Thursday, October 04, 2012

If your procedure for detecting a breach is inadequate, your procedure for detecting a test is also inadequate. Hiring multiple security firms is only a way to pass the buck, it will never ensure that you have adequate security management.
The City of Tulsa’s costly screw-up
October 2, 2012 by admin
The saga of the City of Tulsa hack-that-wasn’t-a-hack fascinates me and would be funny if it wasn’t such a costly foul-up. While the city’s IT manager is on paid administrative leave, Ian Silver of Fox23 provides some additional details , most notably:
  • To their credit, the city had hired SecurityMetrics 18 months ago to periodically check their security for holes. The “hack” was a result of SecurityMetrics doing their job and finding a hole in the process.
  • The city checked the IP address for the intruder but thought it might be a spammer. It appears they never checked with SecurityMetrics. I contacted SecurityMetrics, who provided the following statement:
    SecurityMetrics conducts regular vulnerability scans for tens of thousands of clients each month and uses an identical process to notify all account managers of scan results following each scan completion. In addition, each client has 24/7 online access to their SecurityMetrics account which includes times of past and future scans, and individual scan vulnerabilities. Although there was no breach, we applaud the City of Tulsa for implementing a punctual and accurate response process.
    So it seems the city could have easily checked its account online to see if there had been a scan at the time of the “intrusion,” but didn’t. Had they done that, it could have spared them a lot of time, money, and grief.
  • In addition to paying SecurityMetrics, the city wound up paying $20,000 in mailings to 90,000 people whom they thought had been victims of a hack. They also paid $25,000 to True Digital Security to investigate what they thought was a hack. Why they didn’t ask SecurityMetrics to investigate the hack is not explained. Had they done that, they might have also averted the costly mailing and other fees.
  • The city is hiring yet another firm to help them restructure their IT department so this type of thing doesn’t happen again.
It’s good that they detected a breach, and I don’t want to dismiss the importance of that. But the rest of this was a bit of a fiasco and re-structuring and improving communications may help avert a similar situation in the future. But what are other lessons to be learned here?


This has all the earmarks of a potential, make that probable, disaster. For years, my King Soopers loyalty card has had the name and address of a certain Law School professor I know...
"The UK Government will announce details this month of a controversial national identity scheme which will allow people to use their mobile phones and social media profiles as official identification documents for accessing public services. People wishing to apply for services ranging from tax credits to fishing licences and passports will be asked to choose from a list of familiar online log-ins, including those they already use on social media sites, banks, and large retailers such as supermarkets, to prove their identity."
I can't wait until carrying a telephone is mandatory. In the U.S. at least, how else will the government send you important messages?


A real concern. If their “private Internet” is controled by people who can't spell 'gMail' and is disrupted by data volumes equal to a single movie, no wonder they think they're under constant attack.
Officials in Iran have been busy over the last few months setting up the country’s new national information network. Once that information network was set up, Iran moved to block certain Internet services such as YouTube and Google search. Iran later said that it accidentally blocked access to Google Gmail at the same time.
New reports are coming out of Iran that claim cyber attackers targeted the country’s infrastructure and communications companies. According to the officials, the attacks disrupted the Internet across the entire country. Report of the disrupted Internet access was announced by Mehdi Akhavan Behabadi, secretary of the High Council of Cyberspace yesterday.
The official said the attack that occurred yesterday included “traffic of several gigabytes” that hit the Internet infrastructure and slowed down access across the country.


An update the fans have been waiting for...

...then again, perhaps not. Can you say: Class Action?
FIFA Fake-Out: EA Sells Last Year’s Soccer Game as New
… Yes, the uniforms and players have been updated to match this year’s rosters, the website Nintendo Gamer reported. But otherwise, it’s a re-release of the same game with a new number on the box: The same gameplay modes, character models, graphics, menu screens, dialogue. And the same $50 price tag.
It doesn’t stop there: Other fans of the sport say that FIFA 13 on PlayStation Vita is essentially identical to FIFA Football, the game that Electronic Arts released six months prior, at the launch of the new Sony gaming handheld.
EA is selling old products to unsuspecting consumers at a premium price, and fans are confused and angry.


Ignorance is bliss?
By Dissent, October 4, 2012
Over on Simple Justice, criminal defense attorney Scott Greenfield discusses a news story that is an eye-opener of sorts. It has do with how the Sarasota County Sheriff’s Office has tried to capitalize on our tendency to not really read HIPAA release authorizations we are asked to sign at a doctor’s office. Read the following carefully:
It’s been years since I’ve blogged about “tin stars on doctors,” but I was glad to read that no doctors seem to have actually used the forms or submitted such releases to the county.
As an attorney, Scott’s focus is understandably on the Fourth Amendment end-run that such forms attempt to accomplish. As a privacy advocate, I share his concerns, but as a healthcare professional, I am even more appalled when law enforcement tries to erode patient confidentiality and privacy. Kudos to the Herald Tribune for bringing this matter to the public’s attention and to Scott for amplifying the message.


Scams-du-jour: “It's what you don't know that hurts you...” FTC fine is $163 million – anyone think they'll actually collect?
October 03, 2012
FTC Halts Massive Tech Support Scams
News release: "The Federal Trade Commission has launched a major international crackdown on tech support scams in which telemarketers masquerade as major computer companies, con consumers into believing that their computers are riddled with viruses, spyware and other malware, and then charge hundreds of dollars to remotely access and “fix” the consumers’ computers. At the request of the FTC, a U.S. District Court Judge has ordered a halt to six alleged tech support scams pending further hearings, and has frozen their assets."

(Related) ...and they are 100% successful!
"A company is putting horrible reviews of small business online, and then offering to improve the company's reputation and take the reviews off for a fraction of the cost that a real reputation improvement company would charge. Sierra West received a call from a 'reputation improvement company' telling them they had a negative review online and that the company would take the review offline if Sierra West paid $500. 'Of course when someone is offering $500 the day (the bad review) goes up seemed not legitimate.'"


Is RFID cheaper than all those Traffic Cam with license plate recognition software? Probably... Note that the first “service” listed is traffic tickets.
"As of January, Brazil intends to put into action a new system that will track vehicles of all kinds via radio frequency chips. It will take a few years to accomplish, but authorities will eventually require all vehicles to have an electronic chip installed, which will match every car to its rightful owner. The chip will send the car's identification to antennas on highways and streets, soon to be spread all over the country. Eventually, it will be illegal to own a car without one. Besides real time monitoring of traffic conditions, authorities will be able to integrate all kinds of services, such as traffic tickets, licensing and annual taxes, automatic toll charge, and much more. Benefits also include more security, since the system will make it harder for thieves to run far away with stolen vehicles, much less leave the country with one." [At least, a car with a working RFID chip... Bob]


A lot of articles before and during, I can't wait to see what happens after the court reaches a decision.
Thoughts on the Oral Argument in the Fifth Circuit Cell-Site Case
October 3, 2012 by Dissent
Orin Kerr commented on yesterday’s oral argument:
The Fifth Circuit held its oral argument in its Fourth Amendment cell-site case today; the audio is here. On the whole, I thought the argument was pretty unilluminating. The judges spent a lot of time trying to figure out the statute and the facts, but they had surprisingly few questions about the Fourth Amendment questions DOJ and the amici argued. Here’s a quick run-down of the argument, followed by my thoughts….
Read his summary and comments on The Volokh Conspiracy.
Overall, I remain concerned that this was not the Circuit in which I’d have liked these arguments to be heard. But we’ll see….


Aside from inserting the word “legally” in a few places, this doesn't seem to change my life much...
AAP Publishers Get More Control Over Google As They Settle 7-Year Copyright Infringement Suit Over Google Library Project
Google has finally made some headway on the litigation over copyright infringement for the Google Library Project; and the deal puts in place another key piece of the puzzle for Google Books. Google has reached a settlement with the Association of American Publishers, ending a seven-year legal dispute over the use of books and journals by Google in its Library Project. The suit was first filed in 2005 by five publishers.
Under the new agreement, publishers will have more control over how works that they own appear in Google catalogs, and get more routes for potentially making money from books that appear in the Library Project, which is free to use and brings together content libraries and other sources online.


(Related) Perhaps computers can't do it all... Or, too many people see an easy way to use the automatic take-down to mess with competitors or anyone. Well, there goes my idea to get rich by copyrighting the phrase “I approve this message” during an election year...
YouTube Alters Copyright Algorithms, Will ‘Manually’ Review Some Claims
Google-owned YouTube said Wednesday it is altering its algorithms to reduce invalid copyright infringement claims on its video-sharing site and will begin manually reviewing some claims instead of the system automatically blocking disputed footage.
The development comes a month after First Lady Michelle Obama’s speech at the Democratic National Convention was wrongly flagged by algorithms just after it aired. YouTube, the official streaming partner of the Democratic National Convention, automatically put a copyright blocking message on the livestream video of the event shortly after it ended.
Thabet Alfishawi, rights management product manager for YouTube, said “mistakes can and do happen” due to the volume of uploaded videos and the sheer number of copyrighted clips uploaded into its automated Content ID service. We at Wired have labeled the algorithm “streaming video’s robotic overlord.”


For my Data Mining and Data Analysis students.
October 03, 2012
Demystifying Big Data: A Practical Guide to Transforming the Business of Government
  • "Big Data has the potential to transform government and society itself. Hidden in the immense volume, variety and velocity of data that is produced today is new information, facts, relationships, indicators and pointers, that either could not be practically discovered in the past, or simply did not exist before. [Big Data does not create new information. It may make it easier to find. Bob] This new information, effectively captured, managed, and analyzed, has the power to enhance profoundly the effectiveness of government. Imagine a world with an expanding population but a reduced strain on services and infrastructure; dramatically improved healthcare outcomes with greater efficiency and less investment; intensified threats to public safety and national borders, but greater levels of security; more frequent and intense weather events, but greater accuracy in prediction and management... Success in capturing the transformation lies in leveraging the skills and experiences of our business and mission leaders, rather than creating a universal Big Data architecture. It lies in understanding a specific agency’s critical business imperatives and requirements, developing the right questions to ask, understanding the art of the possible, and taking initial steps focused on serving a set of clearly defined use cases. The experiences and value gained in these initial steps lead to more questions, more value, and an evolutionary expansion of Big Data capability that continually leverages prior investments."


Perspective
Facebook has passed one billion active users, social network founder Mark Zuckerberg has confirmed, of which 600m are mobile users. The new milestone again sees Facebook’s average age of users fall, now down to 22 versus 23 when Facebook hit 500m users in July 2010; according to the site, it has seen over 1.13 trillion “Likes” since the February 2009 launch.


Sort of like a Gold Star... I will award “I stayed awake through the entire class” badges (probably once or twice per quarter...) Note: the site is still in Beta
Class Badges
Class Badges is an awesome new site that allows educators to award badges for student accomplishments. These badges are completely customizable for specific subjects, projects, and even for an individual school or classroom. Class Badges is simple to use tool that allows teachers to motivate and reward students for mastery with just a few clicks of their mouse. This is a fantastic new site that allows you to engage your students, reward their learning. Be sure to sign up and request a free account.


There are times when I want this power...
The built-in Remote Desktop application within Windows is a highly useful utility that lets you control a remote computer easily. But what if you need to remotely control multiple computers through a user-friendly interface? In this case, you will find an app called LiteManager to be very helpful.


This could be useful. Handouts my students might actually keep (and dare I hope, read?)
Publish Your Own Crafty Books and Manifestos With Scout Books
Pinball Publishing was founded 10 years ago with a focus on traditional fare like haute couture business cards and gig posters. Having monitored an ongoing explosion of digital media, founder Laura Whipple decided to blend both worlds in a diminutive way. She explains, “We combined our ink and paper expertise with the changing nature of online communications to develop the perfect pocket-sized publishing format called the Scout Book.”
Scout Books are 3.5-by-5-inch black-ink booklets covered with a semi-rigid cardstock that can be printed in one or two colors. Creators specify content for each page and publish a book, or slap a custom cover on a template to create a limited-edition journal.
… The company posts some of the best creations on their site as case studies — showing the potential of the simple paper setup.


Clever marketing? If not the little Trick-or-Treat zombies, then perhaps my Classroom zombies...
Give trick-or-treaters a free copy of Plants vs. Zombies (PC/Mac)
Let's face it: Zombies have the worst oral hygiene. I mean, have you ever seen one floss?
Alas, kids run them a close second, especially around Halloween, when the candy piles up like zombies on a cheerleader pyramid.
To help thwart the totally made-up condition known as "Zombie Mouth," PopCap Games has teamed up with the American Dental Association for a seriously cool promotion: Halloween-night coupons for a free copy of Plants vs. Zombies (PC/Mac).
Just print as many copies of the coupon page (PDF) as you like, then cut each one into eight individual coupons you can hand out to trick-or-treaters.
The code can be redeemed (at www.stopzombiemouth.com) starting Oct. 30, but no later than Nov. 10. It's good for the PC or Mac version of the mega-popular game, which normally sells for $19.95. You read that right: This is a $20 freebie for every kid in your neighborhood.

Posted by at No comments:

Wednesday, October 03, 2012

I'm not going to say “I told you so!” Not often, anyhow. Q: Why did it take them 2 years to blow the whistle? A: There's a lot of money flowing to the states because of this program. Unfortunately, none of it flows to John Q. Public.
Intelligence effort named citizens, not terrorists – Senate report reveals uselessness of fusion centers for fighting terrorism
October 2, 2012 by Dissent
Eileen Sullivan and Matt Apuzzo of Associated Press reports:
A multibillion-dollar information-sharing program created in the aftermath of 9/11 has improperly collected information about innocent Americans and produced little valuable intelligence on terrorism, a Senate report concludes. It portrays an effort that ballooned far beyond anyone’s ability to control.
What began as an attempt to put local, state and federal officials in the same room analyzing the same intelligence has instead cost huge amounts of money for data-mining software, flat screen televisions and, in Arizona, two fully equipped Chevrolet Tahoes that are used for commuting, investigators found.
Read more on Yahoo!
Update: Huffington Post has uploaded a copy of the full report. [Broken link, see below Bob] But take your blood pressure medication before reading it because it is truly scathing and will infuriate anyone who is sick and tired of privacy and civil liberties being sacrificed while taxpayer dollars are wasted on useless programs that do not not protect us from terrorism.
The full report is HERE.


Perhaps we could have a Privacy Seminar and invite the Royal Family?
Kate Middleton and Privacy Law
October 2, 2012 by Dissent
Privacy law scholar Dan Solove writes:
The recent incident of paparazzi snapping photos of Kate Middleton sunbathing in the nude has sparked renewed attention to privacy law. According to the Washington Post: “The royals contend that the photos of Middleton — apparently taken by a single paparazzo — violate her privacy and that the photographer trespassed on the private French estate where she and Prince William were vacationing. The editor of the Italian magazine disputes the trespassing allegation, saying the photos were shot from a public road.”
Many pundits have said dismissingly that any legal action Middleton might take is essentially a fool’s errand and she shouldn’t have expected privacy. For example, Donald Trump has declared in a tweet that Middleton has “only herself to blame.” [..and The Donald should certainly know about Blame... Bob] According to a Washington Times editorial: “Princess Kate needs to remember there is no privacy, so keep your top on.”
These sentiments are the typical reactions to media invasions of privacy — people should expect no privacy whenever they are outside the confines of their homes. I contend that this view isn’t correct both descriptively and normatively.
Read more on Linkedin.


I can see swarms of high schoolers asking such intellectually stimulating questions as “Boxers or briefs, Mr. President?”
October 02, 2012
Government Agency Consortium Launches FOIAonline
"FOIAonline is a tool that allows both the public and agency staff to make, monitor, and manage FOIA requests from a single website. Requesters may choose to submit requests and file appeals by registering for an account. This will also allow requesters to track progress and communicate directly with agency staff. Prior to making a request, a searchable repository of records previously released may be reviewed to eliminate the need to make a new request. Agency staff can move requests between organizations, review documents for potential withholding, generate invoices and make referrals and consultations quickly to other partner agencies. Agency management will be pleased with the time saved to prepare the Annual Report to the Department of Justice, a standard report in FOIAonline. FOIAonline was developed by a small group of government agencies looking for ways to use technology to process FOIA requests in a cost-effective way. FOIAonline operates as a module of the eRulemaking system and, like eRulemaking, is managed by a Change Control Board of partner agencies. The current partner agencies are: Departments of Commerce and Treasury, Environmental Protection Agency, National Archives and Records Administration, Merit System Protection Board and Federal Labor Relations Authority."


Perspective Sometimes, great business models are obvious – in retrospect.
The World's Largest Payment Platform Can Reach 2 Billion People
When Jana co-founder Nathan Eagle needed to connect to a cell carrier in the developing world, he'd come to meetings with a duffel bag full of cash and say that he wanted to buy airtime. For carriers who were taking on more customers than ever, but struggling with declining revenue per user, it was an irresistible sales pitch. The result, two years later, is that Jana is now the largest payment platform in the world.
Eagle describes Jana as an "opt-in mobile network" that pays users to fill out consumer surveys and try products. The company has access to 100% of the users on 237 cell carriers in 101 countries throughout Asia, Africa and Latin America.
By 2004, there were more mobile subscribers in the developing world than in developed countries, and the gap has been widening ever since. In 2012, Jana estimates that of the 6.5 billion mobile subscriptions on Earth, 5 billion are in emerging markets. The World Bank estimates that 75% of the people on Earth have access to a mobile phone. According to the McKinsey Quarterly, three billion people are projected to move into the middle class in the next twenty-five years. Right now their mobile devices are in some respects the most direct way to reach them.
Eagle comes from an academic background--he has appointments at Harvard and MIT and once more than a year as a Fulbright professor in Kenya--and his roots lie in using technology for development and social good. Jana was born, in part, of Eagle's success in setting up a network in rural villages in Kenya for nurses to text in status reports on supplies of hospital blood banks.
Jana's network, which is connected directly to the computer systems used by mobile carriers around the world, doesn't send actual money; instead, it gives mobile-phone credit. In emerging markets, where, according to Eagle, the average user spends 8%-12% of his or her income on prepaid mobile service, that's almost as good as cash.
… Often, Jana links its promotions to purchases in the physical world. "In the Philippines, if you go out and buy a particular brand of candy bar, if you get three of your friends to also buy it, all of you get it for 50% off." says Eagle. "We can validate the purchase because 7-Eleven is now printing Jana IDs on every receipt they have. At any of 713 7-Elevens, it's on the receipt." In another promotion, consumers in Indonesia who purchased two or more Danone yogurt products got 5,000 rupiahs ($0.52) worth of airtime directly on their phones.


A business model that was not obvious...
Changemakrs Looks To Reinvent Inspirational Quotes For A More Social Web
A few months ago, former Facebooker Sacha Tueni and Matthias Wagner were working on a Twitter client. Yes, a Twitter client — several years after Tweetdeck launched and Seesmic pivoted toward being a social media reader. While their app Zerobird was good at filtering interesting content, investors weren’t biting. It was also going to be a long uphill battle in the app store and on Twitter’s increasingly politically complicated platform.
So they took some good advice to heart. Steve Jobs’ advice, in fact. They built a tribute site to the late visionary. It was spartan, with that famous photograph of him sitting in an unfurnished house. They overlaid some of his best advice on that picture.
The barebones site quickly went viral, accumulating 3 million pageviews in about 48 hours. Surprised by the response to such a simple concept, they redid it with other figures. They did it with Yoda, and got 300,000 visitors. Then they did it again with Albert Einstein, and immediately got 400,000 visitors. Again, they did it with Lady Gaga, and got 700,000 visitors with 16 percent of them clicking through to a music track.
Thus, a new idea was born. What if they built a platform where anybody could share and accumulate bits and pieces of aspirational wisdom? So they created Changemakrs, which is a site full of inspirational quotes from different people ranging from celebrities to intellectuals, and even entrepreneurs from this community. It’s in beta and invited members can piece together quotable advice from anyone else.


...and a business model to give the RIAA heartburn.
One of the biggest cost centers for streaming audio providers is royalties paid to artists and music publishers. Music streaming company Rdio has announced a plan that will see it pay musicians a significant amount of money for each new subscriber the artist brings to the streaming service. Rdio launched an Artist Program this week that will pay musicians as much as $10 per subscriber.


For my Statistics students...
October 02, 2012
BLS Launches Data Sets Finder Search Tool Launched in Beta
"Data Finder is a new search and navigation tool for BLS time series data available on the BLS website. Rather than searching individual data sets, Data Finder allows users to conveniently search multiple data sets all at once. Users can extract specific data by searching by keyword or by filtering through multiple topics, measures, and attributes. This tool is designed to eventually replace many of the existing query tools on data.bls.gov. It is being developed iteratively, and we plan to update the application on a regular basis. We therefore encourage feedback, which we will use to plan and prioritize enhancements. We want to make this product useful to you." [Codeword check: Are they saying there is data here that will embarrass politicians? Bob]

(Ditto)
"The phrase 'correlation does not imply causation' goes back to 1880 (according to Google Books). However, use of the phrase took off in the 1990s and 2000s, and is becoming a quick way to short-circuit certain kinds of arguments. In the late 19th century, British statistician Karl Pearson introduced a powerful idea in math: that a relationship between two variables could be characterized according to its strength and expressed in numbers. An exciting concept, but it raised a new issue: how to interpret the data in a way that is helpful, rather than misleading. When we mistake correlation for causation, we find a cause that isn't there, which is a problem. However, as science grows more powerful and government more technocratic, the stakes of correlation — of counterfeit relationships and bogus findings — grow larger."


For all my Intro to Security students...
We know what you're doing...
… queries Facebook's Graph API and outputs the results. There is nothing on this website that cannot be accessed by anyone else.

(Related) I suspect it is because we have not yet developed a culture of appropriate action (we ain't got no good examples)
"An article in the WSJ discusses why internet users are more rude online than they are in person. The story discusses some of the possible reasons. For example, a study found that browsing Facebook tends to lower people's self control. An MIT professor says people posting on the internet have lowered inhibitions because there is no formal social interaction. Another theory is that communicating through a phone or other device feels like communicating with a 'toy,' which dehumanizes the conversation. Of course, a rude conversation has never happened on Slashdot in the last 15 years."


Student cell phone rings. Professor grabs cell phone. Shoves it where the sun... Okay, maybe just a “No cell phones, please” sign.
There are several ways to make animated GIFs: You can use a bunch of pictures you took and combine them, you can create one on the go using a webcam, and you can take an existing video and turn it into an animated GIF. Most of the tools you’ll find below are meant for the first method. Turns out that by using a series of pictures you’ve taken yourself, or just some pictures you like, you can actually create some really beautiful things!


Geeky stuff?
YouTube is the undisputed king of online video, even though there are several willing (but somewhat lacking) competitors. With that in mind, a list of 10 technology YouTube channels you cannot afford to miss would seem to be appropriate.


Another list, with some Free Stuff!
15 Must Have Windows Utilities

Posted by at No comments:

Tuesday, October 02, 2012

It could be worse, and I think that's their point...
ProjectWestWind: TeamGhostShell hacks and dumps 120,000 records from 100 U.S. and non-U.S. universities
October 1, 2012 by admin
Over on Softpedia, Eduard Kovacs alerts us all to a paste from a group of hackers who call themselves TeamGhostShell. In a paste today on Pastebin, they introduce “ProjectWestWind,” exposing the hacks and vulnerabilities in universities around the world. I’m deleting their rationale and links to data dumps, but here’s a bit of their project description:
Our targets for this release have been the top 100 universities around the world. After carefully filtering the ones that we’ve already leaked before and the ones where Anonymous has in major operations, we have eventually got together a new fresh list. The majority of them should be here. Also, some of us decided to go ahead and add vulnerable links to the other ones anyway, which you can find at the bottom, at “Other Universities”.
side note* We tried to keep the leaked information to a minimum, so just around 120.000+ accounts and records are here, leaving in their servers hundreds of thousands more. (When we got there, we found out that a lot of them have malware injected. No surprise there since some have credit card information stored.)
The following is a list of universities for which data were dumped. The number in parentheses indicates the number of servers the hackers accessed and downloaded data from): [Removed all but the local Univ. Bob]
  • University of Colorado (three servers)
The preceding list does not include their link of vulnerable sites.
So…. what will the U.S. Education Department think about the security of universities that amass tremendous amounts of personally identifiable information on students? What will it do, if anything? I have contacted them and left a message asking for a statement about these breaches and will update this blog entry if/when I get a response.


“Gosh, we had no clue! Do you think we should inplement some security?”
Ca: Criminals hack into high school computer system to access FBI, CIA
October 1, 2012 by admin
Hackers have been using a Bay Area school district’s computer system to try hack into top secret government agencies.
Like all school districts, the San Mateo Union High School District is heavily computerized with general public access and password only access to many of its files, but the district discovered a security breach [Clearly, the district did not discover a breach. The Navy told them they had one... Bob] after receiving a strange communication.
“It seems like a very strange communication because the United States Naval Intelligence contacted us and said that one of our servers had been compromised,” said Kirk Back, the district’s superintendent.
Read more on KTVU.com


I'm concerned that no bank managers caught this... What does that say about their control over operations?
October 01, 2012
CFPB orders American Express to pay $85 million refund to consumers harmed by illegal credit card practices
News release: "The Consumer Financial Protection Bureau (CFPB) today announced an enforcement action with orders requiring three American Express subsidiaries to refund an estimated $85 million to approximately 250,000 customers for illegal card practices. This action is the result of a multi-part federal investigation which found that at every stage of the consumer experience, from marketing to enrollment to payment to debt collection, American Express violated consumer protection laws... The Federal Deposit Insurance Corporation (FDIC) together with the Utah Department of Financial Institutions discovered the illegal activities during a routine examination [and so should any competent manager! Bob] of an American Express subsidiary, the American Express Centurion Bank. The FDIC transferred portions of the investigation to the CFPB when the Bureau opened its doors last year and together the agencies pursued the matter. The CFPB later concluded that many of the same violations that occurred at American Express Centurion Bank also took place at American Express Travel Related Services Company, Inc. and American Express Bank, FSB."


“At least, that's how it looks to us...”
Not From the Onion: Army Says ‘Social Network’ Use Is a Sign of Radicalism
These are some warning signs that that you have turned into a terrorist who will soon kill your co-workers, according to the U.S. military. You’ve recently changed your “choices in entertainment.” You have “peculiar discussions.” You “complain about bias,” you’re “socially withdrawn” and you’re frustrated with “mainstream ideologies.” Your “Risk Factors for Radicalization” include “Social Networks” and “Youth.”
These are some other signs that one of your co-workers has become a terrorist, according to the U.S. military. He “shows a sudden shift from radical to ‘normal’ behavior to conceal radical behavior.” He “inquires about weapons of mass effects.” He “stores or collects mass weapons or hazardous materials.”
That was the assessment of a terrorism advisory organization inside the U.S. Army called the Asymmetric Warfare Group in 2011, acquired by Danger Room. Its concern about the warning signs of internal radicalization reflects how urgent the Army considers that threat after Maj. Nidal Malik Hasan shot and killed 13 people at Ford Hood in 2009. But its “indicators” of radicalization are vague enough to include both benign behaviors that lots of people safely exhibit and, on the other end of the spectrum, signs that someone is so obviously a terrorist they shouldn’t need to be pointed out. It’s hard to tell if the group is being politically correct or euphemistic.
[Interesting chart here Bob]


“Those who cannot remember the past are condemned to repeat it.” George Santayana
Article: The Curious History of Fourth Amendment Searches – Orin Kerr
October 1, 2012 by Dissent
More food for thought from Orin Kerr. Here’s the abstract of his new paper, The Curious History of Fourth Amendment Searches:
In United States v. Jones, 132 S.Ct. 945 (2012), the Supreme Court restored the trespass test of Fourth Amendment law: Any government conduct that is a trespass onto persons, houses, papers, or effects is a Fourth Amendment ‘search.’ According to the Court, the trespass test had controlled the search inquiry before the reasonable expectation of privacy test was introduced in Katz v. United States, 389 U.S. 347 (1967). Although Katz had rejected the trespass test, Jones restored it. This essay examines the history of the Fourth Amendment search doctrine and reaches the surprising conclusion that the trespass test never existed. Pre-Katz decisions did not adopt a trespass test, and instead grappled with many of the same questions that the Court has focused on when applying the reasonable expectation of privacy test. The idea that trespass controlled before Katz turns out to be a myth of the Katz Court: Katz mischaracterized Fourth Amendment history to justify a break from prior precedent. Jones thus restores a test that never actually existed. The essay concludes by considering both the doctrinal and theoretical implications of the surprising history of the Fourth Amendment search doctrine.


Not so much a problem with IP protections, but with the mechanics of administering the law?
Ars Technica reports on Judge Posner's weblog, and in particular a recent post on the excessive strength of U.S. copyright and patent law:
"The problem of excessive patent protection is at present best illustrated by the software industry. This is a progressive, dynamic industry rife with invention. But the conditions that make patent protection essential in the pharmaceutical industry are absent. Nowadays most software innovation is incremental, created by teams of software engineers at modest cost, and also ephemeral—most software inventions are quickly superseded. ... The most serious problem with copyright law is the length of copyright protection, which for most works is now from the creation of the work to 70 years after the author’s death. Apart from the fact that the present value of income received so far in the future is negligible, obtaining copyright licenses on very old works is difficult because not only is the author in all likelihood dead, but his heirs or other owners of the copyright may be difficult or even impossible to identify or find. The copyright term should be shorter."
Reader jedirock pointed to a related article on how the patent situation got so out of hand in the first place.

(Related)
"PersonalWeb's software patent suit against Github and others threatens the freedom of the Web. In order to make sure that the Web can remain a free and accessible space for everyone, we need to rid ourselves of all the patents that threaten its viability. We need to end software patents."


This should start the Second Amendment crowd buzzing, but isn't it a First Amendment question? (This is old news in Science Fiction circles) Possible the every law school with have a Gun Printing club?
3-D Printer Company Seizes Machine From Desktop Gunsmith
Cody Wilson planned in the coming weeks to make and test a 3-D printed pistol. Now those plans have been put on hold as desktop-manufacturing company Stratasys pulled the lease [He should have purchased it outright. Bob] on a printer rented out for Wiki Weapon, the internet project lead by Wilson and dedicated to sharing open-source blueprints for 3-D printed guns. Stratasys even sent a team to seize the printer from Wilson’s home.
“They came for it straight up,” Cody Wilson, director of Defense Distributed, the online collective that oversees the Wiki project, tells Danger Room. “I didn’t even have it out of the box.” Wilson, who is a second-year law student at the University of Texas at Austin, had leased the printer earlier in September after his group raised $20,000 online. As well as using the funds to build a pistol, the Wiki Weapon project aimed to eventually provide a platform for anyone to share 3-D weapons schematics online. Eventually, the group hoped, anyone could download the open source blueprints and build weapons at home.
Until Stratasys pulled the lease, the Wiki Weapon project intended to make a fully 3-D printed pistol for the first time, though it would likely be capable of only firing a single shot until the barrel melted. Still, that would go further than the partly plastic AR-15 rifle produced by blogger and gunsmith Michael Guslick. Also known as “Have Blue,” Guslick became an online sensation after he made a working rifle by printing a lower receiver and combining it with off-the-shelf metal parts.


Perspective
A new survey has been published by Pew looking at the adult US population who owns a smartphone or tablet. According to the survey, half of all adults in the US currently have a mobile web connection through a smartphone or tablet. That number is up significantly from a similar study conducted by the Pew Research Center last year.

(Related)
October 01, 2012
UVic Law Student Technology Survey 2012
Rich McCue: "In addition to the technology questions we’ve been asking UVic Law students over the past ten years, we decided for the first year to ask more detailed questions about student use of tablets and e-readers for academic use, along with questions about their usage of “cloud” services for file storage and collaboration. This survey was completed by 126 incoming and transferring law students, which is a strong 90% plus response rate." Some of the survey results summarized as follows:
  • "89% of incoming law students own “Smart Phones” that can browse the internet (up from 84% last year and 50% two years ago), with 48% of the total being iPhones, 29% Android and 11% Blackberry (Blackberry usage down from 27% last year).
  • 31% of students own tablet devices or ebook readers, up from 19% last year.
  • When it comes to reading school related documents, students report reading those documents in bound books 46% of the time, on laptops 35% of the time, on laser printed pages 16% of the time, and on tablet devices 3% of the time.
  • 99% of students own laptops. 49% of laptops are Mac’s, and 48% Windows.
  • The students’ average typing speed is 49 wpm.
  • 68% of all students bring their laptops to school most days.
  • 75% of students use laptops to take class notes, 63% use pen and paper, 6% use tablets and 3% use their cell phones.
  • 53% of students use Gmail as their primary email account, 7% use UVic email and 20% Hotmail..."


For my students?
Do you know how the online services you choose use your data? Do they claim a broad copyright to it, remove your rights to a class-action lawsuit in the USA, or share your information with other companies? Or are they a well-behaved service that respects your rights? The answer to this is in each website’s terms of service – unfortunately, no one has the time to read those. A new service reads websites’ terms of service for you, summarizing what you need to know in a quick, bullet-point list.
… We’ve covered some of the more ridiculous things that can be found in EULAs and terms of services before – one company even offered $1,000 in the middle of their EULA to the first person that contacted them about the offer. It took four months for someone to notice – that’s how few people read EULAs.
… Terms of Service; Didn’t Read is an innovative, smart solution to this problem. They read the terms of service for popular websites for you, condensing the terms into an easily understood bullet-point list. If that isn’t enough, they rate websites according to their terms of service, so you can see at a glance if the website respects your rights or tramples on them.
Terms of Service; Didn’t Read also offers browser extensions for Firefox, Chrome, and Safari. You can see information about a website’s terms of service right from your browser, without navigating to any other pages.
… You may also be interested in EULAlyzer, a free Windows program that automatically scans end-user license agreements for programs you install and alerts you to certain phrases in them.


A topic I'm interested in too...
Announcing EDBP.com, a New Website of Best Practices For Attorneys


Handy tools. I use this to demonstrate software the school doen't have (and blocks me from installing)
Portable applications are no secret – they have grown in popularity as their benefits continually become more well known. PortableApps.com should be given a lot of credit for this. Sure there are several portable application suites available, but PortableApps.com has contributed a great amount to how portable applications are being used.
… Now if you are still sitting on the fence wondering whether you should use portable applications, let alone PortableApps.com, I highly encourage you to check out 3 Ways The Portable Apps Platform Will Make Your Life Easier by Jessica. I can almost guarantee that you’ll be eager to use it after reading her article.


I'm teaching Statistics again this Quarter, so this will likely be a handout...
"A recent paper published in PNAS describes statistical techniques for clearly displaying the presence of two types of electoral fraud (PDF) — 'incremental fraud' (stuffing of ballot boxes containing genuine votes with ballots for the winning party) and 'extreme fraud' (reporting completely contrived numbers, typically 100% turnout for a vote-counting region, with 100% voting for the winning party). While the techniques would require skill with statistical software to apply in real time, the graphs produced in the paper provide tools for the interested non-statistician to monitor an election 'live.' Examples are discussed with both 'normal' elections, fraud by the techniques mentioned, and cases of genuine voter inhomogeneity. Other types of fraud, such as gerrymandering and inhibiting the registration of minority voters, are not considered."


For my Math students
Eight Alternatives to Buying Scientific Calculators


A 20 minute TED video worth watching...
Amy Cuddy: Your body language shapes who you are
Body language affects how others see us, but it may also change how we see ourselves. Social psychologist Amy Cuddy shows how “power posing” -- standing in a posture of confidence, even when we don’t feel confident -- can affect testosterone and cortisol levels in the brain, and might even have an impact on our chances for success.
Amy Cuddy’s research on body language reveals that we can change other people’s perceptions — and even our own body chemistry — simply by changing body positions.

Posted by at No comments:

Monday, October 01, 2012

What could possibly go wrong?
September 30, 2012
DHS Privacy Policy for Operational Use of Social Media
Public Intelligence: "The following is an instruction accompanying DHS Policy Directive 110-01 “Privacy Policy for Operational Use of Social Media” that was enacted in June 2012. The policy directive itself is only three pages and provides little information, whereas this instruction for the policy is ten pages and includes rules for compliance with the directive. The policy was enacted following congressional hearings earlier this year that criticized DHS’ monitoring of social media. However, this privacy policy specifically exempts the use of social media for “situational awareness by the National Operations Center” which was the focus of the hearings."


Not all wishes are equally desireable...
"WHOIS was invented as an address book for sysadmins. These days, it's more likely to be used by Law Enforcement to identify a perpetrator or victim of an online crime. With ICANN's own study showing that 29% of WHOIS data is junk, it's no surprise that Law Enforcement have been lobbying ICANN hard to improve WHOIS accuracy. The EU's privacy watchdog, the Article 29 Data Protection Working Party, has stepped into the fray with a letter claiming that two of Law Enforcement's twelve asks are "unlawful" (PDF). The problem proposals are data retention — where registrant details will be kept for up to two years after a domain has expired — and re-verification, where a registrant's phone number and e-mail will be checked annually and published in the WHOIS database. The community consultation takes place at ICANN 45 in Toronto on October 15th."


For my Data Mining and Data Analysis students...
Data Markets: The Emerging Data Economy
… The term data market brings to mind a traditional structure in which vendors sell data for money. Indeed, this form of market is on the rise with companies large and small jumping in. Think of Azure Data Marketplace (Microsoft), data.com (Salesforce.com), InfoChimps.com, and DataMarket.com.
While this model allows organizations to acquire valuable data, the term is evolving to include a variety of forms, each with varying degrees of adoption success. At the heart of it, data markets enable organizations to access data in new ways, where the currency does not only have to be money, but can be in the form of data or insight.
There is also a trend where companies can outsource certain aspects of data management, especially around reference or canonical datasets, to a third party that specializes in assembling and curating datasets or creating value from data in other ways. As a result, new data economies are being formed where data can be created, accessed, rented, and perpetually maintained in a more simple and affordable way.
… Consider the following examples:
  • Jigsaw has created a data market in which individuals and organizations provide contact information in a central repository. Jigsaw curates that data and distributes in part and en masse in exchange for both data and money.
  • Kaggle allows companies to provide data to a community of data scientists who analyze the data to discover predictive, actionable insight and win incentive awards. Data and rewards are traded for innovation.
… Data markets are also changing attitudes about data as an asset that must be kept private. While some data will clearly always be proprietary, in many cases the largest amount of value will come from sharing data and getting some new type of value in return.
Key questions for new participants to data markets include:
  • What is the value of your data inside your organization?
  • What is the risk in sharing it?
  • What control do you over the data?
  • What can you get in exchange for it?
  • What role should you play in data markets?


This will be useful!
Do you hate websites that force you to login with Facebook or Twitter? Many sites resort to this option as the easiest way to integrate logins, despite that fact that most users don’t like it. Mozilla Persona can change this, and it’s now officially in public beta. Mozilla Persona, formerly known as BrowserID, is a centralized login option websites can implement that allows users to log in quickly, without compromising their Facebook or Twitter profiles.
… As a user, it takes several minutes to create a Persona account, which you can then theoretically use across the web to log in, if the website supports it. You can easily add several email addresses, but you have one password for all of them.
… If you want to implement Persona on your website, you can learn how to do so here.
Mozilla Persona is now in public beta, so you can try it out by creating your own account.

Posted by at No comments:

Sunday, September 30, 2012

Hacking to what end? Misdirection? Establishing a “new normal” might have some long term benefits.
Cyber attackers hit Canadian energy companies
CALGARY -- The federal government said it is taking action after revelations of a cyber attack on a major player in Canada's energy industry.
Calgary-based Telvent Canada, an IT service company that helps manage 60% of all oil and gas pipelines in North America and Latin America, confirmed the cyber attack.
The company said some customer files had been impacted, but would not disclose which companies were targeted.
… The breach, which some experts have linked to Chinese hackers, was first reported by a U.S. journalist and cybercrime blogger.
… Word of the hack, which is said to have hit operations in the U.S., Spain and Canada, did not surprise Davies.
"It's nothing new for the industry," he said.
"It's the new normal."

(Related) What strategy makes this worthwhile?
U.S. banks hit by more than a week of cyberattacks
U.S. banks have been buffeted by more than a week of powerful cyberattacks, but the mystery surrounding their perpetrators lingers.
One expert said Friday that he was suspicious of claims of responsibility purportedly made by Islamists angry at an anti-Muslim movie made in the United States, explaining that the widely circulated Internet postings might have been an attempt to deflect attention from the true culprit.
… Such attacks are fairly common and generally don’t compromise sensitive data or do any lasting damage. Still, they can be a huge headache for companies that rely on their websites to interact with customers.


A lot of interesting questions when civilians conduct the war.
Not Even the White House Knows the Drones’ Body Count
Government officials claim they’re ultra-precise killing machines that never, ever miss their targets. Outside groups say they’re covered in children’s blood. The fact is no one has a clue exactly how many militants and how many innocents have been slain in the U.S. drone war that spans from Pakistan to Somalia. Remember that before you start your next Twitter feud about the drone war.
… The death toll claims, which vary wildly, are all educated guesswork.
It’s one of many conclusions in a new report on the covert, robotic air war that doesn’t fit neatly into the dominant narratives about the drone campaign, pro or con. (The report is due to publish at midnight GMT on Sunday.) Using interviews with dozens of people in northwest Pakistan — one of the epicenters of the unmanned air assaults — The Center for Civilians in Conflict and Columbia Law School’s human rights clinic have crafted a nuanced view of the civilian impact of this most controversial component of the Obama administration’s counterterror efforts. Table your preconceived notions about the drone war before you read — starting with the notions about who the drones are actually taking out.


“We don't need no stinking IP lawyers!” Note that this is not coming from geeks dressed as Klingon warriors...
"The most recent call for curtailing patents comes not just from an unexpected source, the St. Louis Fed, but also in its most basic form: total abolition of all patents. Via the Atlantic Monthly: a new working paper (PDF) from two members of the St. Louis Federal Reserve, Michele Boldrin and David Levine, in which they argue that while a weak patent system may mildly increase innovation with limited side-effects, such a system can never be contained and will inevitably lead to a stifling patent system such as that presently found in the U.S. They argue: '...strong patent systems retard innovation with many negative side-effects. ... the political demand for stronger patent protection comes from old and stagnant industries and firms, not from new and innovative ones. Hence the best solution is to abolish patents entirely through strong constitutional measures and to find other legislative instruments, less open to lobbying and rent-seeking.' They acknowledge that some industries could suffer under a such a system. They single out pharma, and suggest other legislative measures be found to foster innovation whenever there is clear evidence that laissez-faire under-supplies it."


My first thought was, “This guy's an idiot!” After some reading and more thought I have concluded that he is in fact a complete and total idion in need of a rubber room.
"Reminiscent of buggy whip manufacturers taking legal action against auto makers, the former U.S. Register of Copyrights, Ralph Oman, has given an amicus brief in the Aereo case (PDF) stating that all new content-delivery technology should be presumed illegal unless and until it is approved by Congress. He adds that providers of new technology should be forced to apply to Congress to prove they don't upset existing business models."


No reason it has to be done this quickly
"A group of Finnish mathematics researchers, teachers and students write an upper secondary mathematics textbook in a three-day booksprint. The event started on Friday 28th September at 9:00 (GMT+3) and the book will be (hopefully) ready on Sunday evening. The book is written in Finnish. The result — LaTeX source code and the PDF — is published with open CC-BY-license. As far as the authors know, this is the first time a course textbook is written in three-day hackathon. The hackathon approach has been used earlier mainly for coding open source software and writing manuals for open source software. The progress can be followed by visiting the repository at GitHub or the project Facebook page."


I was thinking about a Robotics class. Perhaps a challengs for “do it yourself” drones? Complete with hardpoints for weapons mounts.
These $10 Robots Will Change Robotics Education
When the African Robotics Network announced their $10 robot design challenge this summer, co-founder Ken Goldberg was careful not to share too many expectations, lest he influence contestants' designs. But he never imagined one of the winning entries would prominently feature a pair of Spanish lollipops.
The challenge, hosted by AFRON co-founders Goldberg and Ayorkor Korsah, emphasized inexpensive designs to help bring robotics education to African classrooms. Goldberg announced AFRON's 10 winners in three categories today at Maker Faire, including the lollipop-laden Suckerbot and traditional (roaming) category first prize winner Kilobot, a Harvard-spawned three-legged, vibrating, swarming robot.
… Suckerbot, designed by Thomas Tilley, a computer scientist living in Thailand, started with a hacked PlayStation controller, and wound up winning first prize in the tethered robot category. In this case, the tether is the controller's USB cable, and Tilley attached the rumble motors to a pair of wheels. Suckerbot's list of parts comes to $8.96, but the real genius is the Chupa Chups. Tilley needed a way for the robot to sense if it ran into something, so he stuck a lollipop in each joystick. Whenever the Suckerbot bumps something, the weight of the sucker tips the joystick forward, and a signal is sent to the processor.


For my wino friends. (I say wino because I can never remember how to spell oenophile)
Amazon to start selling wine?
… The Wall Street Journal reports today that Amazon will be launching a wine marketplace in the next few weeks, one that will surely lift the spirits.
It seems that company executives were in Napa only this week, meeting with 100 different wineries and explaining the launch.
The meeting created some intrigue. Amazon's terms are reportedly 15 percent of sales, plus a $40 fee to join the marketplace.
My religious reading of Wine Industry Insight tells me that all the wineries attending the meeting signed nondisclosure agreements -- after which a couple of them may have offered a murmuring here or there. Perhaps a little local Cabernet was available at the meeting.
Naturally, working with the might of Amazon might allow for lower shipping fees for the wineries -- which will reportedly be responsible for arranging all the boxing and delivery.
… Clearly, there are regulatory issues, as different states tend to have their own quirks when it comes to sales and delivery of one of nature's great inspirational soothers.


Perspective (Plus, I like what they plan for New Jersey!)


An amusing Infographic...

Posted by at No comments:
Subscribe to: Posts (Atom)