...because...

http://www.pogowasright.org/article.php?story=20080623070247587

Data “Dysprotection:” breaches reported last week

Monday, June 23 2008 @ 07:02 AM EDT Contributed by: PrivacyNews News Section: Breaches

A recap of incidents or privacy breaches reported last week for those who enjoy shaking their head and muttering to themselves with their morning coffee.

Source - Chronicles of Dissent

“Yeah, it's a problem, we just have no idea what to do about it.”

http://www.phiprivacy.net/?p=489

Jun-22-2008

Agency Sees Theft Risk for ID Card in Medicare

Robert Pear of the NY Times reports:

Social Security officials, concerned about the risk of identity theft, are calling for immediate action to remove Social Security numbers from the Medicare cards used by millions of Americans.

But Medicare officials have resisted the proposal, saying it would be costly and impractical.

[...]

Read the full story in NY Times

Not exactly e-discovery, but useful background information?

http://www.pogowasright.org/article.php?story=20080622141447914

Judges angry at Ottawa for mining personal tax information in labour dispute

Sunday, June 22 2008 @ 02:13 PM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

The Conservative government is facing criticism for using the personal income-tax information of more than 500 sitting federal judges during salary negotiations.

The lawyer who acted as counsel for the judges says the tactic may have violated their privacy and threatens the independence of the judiciary.

Source - Canadian Press

Tools & Techniques Give someone a tool and they'll find a way to mis-use it.

http://www.pogowasright.org/article.php?story=20080623070808509

UK: Councils Told: Stop Spying On The Public

Monday, June 23 2008 @ 07:08 AM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

Bosses have been warned by the head of the Local Government Association (LGA) that they risk alienating the public for so-called snooping.

They may also be stripped of the right to use spying methods.

Source - Sky News

For your CPO So who is right?

http://www.pogowasright.org/article.php?story=2008062306464189

What Privacy Policy?

Monday, June 23 2008 @ 06:46 AM EDT Contributed by: PrivacyNews News Section: Businesses & Privacy

Want to know how well a company protects its customers' data? Don't talk to its security and compliance officers. Instead, try its marketing department.

A study released Monday by the privacy-focused Ponemon Institute and funded by e-mail marketing firm Strongmail reveals a disturbing disconnect in companies between the executives tasked with protecting customer data and marketing departments, which use the data for advertising purposes or share it with third parties.

Source - Forbes

From StrongMail's press release, key findings:

• 75% of privacy professionals believe their organization limits the customer information that is shared with third parties vs. 40% of marketers

• 59% of marketers reported that a data breach resulted in the loss of potential customers, and 56% reported a corresponding loss in existing customers

• 72% of marketers who outsource email marketing reported a data breach vs. 56% of marketers from the general survey population

• Only 44% of marketers believe that they are compliant with CAN-SPAM vs. 83% of privacy professionals

Paper available for download at StrongMail

For your security manager

http://www.pogowasright.org/article.php?story=20080623071325665

An Analysis of PRC's “Chronology of Data Breaches” and Implications for Information Security Professionals

Monday, June 23 2008 @ 07:13 AM EDT Contributed by: PrivacyNews News Section: Breaches

... The first part of this article will present an analysis of information derived from the [Privacy Rights] Clearinghouse database; a second article, to be published in a few weeks, will attempt to extract conclusions from this analysis.

Source - BlogInfoSec.com

Related - The Identity Theft Resource Center provides breach reports for each year plus statistical analyses.

Related - The Attrition.org: DLDOS database of breaches can be statistically analyzed via Etiolated.org

Related analyses of 2007 and 2006 data from Chronicles of Dissent:

Looking at 2007’s data breaches in perspective
Second look: What kind of year was 2007 in terms of data breaches?
2007 vs. 2006 breaches: thefts, loss, and hacks

Ditto

http://www.pogowasright.org/article.php?story=20080623074319642

New Javelin Research Pinpoints How Institutions Should Respond to Data Breaches

Monday, June 23 2008 @ 07:43 AM EDT Contributed by: PrivacyNews News Section: Breaches

Javelin Strategy & Research announced today results from a new study covering data breach victims, which highlights the acute awareness among consumers about data security and the significant implications security breaches represent to businesses once consumer trust is compromised.

Source - Forbes

From Javelin's press release, key findings:from their survey of breach victims:

• 55% of consumers experiencing a security breach expressed diminished confidence in the breached organization's ability to protect and mange their personal data.

• Data breach victims (56%) favor a solution that prevents fraud and although there are several solutions available, Javelin identifies the benefits of contacting the consumer, creating an audit trail that law enforcement can utilize, preserving the consumer's privacy and proving it works.

• Providing a fraud protection solution makes a tremendous difference in customer approval of the breached organization's management and handling of the incident. Javelin data shows that 55% of breach victims that were offered a fraud protection solution were more satisfied with the institution's handling of the incident, compared to those consumers who were not offered anything.

A free copy of the research is available at www.debix.com/javelin

Related - On July 15th at 10:00am PDT, Javelin plans to present its findings during an educational webinar that will be open to the public, titled: When a Data Breach Occurs, What Do Consumers Expect? Sponsor and co-presenter, Debix, will present its Identity Protection Network, which focuses on building solutions that prevent identity theft and publishing metrics to prove their solution works. Registration for the webinar can be found at: https://www1.gotomeeting.com/register/254276431

Ditto

http://www.infoworld.com/article/08/06/23/Liberty_releases_guidelines_for_data_management_handling-IDGNS_1.html?source=rss&url=http://www.infoworld.com/article/08/06/23/Liberty_releases_guidelines_for_data_management_handling-IDGNS_1.html

Liberty releases guidelines for data management, handling

Pair of frameworks help businesses safeguard sensitive data

By Jeremy Kirk, IDG News Service June 23, 2008

... The Identity Governance Framework (IGF) is an XML (Extensible Markup Language) schema that lets organizations set rules for specific types of data, Sullivan said. For example, the schema can be modified to tell a particular application to erase a certain type of personal data after 24 hours if it is no longer needed.

The schema can also define the rules under which one application is allowed to access information in another, or under what circumstances the information can be shared, Sullivan said. If data is lost, the schema can be set so the application displays a warning message of what to do and who to call.

Liberty also released the Identity Assurance Framework (IAF), a program by which businesses can get certified that they are qualified to handle data at varying levels of sensitivity.

The framework has four "assurance" levels, Sullivan said. The idea is that an external consultant can certify a business as complying with the framework at a certain level. The certification will act as a confidence-builder for another business that wants to enter into an arrangement where the two exchange data.

... The IAF is available for download here and the IGF is here.

You gotta admit these folks are creative.

http://torrentfreak.com/mpaa-says-it-doesnt-need-evidence-to-convict-pirates-080621/

MPAA Says It Doesn’t Need Evidence to Convict Pirates

Written by Ernesto on June 21, 2008

Only a few weeks ago, a University of Washington study showed showed how inaccurate the MPAA and RIAA’s evidence gathering techniques are. Now, instead of improving their pirate chasing tactics, the MPAA simply claims they don’t need any evidence to bankrupt “alleged” copyright infringers.

Threat Level reports that the MPAA now argues that it has the right to demand up to $150,000 in damages per illegally downloaded file, without having to proof that someone actually downloaded that file.

... In a brief submitted this Friday, as part of the ongoing “making available” debate in the Jammie Thomas case, Van Uitert writes:

“It is often very difficult, and in some cases, impossible, to provide such direct proof when confronting modern forms of copyright infringement, whether over P2P networks or otherwise; understandably, copyright infringers typically do not keep records of infringement.”

Just in case you think you can walk around anonymously..

http://www.nytimes.com/2008/06/22/technology/22proto.html?ex=1371787200&en=493d699accb3d69a&ei=5124&partner=digg&exprod=digg

Predicting Where You’ll Go and What You’ll Like

By MICHAEL FITZGERALD Published: June 22, 2008

... Sense’s models were developed initially from sources like taxicab companies that let it look at location data over such a period. Sense also uses publicly available data, like weather information, and other nonpublic sources that it would not disclose. “We had three-quarters of a billion data points from just one city,” Mr. Skibiski says.

... The Macrosense tool lets companies engage in “reality mining,” a phrase coined by Sandy Pentland, an M.I.T. researcher who was also a co-founder of Sense and now advises it on privacy issues.

... His original idea in 2002 was to pay people for their data, but a formula for doing so proved too complicated.

Instead, Sense decided to trade services for data. On the same day it released Macrosense, it announced a new software package called Citysense, which uses location data to show where people are going, say, for nightlife, and maps their activity. Consumers who have iPhones or BlackBerrys can sign up for the service, which does not ask for personal information. Over time, the software will learn their patterns [So it must be able to uniquely identify the “customer” Bob] and recommend places they might like to go, or show them where other people with similar patterns are going. If they want to purge their data, [another clear indication that the data can be identified as theirs... Bob] they can do so at any time.

For all those managers who think encryption is too costly or too complex...

http://yro.slashdot.org/article.pl?sid=08/06/22/1438234&from=rss

SSL Encryption Coming To The Pirate Bay

Posted by Soulskill on Sunday June 22, @11:20AM from the privacy-arms-race dept. Privacy Encryption The Internet

An anonymous reader writes

"The Pirate Bay, in response to Sweden's new wiretapping law, will start offering SSL encryption to its user base this week. Although copyright issues really have little to do with national security, The Pirate Bay knows its population is uneasy with the recent legal change. The encryption will mostly benefit Swedish users living under the current law. Since The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal."

I wonder which party has the most geeks?

http://news.slashdot.org/article.pl?sid=08/06/22/1534234&from=rss

Blogger Launches 'Google Bomb' At McCain

Posted by Soulskill on Sunday June 22, @12:22PM from the everyone-needs-a-hobby dept. Google Republicans The Media Politics

hhavensteincw writes

"A liberal blogger has launched a 'Google bomb' project aimed at boosting Google search results for nine news articles showing Sen. John McCain in a negative light. The Computerworld article notes: 'Chris Bowers, managing editor of the progressive blog OpenLeft, is launching the Google bombs by encouraging bloggers to embed Web links to the nine news stories about McCain in their blogs, which helps raise their ranking in Google search results. Bowers is reprising a similar Google bombing effort he undertook in 2006 against 52 different congressional candidates. "Obviously, it is manipulating, but search engines are not public forums and unless you act to use them for your own benefit, your opponent's information is going to get out there," Bowers said.'"

No doubt we'll see this on CSI

http://science.slashdot.org/article.pl?sid=08/06/22/1245243&from=rss

Fingerprints Recoverable From Cleaned Metal

Posted by Soulskill on Sunday June 22, @09:19AM from the leaving-a-mark dept.

dstates points out a recent article from guardian.co.uk which discusses a new method by which to recover fingerprints from metal. The method relies on corrosion caused by sweat and other biological residues on the metal's surface. Quoting:

"The patterns of corrosion remain even after the surface has been cleaned, heated to 600C or even painted over. This means that traces of fingerprints stay on the metal long after the residue from a person's finger has gone. The chemical basis of the change is not yet clear, but [Dr. John Bond] believes it is corrosion by chloride ions from the salt in sweat. These produce lines of corrosion along the ridges of the fingerprint residue. When the metal is heated, for example in a bomb blast or when a gun is fired, the chemical reaction actually speeds up and makes the corrosion more pronounced."

For my web site class. Now you can convert those boring PowerPoints into boring Flash

http://www.killerstartups.com/Web-App-Tools/ispringsolutions-com-converting-powerpoint-to-flash/

iSpringSolutions.com - Converting PowerPoint To Flash

If you want to make your PowerPoint cards and projects even more dynamic you can convert them to flash. iSpring allows users to convert their PowerPoint projects into Flash in just one click. iSpring lets users convert their PowerPoint projects into Flash movies while containing the animation effects of the PowerPoint project: such as, diagrams, charts, graphs, slide masters, mouse driven animations, flash files, all slide transition effects and more.

http://www.ispringsolutions.com/

A rambling, but interesting article. Lots of points to argue!

http://www.tribunetimes.com/apps/pbcs.dll/article?AID=/20080621/NEWS01/806210327/1144/TRIBUNETIMES

Workers should expect little computer privacy, experts say

Published: Saturday, June 21, 2008 - 12:53 pm Updated: Saturday, June 21, 2008 - 1:01 pm

By Ron Barnett and Ben Szobody STAFF WRITERS rbarnett@greenvillenews.com

Greenville County employees have "no expectation of privacy" on county computers and may be monitored if there's reason to suspect misuse, [e.g the employee looks happy? Bob] a policy that underscores what many employees ignore but may now be thinking: The boss is watching.

Hanging in the air since court documents revealed allegations that county Councilman Tony Trout used spyware on the county administrator's computer is what experts say is employers' free rein over the computers they provide for employees, meaning workers have no privacy rights on those machines.

What sets the Trout case apart is a legal distinction between individual council members, who County Attorney Mark Tollison said don't have any employer rights, and the council as a whole, which hires and fires the county administrator.

Trout, who has refused to comment to The Greenville News, has told WYFF TV that he accessed County Administrator Joe Kernell's computer, and that it was legal because Kernell is his employee.

No charges have been filed.

The council has countered Trout's argument before, voting 9-0 last year to reinforce state law with a county policy that sent a "clear signal" to county employees that they can refuse to respond to "coercion or force" from individual council members. It also prohibited council members from "interfering and intruding" on county operations.

Tollison points to a state Supreme Court ruling issued this month that said, in part, that an individual Anderson County Council member had no right to independently review county documents protected by attorney-client privilege, but that only the council as a whole could do so.

A 1978 state Attorney General's opinion says state law allows a council as a whole to conduct investigations but not individual council members.

Employers face no such restrictions.

"Unfortunately, there's almost no limit on what employers can do," said Lewis Maltby, president of the National Workrights Institute in Princeton, N.J. "The only reason there's a legal issue here is because it's not clear that the council member was the employer."

Monitoring by private companies can range from the suspicion of illegal activity triggering an investigation, to the spying of a firm intent on discovering if, for example, employees are using e-mail to hunt for another job, said Phil Yanov, executive director of the Greenville-Spartanburg-Anderson Technology Council.

The only restriction an employer has in monitoring employees' use of company equipment is they can't eavesdrop on personal conversations, Maltby said. [Of course they can... Bob]

Employers also would be crossing the line to intentionally read an employee's personal e-mail, he said.

"Your boss shouldn't deliberately look at your e-mail messages, arrange them by who they went to, and then deliberately look at all the ones you sent to your husband," he said. "It's legal. But there's no legitimate business reason to deliberately go out of your way to read someone's personal e-mail that they sent during their lunch break."

"We think the line should be drawn not on where the computer is located but by the nature of the message."

Interesting but anecdotal story of the perils of web 2.0. Might be a good presentation topic for the White Hat club.

http://www.technewsworld.com/rsstory/63469.html?welcome=1214136291

Getting Found Out, Web 2.0 Style

By Sarah Lacy Business Week Online 06/22/08 4:00 AM PT

Web 2.0 technologies and trends are threatening the tiny, white lies woven so tightly into our social fabric, writes Sarah Lacey. Want to call in sick to work after a night of partying? Better hope nobody posted a photo of that night on Facebook or Twittered about it.

Related If you really really want to spy on someone.... (Free trial available)

http://www.pcpandora.com/

PC Pandora

PC Pandora will monitor computer activity and allow you full access to key logging, instant message chats, password retrieval for myspace and other sites.

[From the website:

Monitors And Records All Emails, All Instant Message/Chats, Records All Key Strokes,

All Web Sites Visited, Monitor And Capture Every Program Run On Your PC

Related Technology that absolutely protects your privacy (except when it does not) Beware of “privacy protection” technology that is controlled by the company that is invading your privacy in the first place.

http://www.technovelgy.com/ct/Science-Fiction-News.asp?NewsNum=1704

Let's Hear It For The Vague Blur!

Widespread video surveillance has been a great boon - well, to someone, since studies in Great Britain show that there is virtually no significant reduction in crime in heavily surveilled neighborhoods.

The real problem is finding people (enough of them!) and paying them to watch all these cameras to search for wrong-doing.

The video-analysis company 3VR has built up a database of every last license plate, vehicle and face that is encountered by video cameras in its network and sounds the alarm if it sees a suspect anywhere.

As it turns out, there seem to be people who don't like being constantly photographed [Imagine that! Bob] every minute of their lives, and 3VR's engineers have come up with an interesting gimmick to help maintain the privacy of people who are being constantly photographed without their knowledge or consent.

This system uses the same algorithms that pick out faces and license plates; it then blurs the faces and vehicles that are not in their database of suspicious persons.

Of course, if you later become a suspicious "person of interest," security guards can "unlock" your image to reveal your real, sharp-featured self under the blur.

Are we tossing gasoline on the fire? Read further for an interesting hack and some insightful comments,

http://yro.slashdot.org/article.pl?sid=08/06/21/1814239&from=rss

Sandvine CEO Says Internet Monitoring a Necessity

Posted by kdawson on Saturday June 21, @04:48PM from the for-his-business-model-maybe dept.

Khalid Baheyeldin writes in with a CBC interview with the CEO of Sandvine, Dave Caputo (bio here). Sandvine is the Waterloo, Ontario-based company that provides the technology that Comcast and other ISPs use to overrule Net neutrality by, for example, injecting RST packets to disrupt Bittorrent traffic. Caputo says, among other things, that Internet monitoring is a necessity. Some of the comments to the interview are more tech-savvy than the interviewee comes across.

Even good companies make bad choices...

http://it.slashdot.org/article.pl?sid=08/06/21/1919223&from=rss

Safari "Carpet Bomb" Attack Still a Risk

Posted by kdawson on Saturday June 21, @05:51PM from the will-it-blend dept. Security Apple

SecureThroughObscure writes

"Just a short time after Apple's recent acknowledgment of and patch for the Safari Carpet Bomb 'blended' IE flaw, Microsoft researcher Billy Rios shows that Safari is still useful in a blended attack, this time with Firefox 2/3. (ZDNet's Nate McFeters also spread the word.) Rios claimed that he is able to use Carpet Bomb, despite the recent patch, to steal arbitrary files from victims who also have Firefox 2/3 installed. Both Rios and McFeters pointed out that Apple, which took some heat for not originally patching, actually did a good job of addressing the issue, as the code execution angle was not originally understood (the details came out later). Rios is withholding details of the new attack vector until Apple has had time to patch or respond to this issue."

[An explanation of Carpet Bombing including the HTML code to make your own:

http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html

Safari Carpet Bomb

... because the Safari browser cannot be configured to obtain the user's permission before it downloads a resource. Safari downloads the resource without the user's consent and places it in a default location (unless changed).

Music Lovers!

http://torrentfreak.com/isohunt-adds-10000-free-and-legal-albums-080621/

IsoHunt adds 10.000 Free and Legal Albums

Written by Ben Jones on June 21, 2008

Despite being ensnared in legal proceedings with the MPAA, isoHunt is continuing to grow. Adding fuel to the ’significant non-infringing use’ argument is their latest partnership, with the Creative Commons music distribution site Jamendo.

... isoHunt has announced a partnership with Jamendo, a site that deals in Creative Commons licensed music. Reaching the 10,000 album milestone only days ago, content available on Jamendo is growing quickly and when you grow, it helps to be able to get the content out there.

... “We receive up to 500 new albums per week, from more than 60 countries in the world,” Kratz said.

Happy Anniversary! (Imagine calling a one tonne computer “small scale”) Cute little video (old newsreel?) accompanies

http://it.slashdot.org/article.pl?sid=08/06/21/1436259&from=rss

'Modern' Computers Turn 60 Years Old

Posted by CowboyNeal on Saturday June 21, @11:39AM from the happy-birthday-baby dept. Upgrades Software Hardware Technology

Christian Smith writes

"Stored program computers are 60 years old on Saturday. The Small Scale Experimental Machine, or 'Baby,' first ran on the 21st of June, 1948, in Manchester. While not the first computer, nor even programmable computer, it was the first that stored its program in its own memory. Luckily, transistors shrank the one tonne required for this computing power to something more manageable."

Don't you love a good argument?

http://techdirt.com/articles/20080530/2014171272.shtml

Why The 'Third Party Doctrine' Undermines Online Privacy Protections

from the fourth-amendment dept

There's been an interesting discussion going on between my colleague Jim Harper and legal scholar Orrin Kerr about the third party doctrine, the legal principle that, in effect, you lose your Fourth Amendment rights when you relinquish information to a third party. The doctrine has become increasingly important with the rise of modern technology because we now entrust a host of private data -- including our email, cell phone calling data, credit card transactions, and more -- to private companies, and the third party doctrine would seem to suggest that Fourth Amendment protections would not extend to such information. A couple of weeks ago, Kerr posted a draft paper defending the doctrine, arguing that it brings clarity and simplicity to privacy law and avoids the need for "a complex framework of sui generis rules." Jim strongly disagrees with Kerr, arguing that the third party doctrine was always misguided and that recent technological changes have simply made these flaws more evident.

Jim points out that when the Fourth Amendment was drafted, the vast majority of peoples' private activities occurred inside the home, and so it made sense to make the home focus of Fourth Amendment protections. But as people began conducting more and more of their lives outside of the home, with telephones, email, credit cards, and so forth, using the four walls of the home as the boundary for Fourth Amendment protection made less and less sense. And indeed, that's precisely what the Supreme Court recognized in the famous 1967 case of Katz v. United States, which held that the Fourth Amendment applied to wiretapping of public pay phones because the Fourth Amendment protects "people, not places." The same principle ought to apply to our emails, credit card transactions, and other data of a private nature: what matters is not where the data is located or who has custody over it, but whether the subject of surveillance had a reasonable expectation of privacy in his use of that data.

Kerr responded that "the real judges and Justices that make the rules" have recently shown greater sympathy for Kerr's view of the Fourth Amendment as a narrow doctrine of criminal procedure rather than a broad charter for protecting peoples' privacy. I agree with Jim that this isn't really responsive to his argument. Whether judges currently do see things Kerr's way tells us little about whether they ought to view them that way. Judges have gotten the Fourth Amendment wrong in the past. After all, Katz overruled Olmstead v. United States, a decision that had allowed warrantless wiretapping almost four decades earlier. So the fact that the courts have not yet extended Fourth Amendment protections to email or other digital records doesn't prove that a future court won't recognize that such information is as crucial to personal privacy as paper records and phone calls. Sticking with the third party doctrine would make the Fourth Amendment less and less relevant as technology changes because more and more private information to be held by third parties. If we want the Fourth Amendment to continue to be an effective protection for peoples' privacy, and I think we do, it needs to be continuously updated to reflect changing technological realities.

Another “Some courts get it wrong” brief

http://yro.slashdot.org/article.pl?sid=08/06/21/0341239&from=rss

Law Profs File Friend-of-Court Brief Against RIAA

Posted by Soulskill on Saturday June 21, @08:19AM from the dissenting-opinions dept. Media The Courts

NewYorkCountryLawyer writes

"A group of 10 copyright law professors has filed an amicus curiae ('friend of the court') brief on the side of the defendant in Capitol v. Thomas, agreeing with the judge's recent decision that the $222,000 verdict won by the RIAA appears to be tainted by a 'manifest error of law.' The clear and well-written 14-page brief (PDF) argues that the 'making available' jury instruction, which the RIAA had requested and the judge ultimately accepted, was in fact a 'manifest error of law,' making the point, among others, that an interpretation of a statute should begin with the words of the statute. My only criticism of the brief is that it overstates the authorities relied on by the RIAA, citing cases which never decided the 'making available' issue as cases which had decided it in the RIAA's favor."

As it turns out, the MPAA, close ally to the RIAA, has come forth with a more controversial view. They suggest that proof of actual distribution shouldn't be required. From their brief (PDF): "Mandating that proof could thus have the pernicious effect of depriving copyright owners of a practical remedy against massive copyright infringement in many instances." [Huh? Bob]

Interesting question more businesses should be asking, with some useful answers. For my Business Continuation class

http://ask.slashdot.org/article.pl?sid=08/06/20/1549203&from=rss

Best Way To Store Digital Video For 20 Years

Posted by kdawson on Friday June 20, @03:57PM from the thanks-for-the-memories dept. Data Storage

An anonymous reader writes

"My kid is now 1 year old and I already have 100G of digital video (stored on DVDs, DVD quality) and photos. How should I store it so that it's still readable 10 to 20 years from now? Will DVDs stil be around, and readable, 10 years from now? Should I plan for technology changes every 5 to 10 years (DVD->Blue-ray->whatever)? Is optical storage better, or should I try to use hard drives (making technology changes automatic)? And, if the answer is optical, how do you store optical disks so that they last?"

Interesting idea: let an independent group evaluate your product. How long before pay is based on this type of review?

http://digg.com/tech_news/Forbes_has_launched_a_Digg_channel_and_Digg_widgets

Forbes has launched a Digg channel, and Digg widgets

forbes.com — Forbes.com has integrated with Digg to showcase the most dugg and most recently dugg Forbes.com stories, slide shows and videos.

http://www.forbes.com/digg/mostrecent/

Perhaps using the Kindle to replace textbooks isn't the ultimate in new education technology?

http://hosted.ap.org/dynamic/stories/P/PODCAST_CAMPUS?SITE=VALYD&SECTION=HOME&TEMPLATE=DEFAULT

N.M. school tries to reach students via podcast

By FELICIA FONSECA Associated Press Writer Jun 21, 7:12 AM EDT

... This past semester, nearly every one of the roughly 100 students at Fort Sumner High School was outfitted with the Microsoft media player, similar to Apple's iPod, enabling them to watch videos and listen to recorded lectures created or recommended by teachers and fellow students.

... Teachers got a $400 bonus for coming up with lessons to identify 20 downloadable digital lectures that supported their lessons and to develop five of their own.

Economics in action

http://digg.com/autos/U_S_motorists_brave_Mexico_border_violence_for_fuel

U.S. motorists brave Mexico border violence for fuel

reuters.com — By Lizbeth Diaz TIJUANA, Mexico (Reuters) - U.S. motorists are risking rampant drug violence in Mexico to drive over the border and fill their tanks with cheap Mexican fuel, some even coming to blows over gas shortages and long queues.

http://www.reuters.com/article/GCA-Oil/idUSN1919184420080619?rpc=64

Business opportunity: A small investment in an e-commerce site could yield big bucks!

http://techdirt.com/articles/20080620/1132211463.shtml

Less Well Known Musicians Embracing 'Pay What You Want'

from the small-musicians,-big-musicians-alike dept

It still amuses me how often when we talk about specific music business models, defenders of the old system rush in to explain why any particular example is an exception. For years, we showed examples of less well known musicians embracing these kinds of new business models, critics would complain that they might work for unknown musicians who have "nothing to lose" and need attention more than anything else, but it would never ever work for a big star who has too much to lose. Then, of course, we talked about big time musicians like Radiohead and Nine Inch Nails embracing these kinds of models, and the critics said "well, sure, it works for them with their well recognized name, but it would never work for unknown artists." Hell, someone said that just yesterday in response to a post here, leading another commenter to jokingly (I hope) coin the phrase "Masnick's Law", which is loosely defined as

"in any conversation about musicians doing something different to achieve fame and/or fortune someone will inevitably attempt to make the argument that 'it only worked for them because they are big/small and it will never work for someone who is the opposite,' no matter how much evidence to the contrary might be readily available."

I might expand on that definition a bit to have it go beyond just big/small. People will keep looking for excuses why each example is an exception, (big/small just being an easy such reason) to the point that they'll eventually miss the fact that all of those exceptions are the rule.

Anyway, based on all of this, it will be interesting to see how Girl Talk's new album does. Girl Talk is a one man DJ once mentioned (positively) in Congress as an example of why traditional copyright laws might not make sense anymore. With the release of his latest album, he's decided to use a Radiohead-style model, with a few improvements. That is, rather than just a pure "give it away and pray," he's giving people an additional reason to buy -- though I think he could still put together a better model. His is set up so you can pay what you want (including nothing at all) and get 320 kbps MP3 files, but if you pay over $5, he offers FLAC files as well, and at $10 you'll also get a copy of the physical CD when it comes out. If you pay $0, he does ask that you fill out a little survey explaining why. There still are some problems with this model (it's still a little too much like a give it away and pray model), but overall, it's quite similar to Radiohead's experiment.

Now, of course, all the folks who insisted that Radiohead's model would never work for a relatively obscure musician are supposed to now insist that this model won't work at all for Girl Talk, right? But what happens if Girl Talk is actually happy with the results, whether in direct payment amounts or in the fact that it gets him more publicity? Will they finally admit that the model isn't just an exception?

I like lists. I like RSS Feeds. How could I not like this?

http://ask.slashdot.org/article.pl?sid=08/06/21/0218217&from=rss

What RSS Feeds Do You Use?

Posted by Soulskill on Saturday June 21, @05:14AM from the attention-deficit dept. The Internet

oncehour writes

"I'm looking to broaden my horizons in terms of news, industry information, and generally good-to-know stuff. I've found a lot of great blogs and websites over the years, but I'm wondering what Slashdotters read regularly? What's in your RSS feeds?"

We discussed this back in 2004, but the list of quality feeds has grown quite a bit in the past four years. Try to include at least a minimal description, so we know if we'll be looking at NASA news or up-to-the-minute cowboy boot fashion trends.

I'll save this for my web site class, but no doubt something like it will resurface whenever an organization and its employees are in conflict.

http://news.cnet.com/8301-10784_3-9974466-7.html?part=rss&subj=news&tag=2547-1_3-0-5

June 20, 2008 6:08 PM PDT

Let the fun begin: Yahoo auto resignation tool

Posted by Stefanie Olsen 4 comments

In true Internet-foolery fashion, someone is having a little fun at Yahoo's expense following its latest executive exodus.

By visiting the newly created site Yahoorezinr.com, current Yahoo employees can expedite their resignation to Yahoo Chief Jerry Yang with a host of Mad Libs-style pull-down menus.

Another for the web site class

http://www.killerstartups.com/Web-App-Tools/quikmap-com-draw-on-top-of-google-maps/

QuikMaps.com - Draw On Top of Google Maps

Google Maps are pretty fab and all, but haven’t you ever wished there were more color, more flash and more leeway to add doodles? The maps are primed for it and now, with QuickMaps, you can draw to your heart’s content on top of G-map of your choice (the Earth, stars, moon and Mars). You can add markers (and captions) and once you’ve complete your work, the map with all your added extras can be saved in your account. You’ll also be able to add your map to any website or blog and share it with pals. Each map may be accompanied by your own description and title; you can also import elements from another Quikmap, or from a KML or GPX file from the web or your computer.

“How to ensure third party security” might make an interesting article.

http://www.pogowasright.org/article.php?story=20080619113348678

Stolen State Street tower contained 3,659 Exeter Trust customers's data (State Street update)

Thursday, June 19 2008 @ 11:33 AM EDT Contributed by: PrivacyNews News Section: Breaches

Exeter Trust recently notified the Maryland Attorney General's Office that 3,659 of their clients were impacted by the theft of a computer tower from a third-party vendor hired by Investors Bank & Trust (IBT) to assist in compiling data required for federal regulators as part of the merger between State Street and IBT.

The stolen tower contained over 4 million emails which included individual names, social security numbers and/or checking account numbers. The server containing the email and client data was not recovered.

According to Megan Henry, the Executive Vice President of Exeter, the theft occurred on December 18, 2007. State Street notified Exeter on May 25, informing them that they had learned of the breach on January 25th and that it had taken them 4 months to review the 4 million emails to determine how many contained personally identifiable information.

In its notification letter to its clients, Exeter did something that other companies may wish to emulate: they not only set up a client assistance team with a phone number, but indicated the names and positions of the assistance team, which include the Executive Vice President of the company, the supervisor of account administration of individual services group, and three named senior account administrators.

Driver's licenses used to “prove” age?

http://www.pogowasright.org/article.php?story=20080619102908883

Facebook software glitch exposes drivers' license images

Thursday, June 19 2008 @ 10:29 AM EDT Contributed by: PrivacyNews News Section: Breaches

Given all of the significant concerns raised about social networking sites and privacy, it seems almost ironic that Facebook, Inc. has notified the Maryland Attorney General's Office that on May 2, a glitch during a software update exposed some members' driver's license images to anyone viewing those pages for a period of about two hours.

Simon Axten of Facebook does not indicate how many members were affected by the breach in total, but notes that there was no evidence [Translation: “We don't keep no stinking records” Bob] that the 2 Maryland residents had their pages viewed during the critical time period.

Sometimes it pays not to be so popular, perhaps.

Eventually these thefts will result in changes in procedure... Eventually.

http://www.pogowasright.org/article.php?story=20080619110617565

Stolen SunGard Availability Services laptop contained employee data

Thursday, June 19 2008 @ 11:06 AM EDT Contributed by: PrivacyNews News Section: Breaches

A laptop stolen from a SunGard HE employee earlier this year was not the only laptop containing personal information that was stolen.

In a report to the Maryland Attorney's General Office, SunGard Availability Services (SAS) reports that a company laptop was stolen on March 5th from an employee's car while it was parked outside a mall in King of Prussia, Pennsylvania.

Personal information including names, Social Security numbers, and in some cases, date of birth, address, phone number, compensation, and other human resources-related information on about 160 current and former SAS employees was on the laptop

The laptop was reportedly "protected with a complex alphanumeric password."

I wonder who holds the record? Is 'five' even in the top 100?

http://www.pogowasright.org/article.php?story=20080619112124526

LPL FInancial reports 5th breach in less than a year

Thursday, June 19 2008 @ 11:21 AM EDT Contributed by: PrivacyNews News Section: Breaches

LPL Financial reports that hackers compromised the logon password of one of their financial advisors for what LPL believes was an attempt to gain access to customer accounts in a "pump and dump" penny stock scheme.

This is not the first report of this kind from LPL. As reported on PogoWasRight.org previously, LPL Financial also discovered a similar scheme in July 2007 that covered 9 states and 14 financial advisors and that had gone on over a period of months. This latest incident reportedly occurred on May 5th and was detected the same day.

According to the letter signed by Keith H. Fine, the customer data potentially accessed included unencrypted names, addresses, and Social Security numbers of LPL customers and non-customer beneficiaries, but "LPL cannot determine whether the protected information was actually accessed." The Maryland AG's site reports that the total number of potentially affected individuals for the incident was 185, two of which are Maryland residents.

Some information is clearly required for business processes to function. (If you don't tell Sears where you live, they can't deliver your new refrigerator.) But who decides which “business processes” are appropriate?

http://www.pogowasright.org/article.php?story=20080619163642205

Ca: NB Power wants too much information from ratepayers - Tories

Thursday, June 19 2008 @ 04:36 PM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

Opposition leader Jeannot Volpe is questioning NB Power's policy of collecting personal information on all persons residing at an address before connecting power.

But NB Power said the practice is designed to protect customers from identify theft, collect old debts and make sure ratepayers aren't taken advantage of.

Source - The Daily Gleaner

Isn't there a law requiring auto manufacturers to ensure spare parts are available for at least 10 years after manufacture stops? Should there be one for digital products that extends as long as the bit & bytes?

http://techdirt.com/articles/20080619/0907281455.shtml

Microsoft Keeps DRM Servers Alive For Now; Won't Screw Over Own Customers For A Few More Years

from the well,-that's-something dept

For years, we've given examples of how DRM ends up screwing over customers one way or another. One of the most obvious ways is when that DRM requires files to "check in" over the internet to work, and the company that manages the "check in" server takes it down. That's what's Microsoft announced it was doing with its incredibly-misnamed "PlaysForSure" DRM servers back in April. This was, effectively, going back on the terms of the deal they offered to music buyers. Following the outcry in response, however, it appears that Microsoft has reconsidered, saying that it will keep the servers running at least until 2011. So for the 35 people or so who bought into the PlaysForSure system, you have another 3 years to find new DRM-free sources of music.

Sneaky security tricks. Pass this to your security manager

http://www.infoworld.com/article/08/06/20/Software_makes_virtual_servers_a_moving_target_1.html?source=rss&url=http://www.infoworld.com/article/08/06/20/Software_makes_virtual_servers_a_moving_target_1.html

Software makes virtual servers a moving target

Businesses can cut the damage hackers inflict by managing virtual servers and reducing the time that any one version of a server is exposed to the Internet, researcher says

By Tim Greene, Network World June 20, 2008

Carefully managed virtual servers can make the job of attackers more difficult by reducing the time that any one version of a server is exposed to the Internet, according to a George Mason University professor who has developed software that phases virtual servers in and out of use.

... "If you take a server offline every minute, the intruder has just one minute to play games," he says.

Timing capabilities within SCIT manage the life cycles of virtual servers, making sure some server is always available so that service is uninterrupted, Sood says. To client machines, SCIT-ized virtual servers appear as if they are a single server.

... Once a server has been in use for the prescribed period, it is taken offline where it can be killed. The SCIT Controller generates replacement virtual servers from a server image of known state. Used virtual servers can be analyzed before they are killed to look for whether any attacks were carried out against them. They can also be saved but kept offline for future reference, Sood says.

Is it a legal question or merely a technical one?

http://blogs.computerworld.com/why_its_ok_to_steal_wi_fi

June 19, 2008 - 12:41 P.M.

Why It's OK to 'Steal' Wi-Fi

TIME Magazine printed this week a piece called, "Confessions of a Wi-Fi Thief," in which author Lev Grossman admits to using his neighbors' open Wi-Fi connections from inside his apartment.

Grossman writes that "stealing" Wi-Fi might be illegal (statutes vary according to where you live) but "definitely unethical." He also mentions a recent survey that found a slim majority -- 53% -- have "stolen" Wi-Fi.

I disagree with Grossman. I don't think it's unethical to "steal" Wi-Fi -- or even possible without deliberate hacking. And it shouldn't be illegal to simply use an open, unprotected wireless network.

1. By using a Wi-Fi network you're asking for, and receiving, permission from the owner.

When you open up your trusty laptop, check for available networks, choose one and click "Connect," you're instructing your computer hardware and software to communicate with the hardware and software that's providing the Wi-Fi network and ask permission to use the network.

When you do this, a router either grants permission, and assigns an IP address for you to use, or denies permission. If the connection simply works, it means by definition that the network is set up to automatically grant you permission to use it, and to actively provide the means for you to do so.

Repeated break-ins, spyware, password theft, this kid did it all.

http://www.technewsworld.com/rsstory/63483.html?welcome=1213967933

Teen Hacker Could Get 38-Year Sentence for Fixing Grades

By Katherine Noyes E-Commerce Times Part of the ECT News Network 06/19/08 2:02 PM PT

If your security logs aren't kept or aren't reviewed you will never stop this.

http://it.slashdot.org/article.pl?sid=08/06/19/1711257&from=rss

1 In 3 Sysadmins Snoop On Colleagues

Posted by timothy on Thursday June 19, @01:13PM from the and-they-steal-chips-and-soda dept. Security

klubar writes

"According to a a recent survey, one in three IT staff snoops on colleagues. U.S. information security company Cyber-Ark surveyed 300 senior IT professionals, and found that one-third admitted to secretly snooping, while 47 percent said they had accessed information that was not relevant to their role. Makes you wonder about the other 2 out of 3. Did they lie on the survey or really don't snoop?"

For educational purposes only! (Includes some defensive tips)

http://tech.slashdot.org/article.pl?sid=08/06/19/1433212&from=rss

Guide to DIY Wiretapping

Posted by CmdrTaco on Thursday June 19, @11:16AM from the do-you-hear-what-i-hear dept. Communications Security

Geeks are Sexy writes

"ITSecurity.com has a nice piece this week on how wiretapping works and how you can protect yourself from people who wants to snoop into your life. From the article 'Even if you aren't involved in a criminal case or illegal operation, it's incredibly easy to set up a wiretap or surveillance system on any type of phone. Don't be surprised to learn that virtually anyone could be spying on you for any reason.'"

Maybe I'm on the wrong track here, but I guess I assumed that wiretapping now happened in secret rooms at the telco, and not by affixing something physically to a wire in your home, but I'll definitely be aware next time I hear a stranger breathing next time I'm stuck on hold.

Future: Eventually, all movies (and music and everything else digital) will come via the Internet. We will only watch movies on our computers if we are traveling. Home viewing will be on our 72” wall mounted tv/monitor

http://news.cnet.com/8301-13845_3-9972548-58.html?part=rss&tag=rsspr.6242049&subj=news

June 19, 2008 6:53 AM PDT

Watch feature films free of charge at Hulu.com

Posted by Rick Broida

Many people already recognize video-streaming service Hulu.com as a great destination for watching TV shows (it has every single episode of Arrested Development, people!), but did you know it also offers movies?

... You'll have to sit through the occasional commercial--and stay tethered to your PC, of course--but that's a small price to pay for watching free movies on demand.

Global Warming! Neanderthal SUVs? Dinosaur flatulence?

http://www.eurekalert.org/pub_releases/2008-06/uoca-gic061808.php

Greenland ice core analysis shows drastic climate change near end of last ice age

Temperatures spiked 22 degrees F in just 50 years, researchers say

Public release date: 19-Jun-2008

Contact: Jim White jwhite@colorado.edu 303-492-2219 University of Colorado at Boulder

Dilbert on Security Cameras

http://dilbert.com/strips/comic/2008-06-20/

Unreported breach, or just cleverly disguised?

http://www.pogowasright.org/article.php?story=20080619060558997

Citibank Hack Blamed for Alleged ATM Crime Spree

Thursday, June 19 2008 @ 06:05 AM EDT Contributed by: PrivacyNews News Section: Breaches

A computer intrusion into a Citibank server that processes ATM withdrawals led to two Brooklyn men making hundreds of fraudulent withdrawals from New York City cash machines in February, pocketing at least $750,000 in cash, according to federal prosecutors.

The ATM crime spree is apparently the first to be publicly linked to the breach of a major U.S. bank's systems, experts say.

... Notwithstanding the court documents, Citibank said in an e-mailed statement that it was not the source of the breach. "There is no evidence that Citi servers were compromised in connection with this fraud," the company wrote.

Source - Threat Level

[From the article:

Citibank denied to Wired.com's Threat Level that its systems were hacked. But the bank's representatives warned the FBI on February 1 that "a Citibank server that processes ATM withdrawals at 7-Eleven convenience stores had been breached," according to a sworn affidavit by FBI cyber-crime agent Albert Murray. [Why the denials? Bob]

... When they raided Ryabinin's home, agents found his computer logged into a carding forum. They also found a magstripe writer, and $800,000 in cash, including $690,000 in garbage bags, shopping bags and boxes stashed in the bedroom closet. Another $99,000 in cash turned up in one of the safe deposit boxes rented by Ryabinin and his wife, Olena. Biltse was also found with $800,000 in cash. [These are not small crimes. Bob]

... The timing of the caper -- which prosecutors say began in October -- overlaps Citibank's previously-unexplained lowering of ATM withdrawal limits in New York last December.

... That language suggests that the attackers may not have had access to stored account numbers and PINs, but instead were tapping into transactions in real time to vacuum up PIN codes as they flew past.

No one learns...

http://www.pogowasright.org/article.php?story=20080618131758799

KS: Used state computers found with confidential files

Wednesday, June 18 2008 @ 01:17 PM EDT Contributed by: PrivacyNews News Section: Breaches

Used state computers that had been sent to the Surplus Property agency to sell still contained confidential information, according to a state audit released Wednesday.

... Foster and his team checked 15 computers at the state Surplus Property agency. Data was still on 10 of the computers, and 7 of those contained confidential documents, including thousands of Social Security numbers, he said.

Source - LJWorld

From the report [pdf]: We picked 15 computers from Surplus Property and used inexpensive fi le recovery software to see if any of them contained agency fi les. We were able to recover fi les from ten of the computers. Seven computers contained confi dential information (social security numbers, Medicaid information, and password fi les), four contained sensitive fi les that agencies probably wouldn’t want made public, and one contained copyrighted music files. In general, it didn’t appear that much had been done to most of the computers to remove the data. We found that the data weren’t properly removed from the computers because agencies lacked policies, thought that Surplus Property was removing the data, or did a poor job of keeping track of their computers. Because of the severity of our early fi ndings, the Department of Administration temporarily stopped selling computers in early May until they could make sure data were properly removed from all they had in stock.

[From the article:

For the Legislative Post Audit Committee, Foster demonstrated how he was able to access confidential files by using readily available $60 software. [Typical government employee – he could have used free software, just like the crooks do. Bob]

A few more details and some interesting questions. The very definition of “undue reliance”

http://it.slashdot.org/article.pl?sid=08/06/18/2213232&from=rss

Man Fired When Laptop Malware Downloaded Porn

Posted by samzenpus on Wednesday June 18, @06:59PM from the your-computer-wants-porn dept. Security

Geoffrey.landis writes

"The Massachusetts Department of Industrial Accidents fired worker Michael Fiola and initiated procedutes to prosecute him for child pornography when they determined that internet temporary files on his laptop computer contained child porn. According to Fiola, "My boss called me into his office at 9 a.m. The director of the Department of Industrial Accidents, my immediate supervisor, and the personnel director were there. They handed me a letter and said, "You are being fired for a violation of the computer usage policy. You have pornography on your computer. You're fired. Clean out your desk. Let's go." Fiola said, "They wouldn't talk to me. They said, "We've been advised by our attorney not to talk to you." [Shouldn't someone ask a few questions? Bob] However, prosecutors dropped the case when a state investigation of his computer determined there was insufficient evidence to prove he had downloaded the files. Computer forensic analyst Tami Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye. [Not sure what that means... Bob] The virus protection and software update functions on the laptop had been disabled, and apparently the laptop was "crippled" by malware. According to Loehrs, "When they gave him this laptop, it had belonged to another user, and they changed the user name for him, but forgot to change the SMS user name, so SMS was trying to connect to a user that no longer existed... It was set up to do all of its security updates via the server, and none of that was happening because he was out in the field." A malware script on the machine surfed foreign sites at a rate of up to 40 per minute whenever the machine was within range of a wireless site."

[From the first article:

Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye.

Two forensic examinations conducted by the state Attorney General’s Office for the prosecution concurred with that conclusion, Wark said.

... DIA spokeswoman Linnea Walsh confirmed Fiola “was terminated,” but declined to say if any internal discipline has been meted out as a result of his name being cleared in court.

“We stand by our decision,” she said.

... “Anybody who has a work laptop, this could happen to,” he said. “Mike Fiola is a hunt-and-peck kind of computer guy. He can barely get on the Internet.”

Fiola’s troubles began in November 2006 when, seven years into a job probing workers’ compensation fraud, DIA gave him a replacement laptop for one that was stolen.

Months later, DIA information technology officials noted that the data usage on Fiola’s Verizon wireless bill was 4 times greater than his colleagues’. After discovering the child porn , Commissioner Paul Buckley fired him on March 14, 2007. [It took them 4 months to notice something was odd? Bob]

DIA turned the matter over to state police who, after confirming “an overwhelming amount of images of prepubescent children engaged in pornographic poses” were stored on the laptop, persuaded Boston Municipal Court to issue a criminal complaint against Fiola in August 2007. [For five months, all they looked for was the porn? Bob]

... Consistently, Loehrs’ findings noted, there was “no apparent origin or user interaction [Wouldn't “who done it?” be part of the prosecution's case? Bob] preceding the pornographic activity,” some of which was downloaded “fast and furious.”

[From article two:

IDGNS: So what do you think happened?

Fiola: It was either a rogue hack ... or after my computer was stolen, [the new computer] might have been loaded with the stuff, ready to go. I'm not accusing anybody, but if it was someone in the IT department who was doing this, [maybe they] never had a chance to take it off of there. [Interesting idea. Do you suppose there is still evidence to prove or disprove it? Bob]

[From article three:

"In the SMS software, they forgot to change the user name, so SMS was trying to connect to a user that no longer existed. So the day he walked out with the laptop, the SMS logs were red. If the IT department would have taken a single look at it, they would have seen that it was red and wasn't connecting to the server.

... "What I found is, he would log in to the state's Web site, he'd be on for five or 10 minutes and during the exact same time that he's filling out a form, an image shows up, out of nowhere. No typed [Uniform Resource Locator], no search, no Web site activity, just bam, a cached image shows up on his computer," Loehrs said. The offending images were located in the laptop's browser cache directory.

"He'd have 40 Web sites hitting his computer in a minute -- who's the IT guy who looked at this and said, "Wow, this guy is pretty active on the Internet?'" Loehrs said. "It's physically impossible!"

Loehrs found a script file that was set to go out and run its own searches on foreign Web sites, she said. "And once you get into some of these foreign sites, you'll get all kinds of stuff you don't want to see.

"Actually, the child pornography was just a very small portion of it. The majority was just bizarre porn. He was being hit with everything," she added.

Still, it took prosecutors months to drop the charges -- largely due to Loehrs uncovering the true nature of the images.

... Fiola's case raises serious questions about government security. If a state-run IT department can't configure a laptop properly, what can a person do to protect themselves from rogue malware?

... "Trojans are written by tech-savvy people. What's the first thing they are going to do? They're going to disable the protection," she added, noting that Fiola's Symantec-based logs were missing from the compromised laptop. [That would have been the easy way to determine what Fiola did. If they were missing, prosecutors must have assumed he was “covering up” and done no further investigation. Bob]

... The Fiola case brings up some troubling questions. What if a person actually did realize that his PC was compromised with child porn? How could someone safely remove it? If an innocent user took it to the company's IT department, he or she might get fired. A computer repair shop would probably alert the authorities, and there's a good chance the police would seize the computer, arrest the user and start the prosecution process.

[In case you need Tami Loehrs: http://www.law2000.net/

It would be nice if they contacted the victims, however the criminals encrypted their data (being more interested in security than the companies they stole it from)

http://www.pogowasright.org/article.php?story=20080618073003747

Finjan Finds Health And Business Data Being Auctioned Online

Wednesday, June 18 2008 @ 07:30 AM EDT Contributed by: PrivacyNews News Section: Breaches

More than 500 megabytes of premium health- and business-related data, along with stolen social security numbers, have been found being offered to the highest bidder on crimeware servers in Argentina and Malaysia.

Security firm Finjan discovered the illicit data market and issued a report about its findings today.

Source - InformationWeek

Related - Finjan Discovers more than 500 Mb of Stolen Medical, Business and Airline Data on Crimeware Servers in Argentina and Malaysia
Finjan Report - Malicious Page of the Month [pdf] (requires free sub.)

“You may install software on my computer at any time for $327.50 per bit per day. Installation is evidence of acceptance of this contract.” (O boy, I'm gonna be rich!)

http://www.eweek.com/c/a/Legal/Watchdogs-Claim-NebuAd-Hijacking-Sites/

Watchdogs Claim NebuAd Hijacking Sites

By Roy Mark 2008-06-18

Two watchdog groups accused Silicon Valley startup NebuAd June 18 of hijacking Web sites and intercepting users' browsers. NebuAd is an online advertising company that provides targeted advertising for ISPs

According to a new technical report (PDF) by Free Press and Public Knowledge, NebuAd uses special equipment that "monitors, intercepts and modifies the contents of Internet packets" as consumers go online. The report found that NebuAd inserts extra hidden code into users' Web browsers that was not sent by the Web site being visited.

In turn, the code directs the browser to another site not requested or even seen by the consumer, where more hidden code is downloaded and executed to add more tracking cookies. Using the secretly collected information, NebuAd serves up ads based on the user's browsing habits.

Related: A more subtle hack

http://techdirt.com/articles/20080531/1924311274.shtml

Web Browsers' 'Visited' Feature Creates Privacy Concerns

from the just-visiting dept

Ben Adida points to an interesting hack that takes advantage of a bug/feature (depending on your perspective) of modern browsers. When a webpage is rendered, the browser will typically display links that have been previously visited in a different color. Under the hood, this is implemented by setting the link's style to "visited." A website can use JavaScript to detect this information and report it back to the server -- and could even do something sneaky like adding "hidden" links not actually visible to users just to find out if you had visited certain sites. This behavior was noticed by the Mozilla community way back in 2002, but because of the way the spec was written, there wasn't any easy solution. Now somebody has figured out at least one useful purpose for this particular data leak: reducing the number of links some websites provide to social networking sites. As Digg, Reddit, and dozens of social news competitors have proliferated, blogs and news sites have increasingly faced the challenge of supporting ways to submit stories to those sites without unnecessarily cluttering up their pages. But this guy has developed some JavaScript code that will use the "visited" data leak to determine which social networking sites the user has visited and display badges only for those sites. It's a clever hack, albeit one that will make privacy sticklers' skin crawl. Browser vendors ought to fix the underlying privacy issue, which will break this little hack in the process, but in the meantime it doesn't hurt to put it to a useful purpose.

“Stupid is as stupid does.” F. Gump

http://techdirt.com/articles/20080617/1110341434.shtml

Blog Receives Takedown Notice For Embedding A Video With Authorized Embed Code

from the keep-the-lawyers-busy dept

A year and a half ago, I wondered outloud if embedding an infringing video would be considered infringement as well. Technically, it's no different than just linking to infringing content. However, imagine an even more ridiculous scenario: what if a website puts up its own videos with an embed code, but then sends out takedown notices to anyone who embeds it? Russ writes in to let us know that's exactly what happened with an Iowa sports blog that was trying to raise awareness of the floods in Iowa (a good thing) and embedded a video from the website of the Des Moines Register using the very embed code offered by the Des Moines Register. So what happens? The Des Moines Register sends a takedown notice claiming copyright infringement. After complaining about this on the blog, and getting some attention over it, someone from the Register apologized and said that it was an overeager staffer who was unfamiliar with the fact that videos on the site included embed codes.

While it's great that the Des Moines Register quickly recognized its mistake, apologized and promised to make sure it wouldn't happen again, it still does raise some questions that are almost certain to show up in the future. It's still not clear if a site is responsible for embedding infringing videos. But what if the video's copyright holder doesn't like how a video is being used? What if, for example (and this is not what happened in this case) a site had used that same video of the Iowa floods to mock the victims? I would imagine that it would be tempting in that case to send out the takedown notice, even though the embed code had been offered up. We're almost certainly going to see this happen in the near future. Someone who puts up a video with an embed code is going to be unhappy with how that content is being used, and will claim infringement, even though the content was freely offered up.

The copyright implications of embedding are not at all clear -- and that means you can be sure that lawsuits are on their way.

Is it overly optimistic to think someone will actually read these?

http://www.pogowasright.org/article.php?story=2008061814014345

GAO releases three privacy-related reports

Wednesday, June 18 2008 @ 02:01 PM EDT Contributed by: PrivacyNews News Section: Fed. Govt.

The following GAO reports are now available:

Privacy: Agencies Should Ensure That Designated Senior Officials Have Oversight of Key Functions, GAO-08-603, May 30, 2008: Summary Full Report [pdf]

Privacy: Alternatives Exist for Enhancing Protection of Personally Identifiable Information, GAO-08-536, April 19, 2008: Summary Full Report [pdf]

Privacy: Congress Should Consider Alternatives for Strengthening Protection of Personally Indentifiable Information, GAO-08-795T, June 18, 2008: Summary Full Report [pdf[

This is interesting. The text message is private despite being transmitted by radio (unencrypted?) to a local receiver (think cell tower and anyone else with a radio tuned to that frequency) and then to the provider's computers via wire (secure) or satellite (now even aliens can intercept it), then it is archived (where the copy the cops obtained came from). Then the whole process is reversed to deliver the message to the addressee.

http://www.pogowasright.org/article.php?story=20080618142748906

Ninth Circuit Upholds Privacy of Text Messages

Wednesday, June 18 2008 @ 02:27 PM EDT Contributed by: PrivacyNews News Section: In the Courts

Today the Ninth Circuit issued its opinion in Quon v. Arch Wireless, holding that "users of text messaging services such as those provided by Arch Wireless have a reasonable expectation of privacy in their text messages."

Source - EFF

What happens when golf fans can't get to their televisions to watch Tiger Woods? Certain to join the Streisand Effect ( http://en.wikipedia.org/wiki/Streisand_effect ) in the lexicon.

http://tech.slashdot.org/article.pl?sid=08/06/18/199254&from=rss

The Tiger Effect and Internet DDoS

Posted by timothy on Wednesday June 18, @03:32PM from the aka-the-kenn-starr-steamroller dept. The Internet Media Security IT

An anonymous reader writes

"Many US and Canadian ISPs thought they were under a massive denial of service attack yesterday — traffic spiked by hundreds of gigabits across North America. Turns out that the traffic was due to live streaming of the U.S. Open and Tiger Woods nail-biting victory."

Perhaps I'll use this to explain arbitrage... Naaaaah. More likely to explain out-of-control marketing departments.

http://techdirt.com/articles/20080618/1321561448.shtml

Would You Buy $630 For $715? Thanks To Microsoft, You Can Make Money Doing So

from the loopholes dept

Just last month, Microsoft announced its desperation plan of bribing users to use Microsoft's search. Basically, if you bought certain products via a Microsoft search, Microsoft would pay you cash back. And, of course, as soon as the cash got involved, it didn't take long for people to find loopholes. Various messages boards are highlighting how this works, but the end result is that people are buying $630 in cash for $715 (via Whitney McNamara), knowing that Microsoft will pay them "cash back" that more than makes up the difference -- in some cases up to $250. So, in that case, the seller of the "cash" ends up making $85, and the "buyer" makes $165. Microsoft, of course, is out the $250. Talk about arbitrage.

Trend or aberration?

http://www.reghardware.co.uk/2008/06/18/tech_aids_pool_crashing/

Teens use technology to party in strangers' pools

By James Sherwood 18th June 2008 15:36 GMT

Tech savvy teens are using Google Earth’s splendidly clear aerial shots of the UK to launch a summertime craze – pool crashing.

Teens begin by surfing Google Earth’s satellite images to find houses with swimming pools — or at least paddling pools. Once a target has been identified, sweaty swimmers then use Facebook to arrange an organised, but uninvited, pool-crash.

Another way to interest children in the legal system.

http://afp.google.com/article/ALeqM5h9kqGvkVPSvo-KNWFDWAg-mVfleg

Court overturns father's grounding of 12-year-old

20 hours ago

OTTAWA (AFP) — A Canadian court has lifted a 12-year-old girl's grounding, overturning her father's punishment for disobeying his orders to stay off the Internet, his lawyer said Wednesday.

The girl had taken her father to Quebec Superior Court after he refused to allow her to go on a school trip for chatting on websites he tried to block, and then posting "inappropriate" pictures of herself online using a friend's computer.

... Beaudoin noted the girl used a court-appointed lawyer in her parents' 10-year custody dispute to launch her landmark case against dear old dad.

What does a data center cost? (Just a few pictures, early in the construction.)

http://digg.com/microsoft/Inside_Microsoft_s_550_Million_Mega_Data_Centers_2

Inside Microsoft's $550 Million Mega Data Centers

informationweek.com — A tour of Microsoft's gargantuan, under-construction San Antonio data center reveals a state-of-the-art IT infrastructure on an immense scale.

http://www.informationweek.com/galleries/showImage.jhtml?galleryID=191&articleID=208403723

Future: Anything digital on demand

http://www.alleyinsider.com/2008/6/youtube_tries_long_form_video

YouTube Shifts Strategy, Tries Long-Form Video

Michael Learmonth | June 18, 2008 11:47 AM

... YouTube's 10-minute limit has served a couple of purposes to date: It keeps bandwidth costs down, and it makes it harder for copyright owners to complain about unauthorized streams...

Future, convergence The device is still huge (the size of an iPod) but potentially could be squeezed into the next generation iPhone

http://www.popularmechanics.com/blogs/technology_news/4269248.html

World’s Smallest Projector, TI Optoma Pico, Coming to U.S. Next Year

June 18, 2008