Not my Centennial. Also, be careful what you say, the data accessed looks important to me!

So easy children could do it? Centennial School District Hacked by Students

Travis Loose reports:

The Centennial School District on Friday announced a security breach within its student information systems. District officials do not currently believe any important student information was taken, however the investigation is ongoing.

Two Centennial High School students — a junior and senior, both under 18 — are responsible for data breach, school district spokeswoman Carol Fenstermacher told Patch in an email Friday. One of the students reportedly told authorities they did it to “show that the system could be hacked,” Fenstermacher said, but police are working to determine any specific or nefarious intent.

The district’s IT staff reportedly found the access points that were hacked by the students and has secured them, Fenstermacher said. Law enforcement is determining the full extent of the breach and figuring what, if anything, was taken.

Read more on Patch.

[From the article:

Fenstermacher said the hackers were able to access the names, birthdates, addresses, schools and grade levels, phone numbers, student IDs, and demographic information of all current and former Centennial School District students.

What were they (not) thinking?

Online Shop Can’t Determine Card Breach Onset Due To “Lack of Backups”

I tweeted about this breach disclosure earlier today after Zack Whittaker called everyone’s attention to it, and I am glad to see that Catalin has written the matter up:

In a data breach notification letter submitted to the Office of the Attorney General for the state of California, a makeup product vendor said it could not fully assess the impact of a recent card security breach due to a lack of backups.

[…] Beautyblender started investigating the incident after two customers complained about fraudulent transactions on credit cards used on the site.

[…] “Unfortunately, due to the lack of backups of the website that were available from the website hosting company, beautyblender has been unable to confirm the date that the malware was placed on the website.”

Their last backup was in April, 2015. Ugh.

Read more on BleepingComputer.

North Korea needs hard currency.

http://www.securityweek.com/monero-miner-sends-cryptocurrency-north-korean-university

Monero Miner Sends Cryptocurrency to North Korean University

An application compiled just weeks ago was found to be an installer for a Monero miner designed to send the mined currency to a North Korean university, AlienVault reports.

The application’s developers, however, might not be of North Korean origins themselves, the security researchers say. They also suggest that the tool could either be only an experimental application or could attempt to trick researchers by connecting to Kim Il Sung University in Pyongyang, North Korea.

Still trust this vendor?

http://www.securityweek.com/hardcoded-backdoor-found-western-digital-storage-devices

Hardcoded Backdoor Found on Western Digital Storage Devices

… Discovered by GulfTech security researcher James Bercegay, the security flaws could be exploited to achieve remote root code execution on the affected WD My Cloud personal cloud storage units (the device is currently the best-selling NAS (network attached storage) device on Amazon).

One of the most important security issues the researcher found was an unrestricted file upload vulnerability created by the “misuse and misunderstanding of the PHP gethostbyaddr() function,” the researcher says.

Definitely an article for my Computer Security student toolkit!

How to Assess a Vendor’s Data Security

Perhaps you’re an office manager tasked with setting up a new email system for your nonprofit, or maybe you’re a legal secretary for a small firm and you’ve been asked to choose an app for scanning sensitive documents: you might be wondering how you can even begin to assess a tool as “safe enough to use.” This post will help you think about how to approach the problem and select the right vendor.

A printable checklist for How to Assess a Vendor’s Data Security.

Something for my researching students?

https://www.bespacific.com/new-guide-helps-journalists-researchers-investigate-misinformation-memes-and-trolling/

New guide helps journalists, researchers investigate misinformation, memes and trolling

“Recent scandals about the role of social media in key political events in the US, UK and other European countries over the past couple of years have underscored the need to understand the interactions between digital platforms, misleading information and propaganda, and their influence on collective life in democracies. In response to this, the Public Data Lab and First Draft collaborated last year to develop a free, open-access guide to help students, journalists and researchers investigate misleading and viral content, memes and trolling practices online. Released today, the five chapters of the guide describe a series of research protocols or “recipes” that can be used to trace trolling practices, the ways false viral news and memes circulate online, and the commercial underpinnings of problematic content. Each recipe provides an accessible overview of the key steps, methods, techniques and datasets used. The guide will be most useful to digitally savvy and social media literate students, journalists and researchers. However, the recipes range from easy formulae that can be executed without much technical knowledge other than a working understanding of tools such as BuzzSumo and the CrowdTangle browser extension, to ones that draw on more advanced computational techniques. Where possible, we try to offer the recipes in both variants…”

Perspective.

https://www.wsj.com/articles/techs-enormous-scale-samsung-now-outspends-exxon-and-shell-combined-1515490437

Tech’s Enormous Scale: Samsung Now Outspends Exxon and Shell Combined

Samsung Electronics Co. spent more money on capital expenditures last year than any other publicly traded company, offering a dramatic example of how technology and telecom firms have driven an uptick in global manufacturing investment.

The South Korean tech giant invested $44 billion to build or expand new facilities making semiconductors, displays and other products, according to S&P Global Market Intelligence estimates.

Always an amusing argument.

What the Future of U.S. Antitrust Should Look Like

… Both conservatives and progressives invoke “consumer welfare” as antitrust’s core concern, but they offer divergent interpretations of this concept. Guided by the late Robert Bork’s seminal work, The Antitrust Paradox, conservatives invoke a total welfare standard that regards efficiency-enhancing mergers as presumptively legitimate, no matter how those gains are allocated between consumers and producers. For their part, progressives also focus on the consequences for consumers, but employ a broader understanding of consumer welfare that encompasses quality, innovation, and choice as well as price.

Recently, a third stance has entered the fray. Populists regard the consumer welfare standard as inadequate, because it pays no attention to the political dimension of antitrust — in particular, to the connection between economic concentration and corporate political power. Reflecting a tradition extending back a century to the thought of Louis D. Brandeis, populists believe that a multiplicity of businesses is preferable to a small number of large firms — for the health of local communities as well as economic sectors — even if consumers pay higher prices.

(Related).

Are Apple, Facebook, Google and Amazon Unstoppable?

NYU professor Scott Galloway talks about the pervasive influence of Big Tech – both good and bad – in his new book.

For my geeks who Pi.

20 Awesome Uses for a Raspberry Pi

Surveillance as a commercial opportunity?

https://www.bespacific.com/california-senate-to-hear-effs-license-plate-cover-bill/

EFF – “Across the country, private companies are deploying vehicles mounted with automated license plate readers (ALPRs) to drive up and down streets to document the travel patterns of everyday drivers. These systems take photos of every license plate they see, tag them with time and location, and upload them to a central database. These companies—who are essentially data brokers that scrape information from our vehicles—sell this information to lenders, insurance companies, and debt collectors. They also sell this information to law enforcement, including U.S. Department of Homeland security, which recently released its updated policy for leveraging commercial ALPR data for immigration enforcement. The Atlantic has called this collection of our license plates “an unprecedented threat to privacy.” This data, collected in aggregate, can reveal intimate details about our lives, including what doctors we visit, where we worship, where we take our kids to school, and where we sleep at night. Companies marketing this data claim that the technology can predict our movements and link us to our associates based on which vehicles are often parked next to each other…”

See also the Washington Post – “Beijing bets on facial recognition in a big drive for total surveillance… It will use facial recognition and artificial intelligence to analyze and understand the mountain of incoming video evidence; to track suspects, spot suspicious behaviors and even predict crime; to coordinate the work of emergency services; and to monitor the comings and goings of the country’s 1.4 billion people, official documents and security industry reports show.”

Governments don’t do technology very well. Perhaps my students could create an Emergency App?

http://kutv.com/news/local/911-fatal-flaw

Uber can find you easily, but emergency services struggle to locate those in need

We live in a day and age where calling 911 anytime, anywhere, is easier than ever. But getting 911 dispatchers to track your location is harder than ever.

Your smart phone allows Uber drivers, video games apps and social media accounts, like Instagram, to pinpoint your exact location — yet 911 dispatchers are left scrambling to find you.

With 70 percent of all 911 calls made nationally on cell phones, 2News wanted to know how well your location can be tracked in a life-or-death situations.

… Apps like Pokemon-Go and Uber can track your every move, because you have accepted the terms and conditions of their operating system. Your acceptance gives your permission to be tracked to your exact GPS location. Emergency dispatchers don't have that luxury, and instead rely on cell towers from the major carriers and what is called triangulation. If the triangulation system works, the longer you are on the phone, the closer and closer the cell towers can pinpoint your location as they relay information between towers nearest to where your call was made.

It’s not the current level of sharing, it’s the direction this is going. I’ve highlighted the hackable bits.

https://www.theverge.com/2018/1/8/16850620/vivint-streety-shared-live-security-camera-app-ces-2018

What if you could view your neighbors’ smart security cameras?

More and more companies are trying to sell you cameras to put outside the house. Now one of them is wondering: why not share their footage with neighbors, so more people can monitor what’s going on?

That’s the idea behind Streety, a new app from the security provider Vivint. People with Vivint security systems will be able to share footage from their outdoor cameras with neighbors, who will be able to tune into them live and post messages for others. They can also place requests to view recorded footage in case, say, they’re trying to figure out who dinged their car a couple hours ago.

Vivint is only activating the feature for outdoor cameras — not indoor ones — and the sharing has a range limit: 300 yards, or about one-sixth of a mile. That isn’t very far, which could really restrict the feature’s usefulness. In a denser neighborhood, that might cover a lot of ground; but in a more spacious suburb, it might only cover a few houses in any direction. That wouldn’t help if you’re hoping to tap into a camera down the street to see what your kid is up to.

Gosh! What the coincidence. (As a Director, I would like to know what is going on here.)

https://www.axios.com/intel-ceos-big-stock-sale-raises-questions-1515111053-e77aec11-cb39-48e7-94f9-c37458471ae6.html

Intel CEO's big stock sale raises questions

Intel CEO Brian Krzanich sold more than $39 million worth of company stock after Intel learned of a fundamental design flaw in its products, but before the general public was made aware.

Why it matters: The SEC may take a hard look at Krzanich's windfall, particularly the part where he changed the rules governing his stock sale schedule.

… An Intel spokeswoman says that Krzanich's October 2017 trading plan change and subsequent stock sale were "unrelated" to the chip design flaw, but declined to provide any alternate explanation.

Intel also says that it does not expect material financial impacts from the design flaw, although it remains too early to know for sure.

Colorado is already in compliance. What will we use when all cars are self-driving and no one has a drivers license?

https://www.bloomberg.com/news/articles/2018-01-08/flying-domestic-may-require-you-get-a-new-driver-s-license?utm_source=google&utm_medium=bd&cmpId=google&google_editors_picks=true

Flying Domestic May Get Harder Thanks to Driver’s License Law

Four years after hijackers showed driver’s licenses to board planes used in the 2001 terrorist attacks, Congress passed the “Real ID” Act to force states to exert greater oversight of the primary identification Americans use when they fly domestically.

Now, after 13 years of delays and extensions, the Trump administration has fixed a hard deadline of October for states to comply. Under the law, all airline travelers must display a new, technologically advanced license if they wish to board a plane. But privacy advocates warn that the program, with its requirement of data and photo sharing between states and the federal government, carries with it some Orwellian implications.

The Department of Homeland Security has given the 23 states still operating under extensions until Oct. 10.

Know the players…

https://www.bespacific.com/membership-of-the-115th-congress-a-profile-3/

Membership of the 115th Congress: A Profile

CRS report via FAS – Membership of the 115th Congress: A Profile. Jennifer E. Manning, Senior Research Librarian, January 3, 2018: “This report presents a profile of the membership of the 115th Congress (2017-2018) as of January 3, 2018. Statistical information is included on selected characteristics of Members, including data on party affiliation, average age, occupation, education, length of congressional service, religious affiliation, gender, ethnicity, foreign births, and military service. In the House of Representatives, there are 241 Republicans (including 1 Delegate and the Resident Commissioner of Puerto Rico), 197 Democrats (including 4 Delegates), and 3 vacant seats. The Senate has 51 Republicans, 47 Democrats, and 2 Independents, who both caucus with the Democrats.”

It’s a Vet thing.

https://www.bespacific.com/military-service-records-awards-and-unit-histories-a-guide-to-locating-source/

Military Service Records, Awards, and Unit Histories: A Guide to Locating Source

CRS report via FAS – Military Service Records, Awards, and Unit Histories: A Guide to Locating Sources. Nese F. DeBruyne, Senior Research Librarian; Barbara Salazar Torreon, Senior Research Librarian. January 2, 2018. “This guide provides information on locating military unit histories and individual service records of discharged, retired, and deceased military personnel. It also provides information on locating and replacing military awards and medals. Included is contact information for military history, websites for additional sources of research, and a bibliography of other publications, including related CRS reports.”

I might have a use for this.

https://www.bespacific.com/anywhere-link-offers-free-video-conferencing-for-up-t0-5-participants/

Anywhere.link offers free video conferencing for up t0 5 participants

“Anywhere.link is a one-click video conference solution. After signing up for an Anywhere.link account, users can create a video conference. The system provides a url to join the conference that can be sent to up to six participants. Recipients of this link need only click it to join the video conference – they will not need to create an account, nor will they need to download or install any additional software. Anywhere.link also supports screen sharing for presentations, software demos, remote technical support, and so on. It provides a ‘website widget’ that site owners can use to enable one-click video calls from their home page. Anywhere.link’s free tier allows five team members, each of whom can receive ten ‘website widget’ calls per month and can create an unlimited number of video conferences. Anywhere.link currently supports Google Chrome, Mozilla Firefox, and Opera, with work ongoing to add support for other browsers. Companion mobile phone apps for iOS and Android are currently in beta.”

Do I really want Big Brother talking to me via an ‘always on’ device?

Witness a crime? In the UK, you can report it to Alexa

Alison DeNisco Rayome reports:

Lancashire police officers are researching an integration with the digital assistant that would allow the force to send out crime bulletins to residents, such as missing persons reports, wanted suspects in the area, and the number of officers currently on duty, according to a TechSpot report. The integration could also be used for internal communications, such as to update officers on daily crime logs or breaking incidents.

However, the most interesting potential usage would directly involve residents, allowing victims and witnesses to report crimes directly to the police via their Amazon Echo—another example of how artificial intelligence (AI) tools can potentially free up human workers like police to do more complex work.

Read more on TechRepublic.

So, it’s like fingerprints? But it can be used in ways fingerprints can not. (e.g. You are related to someone who left DNA at a crime scene.)

The Fourth Amendment doesn’t protect you from DNA collection during a misdemeanor booking

Did you know that police can compel you to provide a DNA sample if they are booking you for (just) a misdemeanor?

I didn’t know, and was not happy to read about it on FourthAmendment.com. John Wesley Hall posts part of the opinion in U.S. v. Buller:

This court tends to agree with Justice Scalia that the primary purpose of the DNA collection statute is criminal investigation. As such, this court also agrees that the Fourth Amendment should require a warrant or some level of suspicion before the search of one’s DNA is allowed. However, until the King decision is modified or repudiated, it remains the law of the land and this court is bound to apply it. Because the analysis under King and the rationale for the conclusion in King cannot be meaningfully distinguished in the case of a misdemeanor arrestee, and because there is no federal law decided in the five years since the King decision was issued making such a distinction, the court concludes that the collection of DNA from Mr. Buller is constitutional under the Fourth Amendment.

Add that to the list of things that need to be fixed.

Are they now saying “Free is Bad?”

https://www.wired.com/story/how-to-curb-silicon-valley-power-even-with-weak-antitrust-laws/

How to Curb Silicon Valley Power—Even With Weak Antitrust Laws

Technology companies with unprecedented power to sway consumers and move markets have done the unthinkable: They’ve made trust-busting sound like a good idea again. [Yoicks! Bob]

The concentration of wealth and influence among tech giants has been building for years—90 percent of new online-ad dollars went to either Google or Facebook in 2016; Amazon is by far the largest online retailer, the third-largest streaming media company, and largest cloud-computing provider. Silicon Valley titans coasted to the top of the economy with little government oversight on the backs of incredibly convenient products, a killer backstory, shrewd lobbying, and our personal data. They were allowed to grow unfettered in part because of a nearly-40-year-old interpretation of US antitrust law that views anticompetitive behavior primarily through the prism of the effect on consumers. In that light, the tech industry’s cheap products and free services fell somewhere between benign and benevolent.

Perspective. How would you find that terrorist-related needle in this haystack?

https://venturebeat.com/2018/01/03/whatsapp-sets-new-messaging-record-75-billion-on-new-years-eve/

WhatsApp sets new messaging record: 75 billion on New Year’s Eve

WhatsApp, one of the world’s most-used messaging services, hit a new milestone on New Year’s Eve: more than 75 billion messages sent by its users. The new record represents the most messages sent in a single day in the chat app’s history, a spokesperson told VentureBeat in an email. The previous record was set in 2016, also on New Year’s Eve: 63 billion messages sent.

The 75 billion number included 13 billion images and 5 billion videos, the Facebook-owned WhatsApp revealed.

What have they found? Do they ever disclose that information?

http://www.zdnet.com/article/warrantless-phone-laptop-searches-at-the-us-border-hit-record-levels/

Warrantless phone, laptop searches at the US border hit record levels

New figures released Friday reveal that Customs and Border Protection (CBP) officers searched 30,200 devices – an increase of about 60 percent year-over-year – between October 2016 and September 2017.

That averages out to about 2,500 searches each month out of more than 397 million who crossed the border -- or less than 0.01 percent of all international travelers, according to the agency charged with enforcing immigration and customs rules at the nation's ports of entry.

… The agency said newly-issued guidelines, replacing a 2009 directive that allow border searches of devices belonging to both Americans and foreign nationals without a warrant, will now require "reasonable suspicion" for border authorities to conduct a deeper, so-called "advanced search" of a travelers' phone or laptop.

But basic searches carried out at random – which don't require any reasonable suspicion – are still permitted, the guidelines say.

Perspective. Something my Data Management students will have to consider.

https://techcrunch.com/2018/01/04/on-demand-streaming-now-accounts-for-the-majority-of-audio-consumption-says-nielsen/

On-demand streaming now accounts for the majority of audio consumption, says Nielsen

U.S. album sales declined in 2017 as streaming continues to grow, according to Nielsen’s year-end music report released this week. The report found that album sales, including both digital and physical, fell 17.7 percent last year to 169.15 million copies, down from 205.5 million in 2016. Meanwhile, streaming once again soared, leading the overall music industry to growth, largely due to the significant 58.7 percent increase in on-demand audio streams over last year.

In total, on-demand audio streams surpassed 400 billion streams in 2017, compared to 252 billion in 2016, and overall on-demand streams, including video, exceeded 618 billion. This led to the music industry’s growth of 12.5 percent in total volume, over 2016.

If I call it (register it) as a drone, can I skip all that tedious training to get a pilots license?

https://www.entrepreneur.com/article/307065?utm_source=google-news&utm_medium=syndication&utm_campaign=google-editors-pick&google_editors_picks=true

Humans Can Fly in This Drone-Like Electric Hybrid 'Octocopter'

The company that partnered with UPS to create a package-delivering drone is ready to fly its new passenger aerial vehicle.

The SureFly, a two-seater electric hybrid helicopter (or “octocopter,” because of its eight propellers), has received approval from the FAA to take a test flight at CES in Las Vegas on Jan. 8.

Clearly we can’t recognize a human mind that is ready to commit violence...

https://venturebeat.com/2018/01/05/ai-weekly-if-we-create-artificial-intelligence-will-we-know-it/?google_editors_picks=true

AI Weekly: If we create artificial intelligence, will we know it?

When people talk about creating an artificial intelligence, the conversation is often focused on human or superhuman AI — systems that would equal or surpass us in intelligence. But what if we create an artificial intelligence that’s deserving of respect, but don’t recognize it as such?

That’s a question I’ve had bouncing around in my head for the past several months. Over the course of human history, we’ve proven very poor as a species at successfully evaluating the intelligence of other beings, whether they’re human or non-human. Consider crows, who learn from their dead, recognize individuals, use tools, and even bring gifts to those they like — are they … intelligent?

… Take octopuses, for instance, which have proven to be highly intelligent and talented escape artists. Should they — or AIs that match them in intelligence — be treated differently because of the way their brains work?

(Related)

http://dilbert.com/strip/2018-01-06

Surprise! Surprise! Surprise!

https://venturebeat.com/2018/01/05/twitter-admits-world-leaders-like-trump-have-special-status/?google_editors_picks=true

Twitter admits world leaders like Trump have special status

Twitter Inc on Friday reiterated its stance that accounts belonging to world leaders have special status on the social media network, pushing back against users who have called on the company to banish U.S. President Donald Trump.

“Blocking a world leader from Twitter or removing their controversial Tweets would hide important information people should be able to see and debate,” Twitter said in a post on a corporate blog.

Twitter had already said in September that “newsworthiness” and whether a tweet is “of public interest” are among the factors it considers before removing an account or a tweet.

For my Java geeks.

How to Make a Web Crawler With Selenium

Ciao, comrade?

A variation on the Nigerian Prince?
Florida colleges receive extortion demands to avert attacks on campuses (UPDATED)
Stephanie Brown reports:

An extortion email apparently sent to several colleges and universities demands payment in Bitcoin, threatening to commit an attack against campus students and faculty.

We first told you Wednesday that the University of North Florida confirmed they had received an emailed extortion threat. The UNF Crime Alert said law enforcement believed the threat was “likely non-credible”, but that state and federal partners continued to investigate, in an effort to find out who was responsible.

UNF is not disclosing the contents of the email they received, but our partner Action News Jax obtained the email that was sent to Hillsborough Community College. Action News Jax also checked with the University of Florida, where a spokesperson says she believes this threat was the same as UNF received.

Read more on WOKV.
Okay, I probably know what you’re wondering. I’m curious, too, but no one’s posted a copy of the threat email, so there’s not enough information to go on. The reporting doesn’t even clearly indicate whether either of the colleges were actually hacked and data exfiltrated or what.
If anyone has more details on these threats, please let me know.
Updated: A report from TBO provides additional details that sound familiar to me. Noting that it is not yet clear how many institutions received the 1,250-word message from the threat actors, or whether it was limited to Florida, they report that:

The suspicious email is written so that it doesn’t make any reference to a specific campus or institution. It demands a payment of 1.2 bitcoin, or about $18,035 in the volatile, untraceable digital currency.

Should the recipient refuse, the sender threatens to wage a campaign of confusion, making repeated false threats of bombings and mass shootings.

“One of these threats will be legitimate. Which one will be a surprise,” the email reads. “You will be forced to evacuate the campus.”

The sender adds a dramatic twist: “Every night I will roll a single die. If a six comes up, I will instruct my compatriots to follow through on the attack and kill as many people as possible … It will be public knowledge that you failed to take this threat seriously.”

Old technology is not “proven” technology.
https://hotforsecurity.bitdefender.com/blog/russian-atm-hacked-with-5-keystrokes-video-19381.html
Russian ATM hacked with 5 keystrokes – Video
In early December, an employee of Russian website Habrahabr went to get some cash from a Sberbank ATM that incidentally had a full-size keyboard. Out of boredom, as the man recalls, he started hitting the Shift key repeatedly when, all of the sudden, the Sticky Keys feature switched on, giving him full access to the machine’s underlying Windows XP operating system.
… By pressing the Shift key five times in a row, Windows serializes keystrokes, allowing the user to press and release modifier keys. This eliminates the need to hold one key with a finger while reaching for other keys.
While it’s certainly helpful to users who have physical disabilities or to those with Emacs Pinky syndrome, Sticky Keys leaves Windows-based ATMs vulnerable to attacks – especially when customers are offered a full-size keyboard. The hack was captured on video and posted to YouTube (embedded below) for everyone’s viewing pleasure.






“What you are” is a password.
https://hotforsecurity.bitdefender.com/blog/behavioral-biometrics-will-replace-passwords-by-2022-gartner-19401.html
Behavioral biometrics will replace passwords by 2022 – Gartner
… Gartner analysts believe on-device AI, as opposed to cloud-based AI, will mark a paradigm shift in digital security, and will do so sooner than most people think.
… The research company outlines 10 AI solutions expected to run on 80% of smartphones in 2022 that will become an essential part of vendor roadmaps and our everyday lives. At least four of them impact security.

… “Smartphones will be an extension of the user, capable of recognizing them and predicting their next move,” reads the report. “They will understand who you are, what you want, when you want it, how you want it done and execute tasks upon your authority.”

… New-generation smartphones will collect behavioral data to more accurately profile the user, paving the way for dynamic protection and assistance in emergency situations. It will also benefit insurers. Gartner speculates that car insurers will be able to adjust insurance rates based on driving behavior.

… A device with on-board AI could automatically detect inappropriate content – such as objectionable images, videos or text – and flag it, or block it altogether.

… Probably the boldest, but also the most-likely-to-materialize prediction from the report is the idea that on-device AI will render password-based authentication obsolete

A resource for policy writers?
https://www.bespacific.com/dhs-handbook-for-safeguarding-sensitive-pii/
Handbook for Safeguarding Sensitive PII Privacy Policy Directive 047-01-007, Revision 3. Published by the DHS Privacy Office. December 4, 2017.
This Handbook provides best practices and DHS policy requirements to prevent a privacy incident involving PII/SPII during all stages of the information lifecycle: when collecting, storing, using, disseminating, or disposing of PII/SPII. This handbook explains: how to identify PII and SPII, how to protect PII and SPII in different contexts and formats, and what to do if you believe PII and/or SPII has been lost or compromised…”






How should your policy define harassment?
https://www.bespacific.com/january-4-2018-crossing-the-line-what-counts-as-online-harassment/
Crossing the Line: What Counts as Online Harassment?
Americans agree that certain behaviors constitute online harassment, but they are more divided on others – “Pew Research Center surveys have found that online harassment is a common phenomenon in the digital lives of many Americans, and that a majority of Americans feel harassment online is a major problem. Even so, there is considerable debate over what online harassment actually means in practice. In an effort to examine more deeply where people “draw the line” when it comes to online harassment, the Center conducted a survey in which respondents were presented with fictional scenarios depicting different types of escalating online interactions. The survey then asked them to indicate which specific elements of the story they considered to be harassment. Their answers indicate that Americans broadly agree that certain behaviors are beyond the pale. For instance, in various contexts most agree that online harassment occurs when people make direct personal threats against others. At the same time, the public is much more divided over whether or not other behaviors – such as sending unkind messages or publicly sharing a private conversation – constitute online harassment….”






Or not...
https://www.recode.net/2018/1/4/16851892/fcc-final-order-text-net-neutrality-repeal-free-internet
Read all 539 pages of the FCC’s final order repealing net neutrality
Roughly a month after the Federal Communications Commission voted to scrap the U.S. government’s net neutrality rules, the agency has released the full, final text of its repeal.
… It also gives us a lot more to read: as in 539 pages (which you can read in full below). Pai and his fellow Republican commissioners — Michael O’Rielly and Brendan Carr — also released fuller statements explaining their votes, as did their Democratic counterparts — Jessica Rosenworcel and Mignon Clyburn — who opposed the repeal.






I like this approach. No monopoly. City can upgrade to “all fiber.” Many other potential benefits.
https://venturebeat.com/2018/01/04/fort-collins-colorado-moves-ahead-with-civic-broadband-after-net-neutrality-repeal/?google_editors_picks=true
Fort Collins, Colorado moves ahead with civic broadband after net neutrality repeal
This week, the Fort Collins City Council voted to move ahead with a ballot measure approved by 57 percent of voters in November, which allowed, but did not require, the city council to establish a telecommunications utility to provide broadband services.
Specifically, the city voted this week to approve some of the first steps needed to install civic broadband. They voted to provide a $1.8 million loan to “support first year startup costs associated with recruiting and hiring personnel, consulting, equipment, and branding to support the initiative” and to make certain changes to the city code that will allow the city to become a telecommunications provider.
… The city of Fort Collins laid out a broadband business plan on its website, which “does not call for any restrictions on access, including uploads, downloads, delivery methods, or providers (email, Skype, Netflix, etc.).” The plan also notes that the city will develop additional policies concerning net neutrality and security.
… One of the best-known municipal broadband networks in the U.S. is the one installed by the city of Chattanooga in 2010. At the time, the city garnered national attention as the only city-wide network with speeds of up to 1 gigabyte per second.






Maybe Social Media IS mind control!
http://dilbert.com/strip/2018-01-05

It’s never “if,” it’s always “when.”

https://www.reuters.com/article/us-cyber-intel/security-flaws-put-virtually-all-phones-computers-at-risk-idUSKBN1ES1BO?feedType=RSS&feedName=newsOne&google_editors_picks=true

Security flaws put virtually all phones, computers at risk

Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.

… Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.

… The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.

[More details: https://meltdownattack.com/

Governments don’t do IT well. (I may have said that a few times.)

https://www.buzzfeed.com/pranavdixit/indias-national-id-database-with-private-information-of?utm_term=.jnrkZpAor#.pnjEG0jJ6

India's National ID Database With Private Information Of Nearly 1.2 Billion People Was Reportedly Breached

… The Tribune, a local Indian newspaper, published a report claiming its reporters paid Rs. 500 (approximately $8) to a person who said his name was Anil Kumar, and who they contacted through WhatsApp. Kumar was able to create a username and password that gave them access to the demographic information of nearly 1.2 billion Indians who have currently enrolled in Aadhaar, simply by entering a person’s unique 12-digit Aadhaar number. Regional officers working with the Unique Identification Authority of India (UIDAI), the government agency responsible for Aadhaar, told the Tribune the access was “illegal,” and a “major national security breach.”

A second report, published on Thursday by the Quint, an Indian news website, revealed that anyone can create an administrator account that lets them access the Aadhaar database as long as they’re invited by an existing administrator. [Think: Hackers inviting hackers. Bob]

(See the comment above.)

More details emerge on Department of Homeland Security breach affecting more than 247,000 employees and non-employees

If you were part of a Department of Homeland Security Office of the Inspector General investigation at some time between 2002 through 2014, DHS wants you to know that you may be a breach victim. Unfortunately, due to “technological” issues, it seems that DHS can’t directly contact you to alert you, so read on…..

A few more details have emerged in the matter of a breach involving the Department of Homeland Security. The breach, which involved the May discovery of an unauthorized copy of DHS’s investigative case management system in the possession of a former DHS OIG employee, was first reported in November by USA Today.

Joseph Marks reports that the Inspector General has now confirmed that the breach affected more approximately 247,167 DHS employees, but DHS has now also revealed that the breach impacted non-employees who contacted or interacted with the department: “individuals (i.e., subjects, witnesses, and complainants) associated with DHS OIG investigations from 2002 through 2014 (the “Investigative Data”).”

DHS’s statement can be found on their site. Of note, DHS writes:

The privacy incident did not stem from a cyber-attack by external actors, and the evidence indicates that affected individual’s personal information was not the primary target of the unauthorized exfiltration.

Affected individuals are being offered 18 months of free credit monitoring and identity protection services.

But of course, there are lots of raised eyebrows that the agency responsible for protecting our homeland from terrorist attacks and the like had an insider breach that went unprevented and undetected until May of this year. In response to the incident, DHS notes:

The Department of Homeland Security takes very seriously the obligation to serve the Department’s employees and is committed to protecting the information in which they are entrusted. Please be assured that we will make every effort to ensure this does not happen again. DHS is implementing additional security precautions to limit which individuals have access to this information and will better identify unusual access patterns. We will continue to review our systems and practices in order to better secure data. DHS OIG has also implemented a number of security precautions to further secure the DHS OIG network.

Will their changes also enable them to identify and notify any non-employees who might get caught up in any future breaches? Shouldn’t the agency have some way of doing that unless someone was a confidential witness who did not provide their real details in dealing with the agency – or something like that?

The Security implications are clear, but there are also significant Data Management challenges. Hint: Every Presidential Tweet is an “Official Record.”

http://www.washingtonexaminer.com/white-house-bans-personal-cellphones-from-the-west-wing/article/2644937

White House bans personal cellphones from the West Wing

The White House on Thursday banned the use of personal cellphones and other personal devices from the West Wing, citing security concerns.

...Officials said the decision was made because too many devices were connected to the White House network, and because personal devices are not as secure.

The White House said staffers will still be able to use their government-issued devices.

But some staffers are worried that it will be harder for them to reach family and friends when they need to at work.

An article for my Data Management class. What to do with the data you have.

How One Company Made Its Analytics Investment Pay Off

In the age of rapid advances in data science and artificial intelligence, many organizations still struggle to incorporate advanced analytics capabilities into their business models. True incorporation requires bold decisions about reorganizing the business to make analytics a key component of strategy. Here we present the case of Grupo Financiero Banorte (GFNorte), a large Mexican financial group, where the analytics transformation has been a success story.

… GFNorte recently established a Central Analytics Business Unit (ABU) with the mandate to convert information into profits at a rate of 10X cost and to lead the adoption of a customer-centric approach within the organization. The results significantly exceeded expectations: In its first year the ABU yielded profits 46X its costs, in the second year 106X (equivalent to $275 million of net income), and during its third year it is on course to produce 200X. These results, along with other transformational initiatives, have contributed to GFNorte leapfrogging its competitors within three years to attain second place in profit generation (up from fourth) in the Mexican financial system.

I can’t keep up now.

Twitter Is Dying! 7 Alternative Social Networks to Join Now

Something for my geeks?

https://techcrunch.com/2018/01/03/apple-developer-program-fee-waivers-are-now-available-for-nonprofits-schools-and-government/

Apple Developer Program fee waivers are now available for nonprofits, schools and government

It’s a work in progress.

https://www.propublica.org/article/facebook-enforcement-hate-speech-rules-mistakes

Facebook’s Uneven Enforcement of Hate Speech Rules Allows Vile Posts to Stay Up

… We asked Facebook to explain its decisions on a sample of 49 items, sent in by people who maintained that content reviewers had erred, mostly by leaving hate speech up, or in a few instances by deleting legitimate expression. In 22 cases, Facebook said its reviewers had made a mistake. In 19, it defended the rulings. In six cases, Facebook said the content did violate its rules but its reviewers had not actually judged it one way or the other because users had not flagged it correctly, or the author had deleted it. In the other two cases, it said it didn’t have enough information to respond.

Something for my Computer Security Managers in training…

http://www.dailymail.co.uk/sciencetech/article-5230085/Are-cyberloafer-Warning-slacking-online.html

Are you a 'cyberloafer'? Experts warn employees are spending over two hours a day slacking off online - and say it's causing major security risks

… My research group's new study shows this practice of using work computers for personal internet browsing can become a serious security threat to a company when it goes too far.

Most companies accept that their employees will occasionally check social media or send personal emails from work computers. But in some cases things can get more serious, with people people spending significant amounts of time updating their own websites, watching videos or even pornography.

Governments don’t do IT very well.

https://www.washingtonpost.com/business/get-a-pencil-californias-marijuana-tracking-system-delayed/2018/01/02/3cc663cc-f01b-11e7-95e3-eff284e71c8d_story.html?utm_term=.4786988e5d5d

Get a pencil: California marijuana-tracking system not used

California’s legal pot economy was supposed to operate under the umbrella of a vast computerized system to track marijuana from seed to storefronts, ensuring that plants are followed throughout the supply chain and don’t drift into the black market.

But recreational cannabis sales began this week without the computer system in use for pot businesses. Instead, they are being asked to document sales and transfers of pot manually, using paper invoices or shipping manifests. That raises the potential that an unknown amount of weed will continue slipping into the illicit market, as it has for years.

… The state Department of Food and Agriculture, which is overseeing the tracking system, said in a statement it was “implemented” Tuesday. However, it conceded that growers and sellers are not required to use it yet and training on how to input data will be necessary before it becomes mandatory, apparently later in the year.

Would this me a better fit than Sears?

http://fortune.com/2018/01/02/amazon-will-buy-target-gene-munster/

Amazon Will Buy Target in 2018, Tech Analyst Predicts

… “Target is the ideal offline partner for Amazon for two reasons, shared demographic and manageable but comprehensive store count,” Munster wrote, noting both companies focus on mothers and families.

The new business model for music?

https://www.billboard.com/articles/business/8085856/taylor-swift-reputation-tour-sales-could-be-biggest-all-time

Shake It Off: Despite Negative Press, Taylor Swift's Reputation Tour Could Be One of the Biggest of All Time

Taylor Swift is on track to chart one of the highest-grossing tours of all time, with projections that she could sell $450 million worth of tickets on her Reputation stadium tour which kicks off this summer.

Swift is using a strategy deployed by Jay-Z and bands like The Rolling Stones – price tickets high and have seats available on the primary market up until the day of show. That means few, if any, early sellouts but huge revenues, as tickets, especially premium seats, are marked up much higher than previous tours. While several recent stories have warned of poor ticket sales – including a New York Post article this morning – those close to Swift say the “Look What You Made Me Do” singer sold $180 million worth of tickets in the first seven days of sales

Maybe I could have my students create an ebook rather than a simple post?

http://www.freetech4teachers.com/2018/01/5-ed-tech-tools-to-try-in-2018.html#.WkzpQJdG3YA

5 Ed Tech Tools to Try in 2018

Earlier today I went on live on my YouTube channel to share five ed tech tools that I recommend trying in 2018 if you didn't try them in 2017. Watch the video for my explanations of my recommendations then jump to the list to find tutorial videos for my recommended tools.

[I liked this one:

Book Creator

https://www.youtube.com/watch?time_continue=433&v=wlfooQcV75Y

I don’t think I’ve ever seen these words in an initial breach announcement.

http://www.ibtimes.com/passport-system-down-thousands-delayed-airports-around-country-2635647

Passport System Down, Thousands Delayed At Airports Around The Country

Thousands of passengers reported being stranded at airports across the United States, in a delay that was caused because the passport system across the country was down Monday.

… According to the stranded passengers, the delay was because the computer system to check passports, operated by the U.S. Customs and Border Protection, had failed. CBP later put out a statement on its Twitter page, saying all the airports were back online after a brief outage of its processing systems.

"During the disruption, CBP had access to national security-related databases and all travelers were screened according to security standards," it added and also said that disruption did not appear to be of a malicious nature.

… Strangely, a quite similar incident took place on Jan.2, 2017, almost one year to the date, where extensive delays were caused due to computer outage affecting customs procedures.

At the time, the U.S. Customs and Border Protection agents were forced to process travelers through a slower backup system when the computers went down, NY Daily News said.

A big data example.

https://www.nytimes.com/2017/12/31/technology/google-images-voters.html

How Do You Vote? 50 Million Google Images Give a Clue

What vehicle is most strongly associated with Republican voting districts? Extended-cab pickup trucks. For Democratic districts? Sedans.

Those conclusions may not be particularly surprising. After all, market researchers and political analysts have studied such things for decades.

But what is surprising is how researchers working on an ambitious project based at Stanford University reached those conclusions: by analyzing 50 million images and location data from Google Street View, the street-scene feature of the online giant’s mapping service.

Social Media is not simple.

The Basic Social Media Mistakes Companies Still Make

Over 90% of medium and large businesses have used social media in their marketing for five years or longer. Yet the CMO Survey reveals that nearly half of marketers are unable to show the impact of their social media investments. That’s why, no matter what your social media strategy is, it’s always a good idea to go back and make sure you have the basics covered. Your company may discover that it needs a strategic do-over.

It’s no longer sorting punch cards, mounting magnetic tapes, and separating six part (carbon) printed reports.

https://economictimes.indiatimes.com/jobs/its-going-to-be-a-happy-new-year-for-artificial-intelligence-robotics-experts/articleshow/62320776.cms

It’s going to be a Happy New Year for Artificial intelligence and robotics experts in 2018

Artificial intelligence (AI) is the buzz in the jobs bazaar as machine learning and the Internet of Things (IoT) increasingly influence business strategies and analytics. Human resource and search experts estimate a 50-60% higher demand for AI and robotics professionals in 2018 even as machines take over repetitive manual work.

"Machines are taking over repetitive tasks. Robotics, AI, big data and analytics will be competencies that will be in great demand," said Shakun Khanna, senior director at Oracle for the Asia-Pacific region.

Because…

The Best Free Microsoft Office Calendar Templates for the New Year

My students have the same kind of car!

http://dilbert.com/strip/2018-01-02

Examples of poor security even my students will recognize!

https://www.schneier.com/blog/archives/2018/01/security_vulner_12.html

Security Vulnerabilities in Star Wars

A fun video describing some of the many Federation security vulnerabilities in the first Star Wars movie.

My Data Management students are using an eTextbook this quarter. Perhaps they will use this App to do research? (Probably not.)

https://smallbiztrends.com/2017/12/libby-app.html?google_editors_picks=true

Libby App Connects eReaders to Business Titles from Most Major Metro Public Libraries

… The Libby app connects local libraries and the thousands of eBooks and audiobooks on their digital bookshelves 24/7.

The Libby app is developed by OverDrive.

… After you download the Libby app on your Android or iOS smartphone or tablet, (or on your Windows PC) all it takes is your library card to start borrowing books. If you happen to have an Amazon Kindle, the books you borrow on Libby can be sent to the device.

Once you have the app, it will help you find your local library and even get you a card using your mobile phone number. You can sign into multiple libraries using one or more cards.

When it comes to reading or listening to the books, you can stream or download them. And best of all, the company says it will always be free.

Why you need to think carefully before you pass a law?

https://arstechnica.com/tech-policy/2017/12/14-year-old-girl-faces-child-porn-charges-for-sending-nude-selfie/

Child porn law goes nuts: 14-year-old girl charged for nude selfie

A 14-year-old girl is facing charges in Minnesota juvenile courts that could lead to her being placed on a sex offender registry—all for taking a nude selfie and sending it to a boy at her school. Prosecutors say that she violated Minnesota's child pornography statute, which bans distributing sexually explicit pictures of underaged subjects.

But a legal brief filed this week by the ACLU of Minnesota says that this is ridiculous. Charging a teenager for taking a nude selfie means the state is charging the supposed victim—an absurd result that the legislature can't have intended when it passed Minnesota's child pornography statute, the ACLU argues.

… The ACLU also argues that charging a teen for taking nude selfies violates the First Amendment. In a 2002 case, the Supreme Court ruled that the First Amendment protected the creation of virtual child pornography—in which no actual children were used in the creation of works that appeared to involve sex with children. The court held that laws against child pornography were justified because protecting children against exploitation was a compelling state interest. But that argument doesn't apply to a ban on virtual child pornography.

The ACLU argued that a similar point applies here. It doesn't make sense to say that a 14-year-old girl is coercing herself into creating child pornography. Hence, in the ACLU's view, the state lacks a compelling interest to limit the expressive rights of 14-year-olds to create nude selfies and voluntarily share them with peers.

Looks like I’m a big hit in Italy! No idea why…