The more we learn, the worse they seem. (...and they are no doubt spinning this story for all they are worth.)

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9008783&source=rss_topic84

TJX breach occurred seven months before it was detected

Jaikumar Vijayan

January 22, 2007 (Computerworld) The data breach at TJX Companies Inc. that exposed sensitive credit and debit card data on an unknown number of customers occurred nearly seven months before it was detected, a company spokeswoman said today.

The breach occurred as far back as mid-May 2006 but was only discovered in mid-December, said company spokeswoman Debra McConnell. The original statement from Framingham, Mass.-based TJX announcing the data compromise last week only mentioned the discovery of the breach in December and made no mention of when the breach actually happened.

... Meanwhile, a Canadian law firm, the Merchant Law Group, filed a class-action lawsuit against Winners and HomeSense, two TJX-owned retailers in Canada whose customers were affected by the breach.

The lawsuit was filed in courts in six Canadian provinces and seeks "financial recovery on behalf of all individuals for whom personal information has been revealed," a statement posted on the company's Web site said.

... TJX said last Wednesday that an "unauthorized intruder" had gained access to its system and may have stolen credit and debit card data belonging to an unspecified number of customers in the U.S., Canada and Puerto Rico, and possibly in the U.K. and Ireland.

... So far, about 50 banks in Massachusetts alone have been affected by the TJX breach, according to a spokesman at the Massachusetts Bankers Association.

Ryan Fisher, senior risk manager with Madison, Wis.-based CUNA Mutual Group, which insures about 5,500 credit unions, said that while the scope of the breach is unknown, it appears to have had an impact on a substantial number of credit unions as well.

So if these folks had a virus or trojan, is the financial institution off the hook (could they claim they have no responsibility?)

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9008619&source=rss_topic84

Hackers steal $35,000 from customers of federal savings plan

Linda Rosencrance

January 19, 2007 (Computerworld) Hackers stole $35,000 from two dozen users of the Thrift Savings Plan (TSP), a retirement savings and investment plan for federal employees.

In late December, the computers of several TSP participants were infected with keylogging software that allowed criminals to record all keystrokes made by participants without their knowledge. The hackers also retrieved the customers' TSP personal identification number and other account information, according to a statement on the TSP Web site. However, the TSP's system was not breached, the company said.

"We were able to identify approximately two dozen participants who had relatively small amounts withdrawn from their accounts and electronically forwarded to fraudulent accounts," the TSP said. "Although we are working with the financial companies involved for the return of the funds, the total amount of loss involved is approximately $35,000. All affected participants have been notified."

"External penetration testing has demonstrated that our system has not been breached," the TSP said. "There is no evidence of any successful attacks against the system to identify a PIN and thus obtain access."

TSP officials said the personal information was compromised when keyloggers monitored each keystroke made by the users while they entered their TSP information into their own computers. All cases that have been identified involve electronic funds transfers. As an added security measure, the TSP has discontinued making these electronic payments for online transactions.

The TSP said over the coming months, it will be introducing several enhancements to the Web site, including a new alert message, more robust Web passwords and TSP account numbers, which will replace the use of the Social Security numbers for most TSP purposes.

A TSP spokesman declined to comment beyond the statement.

Perhaps not the best thought-out program for community service...

http://www.longmontfyi.com/Local-Story.asp?id=14188

ID recycling?

Security to be tightened at Eco-Cycle following reports of document theft

By Ben Ready The Daily Times-Call Publish Date: 1/21/2007

BOULDER — Think twice about throwing sensitive, unshredded papers into your recycling bin, says a convicted thief who claims he watched some of his companions pocket personal documents at Eco-Cycle’s Boulder facility.

The head of the Boulder County Jail’s alternative-sentencing programs and the director of Eco-Cycle promised to beef up security at the plant after a complaint that a handful of inmates — those serving community service sentences — and Eco-Cycle staff are stealing documents.

... According to Ned, jail volunteers and paid Eco-Cycle staff alike snagged credit card statements, bank statements, medical records, blank checks and documents containing Social Security numbers off conveyor belts while they sorted recyclables at the plant.

... Eco-Cycle director Eric Lombardi said that in the 30 years since he founded the nonprofit, no cases of identity theft have been traced to its four locations or processing plant. [Good security or bad tracing? Bob] That includes the last 10 years in which Eco-Cycle augmented its labor force with jail inmates and alternative-sentencing crews.

... “I’ve never had anything like this brought to my attention,” Caven said Thursday. [Should he be relying on outside tipsters? Bob]

... Jail workers have never caught inmates with anything they could use to steal someone else’s identity, he said. [Why not? Bob]

Alternative-sentence work crew members, however, go home after a day’s work at Eco-Cycle without being strip-searched or patted down, Caven said.

“...and when we're done, the recycled paper is shipped out of state.” (From the pictures, it was not sliced thinly enough... AND NO ONE NOTICED!)

http://www.wfsb.com/iteam/10562661/detail.html?taf=hart

Packing Material Contains Crime Report Info

Company To Stop Using Vendor's Shredded Paper In Packages

POSTED: 6:13 pm EST December 18, 2006 UPDATED: 6:51 pm EST December 18, 2006

ANDOVER, Conn. -- A couple in Andover opened a box they were expecting and found everything one would need to steal someone's identity.

Channel 3 I-Team reporter Kara Sundlun reported the box contained shredded paper meant to protect the contents of the box.

John and Bernadette McBride ordered parts for their humidifier. Upon opening their order, the couple noticed that the shredded paper contained crime reports from a police department in Colorado, replete with names, dates of birth and Social Security numbers.

... The parts came from the Appliance Factory in Colorado. The owner told Eyewitness News he was shocked. He said his company got the paper from Waste Not Recycling, which is based in Colorado. Many companies use shredding services that sell the paper they pick up.

“Unfortunately, our information wasn't stolen – there is no penalty for that.”

http://www.king5.com/localnews/stories/NW_012207BUBpsepenalizedSW.c39580e.html

PSE penalized for illegal release of private customer data

03:36 PM PST on Monday, January 22, 2007 KING5.com Staff

Video: Shredded Paper Contains Social Security Numbers

OLYMPIA - State regulators on Monday penalized Puget Sound Energy nearly $1 million for violating consumer privacy laws by intentionally sharing customers' private information with an outside marketing partner without the customers' written permission.

The Washington Utilities and Transportation Commission accepted a settlement that calls for PSE to pay a $900,000 penalty, contribute an additional $95,000 to low-income heating assistance and permanently cease the marketing program that released private customer information in violation of state law.

Under the settlement, PSE acknowledged transferring more than 65,000 phone calls to an outside marketing firm without the customers' written permission over a five-year period.

In March 2006, the UTC began an investigation into a report that PSE call-center employees were transferring some customer calls and information to Allconnect, Inc., a Georgia-based marketing company. Known as PSE Connections, the program marketed household services, such as telephone, newspaper and lawn services, to PSE's residential customers.

PSE received payment for transferring these residential customers to Allconnect. After PSE transferred a call and customer information, Allconnect would confirm the service order and then market additional services.

PSE immediately suspended the program in March 2006, when the commission investigation began.

As a condition of accepting the settlement, the UTC required PSE to notify its customers of its misconduct and the penalties. PSE will not be allowed to recover the penalties in any future rate-increase request.

State regulations prohibit privately owned energy utilities from releasing or selling customer information to any outside party for marketing purposes without the customer's written permission.

Phila. Is the city of brotherly love, is New York headed toward Big Brotherly-ness?

http://www.nytimes.com/2007/01/23/nyregion/23scanning.html?ex=1170219600&en=c240d84c738d0a87&ei=5099&partner=TOPIXNEWS

New Scanners for Tracking City Workers

By SEWELL CHAN January 23, 2007

The Bloomberg administration is devoting more than $180 million toward state-of-the-art technology to keep track of when city employees come and go, with one agency requiring its workers to scan their hands each time they enter and leave the workplace.

The scanning, which began in August at the Department of Design and Construction, has created an uproar at a generally quiet department that focuses on major city construction projects.

... In New York City, the use of the hand scanners is part of CityTime, an ambitious effort by the city’s Office of Payroll Administration to automate timekeeping. The city has a $181.1 million contract through 2009 with the Science Applications International Corporation to put CityTime in effect, according to the city’s public database of contracts.

... The scanners were introduced in August at the department’s headquarters in Long Island City, Queens. Hundreds of workers who keep daily timesheets — generally, those who make less than $66,000 a year — must use the scanners; those who file weekly timesheets, including many managers and supervisors, are exempt. [“We gotta keep those second class citizens in their place!” Bob]

It's just another warrentless search – what's the big deal?

http://yro.slashdot.org/article.pl?sid=07/01/22/1517218&from=rss

British Cops Hack Into Government Computers

Posted by Zonk on Monday January 22, @10:59AM from the accountability-from-the-bobbies dept. Privacy The Courts Politics

CmdrGravy writes "The British Police have hacked into Government computers as part of the on-going 'cash for peerages' investigation. They've uncovered evidence which has, so far, led to one arrest and charge of perverting the course of justice for a leading Labour party figure. This charge carries a potential life sentence. The British police have the power to hack into computer systems as part of an investigation. On previous occasions they have said they did not believe the government was providing them with the information they had been asking for and had warned that they would seek other methods to gather evidence. The police won't say what tools they have used. From the article: 'The investigators did not have to notify No 10 if they were "hacking" into its system. One legal expert said: "In some cases, a senior officer can give permission. In other cases, you might need the authorization of an independent commissioner, who is usually a retired judge appointed by the Home Office."'"

Ah yes, that bastion of civil liberties which is New Jersey...

http://techdirt.com/articles/20070121/203827.shtml

Another Court Ruling Supports Online Anonymity Rights

from the more-good-news dept

Just last week, we were talking about the importance of protecting online anonymity, and how so many people feel that anonymous speech criticizing themselves must be illegal. The good news, though, is that the courts seem to be in favor of protecting online anonymity if there's no real evidence of anything illegal. The latest case involved a website about a real estate developer. The site was set up anonymously by someone who was critical of the developer, and the developer sued. However, during the course of the case, the judge asked the developers lawyer if his client was willing to move forward with the case even if the identity of the anonymous critic remained hidden -- and the lawyer replied that he did not know, as the main focus of his client was to uncover the identity. The judge then ruled that the online critic could remain anonymous. That's actually an interesting test to pose to those bringing such cases. Most of the time, it does seem like they're bringing the case not to right some wrong, but simply to find out who their anonymous critic is -- and there's no legal reason to force the critic to be unmasked. It seems perfectly reasonable that a court should see whether or not the plaintiff is willing to continue to have the case move forward on the merits without knowing who it is they're suing, before any anonymity is lifted.

See, more goodness from the bench!

http://www.newsday.com/news/local/wire/newjersey/ny-bc-nj--internetuserpriva0122jan22,0,4560121.story?coll=ny-region-apnewjersey

Court finds NJ users can expect privacy from Internet providers

By JEFFREY GOLD Associated Press Writer January 22, 2007, 5:37 PM EST

NEWARK, N.J. -- Computer users in New Jersey can expect that personal information they give their Internet service providers be treated as private, a state appellate court decided Monday in the first such case considered in the state.

As a result, New Jersey and several other states give greater privacy rights to computer users than most federal courts, and law enforcement officers in New Jersey need to obtain valid subpoenas or search warrants to obtain the information.

The court ruled that a computer user whose screen name hid her identity has a "legitimate and substantial" interest in anonymity.

... By using a coded screen name the "defendant manifested an intention to keep her identity publicly anonymous. She could have used her own name or some other ISP address that would have readily revealed her identity, but she did not. Having chosen anonymity, we conclude that defendant manifested a reasonable expectation of privacy in her true identity, known only to Comcast," Appellate Judge Harvey Weissbard wrote for the panel.

... Federal courts have held the Internet subscribers have no right of privacy under Fourth Amendment protections against illegal search and seizure regarding identifying information on file with their service providers. That stems from U.S. Supreme Court decisions which held that a person cannot expect privacy for information voluntarily given to others, the New Jersey court said.

Appellate ruling: http://www.judiciary.state.nj.us/opinions/a3424-05.pdf

Fortunately, this is America, and this would never happen here...

http://news.yahoo.com/s/afp/20070122/od_afp/australiausairlinebushoffbeat_070122033853

Dumped airline passenger fights for right to call Bush a terrorist

Sun Jan 21, 10:38 PM ET

An Australian man barred from an international flight for wearing a T-shirt depicting US President George W. Bush as a terrorist has said he would fight the airline's ruling.

... A Qantas spokesman said: "Whether made verbally or on a T-shirt, comments with the potential to offend other customers or threaten the security of a Qantas group aircraft will not be tolerated".

...except of course in Pennsylvania.

http://news.yahoo.com/s/ap/20070121/ap_on_re_us/letter_writer_threat

Pa. man's letter brings Secret Service

Sun Jan 21, 2:51 PM ET

An elderly man who wrote in a letter to the editor about Saddam Hussein's execution that "they hanged the wrong man" got a visit from Secret Service agents concerned he was threatening President Bush.

The letter by Dan Tilli, 81, was published in Monday's edition of The Express-Times of Easton, Pa. It ended with the line, "I still believe they hanged the wrong man."

... The agents almost immediately decided Tilli was not a threat, Slama said

... Tilli said the agents appeared more relaxed when he dug out a scrapbook containing more than 200 letters that he has written over the years, almost all on political topics. [Sounds like cheap insurance... Bob]

... It wasn't Tilli's first run-in with the federal government over his letter writing. Two FBI agents from Allentown showed up at his home last year about a letter he wrote advocating a civil war to unseat Bush, he said. [Do you suppose the Secret Service was unaware of this? Bob]

Sometools for my students... Many are free!

http://digg.com/apple/Seven_Applications_for_Writing_and_Note_Taking

Seven Applications for Writing and Note Taking

A rundown of 7 applications for note taking and information organization.

http://theappleblog.com/2007/01/22/note-taking-application-faceoff/

Something else...

http://edition.cnn.com/2007/TECH/internet/01/22/grammar.girl/index.html

'Grammar Girl' a quick and dirty success

By David E. Williams CNN

(CNN) -- Grammar lessons often are associated with high school drudgery -- diagramming sentences and memorizing obscure rules in between passing notes in English class -- but an Arizona technical writer has turned the seemingly dry subject into a popular podcast.

Mignon Fogarty, the woman behind "Grammar Girl's Quick & Dirty Tips for Better Writing," has been explaining the finer points of commas, colons and split infinitives since July.

... The show is currently the 47th most popular podcast on Apple's iTunes service, right behind "Merriam-Webster's Word of the Day." It has been as high as number two, Fogarty said. She said the shows have been downloaded more than 1.3 million times.

Another way to get free money? But you have to be first, and big enough to ensure publicity...

http://www.treehugger.com/files/2007/01/free_solar_powe.php

Free Solar Power for Staples

by Justin Thomas, Virginia on 01.22.07 Science & Technology (alternative energy)

Staples has unveiled the largest solar power installation in New England at its 300,000-square-foot retail distribution center in Killingly, Connecticut. The solar power installation was built at no capital cost to Staples. The 433-kilowatt DC commercial solar photovoltaic system larger that a football field, covering nearly 74,000 square feet of roof space. The solar power system has the capacity to produce enough energy to power 14 percent of the distribution center or 36 homes per year.

The project was made possible through the collaborative effort of Connecticut Clean Energy Fund, which provided a $1.7 million grant for the project, and SunEdison, which financed the remaining costs of the project and designed and installed the system.

“It is better to look smart than to be smart” Fernando

http://digg.com/gadgets/How_to_solve_Rubik_s_Cube_2

How to solve Rubik's Cube

The world's most famous puzzle, simultaneously beloved and despised for it's beautiful simple complexity, the Rubiks Cube has been frustrating gamers since Erno Rubik invented it back in 1974.

http://www.chessandpoker.com/rubiks-cube-solution.html

It continues to grow (fester?)

http://www.computerworld.com.au/index.php/id;1436854886;fp;4194304;fpid;1

TJX breach shows IT security lacks in retail industry

Breach shows why it's so vital to purge the Track 2 data from POS and other systems

Jaikumar Vijayan 22/01/2007 09:36:08

... In addition, the MBA spokesman said some of the banks affected by the breach have confirmed through credit card companies that the information stolen in the breach includes so-called Track 2 data taken from the magnetic stripes on the back of credit and debit cards.

... Track 2 data includes account numbers, expiration dates and encrypted personal identification numbers, plus other information that card-issuing banks can include at their discretion. Its apparent inclusion in the breach at TJX provides fresh evidence that IT security remains fragile at some large retailers despite efforts by credit card companies to get them to better protect customer data.

Retailers are forbidden from storing such information under the Payment Card Industry (PCI) Data Security Standard being pushed by Visa, MasterCard International Inc. and other credit card companies. But many retailers continue to do so, often because their point-of-sale systems capture and store the data by default.

... In a statement released yesterday, Daniel Forte, CEO of the Boston-based MBA, criticized what he said was TJX's characterization of itself as a victim of the data breach, "when what it appears they may have been doing is capturing data that is unnecessary."

What, voting irregularities in Chicago? Never!

http://www.suntimes.com/news/politics/222892,CST-NWS-data22.article

City loses voters' vital information

Social Security data, birth dates, addresses on discs

January 22, 2007 BY ART GOLAB Staff Reporter

About 100 computer discs with 1.3 million Chicago voters' Social Security numbers have been distributed to aldermen and ward committeemen, and the whereabouts of at least an additional six CDs with the same information are unknown, according to the Chicago Board of Elections.

This follows another security lapse in October 2006, when voters' Social Security numbers were available through the board's Web site. But unlike the Web site flaw, which was fixed in a few minutes, it will be difficult, if not impossible, for the Board of Elections to retrieve sensitive data physically scattered on more than 100 discs throughout the area.

The discs also contain voters' birth dates and addresses -- information that along with Social Security numbers can be used to commit identity theft.

... The latest leak of sensitive voter information was uncovered by 43rd Ward aldermanic candidate and technology expert Peter Zelchenko, who also discovered the Web site security hole last October.

"This information must be on campaign computers and in desk drawers all over the city," said Zelchenko.

Zelchenko discovered voters' Social Security numbers on a so-called "Ward Work" CD, which is supposed to contain voter names and addresses and is given on request to anyone affiliated with an aldermanic campaign. [Run for office now, steal identities later... Bob]

'Grave doubts'

The board claims that only Zelchenko and one other aldermanic candidate mistakenly received the sensitive data since 2003. But in investigating queries from the Chicago Sun-Times, board officials found out about the other 100-plus CDs, [another case of not knowing where your data is... Bob] spokesman Tom Leach said. Social Security numbers were inadvertently included on those discs, [I doubt “inadvertently” Bob] which were created by the board in the wake of the 2003 fire at 69 W. Washington, where it maintained computers with voter records.

"We couldn't maintain our voter-registration system, [This, I believe! Bob] so they downloaded the whole file for committeemen and aldermen," Leach said.

Records on the CDs contain information about 2.2 million active and inactive voters, but only 1.3 million of the records contain Social Security numbers.

... And it worries Furst that the lapses occurred at an agency responsible for counting votes.

"It would, in my mind, cast grave doubts on electronic voting," he said. "My sense is that these are people with the best of intentions, but [they] don't know enough about the possible consequences of using technology and so are making mistakes."

Even Google screws up...

http://www.prnewswire.co.uk/cgi/news/release?id=188440

Monday 22 January 2007, 8:00 GMT

Finjan Reconfirms Google's Anti-Phishing BlackList Exposed Confidential User Information

SAN JOSE, California, January 22 /PRNewswire/ -- Finjan Inc., the global provider of best-of-breed proactive web security solutions for businesses and organizations, today announced that it reconfirms recent reports that Google have unwittingly exposed private user names and passwords on the Google anti-phishing blacklist, which did not use any access protection. Such sensitive information could potentially have been used to compromise user privacy, and could even have been used for identity theft or financial profit (as users generally have a single "web" password for most of their online accounts).

... Google has fixed the problem, and it is assumed that Google has notified all affected users. Recent tests conducted by Finjan confirm that there is no data leakage on the current Google anti-phishing blacklist.

I think I missed this one... So did they, apparently.

http://www.myrtlebeachonline.com/mld/myrtlebeachonline/news/local/16508366.htm

School district leaves personnel records behind during renovations

Associated Press Posted on Sat, Jan. 20, 2007

GREENVILLE, S.C. - Boxes of personnel records - including the Social Security numbers of thousands of teachers - were accidentally left behind by the Greenville County school district when it vacated its office for renovations, officials say.

The 10 boxes held lists of every teacher employed by the district between 1972 and 1990, as well as their Social Security numbers, district spokeswoman Oby Lyles said Friday. Several other boxes contained personnel records as recent as 1998, Lyles said.

"While it seems apparent the records were left behind because they were essentially hidden and inaccessible, the district is investigating to determine responsibility and will take appropriate action," he said.

There was no evidence the records had been duplicated, Lyles said. [Another self serving comment. “What happened to the other boxes, Mr Lyles?” Bob]

District officials and police searched the empty building Thursday night after The Greenville News told the district it had received an anonymous call about the boxes, which had not been located during a walkthrough of the building before it was vacated, according to an incident report.

A rear door of the building was also found to be "unsecure, due to screws keeping the locking mechanism from locking the door," the report said.

District officials will question employees and workers at the site, Lyles said.

The finding comes just two months after it was discovered that the district had sold computers containing Social Security numbers and birthdates for roughly 100,000 students and at least 1,000 employees.

The two buyers never released the information found in computers they bought at a dozen school district auctions between 1999 and last March but decided to go public with their findings after the district ignored their warnings about the information, their attorney has said.

Last month, Circuit Judge Diane S. Goodstein ordered the men and their company, WH Group, to return the computers, saying both sides had agreed to let an independent computer expert document all of the data.

Welcome to Colorado! In order to find you after the avalanche, you need this chip. (Are you paranoid enough?)

http://www.rockymountainnews.com/drmn/government/article/0,2777,DRMN_23906_5286748,00.html

Bill would nip chips in humans

By Alan Gathright, Rocky Mountain News January 18, 2007

For years, people have been implanting tiny microchips under their pet's skin so that if Rover's collar slips off, there's still a way to find him if he wanders away.

Now a state lawmaker has added a twist to that concept with a bill that would make it a misdemeanor for anyone to require two-legged critters to have a microchip implanted under their skin.

Under the bill, employers could not track workers' movements, for example.

Rep. Mary Hodge, D-Brighton, said she introduced House Bill 1082 as a "proactive measure" at the urging of Adams County's head librarian. He fears that "microchipping" people could become the next Big Brother tactic of a federal government whose use of warrantless telephone eavesdropping and the Patriot Act in the war on terror has alarmed civil libertarians.

The bill is cracking up some Capitol pols.

"Is this a problem? Do we have gangs of post-apocalyptic Terminator-style cyborgs roaming the streets of Colorado implanting citizens with microchips?" wisecracked Rob Fairbank, a former-representative-turned-political-consultant, in an e-mail to statehouse pals.

"One of my legislator friends said, 'If we can't implant microchips on people, how will we know when the black helicopters arrive?' " joked Fairbank, a Littleton Republican.

Michael Sawyer isn't laughing.

He's the library director for the Rangeview Library District in Adams County who urged Hodge to nip the microchipping in the bud.

"I think it's a very scary thing," Sawyer said Wednesday. "I have been very concerned about the direction our government is going. I see the secret courts and I see the Patriot Act and the advocating of putting microchips in people."

Sawyer was referring to Tommy Thompson, the former Wisconsin governor and Bush administration Health and Human Services secretary, who became an advocate of the implants after joining the board of device maker VeriChip Corp.

Supporters like Thompson say implanting the rice-grain-size gadgets in patients could allow doctors to quickly retrieve vital information from someone who has dementia, or is unconscious or unable to speak during medical emergencies.

The tiny glass capsule, called a radio frequency identification device or RFID, can be injected into the upper arm or hand and sits passively until it's read by a scanner.

The fear is that employers could use the chips to track workers as they pass through security-door scanners - like internal versions of the electronic pass-keys many employees use to get around the office.

In fact, the president of Colombia suggested using implants to track migrant workers entering the U.S. And a Wisconsin lawmaker unsuccessfully pushed for using them to track sex offenders - or kids "at the direction of their parents," according to a Wisconsin legislative report.

Last May, Wisconsin became the first state to ban forced implantation of the chips on humans, imposing a $10,000 fine for each day of violation. At least 17 other states have introduced or are considering microchip implant laws.

They may have been overwhelmed... Sounds like a good tool for learning new languages.

http://developers.slashdot.org/article.pl?sid=07/01/21/1410208&from=rss

Building a Programmer's Rosetta Stone

Journal written by Short Circuit (52384) and posted by CmdrTaco on Sunday January 21, @10:09AM

from the still-waiting-for-programmer's-tower-of-babel dept.

Did you ever run into the problem where you knew how to do something in one programming language, but really needed to do it in another? That's what Rosetta Code is all about. A variety of programming tasks are solved using as many languages as possible. You can examine existing tasks, or create your own.

Interesting question. Do you suppose there are hints at a viable answer in the comments? Is there a viable answer? It would be nice to think organizations have that much control over their data, but if they can't tell how much has been stolen, how would they find “all” of your data?

http://yro.slashdot.org/article.pl?sid=07/01/20/0425221&from=rss

Deleting Personal Data from Private Institutions?

Posted by Cliff on Saturday January 20, @12:45PM from the static-on-your-digital-paper-trail dept. Privacy Data Storage

An anonymous reader asks: "This site has many readers who are familiar with the liabilities of personal data being stored on servers owned by private institutions. Bank records, phone records, credit records, flight records, basically any type of digital transaction can be (and likely are) stored indefinitely for whatever reason. Are there processes by which one can request a removal of personal data, or by signing contracts with these companies, do they own the rights to the information? If you have attempted such an erasure, have you encountered resistance?"

Size matters...

http://news.enquirer.com/apps/pbcs.dll/article?AID=/20070120/BIZ01/701200339/-1/all

Fifth Third has role in TJX hole

Hacker got into system

BY JAMES MCNAIR JMCNAIR@ENQUIRER.COM

Fifth Third Bank, the nation's fourth-largest credit-card processor, has been drawn into what's being called possibly the biggest- security breach of customer credit-card information.

The breach was found in mid-December in the form of an "intrusion" into the computer systems of TJX Cos., which owns the T.J. Maxx, Marshalls, HomeGoods and A.J. Wright retail chains.

TJX said this week that "some" customer information has been stolen, but it doesn't know the full extent of the theft, which happened in 2005.

... TJX officials refused to say how many customers had their data stolen or accessed by a computer hacker. The New York Times and the Wall Street Journal reported Friday that more than 40 million cards may be affected.

Spokeswoman Sherry Lang said TJX has identified a "limited number" of credit and debit card holders whose information was stolen from its computer system, adding that the number was "substantially less than millions." A smaller number of customer names with driver's license information was stolen, she said.

... In the TJX case, Visa said the number of accounts potentially accessed by a hacker could exceed the 40 million cards exposed in a 2005 breach of computers at payment processor CardSystems Solutions.

... "If you are a consumer and you're part of the TJX breach, you are hoping it's 10 million people because the chance of your name being misused goes down considerably depending on the size of the data breach," Cook said.

At least someone is paying. I'd like to know why they did...

http://www.pogowasright.org/article.php?story=20070120153425714

Printing company to pay $110,000 for Social Security number snafu

Saturday, January 20 2007 @ 03:34 PM CST - Contributed by: PrivacyNews - Businesses & Privacy

A printing company that inadvertently printed Social Security numbers on 171,000 tax forms will pay $110,000 toward free credit monitoring for those affected, the company president said.... The state will pay the rest of the credit-monitoring cost for those affected who choose to use the service.

Source - Associated Press

[From the article:

Meredith Helgerson, a Revenue Department spokeswoman, said the printer needed the Social Security numbers to make sure the forms went to the correct locations [Absurd! Bob] but she couldn't say exactly how the information was used.

... The state paid the printer $22,000 to print the forms.

Would this apply to any laptop, pda, or cell phone found in the crash?

http://www.morningjournal.com/site/news.cfm?newsid=17733843&BRD=1699&PAG=461&dept_id=46371&rfi=6

Prosecutor: 'Black box' information taken legally

By RICHARD PAYERCHIN , Sandusky Bureau Chief 01/20/2007

SANDUSKY -- Police were allowed to collect information from the internal computer in a car involved in a crash that killed a Vermilion teen in January 2006, according to the Erie County Prosecutor's Office.

The prosecution opposed a request by the defense attorney to suppress data taken from a ''black box'' internal computer inside the car driven by Tiffany Whiting, 19, of Marblehead, who is charged with aggravated vehicular homicide and aggravated vehicular assault in connection with the death of David Anthony Risner Jr., of Vermilion, according to Erie County Common Pleas Court records.

The defense motion argued police needed a search warrant to retrieve the computer information stored by the internal SDM Data Recorder (sensing and diagnosing module) of the 2005 Chevrolet Cobalt Whiting was driving.

The car went airborne at a railroad crossing on Douglas Street in Vermilion and went out of control, hitting a tree, a parked truck and a telephone pole. Risner, 17, a culinary arts student at EHOVE Career Center, was a front-seat passenger. Rear-seat passenger Jessica Tipton, then 17, of Marblehead, was injured, according to a police report.

Police had a right to search for the information without a warrant because a person has ''no reasonable expectation of privacy in the wreckage of a vehicle where another occupant is killed,'' said the response filed by Erie County Chief Assistant Prosecutor Mary Ann Barylski.

The case is due back in court on Feb. 6 for a suppression hearing before Judge Roger E. Binette.

Ohio law on the topic is ''sparse,'' Barylski wrote, but other rulings have upheld warrantless searches of vehicles involved in fatal crashes.

In one case, the U.S. Military Court found Navy police were required to investigate serious motor vehicle crashes and legally could examine a demolished car that was involved in a fatal crash, Barylski wrote.

In Whiting's case, the ''vehicle was utterly demolished which resulted in a fatality,'' Barylski wrote.

Vermilion police worked with the State Highway Patrol to analyze driving data from inside the car's computer, according to court records. One summary said the car was accelerating at 100 percent throttle at four seconds before the crash, showing speeds of 73, mph, 74 mph and 76 mph, according to court records.

Again, the amount of data available goes up exponentially...

http://slashdot.org/article.pl?sid=07/01/21/0044254&from=rss

NYC 911 to Accept Cellphone Pics and Video

Posted by Zonk on Saturday January 20, @10:34PM from the looking-through-the-phone dept. The Internet Media Technology

SpaceAdmiral writes "New York City is developing a plan to allow images to be sent to 911 emergency operators from cellphones. This will likely give emergency operators better information to pass along to responders. They're also planning on implimenting a program of streetcorner video cameras, as seen in the city of London. According to John A. Feinblatt, Mayor Michael Bloomberg's criminal justice coordinator: 'The more information that the police have and the more quickly that they get it, the more likely that they are going to fight a crime.'"

How practical do you think it is to expand this sort of project to cities across the country? Moreover, is it worth the expense?

Why would the school want police powers? Would they handle threats without involving the police?

http://www.technewsworld.com/rsstory/55261.html

School Safety: Technology Outpacing the Law

By Monique Garcia Chicago Tribune 01/20/07 4:00 AM PT

The bill would give school districts the authority to expel or suspend students for making "explicit threats" online toward other students, teachers or school personnel. It would give Illinois one of the toughest laws on the issue of cyberspace threats involving schoolchildren, allowing schools to hold students accountable for computer postings that pose a "reasonable threat."

After threatening to assassinate his assistant principal on MySpace.com last spring, a 15-year-old student at Bednarcik Junior High School in Oswego, Ill., was charged with harassment through electronic communication, a felony.

His threats on the popular social networking Web site were serious enough to draw action by the police, but school officials found there was little they could do.

Under Illinois law, officials may discipline students for misbehavior on school property or at school-sponsored events, but they have little authority over what students do off campus or in cyberspace. [Shouldn't it work that way? Bob]

School Wants More Power

It's a case of technology outpacing the laws on the books, so school officials contacted Illinois House Republican leader Tom Cross, of Oswego, and he has begun a push for legislation to give schools extra power.

"This isn't an issue of schools saying we are going to start monitoring Web sites," [“We'll only look for evidence of crimes committed by students we hate, you know: blacks, jews, and republicans...” Bob] Cross said. "It's about giving them the power to perhaps keep the kid out of the school system. Right now, their hands are tied."

... In May 2005, a 14-year-old Pennsylvania student was expelled from a middle school because of threatening rap lyrics he posted on the Internet. The ACLU of Pennsylvania filed a lawsuit against the Riverside Beaver School District, claiming the punishment violated the First Amendment.

"It was a rap battle, and if you understand hip-hop music at all, you understand there is a lot of metaphorical violence," said Wiltold Walczak, the Pennsylvania ACLU's legal director. "There is a whole body of law under the 1st Amendment that makes it clear you can't punish someone for a threat unless it's a true threat."

The school district settled the case for US$90,000 after a court ruled that the posted lyrics -- about school shootings and getting back at another student who taunted him -- were not true threats, Walczak said. The school now restricts its authority over children to activities at the school or during school events, he said.

Another one bites the dust... (bytes the dust?)

http://it.slashdot.org/article.pl?sid=07/01/20/1936257&from=rss

Chinese Prof Cracks SHA-1 Data Encryption Scheme

Posted by Zonk on Saturday January 20, @03:39PM from the mad-math dept. Security Encryption Education Math

Hades1010 writes to mention an article in the Epoch Times (a Chinese newspaper) about a brilliant Chinese professor who has cracked her fifth encryption scheme in ten years. This one's a doozy, too: she and her team have taken out the SHA-1 scheme, which includes the (highly thought of) MD5 algorithm. As a result, the U.S. government and major corporations will cease using the scheme within the next few years. [Note that even though they know it can be broken, they will continue to use this crypt... Sad, isn't it. Bob]

From the article: " These two main algorithms are currently the crucial technology that electronic signatures and many other password securities use throughout the international community. They are widely used in banking, securities, and e-commerce. SHA-1 has been recognized as the cornerstone for modern Internet security. According to the article, in the early stages of Wang's research, there were other data encryption researchers who tried to crack it. However, none of them succeeded. This is why in 15 years Hash research had become the domain of hopeless research in many scientists' minds. "

Another crack?

http://www.engadget.com/2007/01/20/blu-ray-cracked-too/

Blu-ray cracked too?

Posted Jan 20th 2007 11:59AM by Ryan Block Filed under: HDTV, Home Entertainment

It's still early on to tell whether this is actually true, but HD DVD cracker muslix64 is back, and with the help of another anti-DRM cracker, Janvitos, claims to have also broken the Blu-ray's implementation of AACS. Although their protection does not yet account for BD+ copy-protection, they claim to have been able to implement the same key-grabbing known-plaintext attack as muslix64 used to crack HD DVD in order to successfully to crack Blu-ray without even using a disc or drive (apparently they just used a raw encrypted data file and nothing more). Unfortunately they haven't yet posted code for us to test this out, so we'll have to take their word for it for the time being.

Another crack?

http://ouriel.typepad.com/myblog/2007/01/i_can_finally_g.html

20 January 2007

I can finally get rid of iTunes

I love the iPod but i HATE iTunes. Not convenient for synchronizing in multiple computers, slow, heavy in ressources for movies you have to convert to their stupid format….

Thanks to Christian from ProCab i have (very lately) discovered YamiPod, a freeware, developped by a student that enables you to manage your music AS YOU WANT. You can for example add music by simple drag and drop from your folder, the soft is fast, read all features heres.

The KILLER feature. You can copy music from iPod to your computer, bye bye stupid DRM rules that do not let me copy music i bought from my iPod to another computer (at work for example) [Attention Security Manager Bob] Works on mac/linux/windows

Now i am friend again with my iPod. Christian, you saved my iPod life

update: There is more on the subject here

They did it for the worst possible reason – they put their convenience above the law.

http://politics.slashdot.org/article.pl?sid=07/01/20/1449231&from=rss

Ohio Recount Rigging Case Goes to Court

Journal written by MarkusQ (450076) and posted by CowboyNeal on Saturday January 20, @10:15AM from the counting-down-the-hits dept.

The Akron Beacon Journal is reporting that the trial of the three election workers accused of rigging the 2004 presidential election recount in Cuyahoga County is finally underway. As you may recall, this was the case where poll workers 'randomly' selected the precincts to recount by first eliminating from consideration precincts where the number of ballots handed out on Election Day failed to match the number of ballots cast and, then opening the ballot boxes in private and pre-counting until they found cases which would match up. What is interesting here is that they have already admitted doing this and that it was clearly counter to the letter and the spirit of the law, but still insist it wasn't really 'wrong,' presumably since they only did it to avoid having to go to the bother of a full recount as required by law.

Nothing much now, but expect to see collections of podcasts/videos from law firms, schools, and anyone who wants to be seen as an “expert.”

http://www.researchbuzz.org/wp/2007/01/21/directory-of-business-podcasts/

January 21, 2007

Directory of Business Podcasts

Filed under: Business-Research, Multimedia-Audio

Looking for business podcasts? Check out iBizRadio at http://www.iBizRadio.com , a directory of business-oriented podcasts.

The site is a searchable subject index with categories ranging from accounting to travel and hospitality. Not all categories have listings — actually this directory looks a bit sparsely populated. Category pages have listings with brief descriptions and “last updated” notes so you can see when the podcast has updated. (Unfortunately not all podcasts include date information so not all podcasts have “last updated” flags.)

Each podcast has its own page with a list of recent episode that you can download directly. There’s also an Flash-based player on the page for each episode so you can listen if you’d rather not download.

I’m really surprised there’s not more here, but it’s a nice idea.

Weird enough to be amusing? “Now you can use your doctoral dissertation to crack the top 40!”

http://digg.com/music/let_a_computer_sing_it_for_you

let a computer sing it for you!

Just type in your text and an online application will look up song lyrics that match, and put then together into one song!

http://www.sr.se/P1/src/sing/index.htm?key=2BJAJBJL#

Another technological solution to global warming?

http://ecoiron.blogspot.com/2007/01/black-google-would-save-3000-megawatts.html#links

Saturday, January 20, 2007

Black Google Would Save 3,000 Megawatts a Year

As noted, an all white web page uses about 74 watts to display, while an all black page uses only 59 watts. I thought I would do a little math and see what could be saved by moving a high volume site to the black format.

Take at look at Google, who gets about 200 million queries a day. Let's assume each query is displayed for about 10 seconds; that means Google is running for about 550,000 hours every day on some desktop. Assuming that users run Google in full screen mode, the shift to a black background will save a total of 15 (74-59) watts. That turns into a global savings of 8.3 Megawatt-hours per day, or about 3000 Megawatt-hours a year. And at 10 cents a kilowatt-hour, that's $300,000, a goodly amount of energy and dollars for changing a few color codes.

Ideas?

http://michaelzimmer.org/2007/01/20/nyu-colloquium-on-information-technology-society-spring-2007-schedule/

NYU Colloquium on Information Technology & Society Spring 2007 Schedule

Posted on Saturday, January 20th, 2007 at 7:02 pm

The spring 2007 schedule for the Information Law Institute (NYU Law School) Colloquium on Information Technology & Society has been announced.

Remember, records are made to be broken...

http://news.com.com/2100-7349_3-6151546.html?part=rss&tag=2547-1_3-0-5&subj=news

Swedish bank hit by 'biggest ever' online heist

By Tom Espiner Story last modified Fri Jan 19 10:48:28 PST 2007

Swedish bank Nordea has told ZDNet UK that it has been stung for between seven and eight million Swedish krona--up to $1.1 million--in what security company McAfee is describing as the "biggest ever" online bank heist.

Over the last 15 months, Nordea customers have been targeted by e-mails containing a tailor-made Trojan, said the bank.

Nordea believes that 250 customers [$4,400 per customer. Bob] have been affected by the fraud, after falling victim to phishing e-mails containing the Trojan. According to McAfee, Swedish police believe Russian-organized criminals are behind the attacks. Currently, 121 people are suspected of being involved.

The attack started by a tailor-made Trojan sent in the name of the bank to some of its clients, according to McAfee. The sender encouraged clients to download a "spam fighting" application. Users who downloaded the attached file, called raking.zip or raking.exe, were infected by the Trojan, which some security companies call haxdoor.ki.

Haxdoor typically installs keyloggers to record keystrokes, and hides itself using a rootkit. The payload of the .ki variant of the Trojan was activated when users attempted to log in to the Nordea online banking site. According to the bank, users were redirected to a false home page, where they entered important log-in information, including log-in numbers.

After the users entered the information an error message appeared, informing them that the site was experiencing technical difficulties. Criminals then used the harvested customer details on the real Nordea Web site to take money from customer accounts.

According to McAfee, Swedish police have established that the log-in information was sent to servers in the US, and then to Russia. [Tracing e-criminals won't be easy... Bob] Police believe the heist to be the work of organized criminals.

Nordea spokesman for Sweden, Boo Ehlin, said that most of the home users affected had not been running antivirus applications on their computers. The bank has borne the brunt of the attacks and has refunded all the affected customers.

Ehlin blamed successful social engineering for the heist, rather than any deficiencies in Nordea's security procedures. [The bank had no control over their client's actions. But they could have prevented this... Bob]

... In an effort to combat fraud, most banks have a policy of monitoring the behavior of people claiming to be their customers, so that unusual transaction behavior can be investigated and halted if fraudulent.

Nordea was aware [suspected? Bob] that some of the attempted transactions were false because of the large sums involved. However, during a period of 15 months a large series of small transactions enabled the criminals to successfully transfer a huge sum overall.

"In some cases we saw the transactions were false, and in some cases we didn't," said Ehlin. "We can't look at every transfer, [Your computer system does. Bob] and it looked like our customers had made the transfer. Most of the cases were small amounts that we thought were ordinary. We lost approximately seven to eight million krona."

Nordea has two million Internet banking customers in Sweden. The police investigation is underway, and the bank is currently reviewing its security procedures.

Another new record?

http://techdirt.com/articles/20070119/090325.shtml

Ladies And Gentlemen, We May Have A New Winner For Most Credit Card Data Leaked

from the congrats-all-around dept

There was some talk yesterday about how TJX, the parent company for discount clothing stores T.J. Maxx, Marshalls and some others had lost some credit card data after their systems were hacked. Today, additional information is starting to come out suggesting that this may take the lead as the largest single set of compromised credit card data, reaching even beyond the 40 million or so records lost by CardSystems a few years back. Since those responsible for that data loss only got a slap on the wrist, perhaps it's not surprising that others haven't done much to beef up credit card security. In fact, another article on this story claims that, despite strict guidelines from Visa and Mastercard for how this type of data needs to be handled only 31% actually comply with the guidelines -- and apparently TJX is among those who don't comply (big surprise there). Since it's apparent that not much has happened in the past few years to better protect our data, expect plenty of fretting over what this means and how to do a better job... until enough people forget about it, and we're all set up for a year or two down the road when we'll have a new winner in the largest single data leak ever.

Does ANYONE think about what they are saying to the press?

http://www.kansascity.com/mld/kansascity/16493570.htm

Posted on Fri, Jan. 19, 2007

26 IRS tapes missing from City Hall

Records were delivered in August. Trail of where taxpayer data went is under investigation.

By LYNN HORSLEY The Kansas City Star

Twenty-six IRS computer tapes containing taxpayer information are missing after they were delivered to City Hall months ago.

Kansas City is one of hundreds of governmental entities that share taxpayer information back and forth with the Internal Revenue Service. City officials use the federal tax return information to enforce their collection of the 1 percent city earnings tax, which is paid by people who live or work in Kansas City.

City and IRS officials on Thursday either would not or could not say exactly what information is on the tapes or the number of taxpayers whose information is on the tapes. [Experience suggests the answer is “could not say” Bob]

But the information potentially could include taxpayers’ names, Social Security numbers and bank account numbers, or they could contain employer information.

The tapes require special equipment to read [a Tape Reader, available anywhere Bob] and software that is not commonly used, [Nonsense. Any programming language will do... Bob] so the average person could not access the information, said Assistant City Manager Rich Noll.

“We have no reason to believe there was any foul play,” [and no evidence to the contrary Bob] Noll said, although he added he could not rule it out.

Special agents with the Inspector General’s office of the Treasury Department, along with city officials, are investigating the missing tapes, Noll said.

Several Kansas City Council members said Thursday that they had been briefed on the missing tapes but that the matter was too sensitive for them to comment further. [What an asinine statement. Bob]

... Employees in the city’s Office of Management and Budget and the Finance Department were sent home early on Jan. 3 and their offices were searched, but the tapes were not found. [This is a bit unusual, isn't it? Bob]

Noll said he did not think the tapes contained images of tax forms. He said he did not think there was significant risk that sensitive taxpayer information had been inappropriately released, but he could not say there was no risk.

When asked why the city couldn’t provide more information about what type of information was missing, city spokeswoman Mary Charles said the city had never received this type of tape before. [“...and the IRS won't tell us anything about them.” Bob]

“The tapes were never reviewed, [“We seldom do our job,.” Bob] so we don’t know what’s on there,” she said.

The trail of where the tapes went in City Hall is what is under investigation, Charles said. There is no documentation to show that the tapes ever reached the Finance Department, [Control your sensitive data, people! Bob] where they would have been reviewed.

Follow-up. There seems to be a universal tendency to underestimate the loss – a lot!

http://www.wfaa.com/sharedcontent/dws/news/localnews/stories/012007dnmetutdhack.58085a1e.html

UTD says more put at risk of ID theft

Computer attack exposed personal data of up to 35,000 people

08:29 PM CST on Friday, January 19, 2007 By HOLLY K. HACKER / The Dallas Morning News

A computer attack at the University of Texas at Dallas was worse than officials first thought. They now say Social Security numbers and other personal information may have been exposed for up to 35,000 faculty, current and former students, staff and others, putting them at risk of identify theft.

Officials said Friday that the names and Social Security numbers of 29,000 library cardholders may have been exposed. That group mainly includes students, faculty and staff, along with a few hundred people who aren't affiliated with UTD but have used its library.

UTD officials first reported the computer attack in December and said 6,000 people were affected.

... There is evidence the attack was "somewhat automated," [Another meaningless phrase? Bob] said Ms. Rogers, who declined to elaborate.

If your were the CEO of TJX, this headline could give you a heart attack...

http://news.bostonherald.com/localRegional/view.bg?articleid=177931

Give her credit: AG fights off identity theft

By O’Ryan Johnson Friday, January 19, 2007 - Updated: 12:34 AM EST

Dude, you’re not getting a Dell, but you might be getting a cell - a jail cell.

A week before Martha Coakley was sworn in as attorney general, a cyber crook illegally used her credit card number to buy a Dell computer, and a rather pricey one at that.

“I’m sure they didn’t know (she is the state’s top prosecutor) when they took the number,” Coakley said with a chuckle. “I wouldn’t go after the new AG.”

Coakley said she was leaving on a ski vacation a week ago Monday when she got the call from Dell saying someone had ordered a computer worth about $1,250 and had requested it be shipped to an address in Texas.

Coakley said she called Dell and canceled the shipment, telling them she did not order the machine. She said it appears someone stole the information off one of her credit cards and used it to buy the computer. She said the credit card number theft is not related to consumer information stolen from TJX Corp.

“There was no damage done,” she said. “I was lucky to find out before someone went on a shopping spree.”

Coakley said she canceled the card and ordered a new one, and that appears to be the end of it.

She said the chances of catching the crook - even for the state’s top prosecutor - are slim to none, since even if they could link it to a person, jurisdictional issues would likely hamper an effort to prosecute.

“I wasn’t a victim of the conventional form of ID theft, but still I think it’s something a lot of people suffer,” she said, noting that the crook didn’t use her Social Security number to set up lines of credit.

“It can happen fairly easily.”

This is a new one to me...

http://www.financial-education-icfe.org/identity_theft_specialist/identity_theft_risk_management_specialist_certification.asp

Institute of Consumer Financial Education

The ICFE has developed the "ICFE Certified Identity Theft Risk Management Specialist" (CITRMS) educational and certification testing program. The main purpose is to comprehensively prepare and equip law enforcement professionals, financial planners and CPA's, resolution advocates, notaries, lawyers, credit and debt counselors, through education, testing and computer software training, with the knowledge and skills necessary to help consumers and businesses fully assess and minimize their present risk of credit and identity theft.

Think this might be useful?

http://www.ed.gov/news/pressreleases/2007/01/01182007.html

U.S. Department of Education Office of Inspector General Launches New DVD: 'Identity Theft: It's Not Worth It'

FOR RELEASE: January 18, 2007 Contact: Catherine Grant (202) 245-7023

Editor's note: For a free copy of the DVD, please contact the U.S. Department of Education, Office of Inspector General, at (202) 245-7023.

The U.S. Department of Education's Office of Inspector General (OIG) today announced the release of its second DVD on the issue of identity theft in the student financial assistance arena.

Entitled "Identity Theft: It's Not Worth It," the DVD tracks how OIG, together with the U.S. Attorney's Office, U.S. Marshals Service, U.S. Postal Inspection Service, and Truckee Meadows Community College stopped a $1 million financial aid fraud scam, spearheaded by 64-year old grandmother, Ann Armstrong.

Along with four of her children and three of her grandchildren, Armstrong was convicted of using the identities of more than 65 people to fraudulently obtain federal student aid at various colleges in Arizona, Colorado, Maryland, Nevada, and Texas.

From January 2000 to March 2004, the Armstrongs obtained personal identifying information for various people and used it to enroll in distance education/on-line classes at colleges in those states. They applied for federal student loans and grants through the schools using these identities, submitting all information via e-mail or fax.

Checks for the loans or grants were sent in the students' name to addresses provided on the applications which the Armstrongs then picked up, cashed, or deposited into bank accounts using false identification.

The fraudulent scheme was initially reported to the OIG by a financial aid officer at Truckee Meadows Community College in Reno, Nev. The financial aid officer observed that a number of students were applying for financial aid using the same addresses and telephone numbers. [Apparently not a check made at the federal level... Bob] OIG initiated an investigation, ultimately leading to the filing of a criminal complaint and issuance of arrest warrants against the conspirators.

... Since 2003, the OIG, together with the U.S. Department of Education's Office of Federal Student Aid, has conducted a public awareness campaign to alert students, schools, and other financial aid participants about identity theft via the OIG's special Web site, www.ed.gov/misused.

The site provides information on scams, suggestions for preventing identity theft, and resources on how to report identity theft involving federal education dollars.

In 2003 with the assistance of the Arizona Department of Public Safety, OIG produced its first DVD on this issue, entitled, "FSA Identity Theft: We Need Your Help." This report featured an individual incarcerated for student aid fraud who described the techniques he used to steal identities.

These DVDs are made available to schools and student groups, and the media upon request. For more information on the mission and activities of the Office of Inspector General, visit: www.ed.gov/about/offices/list/oig/.

What, me worry? It's not like someone would track me down and punch me in the nose – is it?

http://www.newassignment.net/blog/keith_axline/jan2007/17/how_to_nine_ways

Finding Those Local Blogs

by Keith Axline on January 18, 2007 - 11:40am.

The last step in the rise of the blog will be the connection of virtual and real space. Your favorite blogger might be in New York, but if you’re living in Oregon, chances are he’s not going to be covering local ordinances or missing dogs.

This is a crucial step for citizen journalism and the democratic process in general. When supporting local causes is as easy as checking your RSS reader, and when the paths of communication are transparent, the seemingly giant gap between an initial desire for change and actually seeing results evaporates.

So how do you find out who’s blogging in your neighborhood? Many hyperlocal blog directories are sprouting up and existing blog aggregators are growing local searches in order to fill this emerging demand. Here are a few of the better ones. (Don’t see your favorite local blog search here? Let us know in the comments of this post.)

Placeblogger.com: The most recent and promising site on the scene, to which Jay Rosen serves as an advisor, Placeblogger has a slick interface and enough buzz to draw a healthy amount of contributors. The success of any of these sites rests on the amount of participation, and Placeblogger seems to have a lot of momentum. Most of the towns I typed in - large or small - had enough blogs listed to keep me interested. The launch package also included a list of the top 10 placeblogs in the country.

Backfence.com: Though only available in a few cities at the moment, Backfence does a lot of things right. It’s easy to contribute to and navigate the site. The ‘Crime Log’ category and the photo gallery seemed particularly helpful. Backfence is currently in a state of transition, after losing , some of its original management team but is still attempting to expand into other cities as funding allows. If you like their format, you should write in and request they take a look at your city as a potential destination.

Feedmap.net: Feedmap is a little rough around the edges, but it gets the job done. Just type in the location you’re looking for and a map pops up with geotagged feeds from local blogs. It also has tools for adding a local blogroll to your own blog and a map image of your location.

Outside.in: This is my personal fave as far as design and content. It tends to only tap a few blogs in some of the more remote areas, but with more time I could see this becoming a great site. Started by Steven Johnson, co-creator of FEED magazine and Plastic.com, Outside.in is in good hands.

Metroblogging.com: Instead of aggregating other blogs in a particular area, Metroblogging hand-picks a few bloggers in a specific city and sets them up on one of their pre-formatted blogs. While this site doesn’t exactly fit perfectly into this list, the quality of its blogs are excellent and they encourage your participation. You may find other blogs in your area by following your town’s Metroblog.

Topix.net: This site is a great tool for narrowing in on any subject, whether it be local blogs or news stories on a specific subject. Topix works better as a local news aggregator than a blog finder, but I was able to find a few gems that weren’t listed elsewhere. Using their advanced search option you should be able to look up blogs by zip code, but the search results still produce local news sites in addition to great local blogs and the localized forums put you directly in touch with people from your neighborhood.

Blogdigger Local: This site feels a little ghetto, but shared some of the same buzz last year that Placeblogger is enjoying now. It definitely has some unique sites registered, and it could fill some crucial holes in your local blog web.

Technorati: Searching for local blogs is just one of the many features available at Technorati. If you’re specific enough, you can usually get excellent results, but it’s not explicitly geared towards that type of function, so the hits tend to not be as focused. A little work on your part could lead to a very local community of bloggers, but it’s not just sitting there for the taking.

AmericanTowns.com: Recently featured in a New York Times article, American Towns has a great interface, but not much more … yet. There’s a lot of potential here if a wide variety of people actively contribute, but when I looked up San Francisco, for example, the only events listed were religious events posted by local churches.

Miscellaneous: Micah Sifry at Personal Democracy Forum has a great post about this topic, specifically for political blogs. A couple directories he mentions are LeftyBlogs for Democrats and Blogatorium for Republicans. CitizenJournalist.net also has some great links related to this topic, although it’s not a blog directory.

There is a lot of potential in these sites that hasn’t really solidified into a standard function or practice. It reminds me of when e-mail and Internet were available on local BBS’s but no one really knew what to do with them. The localized blog movement needs a MySpace or Friendster to get it going. So far, only Placeblogger seems like it might be that type of site. You can help catalyze the movement by registering as many sites as you can with these services and geotagging your own blog. Happy hunting.

For my Business Continuity students... Looks like you should never rely on computers in coastal California, the gulf coast, or Florida.

http://royal.pingdom.com/?p=79

January 19, 2007

Where NOT to keep your servers according to Mother Nature

If Mother Nature has anything to say, there simply are some places where you shouldn’t place a data center.

... We decided to look at heat maps for earthquakes, hurricanes and tornadoes in the U.S. to see exactly where the danger areas were located. In addition to that we also composited them to see get the full picture.

More to my liking than DRM – hold the consumer accountable for their actions, but don't restrict them.

http://yro.slashdot.org/article.pl?sid=07/01/19/1918221&from=rss

Startup Tries Watermarking Instead of DRM

Posted by Zonk on Friday January 19, @02:43PM from the commendable-actions-mean-profits dept. Movies Businesses Technology

Loosehead Prop writes "A U.K. startup called Streamburst has a novel idea: selling downloadable video with watermarks instead of DRM. The system works by adding a 5-second intro to each download that shows the name of the person who bought the movie along with something like a watermark: 'it's not technically a watermark in the usual sense of that term, but the encoding process does strip out a unique series of bits from the file. The missing information is a minuscule portion of the overall file that does not affect video quality, according to Bjarnason, but does allow the company to discover who purchased a particular file.' The goal is to 'make people accountable for their actions without artificially restricting those actions.'"

Why is Colorado the home of e-voting machine certification? (Why haven't any machines been ISO certified before?)

http://news.com.com/2061-10796_3-6151592.html?part=rss&tag=2547-1_3-0-5&subj=news

E-voting test labs get initial nod

January 19, 2007 11:25 AM PST

Two Colorado-based laboratories this week became the first companies to receive the initial go-ahead in their quest for federal approval to test electronic voting machines used by American voters.

In a letter (PDF) on Thursday, the National Institute of Standards and Technology (NIST) recommended that iBeta Quality Assurance of Aurora, Colo. and SysTest Labs of Denver be granted final clearance to test the systems.

... The federal law leaves it up to states whether to pay attention to the EAC accreditations, but many are expected to require that their equipment be tested by those companies. Before HAVA, test labs were certified by the National Association of State Election Directors, and 39 states required their machines to have undergone testing by labs accredited by that group.

You do not need to be a lawyer to participate! (...or for any other reason I can think of...)

http://www.bespacific.com/mt/archives/013647.html

January 19, 2007

Free Acrobat for Legal Professionals eSeminar on 1/25

Covers PDF creation, security, Bates numbering, redaction, eFiling and more. Sign Up Here.

...from the Forrest Gump (Stupid is as stupid does) school of burglary. Perhaps we could add GPS devices to all those laptops that get stolen?

http://news.yahoo.com/s/ap/20070119/ap_on_fe_st/stolen_gps

GPS devices lead to suspects' home

1 hour, 20 minutes ago

Three thieves who allegedly stole 14 global positioning system devices didn't get away with their crime for long. The devices led police right to their home.

Town officials said the thieves didn't even know what they had: they thought the GPS devices were cell phones, which they planned to sell.

According to Suffolk County police, the GPS devices were stolen Monday night from the Town of Babylon Public Works garage in Lindenhurst. The town immediately tapped its GPS system, and it showed that one of the devices was inside a house. Police said that when they arrived there, Kurt Husfeldt, 46, had the device in his hands.

Husfeldt was charged with criminal possession of stolen property. His 13-year-old son also was arrested on grand larceny charges.

Town officials said the boy committed the burglary with Steven Mangiapanella, 20, also of Lindenhurst. He was charged with grand larceny.

Babylon installed 300 GPS devices in snow plows, dump trucks, street sweepers and other vehicles last January.