cent of Internet users surveyed said they are not worried about how much information is available about them online. Similarly, the majority of online adults (61 per cent) do not feel compelled to limit the amount of information that can be found about them online. Just 38 per cent said they have taken steps to limit information available about them.

Caution is required, however. And action is a viable option. “You have to be careful what is being said. There is recourse,” noted Giles Crouch, chief executive officer of MediaBadger, a social media research and consulting firm in Halifax.

Indeed, said Fraser, “you have at least a measure of control. If it’s defamation, you can take legal action.”

That action was apparent in Nova Scotia in a recent court case that highlighted the extent to which individuals — and the courts — will go to protect their reputation. In Mosher v. Coast Publishing Ltd., 2010 NSSC 153, the Supreme Court of Nova Scotia determined that information about individuals who posted online comments following a story in The Coast newspaper alleging racism in the Halifax Regional Municipality fire department and, in particular, against two senior officials, should be provided.

Read more on The Lawyers Weekly.

Behavioral Advertising

http://www.pogowasright.org/?p=15757

Markey and Barton release web site operators’ responses to consumer tracking inquiry

October 11, 2010 by Dissent

Related to the recent WSJ article about responses to a congressional inquiry on consumer tracking, two Representatives have now released the responses of the major web site operators. From the press release:

Representatives Edward J. Markey (D-Mass.) and Joe Barton (R-Texas), Co-Chairman of the House Bi-Partisan Privacy Caucus, today released responses to the letters they had sent to companies identified in a Wall Street Journal investigation as reportedly installing intrusive consumer-tracking technologies to track and/or target consumers visiting these company Web sites.

“The responses raise a number of concerns, including whether consumers are able to effectively shield their personal Internet habits and private information from the prying eyes of online data gatherers,” Rep. Markey said. “Consumers may be unaware that the sites they visit, coordinating with a cadre of analytics firms, advertising networks and offline data companies, may be tracking their activities around the Internet. While the responses that Rep. Barton and I received cite privacy policies and opt-out choices to enable consumers to preserve their privacy, these policies can be complicated and laborious to navigate. For example, a single website may have business relationships with a dozen or more third-party data firms that display advertisements on its site. A consumer may have to visit each of these sites, consulting its privacy policy and clicking through to opt-out, if such an option is provided. In some cases, a list of all third party affiliates is not readily accessible, keeping consumers in the dark.”

Copies of the responses are available here:

Microsoft
AOL
CareerBuilder
Merriam Webster
Yahoo
Verizon
About Group
Comcast
AT&T
PhotoBucket
MySpace

(Related) Note that there is no response from Facebook in the previous article.

http://www.pogowasright.org/?p=15765

“Deleted” Facebook photos still not deleted: a followup

October 11, 2010 by Dissent

Jacqui Cheng reports:

Facebook may be making strides in some areas of privacy, but the company is still struggling when it comes to deleting user photos—or not deleting them, as the case may be.

We wrote a piece more than a year ago examining whether photos really disappear from social network servers when you delete them, and found that Facebook was one of the worst offenders when it came to leaving “deleted” photos online. We decided to revisit the issue recently when readers continued to point out that our deleted photos from that article were still online more than 16 months later. Indeed, this old photo of meremains on Facebook’s content delivery network servers, despite being deleted on May 21, 2009.

Read more on Ars Technica. Does Facebook really expect us to believe that it’s acceptable that it has taken them so long to figure out how to truly delete photos that users want deleted?

Where’s Rep. Joe Wilson when you really want someone to stand up and yell, “You lie!” ?

(Related)

http://www.pogowasright.org/?p=15785

Escaping the ‘Scrapers’

October 12, 2010 by Dissent

The Internet has given rise to a dizzying array of people-search sites and data brokers that gather and compile public information and social-networking profiles. The sites gather information from public sources such as property records and telephone listings, and other information is harvested by “scraping” — or copying — websites where people post information about themselves.

Read more in the Wall Street Journal, where they also provide a guide to how to remove your information from some of the bigger data scrapers.

[Very slick infographic!!!

http://blogs.wsj.com/wtk/

(Related) Dilbert neatly sums up the Behavioral Advertising marketplace.

http://dilbert.com/strips/comic/2010-10-12/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DilbertDailyStrip+%28Dilbert+Daily+Strip%29

The next contentious area of the law?

http://www.pogowasright.org/?p=15754

Cloud Computing Customers’ “Bill of Rights”

October 11, 2010 by Dissent

David Navetta writes:

Needless to say, due in part to our numerous writings on the legal ramifications of Cloud computing, the InfoLawGroup lawyers have been involved in much Cloud computing contract drafting and negotiations, on both the customer and service provider side. As a result, we have seen a lot in terms of negotiating tactics, difficult contract terms and parties taking a hard line on certain provisions.

During the course of our work, especially on the customer side, we have seen certain “roadblocks” consistently appear which make it very difficult for organizations to analyze and understand the legal risks associated with Cloud computing. In some instances this can result in a willing customer walking away from a deal. Talking through some of these issues, InfoLawGroup thought it would be a good idea to create a very basic “Bill of Rights” to serve as the foundation of a cloud relationship, allow for more transparency and enable a better understanding of potential legal risks associated with the cloud.

Just a pre-emptive comment: while we use the strong term “rights,” we know that cloud arrangements vary and that every transaction has its own issues and circumstances that impact the nature and scope of a negotiation. Moreover, as with the real Bill of Rights, we realize that none of these rights are absolute and may appropriately be subject to reasonable limitations in certain contexts. This document should be viewed less as a universal mandate, and more as a tool for cloud customers and providers to engage in spirited debate about the issues addressed in this Bill of Rights.

The Bill of Rights is set forth below with annotations. In addition, you can download an un-annotated version here, and we have even provided a pocket-sized version that can be easily accessed by those who are actively engaged in vetting cloud deals (however, you may need to keep a magnifying glass in your other pocket in order to read this version). [Proof that lawyers like fine print? Bob] This is a work in a progress and we invite you to submit your ideas on additional “rights” that we should include as well as any comments and criticisms on the current listing.

Read the Cloud Computing Customers’ Bill of Rights on InfoLawGroup.

You WILL be attacked. Manage it!

http://www.databreaches.net/?p=14581

Most large companies seeing more hack attacks, survey shows

October 11, 2010 by admin

Ellen Messmer reports:

Is this year turning out to be even worse for getting hacked than last year?

That’s what a survey of 350 IT and network professionals would indicate, with large companies in particular reporting this to be worse than last in terms of suffering at least one network intrusion of their user machines, office network or servers.

According to the Sixth Annual Enterprise IT Security Survey released Monday, 67% of large companies with 5,000 or more employees reported one successful intrusion or more this year, as opposed to 41% in 2009. Mid-size companies of 1,000 to 4,999 employees fared better with 59% reporting an intrusion, up slightly from 57% in 2009.

Read more on Network World.

[From the article:

For the first time, the survey, sponsored by VanDyke Software and undertaken by Amplitude Research in mid-September, delved into what the survey respondents believed primarily caused the network intrusion.

Fourteen percent of those surveyed attributed their intrusion problem to "hacker/network attack," 12% cited "lack of adequate security policies/measures," 10% said "employee Web usage," 9% pointed to "virus/malware/spyware," 8% faulted other employee carelessness, negligence," 6% said "unauthorized access by current/former employees," 5% blamed "weak passwords," 5% thought it was because of "lack of software updates," and 5% simply said "software security flaw/bug."

… About half of respondents said their organizations have a formal security audit by an outside organization at least once a year, up from 35% in 2009. Some 56% felt the audits helped identity "significant security problems."

Separately, 65% this year reported undergoing an internal security audit at least once a year, down slightly from 67% in 2009. Forty-seven percent felt internal audits helped identify security problems, but 30% said the audit didn't go far enough and 40% felt the audits should occur more frequently.

(Related) AKA “Legacy Systems” and “Old stuff that still works” MBAs call this “sunk cost” and find it difficult to spend to upgrade when there is no clear need...

http://developers.slashdot.org/story/10/10/11/1331223/NSF-Wants-To-Know-How-Much-Software-Really-Costs?from=rss

NSF Wants To Know How Much Software Really Costs

Posted by CmdrTaco on Monday October 11, @09:31AM

"It's no secret that the actual cost of software is very complicated. Sure, the companies that write software are spending money on it, but when that software is released, it doesn't stop costing money. You can probably think of a number of relatively tiny things that add up — especially if you're a system administrator — like the man-hours spent patching software to avoid a nasty infection spreading quickly. The bigger debt is that old piece of software you paid a bunch of money for back in 1998 that you're critically dependent on, but it has no support and hasn't been updated in years due to any number of reasons. Well, the National Science Foundation paid Gartner almost half a million dollars to find out what it truly costs to bring an organization to a fully supported environment. According to Gartner, this hidden liability or 'IT debt' is at $500 billion worldwide right now, and in five years it will be at $1 trillion. Along similar lines, a company called Cast that makes software quality tools reported that your average business application comes with a million in IT debt (PDF). And if that's not misapplied enough for you, they estimate that the debt is $2.82 per line of code in the application and also that it's on average higher in the government sector."

Surveillance tools & techniques “Here is where you park at work, and here is where you park when visiting your mistress, and here...”

http://news.slashdot.org/story/10/10/12/020255/French-City-To-Use-CCTV-For-Parking-Fines?from=rss

French City To Use CCTV For Parking Fines

Posted by Soulskill on Tuesday October 12, @02:03AM

"The city of Nice, France is rolling out 626 CCTV cameras throughout town, giving it one of the highest levels of surveillance in the world (1.8 cameras per 1000 inhabitants). The usual rhetoric was given — that they will be used solely for reducing violent crime — but the city will now begin sending out parking tickets solely based on the CCTV video evidence."

(Related) Shades of The Conversation

http://hardware.slashdot.org/story/10/10/11/1838252/High-Tech-Microphone-Picks-Voices-From-a-Crowd?from=rss

High-Tech Microphone Picks Voices From a Crowd

Posted by Soulskill on Monday October 11, @03:12PM

JerryQ writes with news of an impressive audio detection system from a company called Squarehead that was demonstrated during a professional basketball game. According to Wired,

"325 microphones sit in a carbon-fiber disk above the stadium, and a wide-angle camera looks down on the scene from the center of this disk. All the operator has to do is pinpoint a spot on the court or field using the screen, and the Audioscope works out how far that spot is from each of the mics, corrects for delay and then synchronizes the audio from all 315 of them. The result is a microphone that can pick out the pop of a bubblegum bubble in the middle of a basketball game..."

(Related) If you do nothing else, grab the images that accompany the article...

http://www.networkworld.com/community/blog/police-state-wiretapping-web-who-do-they-want

Police State of Wiretapping the Web: Who Do THEY Want to Watch?

For my Ethical Hackers.

http://apple.slashdot.org/story/10/10/11/1420211/The-Hackintosh-Guide?from=rss

The Hackintosh Guide

Posted by CmdrTaco on Monday October 11, @10:21AM

"A 'Hackintosh' is a computer that runs Apple's OS X operating system on non-Apple hardware. This has been possible since Apple's switch from IBM's PowerPC processors to Intel processors a few years ago. Until recently, building a PC-based Mac was something done only by hard-core hackers and technophiles, but in the last few months, building a Hackintosh PC has become much easier. Benchmark Reviews looks at what it's possible to do with PC hardware and the Mac Snow Leopard OS today, and the pros and cons of building a Hackintosh computer system over purchasing a supported Apple Mac Pro."

For my Computer Security students (By the time you learn the rules, the technology is obsolete.)

http://www.wired.com/dangerroom/2010/10/read-em-all-pentagons-193-mind-numbing-cyber-security-regs/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Read 'Em All: Pentagon’s 193 Mind-Numbing Cybersecurity Regs

For my website students

http://www.smashingapps.com/2010/10/11/ten-best-web-services-to-create-free-slideshows-online.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SmashingApps+%28Smashing+Apps%29

Ten Best Web Services to Create Free Slideshows Online

In the rush for “Free phone calls” are we forgetting to secure the systems?

http://it.slashdot.org/story/10/10/10/2313255/In-Australia-Rising-VoIP-Attacks-Mean-Huge-Bills-For-Victims?from=rss

In Australia, Rising VoIP Attacks Mean Huge Bills For Victims

Posted by timothy on Sunday October 10, @07:12PM

"Australian network companies have told of clients receiving phone bills including $100,000 worth of unauthorised calls placed over compromised VoIP servers. Smaller attacks have netted criminals tens of thousands of dollars worth of calls. A Perth business was hit with a $120,000 bill after hackers exploited its VoIP server to place some 11,000 calls over 46 hours last year. ... Local network providers and the SANs Institute have reported recent spikes in Session Initiation Protocol (SIP) scanning — a process to identify poorly configured VoIP systems — and brute-force attacks against publicly-accessible SIP systems, notably on UDP port 5060."

Update: But it still seems like a personal (or at least ill-considered) reaction. Otherwise, I suspect you could make this argument at all levels of the organization.

http://www.databreaches.net/?p=14547

NC: Researcher Yankaskas appeals pay cut, demotion

October 10, 2010 by admin

More details are emerging about why the breach involving the UNC-Chapel Hill Carolina Mammography Registry led to consequences for the researcher.

C. Ryan Barber reports:

[...]

School of Medicine Office of Information Systems officials first alerted the University to the breach in July 2009 after uncovering a virus and potential security breach on the Carolina Mammography Registry’s FTP server.

As the registry’s principal investigator, Yankaskas has been blamed for the breach, which also compromised about 114,000 Social Security numbers. She has since claimed that the University is using her as a scapegoat for systemic data security weaknesses.

On Oct. 27, Yankaskas received an intention to discharge letter from Executive Vice Chancellor and Provost Bruce Carney, who said Yankaskas exhibited “deliberate neglect” in her oversight of the project’s data security.

“I was appalled,” said Carney, who held his current position on an interim basis in July 2009. “The first question you have to ask is, ‘How does this happen?’”

In the intention to discharge notice, Carney wrote that Yankaskas was negligent in assigning security duties without granting additional training to Melinda Boyd, whom he deemed to be underqualified. Carney later became aware that his wife’s Social Security number was exposed and said his personal connection to the breach has not clouded his judgment.

“At the time, Ms. Boyd had no certification or experience as a server administrator,” Carney wrote. “She has stated that she requested that you provide additional training for her in server administration but that you declined to do so.”

[...]

Read more on Daily Tar Heel.

Any technology can be used for evil as easily as for good. This is an old debate. I suggest we apply the old solutions.

http://www.pogowasright.org/?p=15721

Next Version of Web Design May Increase Privacy Threats

October 10, 2010 by Dissent

Tanzina Vega reports:

Worries over Internet privacy have spurred lawsuits, conspiracy theories and consumer anxiety as marketers and others invent new ways to track computer users on the Internet. But the alarmists have not seen anything yet.

Over the next few years, a powerful new suite of capabilities will become available to Web developers that could give marketers and advertisers access to many more details about computer users’ online activities. [Easier collection of data for Behavioral Advertising. Bob] Nearly everyone who surfs the Internet will face the privacy risks that come with those capabilities, which are an integral part of the Web language that will soon power the Internet: HTML 5

Read more in the New York Times.

Via @PrivacyMemes.

(Related) Is Google looking to automate the collection of data for “Street View” or will we be seeing auto-driving like the Sci-Fi novels have predicted for years? (With ads for the businesses you pass by?)

http://www.bespacific.com/mt/archives/025434.html

October 10, 2010

Google announces development of technology for cars that can drive themselves

Official Google Blog: Our automated cars, manned by trained operators, just drove from our Mountain View campus to our Santa Monica office and on to Hollywood Boulevard. They’ve driven down Lombard Street, crossed the Golden Gate bridge, navigated the Pacific Coast Highway, and even made it all the way around Lake Tahoe. All in all, our self-driving cars have logged over 140,000 miles. We think this is a first in robotics research. Our automated cars use video cameras, radar sensors and a laser range finder to “see” other traffic, as well as detailed maps (which we collect using manually driven vehicles) to navigate the road ahead. This is all made possible by Google’s data centers, [Your chauffeur in the Cloud? Bob] which can process the enormous amounts of information gathered by our cars when mapping their terrain. To develop this technology, we gathered some of the very best engineers from the DARPA Challenges, a series of autonomous vehicle races organized by the U.S. Government. Chris Urmson was the technical team leader of the CMU team that won the 2007 Urban Challenge. Mike Montemerlo was the software lead for the Stanford team that won the 2005 Grand Challenge. Also on the team is Anthony Levandowski, who built the world’s first autonomous motorcycle that participated in a DARPA Grand Challenge, and who also built a modified Prius that delivered pizza without a person inside. The work of these and other engineers on the team is on display in the National Museum of American History."

(Related) Is this because existing Operating Systems can't be secured, or because they can't be compromised by the government? (e.g. India's request to tap BlackBerry encryption.)

http://tech.slashdot.org/story/10/10/11/0214249/Indian-Military-Organization-To-Develop-Its-Own-OS?from=rss

Indian Military Organization To Develop Its Own OS

Posted by timothy on Sunday October 10, @10:20PM

"Several newspapers have reported that DRDO (the defence R&D organization of the Indian military) is planning to create an OS. The need for this arose due to the cyber security concerns facing India and that all [conventional] operating systems are made outside India. About 50 professionals in Bangalore and New Delhi are expected to start work on this operating system."

At least one of the linked articles says the new OS, though home-grown, would run Windows software.

It's rare for Pogo to include an editorial cartoon, but this one from the Denver Post is is likely to make it into my Computer Security handouts.

http://www.pogowasright.org/?p=15694

Government surveillance plans

Aren't we doing this already?

http://www.bespacific.com/mt/archives/025433.html

October 09, 2010

Can We Create a National Digital Library?

New York Review of Books: Can We Create a National Digital Library? Robert Darnton - "The following talk was given at the opening of a conference at Harvard on October 1 to discuss the possibility of creating a National Digital Library."

• "Despite the complexities, the fundamental idea of a National Digital Library (or NDL) is, at its core, straightforward. The NDL would make the cultural patrimony of this country freely available to all of its citizens. It would be the digital equivalent of the Library of Congress, but instead of being confined to Capitol Hill, it would exist everywhere, bringing millions of books and other digitized material within clicking distance of public libraries, high schools, junior colleges, universities, retirement communities, and any person with access to the Internet." See also:

• Wikibooks, the open-content textbooks collection that anyone can edit.

• Flat World Knowledge - "We preserve the best of the old — books by leading experts, peer reviewed and developed to high editorial standards, fully supported by review copies, teaching supplements and great service. Then we change everything. Our textbooks are: Free online; ; Affordable offline; Open–licensed; Customizable by educators."

For my students

http://www.makeuseof.com/tag/retail-software-free-student/

Get The Best Retail Software For FREE As A Student

Not much of an update on web-cam-gate. (Sounds like they have picked a scapegoat.)

http://mainlinemedianews.com/articles/2010/10/07/main_line_times/news/doc4cac9d9eae731517978686.txt

LMSD officials address residents' concerns at community meeting in Ardmore church

In an Ardmore meeting Tuesday referred to as a community conversation with Lower Merion School District Supt. Chris McGinley, the subject of the district’s webcam controversy came up but McGinley did not go into specifics.

“There are some actions that have been taken that amount to personnel actions,” McGinley told a number of residents attending the meeting. His comments answered one of them, who asked if anyone has been held accountable for wrongly using the webcams.

Humor: Facebook, by Mom for Moms...

http://www.youtube.com/watch?v=yu4zMvE6FH4&feature=player_embedded

Today Now!: Facebook, Twitter Revolutionizing How Parents Stalk Their College-Aged Kids

How can you discriminate against an ethnic group if you don't know who they are?

http://www.pogowasright.org/?p=15641

French cops claimed to hold secret, illegal gypsy database

October 9, 2010 by Dissent

Last month, I blogged about concerns raised by EDRI that France was compiling a biometric database of Roma that could lead to significant humanitarian concerns. Now more evidence has emerged that is raising concerns. Jane Fae Ozimek reports in The Register:

The French national police force – la Gendarmerie – yesterday stood accused of operating a secret and illegal database of Roma and other travelling minorities.

The existence of this database was reported in great detail in yesterday’s Le Monde. It came to light by chance, when a 48-page powerpoint presentation, prepared by a Commandant in the Central Bureau for prevention of Traveller Crime (OCLDI), and presented to a meeting of Transport Businesses in November 2004, turned up on the internet.

Read more in The Register.

An exercise for my Ethical Hackers: Embed a program on your target's laptop and have it report the laptop's location via Twitter and e-mail.

http://www.pogowasright.org/?p=15664

How sites can pinpoint you without the need for a GPS

October 10, 2010 by Dissent

Ben Grubb reports:

If you thought websites planting tracking “cookies” on your computer was a cause for privacy concerns, what’s known as “location-aware browsing” is able to pinpoint your physical location – and fairly accurately.

Electronic Frontiers Australia chairman Colin Jacobs said this could mean that various websites would have in their databases a history of “where you have been and when”.

If you’re on a computer with Wi-Fi – which most have these days (especially laptops) – then it’s likely you can be pinpointed using the Google Location Service.

Read more in The Age and follow the link to try the Firefox demo. When I tried it, Google was able to pinpoint my location exactly.

[From the article:

Using Firefox? Try out a demo of location-aware browsing

I would have thought this was obvious. But then, I'm not a lawyer.

http://www.pogowasright.org/?p=15661

Meta-data subject to public records law

October 9, 2010 by Dissent

Gene Johnson of The Associated Press reports:

Metadata associated with electronic documents — such as the “to” and “from” fields in e-mails — is a public record subject to disclosure, Washington’s Supreme Court ruled yesterday.

The 5-4 ruling concerned a Shoreline resident’s request under the Public Records Act for an e-mail that had been sent to the city’s deputy mayor. The resident received a copy of the e-mail without the metadata and subsequently filed a request for the information.

“Metadata may contain information that relates to the conduct of government and is important for the public to know,” Justice Susan Owens wrote in O’Neill v. City Of Shoreline.

Read more on The Olympian. Although this is not the first time a court has ruled this way, I think we all need to remain cognizant than when we e-mail public officials, if anyone requests their email under public records, our email address, name, etc. would be revealed.

An interesting if flawed argument. Poverty is not the issue. Political power is. The fact that the two are often linked causes confusion.

http://www.pogowasright.org/?p=15633

Article: A Fourth Amendment for the Poor Alone: Subconstitutional Status and the Myth of the Inviolate Home

October 9, 2010 by Dissent

Jordan C. Budd of the University of New Hampshire School of Law has an article in the Indiana Law Journal (Vol. 85, No. 2, 2010). Here’s the abstract:

For much of our nation’s history, the poor have faced pervasive discrimination in the exercise of fundamental rights. Nowhere has the impairment been more severe than in the area of privacy. This Article considers the enduring legacy of this tradition with respect to the Fourth Amendment right to domestic privacy. Far from a matter of receding historical interest, the diminution of the poor’s right to privacy has accelerated in recent years and now represents a powerful theme within the jurisprudence of poverty. Triggering this development has been a series of challenges to aggressive administrative practices adopted by localities in the wake of federal welfare-reform legislation. As a precondition to public assistance, some jurisdictions now require that all applicants submit to a suspicionless home search by law-enforcement investigators seeking evidence of welfare fraud. In turning back challenges to these intrusions, contemporary courts have significantly curtailed the protections of the Fourth Amendment as applied to the poor.

While the courts that sanction these practices disclaim any sort of poverty-based classification underlying their analysis, no other rationale withstands scrutiny. Neither precedent nor the principled extension of existing doctrine justifies recent outcomes or explains why the holdings should not be applied to authorize a vast – and, thus, unacceptable – expansion of suspicionless search practices directed at the homes of the less destitute. The developing jurisprudence accordingly represents an implicit concession that the poor constitute a subconstitutional class for purposes of the Fourth Amendment. Framed most charitably, the decisions understand poverty as a condition of moral culpability and thus accept it as a surrogate for the individualized suspicion that otherwise would be required to justify the intrusions at issue. The premise of the dissolute poor, tracing back centuries, remains alive and well in American law, and we have a bifurcated Fourth Amendment to prove its enduring vitality.

You can download the working paper from SSRN. (Hat-tip, Legal Theory Blog via @normative).

Although not specifically cited in the working paper, Budd’s article articulates nicely with a point made by Chief Judge Alex Kozinski in his dissent from the panel’s decision not to rehear the Pineda-Moreno ruling en banc:

There’s been much talk about diversity on the bench, but there’s one kind of diversity that doesn’t exist: No truly poor people are appointed as federal judges, or as state judges for that matter. Judges, regardless of race, ethnicity or sex, are selected from the class of people who don’t live in trailers or urban ghettos. The everyday problems of people who live in poverty are not close to our hearts and minds because that’s not how we and our friends live. Yet poor people are entitled to privacy, even if they can’t afford all the gadgets of the wealthy for ensuring it. Whatever else one may say about Pineda-Moreno, it’s perfectly clear that he did not expect– and certainly did not consent–to have strangers prowl his property in the middle of the night and attach electronic tracking devices to the underside of his car. [*10] No one does.

When you glide your BMW into your underground garage or behind an electric gate, you don’t need to worry that somebody might attach a tracking device to it while you sleep. But the Constitution doesn’t prefer the rich over the poor; the man who parks his car next to his trailer is entitled to the same privacy and peace of mind as the man whose urban fortress is guarded by the Bel Air Patrol. The panel’s breezy opinion is troubling on a number of grounds, not least among them its unselfconscious cultural elitism.