It sounds trivial, but ask yourself what other laws, rules, regulations or procedures they don't bother following.

SEC failed to guard sensitive information

Kevin Cirilli reports:

An internal government report obtained by The Hill says the Securities and Exchange Commission has failed to properly guard sensitive nonpublic information. [READ INSPECTOR GENERAL REPORT.]

The report from the SEC’s Inspector General says the agency failed to clear the room during non-public executive session votes of the five-member board.

It also found that officials didn’t keep complete attendance records during at least one high-profile meeting involving a J.P. Morgan settlement worth $200 million.

The 16-page Office of the Inspector General (OIG) report didn’t blame an individual for leaking information, but it raised questions about how the agency conducts routine business.

Read more on The Hill.

(Related)

http://www.securityweek.com/preparing-your-first-board-meeting-security-now-1-topic

Preparing For Your First Board Meeting? Security Now #1 Topic

Corporate Board Member and FTI Consulting recently conducted a study involving more than 500 directors and general counsel. Among the many interesting findings was a significant rise in concerns related to IT and cyber risk.

When asked, “What keeps you up at night?” directors placed data security at the top of their list. Corporate reputation and crisis preparedness were tied for fifth. General counsel had data security at number two behind regulatory compliance, followed by corporate reputation and crisis preparedness as number three and four respectively.

The pendulum of the law swings again.

Reversal in e-mail warrant case

Orin Kerr writes:

Back in March, I had a long post titled “A remarkable new opinion on search warrants for online accounts — and why I think it’s wrong.” My post addressed an opinion by Magistrate Judge John Facciola that had rejected the common practice of executing e-mail warrants in two steps. Under the two-step process, the provider gives the government the entire contents of the account. Next, investigators search through the account for the specific evidence sought by the warrant. Facciola ruled that this procedure was “repugnant to the Fourth Amendment.” According to Facciola, the better approach — and perhaps the constitutionally mandated approach — is to have the service provider execute the warrant for the government and then send on the responsive files to investigators.

On Friday, Chief Judge Roberts reversed Magistrate Judge Facciola.

Read more on WaPo The Volokh Conspiracy.

How it should be done?

http://www.bespacific.com/failing-expectations-fourth-amendment-doctrine-era-total-surveillance/?utm_source=rss&utm_medium=rss&utm_campaign=failing-expectations-fourth-amendment-doctrine-era-total-surveillance

Failing Expectations: Fourth Amendment Doctrine in the Era of Total Surveillance

by Sabrina I. Pacifici on Aug 10, 2014

Sylvain, Olivier, Failing Expectations: Fourth Amendment Doctrine in the Era of Total Surveillance (July 28, 2014). 49 Wake Forest Law Review 485. Available for download at SSRN: http://ssrn.com/abstract=2473101

“Today’s reasonable expectation test and the third-party doctrine have little to nothing to offer by way of privacy protection if users today are at least conflicted about whether transactional noncontent data should be shared with third parties, including law enforcement officials. This uncertainty about how to define public expectation as a descriptive matter has compelled courts to defer to legislatures to find out what public expectation ought to be more as a matter of prudence than doctrine. Courts and others presume that legislatures are far better than courts at defining public expectations about emergent technologies. This Essay argues that the reasonable expectation standard is particularly flawed if it has the effect of encouraging judges to seek guidance from legislatures on constitutional norms and principles. Judicial review is the vital antimajoritarian check against excessive government intrusions on individual liberty under our constitutional scheme. This is a responsibility that courts cannot pass off to the political branches when, as is the case today, most people expect that the cost of network connection is total surveillance. It is beyond irony that, today, courts consult public expectation to determine private entitlements. This Essays argues that court-administered privacy law doctrine must change if the protection against “unreasonable searches and seizures” is to have any positive legal meaning. The current court-created doctrine will not be able to keep up if it compels judges to measure public expectation. It is time for courts to reassert their positive duty to say what privacy law is.”

The Streisand Effect defined? When attempts to limit the spread of information become widespread news.

Aaron’s Seeks to Limit Access to Litigation Details on Customers

R. Robin McDonald reports:

Former customers who are suing Aaron’s Inc. and its franchises claim that when the rental company installed remotely activated secret spyware on its rental computers, company employees had few, if any, concerns about the privacy of the customers whose screen shots, webcam photos and computer keystroke logs they intercepted and recorded. But—in the name of customer privacy—the lawyers defending the suits are seeking to limit public access to the litigation by asking for broad restrictions on the use of discovery in the cases.

In pleadings potential class action suits against Aaron’s and its franchises in federal court in Pennsylvania and in Atlanta, lawyers defending the rental company or its franchises have attempted to dramatically expand protective orders that plaintiffs’ lawyer Andrea Hirsch of Herman Gerel in Atlanta said originally were intended to shield from public scrutiny personal information such as passwords and bank account, credit card and Social Security numbers.

Read more on Daily Report.

Perhaps we could ask Phil back for a Privacy Foundation seminar.

Crypto Daddy Phil Zimmerman says surveillance society is DOOMED

Iain Thomson reports:

A killer combination of rapidly advancing technology and a desire for greater privacy among the public should condemn current surveillance state to an historical anachronism, according to PGP creator Phil Zimmermann.

In an extended talk at Defcon 22 in Las Vegas, Zimmermann said it might seem as though the intelligence agencies have the whip hand at the moment but mankind had faced this situation before. He also said the abolition of slavery and absolute monarchy, and the achievement for civil rights, also once looked unlikely but were achieved.

Read more on The Register.

Amusing. This explains why liberal supporters of politicians who do really dumb things don't seem to care as much as conservative supporters.

http://www.bespacific.com/differences-negativity-bias-underlie-variations-political-ideology-research/?utm_source=rss&utm_medium=rss&utm_campaign=differences-negativity-bias-underlie-variations-political-ideology-research

Differences in negativity bias underlie variations in political ideology – Research

by Sabrina I. Pacifici on Aug 9, 2014

University of Nebraska-Lincoln. (2014, July 31). Political attitudes derive from body and mind: ‘Negativity bias’ explains difference between liberals and conservatives. [fulltext. PDF]

“Disputes between those holding differing political views are ubiquitous and deep-seated, and they often follow common,recognizable lines. The supporters of tradition and stability, sometimes referred to as conservatives, do battle with the supporters of innovation and reform, sometimes referred to as liberals. Understanding the correlates of those distinct political orientations is probably a prerequisite for managing political disputes, which are a source of social conflict that can lead to frustration and even bloodshed. A rapidly growing body of empirical evidence documents a multitude of ways in which liberals and conservatives differ from each other in purviews of life with little direct connection to politics, from tastes in art to desire for closure and from disgust sensitivity to the tendency to pursue new information, but the central theme of the differences is a matter of debate. In this article, we argue that one organizing element of the many differences between liberals and conservatives is the nature of their physiological and psychological responses to features of the environment that are negative. Compared with liberals, conservatives tend to register greater physiological responses to such stimuli and also to devote more psychological resources to them. Operating from this point of departure, we suggest approaches for refining understanding of the broad relationship between political views and response to the negative. We conclude with a discussion of normative implications, stressing that identifying differences across ideological groups is not tantamount to declaring one ideology superior to another.”

Perspective Lawyers and the NFL, what do they have in common?

http://www.datamation.com/mobile-wireless/how-the-surface-tablet-won-the-nfl.html?google_editors_picks=true

How the Surface Tablet Won the NFL

Earlier this week the NFL announced they were moving to the Surface Pro 3 tablet for some of their most critical field activities related to managing plays and on-field activities

… In talking to a number of people around the NFL deal and in a number of legal offices, where the decision process is similar, I’ve come away with two big reasons why the Surface Pro 3 tablet is kicking the iPad and other tablets off the island. The first is security.

The vast majority of tablets simply won’t run the security packages that have been mandates by a number of industries and governmental agencies. These tablets will have what is basically the most valuable information the various NFL teams have, the information on plays and players. Other teams and those that bet on games would find that information invaluable if they were to get their hands on it.

The other thing that works with these tablets is they run legacy software that the teams have come to depend on. The legal offices I’ve spoken with say similar things. They need something secure, a machine that will run their data management packages – which generally run on Windows and nothing else. And given it is massively difficult to both move a database like this to a new platform and retrain attorneys (often the harder of the two tasks) they find migration to be excessively time consumer, painful, and annoying.

For my Homeland Security students. Don't take this too seriously, you won't be doing everything.

http://www.bespacific.com/infographic-day-life-dhs/?utm_source=rss&utm_medium=rss&utm_campaign=infographic-day-life-dhs

Infographic: A Day in the Life of DHS

by Sabrina I. Pacifici on Aug 9, 2014

Nextgov: “Twelve years ago in the aftermath of the Sept. 11, 2001, terrorist attacks, the Department of Homeland Security was established and consolidated 22 agencies into one organization. Its goal: prevent and respond to attacks and disasters — manmade or otherwise — and safeguard citizens. All 22 components have unique missions and plenty gets done in one day. Exactly how much is illustrated in DHS’ daily to-do list.”

For all my students.

http://www.makeuseof.com/tag/33-productivity-tips-140-characters-less/

33 Productivity Tips In 140 Characters or Less

For my Computer Security students in the Network Security Club.

http://www.itbusinessedge.com/slideshows/network-visibility-can-help-avoid-the-it-blame-game.html?google_editors_picks=true

Network Visibility Can Help Avoid the IT Blame Game

The proliferation of data on enterprise networks continues to increase with the rising demand for such technologies as virtualization, software-defined networking, and high-performance computing, as well as a growing dependency on mobility across the workforce. Couple this with a sophisticated cyber attack landscape, and it’s all IT can do to keep up with network activity.

… Click through for results from a survey on network visibility and monitoring tools in IT operations, conducted by Emulex.

A common problem. Do they somehow get paid based on the number of participants?

Protecting privacy while gathering health data

Stephanie M. Lee reports that the recent announcement by rival insurers Blue Shield of California and Anthem Blue Cross that they would team up to create an health information sharing network with their combined 9 million patients is raising privacy concerns. All members will be participants by default in Cal Index unless they opt out.

Lee Tien of EFF gets to the crux of the matter:

As Tien put it, “The industry has never liked opt-in. Privacy advocates believe in opt-in.”

By default, the 9 million patients in Blue Shield and Anthem Blue Cross will become part of the network. Before the system goes live, members will be told of a website where they can choose to not have their information shared, said Dr. Ken Park, vice president of payer and provider solutions at Anthem Blue Cross. Those patients will still receive coverage and treatment.

Cal Index chose this approach to try to balance privacy protection and participation rates, given that rates can sometimes be lower when people are asked to opt in, Park said.

Read more on SFGate.

Perhaps they are learning.

http://www.csmonitor.com/Innovation/2014/0808/FCC-to-wireless-providers-When-do-you-slow-download-speeds

FCC to wireless providers: When do you slow download speeds?

… Verizon, the biggest U.S. carrier, said last month that the top 5 percent of high-speed data users on its older unlimited data plans might experience slower speeds starting in October.

In a letter to Verizon, Federal Communications Commission Chairman Tom Wheeler said he was "deeply troubled" by the plan and expressed concern the decision to slow data was based on consumers' plans instead of network needs.

(Related)

http://www.realtytoday.com/articles/6231/20140809/states-fastest-internet-speed-winner-is%E2%80%A6.htm

US States with Fastest Internet Speed; And the Winner is…

There's an App for that too. Unfortunately.

http://www.business-standard.com/article/news-ians/app-alerts-people-to-avoid-unsafe-areas-114080900085_1.html

App alerts people to avoid unsafe areas

A new app is here that alerts users to avoid "sketchy" areas and provides safe walking directions in the neighbourhood.

The app has also invited some sharp reactions from people who think it will fuel racism.

Launching it on the iTunes app store for New York City users, the app will provide walking directions on a map based on user feedback and allow people to "share pro tips about what routes you take and why".

SketchFactor is a tool for anyone, anywhere, at any time.

… According to McGuire, she was inspired to create the app after living in Washington, DC, as a young non-profit worker.

Perhaps my student vets would find this amusing. (The Marines read “Ender's Game” – interesting.)

http://www.businessinsider.com/army-reading-list-2014-8?google_editors_picks=true

The 13 Best Books The Army Wants Its Leaders To Read

… Unlike the Marine Corps' reading list which is broken down by rank or topic, the Army's reading list is broken down into three categories: "Armies at War: Battles and Campaigns," "The Army Profession," and "Strategy and the Strategic Environment." The Army explains that the sublists are appropriate for any rank and that they allow the reader to choose the topics that best suit their interests.

The list is published annually, and the current list can be seen in full here. We've picked thirteen of our favorites and offer a brief glimpse into each

For my students.

http://www.makeuseof.com/tag/app-store-productivity-sale-boxer-fantastical-prizmo-reduced-ios-sales/

Apps on Sale

… This week’s sales are all about productivity, with some of the App Store’s best email applications, calendars, scanners and sketching environments slashed in price. There’s also the usual smattering of games, like Deus Ex: The Fall for the bargain price of a dollar.

For my geeky students.

LittleBits

http://littlebits.cc/

– is the easiest, most extensive way to learn and prototype with electronics. They are born out of the Maker Movement and have been helping lead the Open Hardware Movement. That’s why littleBits is open source and building a community of contributors who experiment, share online, and learn from each other’s creativity. Designs are publicly available to anyone.

Laugh it up!

Hack Education Weekly News

… Catherine Sugrue, who’s twice failed the Chicago Public Schools’ selection test for principals, will become the principal at Gray Elementary. Sugrue is the sister of Chicago Alderman Patrick O’Connor. Ah, Chicago politics.

… A two part guide (1, 2) from the EFF on using Tor – a “network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet” – on college campuses.

… “Millennial” parents (those under age 34) are less satisfied with the availability and use of technology in schools than older parents, according to a survey conducted by the University of Southern California’s Annenberg School for Communication and Journalism.

Quis custodiet ipsos custodes? “Security Theater”

http://seattletimes.com/html/travel/2024261930_airportsecurityhackersxml.html?syndication=rss

Airport security devices can be hacked, says researcher

… On his own time, Billy Rios of Qualys Security said he purchased some of the hardware and software used by the Transportation Security Administration.

At a talk at this year’s Black Hat conference in Las Vegas, he revealed details about several vulnerabilities he was able to find, most notably in the device entrusted to detect trace levels of drugs and explosives.

The machine, the Morpho Itemiser, is set up so that the technician level password is hardcoded in.

It’s a common practice for a range of devices, one aimed at making it easier for technicians to get in and do maintenance, but it’s become taboo among security advocates because it also makes it easier for machines to be hacked.

… His findings, he said, show TSA is not properly vetting the products it uses for security.

What does this have to do with academics? Will they monitor what the kids had for breakfast? Have they had their shots or been treated for cuts and bruises that indicate abuse? How long was the TV on last night? Where does it stop? Can parents make it stop?

Maryland school district to start monitoring students’ social media posts with new software

Diane Cho reports:

Washington County public school officials announced that, with the start of the new school year in just two weeks, they will be using new software to monitor students’ social media posts.

The county will be one of only four school districts in the nation to enlist a new software program called Social Sentinel that tracks social media accounts for certain keywords.

To those that question the legality of such monitoring in the face of privacy rights, school officials said the software uses “geofencing” protocol to only track posts that are made while the student is on school property.

Read more on WJLA.

[From the article:

School officials said the goal is to protect student safety. Examples of such posts that will be tracked include those that feature keywords like "kill," "bomb" and others.

School officials said they will also be consulting with parents and members of student government for feedback on what additional keywords should be added to the watch-list.

Threats will be flushed out, officials added - if a keyword is caught, the post will be read to check for threats of violence, bullying or harassment, reference to using drugs or alcohol, references to weapons, and the like.

“Take my picture, feel my wrath!” It's merely paranoia, but in this case the paranoids have guns.

Documents Show 100 Officers From 28 Law Enforcement Agencies Accessed A Photographer’s Records

Tim Cushing writes:

Here’s what exercising your First Amendment rights gets you in certain parts of the US. Photographer Jeff Gray has been filming cops and photographing public structures, as well as documenting the reactions of law enforcement to his activities.

The Department of Homeland Security apparently felt Gray was enough of a “threat” that it opened an investigation on him. After scrutinizing publicly-available information (like Gray’s own YouTube account), it came to the conclusion that his activities were completely protected… it just didn’t like the way he acted.

[...]

Now, Gray has obtained more information that shows law enforcement officers are still trying to find some way to shut down his protected activities.

Read more on TechDirt.

I have driven through Massachusetts – they do drive like terrorists. (Colorado shares this information too according to the “document.”)

Massachusetts one of fifteen states sharing drivers’ images with controversial CIA “terrorism” database

sosadmin writes:

The state of Massachusetts is one of fifteen states sharing drivers’ license images and data with federal agencies including the CIA and Department of Defense, a newly disclosed federal government document shows.

The document, which boasts about “strategic accomplishments” of the National Counterterrorism Center’s Directorate of Terrorist Identities, is published to support a new story on The Intercept about the government’s bloated watch-listing and terror database systems.

Read more on PrivacySOS.

This sounds worse than our sanctions.

http://www.reuters.com/article/2014/08/07/us-ukraine-crisis-idUSKBN0G717B20140807

Moscow bans Western food imports; Russian quits as Ukraine rebel chief

… Moscow imposed a one year ban on all meat, fish, dairy, fruit and vegetables from the United States, the 28 European Union countries, Canada, Australia and non-EU member Norway.

Russia has become by far the biggest consumer of EU fruit and vegetables, the second biggest buyer of U.S. poultry and a major global consumer of fish, meat and dairy products.

Does this really surprise anyone?

http://www.usatoday.com/story/news/politics/2014/08/05/federal-spending-transparency-money-missing/13485581/

$619 billion missed from federal transparency site

A government website intended to make federal spending more transparent was missing at least $619 billion from 302 federal programs, a government audit has found.

And the data that does exist is wildly inaccurate, according to the Government Accountability Office, which looked at 2012 spending data. Only 2% to 7% of spending data on USASpending.gov is "fully consistent with agencies' records," according to the report.

… The Department of the Interior did not report spending for 163 of its 265 assistance programs because, the department said, its accounting systems were not compatible with the data formats required by USASpending.gov.

The White House itself failed to report any of the programs it's directly responsible for. At the Office of National Drug Control Policy, which is part of the White House, officials said they thought HHS was responsible for reporting their spending.

For more than 22% of federal awards, the spending website literally doesn't know where the money went. The "place of performance" of federal contracts was most likely to be wrong.

For my geeky students. Please do not drool on the keyboards.

http://www.wired.com/2014/08/ibm-unveils-a-brain-like-chip-with-4000-processor-cores/?mbid=social_twitter

IBM Unveils a ‘Brain-Like’ Chip With 4,000 Processor Cores

… Most efforts to mimic the brain have focused on software, but in recent years, some researchers have ramped up efforts to create neuro-inspired computer chips that process information in fundamentally different ways from traditional hardware. This includes an ambitious project inside tech giant IBM, and today, Big Blue released a research paper describing the latest fruits of these labors. With this paper, published in the academic journal Science, the company unveils what it calls TrueNorth, a custom-made “brain-like” chip that builds on a simpler experimental system the company released in 2011.

TrueNorth comes packed with 4,096 processor cores, and it mimics one million human neurons and 256 million synapses, two of the fundamental biological building blocks that make up the human brain.

DHS has lost similar data before. If I wanted to slip an agent into the DHS (can't imagine why I would) the is the information I would want to analyze to create the perfect background profile.

United States Investigations Services (USIS) suffers major computer breach, officials say; DHS contractor

Ellen Nakashima reports:

A major U.S. contractor that conducts background checks for the Department of Homeland Security has suffered a computer breach that likely resulted in the theft of employees’ personal information, officials said Wednesday.

The company, USIS, said in a statement that the intrusion “has all the markings of a state-sponsored attack.”

The breach, discovered recently, prompted DHS to suspend all work with USIS as the FBI launches an investigation. It’s unclear how many employees were affected, but officials said they believe the breach did not affect employees outside DHS. [So was DHS specifically targeted or is DHS their only client? Bob] Still, the Office of Personnel Management has also suspended work with the company “out of an abundance of caution,”a senior administration official said.

Read more on Washington Post, keeping in mind as you read the rest of her report that Anonymous claims that not only did China hack OPM in March, but it had hacked OPM, too. OPM has not confirmed nor denied that claim.

Gosh Mr Science, could this happen in the US too?

UK: ICO fires warning to legal professionals following ‘troubling’ number of data breaches

Kate Fulton reports:

The UK’s privacy watchdog has fired a warning to barristers and solicitors following a spate of data protection breaches by legal professionals.

In a blog post, the ICO wrote that 15 incidents involving legal professionals breaching the Data Protection Act (DPA) have been reported in the last three months.

Read more on TechRadar.

[From the article:

"We have published some top tips to help barristers and solicitors look after the personal information they handle. These measures will set them on the road to compliance and help them get the basics right."

Tools & Techniques for my Computer Security students.

http://www.securityweek.com/logrhythm-launches-honeypot-security-analytics-suite

LogRhythm Launches Honeypot Security Analytics Suite

Just weeks after announcing that it had raised $40 million in a new round of equity financing, SIEM and security intelligence vendor LogRhythm has released a new analytics suite that monitors honeypots in order to detect and track would-be attackers.

According to the Boulder, Colorado-based Company, the suite enables customers to analyze nefarious tactics and generate targeted threat intelligence.

Designed to look like production servers but left vulnerable on purpose, Honeypots are isolated decoy systems and services used to deceive and detect attackers.

The new Honeypot Security Analytics Suite helps LogRhythm customers deploy honeypots to attract opportunistic hackers and then capture network and log activity stemming from the honeypots. By deploying honeypots, organizations can detect various evolving attacks – including advanced zero-day malware, brute force attacks and emerging nefarious payloads, the company said.

It's what you don't know that hurts you. My wife buys vitamins and other supplements for her horse and our dogs. What group does that put us in?

http://www.troyhunt.com/2014/08/too-much-soft-cheese-may-directly.html

Too much soft cheese may directly impact your health insurance premiums

… You shop at the supermarket and you give them your loyalty card because you’re constantly told that this practice will give you some amount of monetary return. It also gives the supermarket the ability to monitor your purchasing habits. Now keep in mind that you are a known quantity; your name, your contact details and various other personally identifiable data points about you as an individual.

Now you go and apply for insurance with an organisation that has access to this data, whether that be because both companies are under the same umbrella or that the fine print none of us ever read when you signed up for the loyalty card said it could be shared with partners. You buy too much crap – soft drinks, chips, high-fat foods – and you’re also buying vitamins to treat high blood pressure and elevated cholesterol. Then you apply for life insurance.

Or perhaps your shopping habits put you squarely into a particular ethnic bracket; the foods you eat, the magazines you buy, the medicines you choose and so on and so forth. Studies show this ethnic group also has a higher propensity of at-fault claims on their motor vehicle insurance. Now you want to insure your new wheels.

I offer you a new term, “Creep-nology” Really creepy technology.

Foursquare Now Tracks Users Even When the App Is Closed

Douglas Macmillan reports:

Hiding in Foursquare’s revamped mobile app is a feature some users might find creepy: It tracks your every movement, even when the app is closed.

Starting today, users who download or update the Foursquare app will automatically let the company track their GPS coordinates any time their phone is powered on. Foursquare previously required users to give the app permission to turn on location-tracking. Now users must change a setting within the app to opt out.

Read more on WSJ.

A TED video.

http://www.ted.com/talks/hubertus_knabe_the_dark_secrets_of_a_surveillance_state

The dark secrets of a surveillance state

Tour the deep dark world of the East German state security agency known as Stasi. Uniquely powerful at spying on its citizens, until the fall of the Berlin Wall in 1989 the Stasi masterminded a system of surveillance and psychological pressure that kept the country under control for decades. Hubertus Knabe studies the Stasi — and was spied on by them. He shares stunning details from the fall of a surveillance state, and shows how easy it was for neighbor to turn on neighbor.

Et tu, Bill?

http://www.makeuseof.com/tag/obama-favors-net-neutrality-microsoft-scans-emails-tech-news-digest/

Microsoft Is Scanning Your Online Images

You’ll be pleased to discover it isn’t just Google scanning your emails for evidence of illegal activity; Microsoft is doing exactly the same thing. In the same way Google tipped off the authorities about child pornography allegedly being shared via Gmail, Microsoft did the same when it discovered abuse images allegedly being stored on OneDrive.

Microsoft’s Terms of Service explicitly state that the company will use “automated technologies to detect child pornography or abusive behaviour that might harm the system, our customers, or others.” However, regardless of the vile nature of the images being shared, this still raises questions over the right to privacy when using cloud services.

For my Computer Security students. Would you like the poster or the T-shirt?

http://www.securitybistro.com/?p=8902

Passwords Are Like Underwear—They Aren’t Meant to Be Shared

… Software vendor IS Decisions has recently published a report entitled “From Brutus To Snowden: A Study Of Insider Threat Personas” in which the company looks at workers’ habits, behavior and attitudes around topics including password sharing and network access. The company surveyed 1,000 people in the U.S. and another 1,000 in the U.K. to compile the report’s data.

IS Decisions found that while information security teams spend the majority of their time defending against attacks from outside the organization, the threat from within the organization is not considered seriously enough. The report looks at hypothetical “personas” based on worker demographics to help companies understand who is most likely to share a password with someone or exhibit other behavior that can put a network at risk.

… I’ll leave it to you to read the report and draw your own lessons from it, but I will close with this interesting bit of advice from an infographic in the report:

Passwords are like underwear.

• Change yours often.
• Don’t share them with friends.
• The longer, the better.
• Be mysterious.
• Don’t leave yours lying around.

To delink or not to delink. The data itself is fine, but no one can point users to it?

http://www.technewsworld.com/story/80851.html?google_editors_picks=true

Wikimedia Blasts Europe's 'Right to Be Forgotten'

The Wikimedia Foundation on Wednesday released its first-ever transparency report -- and along with it a protest against Europe's "right to be forgotten" law. Wikimedia is the nonprofit owner of Wikipedia and other sites.

"Last week, the Wikimedia Foundation began receiving notices that certain links to Wikipedia content would no longer appear in search results served to people in Europe," wrote Wikimedia General Counsel Geoff Brigham and Legal Counsel Michelle Paulson.

"Denying people access to relevant and neutral information runs counter to the ethos and values of the Wikimedia movement," they added. "The Wikimedia Foundation has made a statement opposing the scope of the judgment and its implications for free knowledge."

… "I think they're overstating the case," John Simpson, director of Consumer Watchdog's Privacy Project, told TechNewsWorld. "I don't think they understand the privacy issues involved."

Meanwhile, the professionals (e.g. http://www.law.du.edu/index.php/privacy-foundation ) are slowly running out of funding.

http://www.law.du.edu/index.php/privacy-foundation

Consumer Privacy Organizations Oppose Farcical Class Action Settlement

by Sabrina I. Pacifici on Aug 6, 2014

“EPIC, along with a group of consumer privacy organizations, has asked the Federal Trade Commission to object to an unfair class action settlement in California federal court. In 2010, Google was sued for sharing user web browsing information with advertisers. Under the proposed settlement agreement, Google will distribute several million dollars to a handful of organizations, many of which already have ties to the company. EPIC and other privacy organizations have argued that the proposed agreement “confers no monetary relief to class members, compels no change in Google’s behavior, and misallocates the cy pres distribution” to organizations that are “not aligned with the interests of class members and do not further the purpose of the litigation.” The consumer groups, who have already written to the court opposing the settlement, urged the Federal Trade Commission to object as well. The agency filed a similar objection in Fraley v. Facebook, an unfair class action settlement in the Ninth Circuit. For more information, see EPIC: FTC and EPIC: Search Engine Privacy.”

Why has PETA refused to become involved?

http://www.bbc.com/news/uk-england-gloucestershire-28674167

Photographer 'lost £10,000' in Wikipedia monkey 'selfie' row

A photographer involved in a copyright row with Wikipedia over a monkey "selfie" says he has lost £10,000 in income over two years because of it.

David Slater, from Coleford in the Forest of Dean, said the web-based encyclopaedia had repeatedly refused to remove the image from its site.

He said there had been no interest from anyone in buying the image since it was declared to be in the "public domain".

The site said Mr Slater did not own the copyright as he did not take the photo.

… The debate about the picture resurfaced on Wednesday as the Wikipedia Foundation published its first transparency report - following a similar practice by Google, Twitter and others.

Perhaps we could recreate the full survey here. I'd bet our students would out score those kids. (I did)

http://betanews.com/2014/08/07/technology-knowledge-its-all-downhill-after-youre-14/

Technology knowledge -- it's all downhill after you're 14

A new study by the UK's communications regulator Ofcom finds that the "millennium generation" of 14-15 year olds are the most technology aware group but as we get older digital knowledge begins to decline.

The study of 2,000 adults and 800 children measured confidence and knowledge of communications technology to calculate a Digital Quotient (DQ) with the average UK adult scoring 100.

Today's 14 year olds have a DQ of 113 and are the first generation to have grown up with the benefits of broadband, probably never knowing the pleasures of dial-up internet. People in their 40s have a DQ in the high 90s, around the same as a modern six-year-old. Over 70s score a DQ in the 80s. You can try this out for yourself and see how you compare with a quick three minute taster test.

… You can find out more about the results of the survey on the Ofcom website.

Apparently we're not teaching everything future tech workers will need.

http://www.bespacific.com/ai-robotics-future-jobs/?utm_source=rss&utm_medium=rss&utm_campaign=ai-robotics-future-jobs

AI, Robotics, and the Future of Jobs

by Sabrina I. Pacifici on Aug 6, 2014

Pew Report – “The vast majority of respondents to the 2014 Future of the Internet canvassing anticipate that robotics and artificial intelligence will permeate wide segments of daily life by 2025, with huge implications for a range of industries such as health care, transport and logistics, customer service, and home maintenance. But even as they are largely consistent in their predictions for the evolution of technology itself, they are deeply divided on how advances in AI and robotics will impact the economic and employment picture over the next decade. We call this a canvassing because it is not a representative, randomized survey. Its findings emerge from an “opt in” invitation to experts who have been identified by researching those who are widely quoted as technology builders and analysts and those who have made insightful predictions to our previous queries about the future of the Internet. (For more details, please see the section “About this Report and Survey.”)

We still have a few design students finishing their program. I can't do what they do, so I find tools like this to trade for future design favors.

YouiDraw

http://youidraw.com/

– Create vector graphic design with YouiDraw online. It’s like Adobe Illustrator or CorelDraw but it works with HTML5 and Google Drive. So there’s no software to download and you can access your work anytime, anywhere. An Online Logo Maker is available for creating high quality vector graphics, headings, HTML5 logos, icons, web site elements and buttons by hundreds of templates and styles.

(Related) Oh look, another one!

Raumrot

http://www.raumrot.com

– if you are into blogging or publishing in any way, then you will need a constant supply of royalty-free photos. One such source for this is Raumrot which is a site of free high-resolution photos you can download for any personal or commercial project. Each photo is categorized and links to the larger version on Flickr.com.

Another tool for my Math students.

http://www.freetech4teachers.com/2014/08/find-more-than-4000-math-lessons-on.html#.U-N8y6P5d8o

Find More Than 4,000 Math Lessons on Open Curriculum

Open Curriculum is a new entry into the lesson depot market. Like similar sites, Open Curriculum offers a collection of thousands of resources for teaching mathematics. You browse the Open Curriculum resource lists according to grade level and topic.

… Open Curriculum provides more than just a collection of mathematics lesson materials. In your Open Curriculum account you can create and share your own lessons and units of study. You can also upload existing materials to incorporate into the lessons and units that you create in Open Curriculum.

… The sharing aspect of Open Curriculum could be useful for large departments that are looking for a place to share materials that they like and create with each other.

For my students. Could be more fun that a formal presentation. (Perfect for math problems?)

http://techcrunch.com/2014/08/06/google-acquires-directr-an-app-for-shooting-short-films-on-your-phone/?ncid=tcep&google_editors_picks=true

Google Acquires Directr, An App For Shooting Short Films On Your Phone

Directr, an app that we’ve covered a few times since its launch back in 2012, has just been snatched up by Google.

In an age of ultra-brief videos, Directr existed to help users and businesses shoot videos that were a bit longer than your average Vine — think ads, or promo clips, or family holiday videos.

Perhaps my idea to have my students write their own textbook isn't so great after all.

http://dilbert.com/strips/comic/2014-08-07/

For my Ethical Hackers: Now that they have them, what will they do with them?

http://www.thetimes.co.uk/tto/technology/internet/article4168261.ece

Russian hackers amass biggest ever password haul

A Russian criminal gang is believed to have stolen more than a billion internet usernames and passwords – the largest stockpile of web credentials yet amassed by cybercriminals.

The gang is thought to be made up of a dozen individuals, based in south-central Russia.

The extent of its cache of stolen passwords was revealed by Hold Security, an American company, which says that the data was stolen from around 420,000 websites.

The affected sites are not being named because many are thought to still be vulnerable to the techniques that allowed the Russian gang to strip them of data.

(Related) Maybe my Ethical Hackers could do it for $19.95!

Firm That Exposed Breach Of ‘Billion Passwords’ Quickly Offered $120 Service To Find Out If You’re Affected

Can't hurt.

http://www.smh.com.au/digital-life/consumer-security/eight-tips-to-improve-your-internet-security-20140806-1012be.html

Eight tips to improve your internet security

If ‘password’, ‘123456’, 'admin', or ‘letmein’ is your password of choice, you could do with a few lessons in internet security.

A Russian crime gang has managed to amass 1.2 billion stolen internet credentials of unsuspecting individuals and businesses, collected from a number of high-profile hacks including the Adobe breach last year, according to The New York Times.

The incident has prompted experts to call on Australians to change their passwords and update their internet security measures, and fortunately there are some simple ways to sharpen your defences against hackers.

1. Keep software up-to-date

2. Regularly change your password

3. Use password management apps

4. Be wary of untrusted networks

5. Secure your email account

6. Know the latest scams

Scammers are constantly changing their tactics, so staying up to date can be difficult, but websites such as SCAMwatch and Stay Smart Online provide the latest information on known scams.

7. Use secure websites

8. Use fake details

McKinnon said when possible, people should use fake birth dates and details on websites so if hackers do steal them, they'll have a harder time using, or selling, your true credentials.

“This is a contentious point, but if it’s not a legal site or something you’re bound to, and the website doesn’t have a clear reason for asking you certain pieces of private information, don’t feel obligated to provide it,” he said.

About time!

Cryptolocker victims to get files back for free

Mark Ward reports:

All 500,000 victims of Cryptolocker can now recover files encrypted by the malware without paying a ransom.

The malicious program encrypted files on Windows computers and demanded a substantial fee before handing over the key to the scrambled files.

Thanks to security experts, an online portal has been created where victims can get the key for free.

Read more on BBC.

Interesting speculation?

http://www.securityweek.com/latest-us-media-intel-scoop-suggests-new-leaker

Latest US Media Intel Scoop Suggests New Leaker

The latest media scoop about the internal workings of the US intelligence community has convinced officials they have a new leaker feeding information to journalists, reports said Tuesday.

The concerns came after The Intercept, a news site that has access to documents from known leaker Edward Snowden, published new revelations about the scope of the US terrorism watchlist.

The Intercept report was "obtained from a source in the intelligence community." Previously, it has not hidden when Snowden was its source, suggesting the latest scoop came from someone else.

I think this goes back much farther than two years.

Visit the Wrong Website, and the FBI Could End Up in Your Computer

Kevin Poulsen reports:

Security experts call it a “drive-by download”: a hacker infiltrates a high-traffic website and then subverts it to deliver malware to every single visitor. It’s one of the most powerful tools in the black hat arsenal, capable of delivering thousands of fresh victims into a hackers’ clutches within minutes.

Now the technique is being adopted by a different kind of a hacker—the kind with a badge. For the last two years, the FBI has been quietly experimenting with drive-by hacks as a solution to one of law enforcement’s knottiest Internet problems: how to identify and prosecute users of criminal websites hiding behind the powerful Tor anonymity system.

Read more on Wired.

An interesting article. Something to consider at least.

http://knowledge.wharton.upenn.edu/article/teens-privacy-online/

Teens Are Waging a Privacy War on the Internet — Why Marketers Should Listen

Back in the early days of social media, Danah Boyd was asked to participate on a panel alongside some representatives from various consumer brands. A fellow panelist who worked at Coca-Cola commented with satisfaction that his company was the most popular brand on MySpace. Without meaning to, Boyd (who writes her name in all lowercase letters) laughed audibly. At the moderator’s prompting, she explained that she, too, had noticed how popular Coke was on the site, and investigated. The most popular “brand” turned out to be not the soft drink, but cocaine.

Web-savvy brand managers, marketers, programmers and data analysts would never make that kind of mistake today — or would they? Boyd, an internationally recognized authority on social media — the Financial Times has dubbed her the “high priestess” of social networks — told the audience at the recent Wharton Web Conference that it is becoming more and more difficult even for web professionals to crack the ever-shifting code of people’s online interactions.

Worth looking at...

Adjust Your Privacy

http://adjustyourprivacy.com/

– makes it easy for you to adjust, check, test, and maintain your online privacy. You can click on each logo to find the privacy page for each service. Next, you can test your privacy settings by seeing how easily you can find yourself using this custom people search engine. This search provides results from other people directories.

Actually old tech (bouncing lasers off of windows to pick up vibrations has been a tool for years)

http://www.informationweek.com/big-data/big-data-analytics/eavesdropping-on-a-new-level/d/d-id/1297777?f_src=informationweek_editorspicks_rss&google_editors_picks=true

Eavesdropping On A New Level

… Researchers from MIT, Microsoft, and Adobe have shown that they can recover sound from video imagery, a technique that promises to pique the interest of intelligence agencies and forensic investigators. While the technique will need to be refined to be practical outside the laboratory, it has the potential to enable retroactive eavesdropping at events that were videoed with sufficient fidelity.

… In a paper to be presented in mid-August at SIGGRAPH 2014, the researchers describe how they filmed a series of objects using both a high-speed video camera and a consumer video camera and were able to reproduce sounds that had been playing near objects using only video information -- the object's minute vibrations in response to the impact of sound waves.

… US intelligence presumably already has more sophisticated eavesdropping technology. A decade-old patent application arising from work at NASA, "Technique and device for through-the-wall audio surveillance," describes a way to listen in on even soundproofed locations by using "reflected electromagnetic signals to detect audible sound." But MIT's Visual Microphone technique could become a useful addition to an already formidable set of surveillance tools.

For my Ethical Hacker's “Guide to Hacking”

http://www.wired.com/2014/08/car-hacking-chart/

How Hackable Is Your Car? Consult This Handy Chart

… All the cars’ ratings were based on three factors: The first was the size of their wireless “attack surface”—features like Bluetooth, Wi-Fi, cellular network connections, keyless entry systems, and even radio-readable tire pressure monitoring systems. Any of those radio connections could potentially be used by a hacker to find a security vulnerability and gain an initial foothold onto a car’s network. Second, they examined the vehicles’ network architecture, how much access those possible footholds offered to more critical systems steering and brakes. And third, Miller and Valasek assessed what they call the cars’ “cyberphysical” features: capabilities like automated braking, parking and lane assist that could transform a few spoofed digital commands into an actual out-of-control car.

http://www.wired.com/wp-content/uploads/2014/08/Screen-Shot-2014-08-05-at-10.08.53-AM.png

You can autocomplete all of the people some of the time and some of the people all of the time, but you can't avoid litigation any time.

http://www.forbes.com/sites/timworstall/2014/08/06/now-google-autocomplete-could-be-found-guilty-of-libel-in-hong-kong/

Now Google Autocomplete Could Be Found Guilty Of Libel In Hong Kong

Another story to illustrate a favourite theme of mine. This time it’s the possibility that Google's autocomplete function will get the company sued for, and found guilty of, libel in Hong Kong.

… The story itself:

A court has ruled that a Hong Kong tycoon can sue Google over its autocomplete results suggesting he has links to organized crime.

In a judgment released Wednesday, the court dismissed the Internet search giant’s objections to tycoon Albert Yeung’s defamation lawsuit.

Yeung filed the lawsuit after Google refused to remove autocomplete suggestions such as “triad,” as organized crime gangs are known in China, which popped up with searches on his name.

For my Computer Security and IT students.

http://www.datamation.com/careers/it-salary-guide-2014-1.html?google_editors_picks=true

IT Salary Guide 2014

(Please note: These IT salary numbers are for starting pay only. Factors like seniority and performance reports are impossible to calculate.)

For all my students, please!

http://www.makeuseof.com/tag/x-ways-spell-grammar-check-microsoft-word-using-different-dictionaries-languages/

8 Ways To Spell & Grammar Check In Microsoft Word Using Different Dictionaries & Languages