____

This appears to be another “no facts” disclosure. Perhaps I'll write a guide for reporters...

http://www.pogowasright.org/article.php?story=20080908085157679

Ca: Gov't reveals security breach of online application site for N.L. student aid (Memorial University, updated)

Monday, September 08 2008 @ 08:51 AM EDT Contributed by: PrivacyNews

Newfoundland and Labrador's Education Department is dealing with a breach of personal information related to the online application site for student aid.

Education Minister Joan Burke says the Student Financial Services Division was recently notified of an incident [Translation: they didn't detect it themselves Bob] involving unauthorized access to a client's personal information. [Suggesting ONE victim? Bob]

Burke says the online site for student aid was immediately shut down, the problem identified and corrected and the site was re-established the same day.

The province says there were approximately 48,000 people who had information in the database at the time of the exposure.

So far its been determined that 90 people had their information accessed [Suggesting only 90 victims? Bob by an unauthorized source.

Burke says the site has been reviewed by an external security firm which confirms the personal information is now secured.

The minister says officials are contacting those affected.

Source - Canada East

Update: Adam Dodge of ESI kindly sent along a link to a later story with additional details on the breach: Student aid records exposed in security breach.

[From the CBC article:

So far, authorities have traced the source of the breach to a single IP address, but it's not known whether one individual tapped into the database.

... The breach was detected when a student reported that while filling out an online application form, information belonging to others could be seen. [Unless the student was accessing from the same “single IP address” that makes at least two... Bob]

[Note: Fist time I've see the ESI site. http://www.adamdodge.com/esi/ Bob]

A trivial breach at a trivial cost? A buck a victim?

http://www.pogowasright.org/article.php?story=20080908163024954

Firm to pay Wisconsin $250,000 for security breach (follow-up)

Monday, September 08 2008 @ 04:30 PM EDT Contributed by: PrivacyNews

A Texas company has agreed to pay Wisconsin $250,000 after it mailed tens of thousands of brochures with state Medicaid participants' Social Security numbers mistakenly printed on the address labels.

The mailing by Texas-based EDS Corp. went to 260,000 participants in Wisconsin's Medicaid, BadgerCare and SeniorCare programs in January. State officials feared the mailing increased the chances of identity theft.

The company and the state Department of Health Services reached a settlement on Aug. 28 calling for EDS to adopt a new system that uses identification numbers rather than Social Security numbers by Oct. 8 and pay the state $250,000 for damages.

Source - WKBT

Hack du jour? (Think of it as Social Engineering by proxy) I had only shorted a few thousand shares. Clearly a coincidence !

http://www.washingtonpost.com/wp-dyn/content/article/2008/09/08/AR2008090803063.html?hpid=moreheadlines

2002's News, Yesterday's Sell-Off

By Frank Ahrens Washington Post Staff Writer Tuesday, September 9, 2008; Page A01

A six-year-old article mistakenly seen by Bloomberg financial news users yesterday reported the bankruptcy of United Airlines and triggered a massive sell-off that nearly obliterated the company's stock in a matter of minutes.

... United parent company UAL opened trading on the Nasdaq Stock Market yesterday at $12.17 per share. The 2002 bankruptcy article appeared on Bloomberg monitors on Wall Street just before 11 a.m. In the minutes that followed, some 15 million shares of UAL traded and the stock plunged to $3 per share. [$12 minus $3 times 810,000 shares = no worries about gas prices Bob]

Hack du jour Second rate by definition: It was immediately detectable.

http://tech.slashdot.org/article.pl?sid=08/09/08/185238&from=rss

The London Stock Exchange Goes Down For Whole Day

Posted by ScuttleMonkey on Monday September 08, @04:23PM from the at-least-no-one-died-...-yet dept. Microsoft Technology

Colin Smith writes

"TradElect, the Microsoft .Net based trading platform for the London Stock Exchange, was offline for about seven hours, meaning that their 5-nines SLAs are shot for approximately the next 100 years. The TradElect system was launched back in June of 2007 and was designed for increased speed and system capacity."

“We can, therefore we must” In particular, how do cameras make us safer?

http://www.pogowasright.org/article.php?story=20080908163216843

NYCLU Sues Over NYPD Surveillance Plan

Monday, September 08 2008 @ 04:32 PM EDT Contributed by: PrivacyNews

The New York Civil Liberties Union wants police to disclose more details about a plan to use 3,000 surveillance cameras to help secure lower Manhattan against terror attacks, saying it could threaten the privacy of millions of law-abiding New Yorkers.

In a lawsuit filed Monday in state Supreme Court, the NYCLU claimed the New York Police Department has moved forward with the plan -- expected to cost tens of millions of dollars -- without explaining how it will use and store images and data captured by the closed-circuit cameras, license-plate readers and other high-tech security devices.

Source - MyFOXNY

[From the article:

The department already has turned over 91 pages of material about the so-called Lower Manhattan Security Initiative. But the NYCLU said the documents were redacted, and that more information should be disclosed.

The NYPD "must have hundreds if not thousands of documents that would be responsive to the NYCLU's request," the suit says.

Police spokesman Paul Browne said the NYPD had provided everything it could, "short of a road map terrorists could use for another attack." [How could terrorists use this information to plan an attack? Bob]

... Police officials say photos and license plate numbers would be cross-checked with information about potential terror suspects and suspicious vehicles. They insist data deemed innocent [Is the word “presumed?” Bob] would be purged from police records after 30 days.

Related? I hope not... (Fun hack though...)

http://www.killerstartups.com/Web-App-Tools/gotomycamera-com-store-your-surveillance-video

GoToMyCamera.com - Store Your Surveillance Video

If you’re having trouble dealing with the massive amounts of video your security cameras are storing, take a look at Gotomycamera.com. This service will allow you to store your network cameras’ videos online, so you can go back and analyze it later. Don’t worry, since the system only works with Axis Network cameras, only relevant video will be stored. Those cameras are motion-activated, so unless there’s some movement in the space you’re filming, the cameras won’t be filming. Once you hire the service, you’ll be given a username and password that will allow you to access your videos from anywhere in the world. All of these features will make it possible for you to keep track of your employees and avoid unwanted break ins. In short, if you’re looking for a way to keep better track of surveillance video and get rid of the storage problem, you should consider giving this service a try.

http://www.gotomycamera.com/

Related? (Connexe?)

http://www.pogowasright.org/article.php?story=20080909054138527

The French Battle Those Spying Bastards

Tuesday, September 09 2008 @ 05:41 AM EDT Contributed by: PrivacyNews

The French are finally in open rebellion against Napoleon's secret police, and don't want all the information collected by these snoops to be computerized and made available to a large number of civil servants. Not so much of a problem with the police having access. Government officials can't understand this,[and that's a surprize? Bob] as it is common knowledge (just check any American, or European, TV crime drama) that the police can quickly access all you phone, credit card and other electronic records when they have too. The bureaucrats don't understand that what upsets a lot of French citizens is all those civil servants nosing around there when they don't have to. The French will tolerate government snooping, but only up to a point, and apparently that point has been reached.

Source - Strategy Page

I suppose this was inevitable...

http://hardware.slashdot.org/article.pl?sid=08/09/08/1447234&from=rss

The Cyber Crime Hall of Fame

Posted by CmdrTaco on Monday September 08, @11:26AM from the do-they-get-cool-bronze-statues dept. Hardware Hacking

DigitalDame2 writes

"Not all hackers are bad guys, but a few fall prey to the dark side and use their talents for evil — not good. In compiling this list of the craziest cyber crimes, PC Mag looked for a few things: ingenuity (had it been done before?), scope (how many computers, agencies, companies, sites, etc. did it affect?), cost (how much in monetary damages did it cause?), and historical significance (did it start a new trend?). Read on about famous hackers John Draper, Robert Morris, Kevin Poulsen, and others."

Not the first case – an earlier decision said “you don't”

http://www.pogowasright.org/article.php?story=2008090905112913

Canton: Who owns your Facebook friends?

Tuesday, September 09 2008 @ 05:11 AM EDT Contributed by: PrivacyNews

A U.K. court recently ordered an ex-employee of a recruitment firm to disclose details of his profile, business contacts and e-mails at his social networking site, LinkedIn, to his former employer.

So who owns those contacts -- the employee or the employer?

LinkedIn is a social networking site used to maintain contacts, and exchange information, ideas and opportunities. One of its functions is to network for jobs and marketing one's services. The ex-employee had invited his employer's customers to join his network at LinkedIn while he was still in their employ. The employer claimed those contacts belonged to them.

Source - David Canton, in CANOE Technology

[From the article:

The decision shows the tension between employees being encouraged by their employers to use social networking websites, but at the same time trying to keep the contacts confidential at the end of their employment.

... The real legal issue is not ownership, but whether the employer is entitled to the contact list, and whether the ex-employee is restricted in any way from using that information.

The starting point is that customer lists are the employer's property, and employees and former employees should use those for their employer's purposes, not personal gain.

... It would be an easier decision to make if all the contact information was stored on a company-owned or -controlled system. [Another Cloud computing issue? Bob]

I must be missing something.

http://www.pogowasright.org/article.php?story=20080909051724519

Google shortens IP address retention on server logs to nine months

Tuesday, September 09 2008 @ 05:17 AM EDT Contributed by: PrivacyNews

Google has revealed plans to anonymise IP addresses on its server logs after nine months from the previous 18-month retention policy.

The search giant – which regularly comes in from scrutiny from privacy advocates over its access to knowledge of user activity – said it is taking the step to address regulatory concerns and improve privacy for users.

Source - Silicon Republic

[From the article:

The search giant – which regularly comes in from scrutiny from privacy advocates over its access to knowledge of user activity – said it is taking the step to address regulatory concerns and improve privacy for users.

Interesting stats. When will we hit the global “One record per person” mark?

http://computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=privacy&articleId=9114176&taxonomyId=84&intsrc=kc_feat

530M records exposed, and counting

By Jay Cline

September 8, 2008 (Computerworld) By my count, over half a billion records of personal information have been exposed or mishandled in the past eight years. And these are only from breaches where a record count has been publicly revealed.

... There are a number of Web sites where you can find information about data breaches, including Computerworld's privacy page, Attrition.org, the Identity Theft Resource Center, blogs, government agencies and privacy newsletters such as the International Association of Privacy Professionals' "Daily Dashboard".

... The biggest line item we found was hackers, at 20% of all breaches. For their part, dishonest insiders garnered 3% of the blame. It's possible that a good number of the stolen laptops (19%) and other computers (8%) were taken by employees, but the cases we reviewed appeared mostly to be random criminal acts.

... A whopping 11% of publicized breaches were the result of an errors traceable to vendors. [Considering that most companies are moving into the “Cloud,” contracts with vendors need some serious attention. Bob]

... And what about industry sector? Some of the more infamous breaches — such as CardSystems, ChoicePoint and TJX — may have given the impression that the privacy breach phenomenon is all about credit card number acquisition from private-sector companies.

But in terms of sheer number of breaches, government agencies (23%) and schools (23%) topped the charts. Health care (14%), finance (13%) and retail (6%) companies followed.

How “intelligence” is supposed to work

http://www.bespacific.com/mt/archives/019266.html

September 08, 2008

U.S. Army Field Manual Section on Knowledge Management

Via Secrecy News: Knowledge Management Section, U.S. Army Field Manual 6-01.1, August 29, 2008

• "This manual provides doctrine for the organization and operations of the knowledge management (KM) section. It establishes the doctrinal principles, tactics, techniques, and procedures necessary to effectively integrate KM into the operations of brigades, divisions, and corps."

I love a challenge!

http://hardware.slashdot.org/article.pl?sid=08/09/08/1710237&from=rss

World's First "Unclonable" RFID Chip

Posted by ScuttleMonkey on Monday September 08, @02:04PM from the until-they-make-a-better-cloner dept.

An anonymous reader writes to tell us that a new RFID chip from Verayo claims to be unclonable through the use of the new Physical Unclonable Functions (PUF), sort of an electronic DNA for silicon chips.

"Basic passive RFID chips can be easily cloned by copying the data residing on one chip to another. Verayo's PUF-based RFID chips cannot be cloned, and provide a very strong and robust authentication mechanism. No other chip or device can be disguised as the original chip, even if the data is copied from one Verayo RFID chip to another."

On November 5^th, you'll be able to say “I told you so, Presdident Schwarzenegger”

http://politics.slashdot.org/article.pl?sid=08/09/09/0123249&from=rss

Black Box Voting 2008 Election Protection Toolkit

Posted by kdawson on Tuesday September 09, @08:12AM from the making-a-difference dept. Government United States Politics

Gottesser writes

"Bev Harris over at Black Box Voting has done everyone a favor and released her 2008 Election Protection toolkit as an ebook. It's like Cliff notes of Bev's 8+ years of experience on the front lines of the modern voting rights movement. The ebook presents succinct information to get individuals actively involved in the full-contact sport that is democracy. The target audience is those who believe that the political process requires more than just showing up to vote once every four years those who know that something's up with those voting machines. You may remember Bev Harris from her Emmy-nominated HBO documentary 'Hacking Democracy.' I've been working on election integrity issues in Ohio for some time now and have met Bev several times. Her work is nothing less than groundbreaking. Please check it out."

Instant collector's item? (for hackers)

http://hardware.slashdot.org/article.pl?sid=08/09/08/2246203&from=rss

Hacking Esquire's E-ink Cover

Posted by kdawson on Monday September 08, @07:50PM from the be-one-of-the-hundred-thousand dept. Hardware Hacking Displays Hardware

ptorrone writes

"I picked up the Esquire E-inked cover today and took a bunch of high res photos, for the makers out there. It has a programming header, 5-pin ISP, a Microchip PIC 12f629 which is flash programmable, 8 pin, 6 lithium coin cell CR2016s, 3 volts each. Two E-ink screens with flex connections — looks like it was made to be reprogrammed and different screens. The top screen has 11 segments, the bottom has 3. It was designed 2008-06-04. The PCB was made by Forewin, half thickness, 2 layer board (FR4). I think someone out there will likely reflash the PIC and make the segments go on / off at different times and perhaps put other displays on it, there's a little bit of hacking to be had but not that much really."

____

Is this the route to good privacy protection/security laws?

http://www.pogowasright.org/article.php?story=20080908063543355

Kr: GS Caltex Faces Class Action Suit (follow-up)

Monday, September 08 2008 @ 06:35 AM EDT Contributed by: PrivacyNews

In the self-proclaimed high-tech utopia of Korea, where people have broadband connections on subways and television on mobile-phones, a recent hot trend seems to be class action lawsuits.

Police have arrested two employees of a subsidiary of GS Caltex and two accomplices on charges of unlawfully downloading customer information of the country's No.2 refinery and attempting to sell it on the black market.

... Lee Dong-gook, a Seoul-based private lawyer, began gathering applications for a class action lawsuit against GS Caltex and said he will be seeking compensation of about two million won per head.

... The Korean Information Security Agency (KISA) said it received reports from more than 9,000 people last year who claimed that their resident registration numbers, a 13-digit code that indicates birth date, sex and site of registration, had been stolen.

Security experts are claiming that companies should be held liable for the increasing number of security breaches, with many of them not bothering to encrypt their customers' data.

A KISA survey of 2,500 domestic companies last year found that about a half of them (50.8 percent) hadn't spent a single penny to enhance information security.

Source - The Korea Times

...because...

http://www.pogowasright.org/article.php?story=200809080616059

Data “Dysprotection:” breaches reported last week

Monday, September 08 2008 @ 06:16 AM EDT Contributed by: PrivacyNews

A recap of incidents or privacy breaches reported last week for those who enjoy shaking their head and muttering to themselves with their morning coffee.

Source - Chronicles of Dissent

For your Security Manager (and if you're serious, your CEO)

http://www.infoworld.com/article/08/09/08/Group_to_release_uniform_metrics_to_measure_IT_security-IDGNS_1.html?source=rss&url=http://www.infoworld.com/article/08/09/08/Group_to_release_uniform_metrics_to_measure_IT_security-IDGNS_1.html

Group to release uniform metrics to measure IT security

The Center for Information Security also launches a new service that enables companies to compare their security performance with their peers

By Jeremy Kirk, IDG News Service September 08, 2008

... The latest CIS project is aimed at resolving the confusion and lack of uniformity in ways to measure whether an enterprise or organization's IT security is improving or not, said Bert Miuccio, CIS's CEO.

... The benchmarks, which are a free download on the CIS Web site, are intended to help organizations reduce IT security risks.

... The metrics should be released in late October or early November, Miuccio said.

Will they apply this to problems they aren't passionate about?

http://www.wired.com/gaming/gamingreviews/commentary/games/2008/09/gamesfrontiers_0908

How Videogames Blind Us With Science

By Clive Thompson

A few years ago, Constance Steinkuehler -- a game academic at the University of Wisconsin -- was spending 12 hours a day playing Lineage, the online world game. She was, as she puts it, a "siege princess," running 150-person raids on hellishly difficult bosses. Most of her guild members were teenage boys.

But they were pretty good at figuring out how to defeat the bosses. One day she found out why. A group of them were building Excel spreadsheets into which they'd dump all the information they'd gathered about how each boss behaved: What potions affected it, what attacks it would use, with what damage, and when. Then they'd develop a mathematical model to explain how the boss worked -- and to predict how to beat it.

... That's when it hit her: The kids were practicing science.

... This led Steinkuehler to a fascinating and provocative conclusion: Videogames are becoming the new hotbed of scientific thinking for kids today.

... This is what Steinkuehler reports in a research paper -- "Scientific Habits of Mind in Virtual Worlds" (.pdf) -- that she will publish in this spring's Journal of Science Education and Technology.

... And here's the thing: The (mostly) young people engaging in these sciencelike conversations are precisely the same ones who are, more and more, tuning out of science in the classroom.

Got Geek? (Not much depth, but points to consider..)

http://www.infoworld.com/article/08/09/08/37FE-startup-tech-how-to_1.html?source=rss&url=http://www.infoworld.com/article/08/09/08/37FE-startup-tech-how-to_1.html

How to start up your own tech startup

Follow the dream using advice from entrepreneurs who've made it work

By Bill Snyder September 08, 2008

The economics of the Internet? (Part 1 of 6 bazillion)

http://tech.slashdot.org/article.pl?sid=08/09/07/1636203&from=rss

How Networks Interact - Peering and Transit Explained

Posted by Soulskill on Sunday September 07, @01:26PM from the very-carefully dept.

Raindeer writes to share his article about peering and transit between networks, which begins:

"In 2005, AT&T CEO Ed Whitacre famously told BusinessWeek, 'What they [Google, Vonage, and others] would like to do is to use my pipes free. But I ain't going to let them do that... Why should they be allowed to use my pipes?' The story of how the Internet is structured economically is not so much a story about net neutrality, but rather it's a story about how ISPs actually do use AT&T's pipes for free, and about why AT&T actually wants them to do so. These inter-ISP sharing arrangements are known as 'peering' or 'transit,' and they are the two mechanisms that underlie the interconnection of networks that form the Internet. In this article, I'll take a look at the economics of peering and transit in order to give you a better sense of how traffic flows from point A to point B on the Internet, and how it does so mostly without problems, despite the fact that the Internet is a patchwork quilt of networks run by companies, schools, and governments."

Also looks like a great placefor consultants/professionals to tout their skills & expertise.

http://www.killerstartups.com/Social-Networking/ileonardo-com-a-collection-of-information

iLeonardo.com - A Collection Of Information

iLeonardo.com combines the advantages of social networking and knowledge sharing to create a truly unique web experience. Through the site, you’ll be able to upload content about things you know, allowing the service to create notebooks of information that many users collaborate on. As you start making more friends, you’ll be able to see the information they’ve uploaded. This will allow you to meet new people and enjoy the quality of the knowledge they have chosen to share with the rest of the community. I’ve come to think of this as a sort of cross between Facebook and Wikipedia. This sort of communal knowledge sharing is the dream of any utopist web designer. If all sites were a little bit more like this, the internet would sure be a better place. This social network is not about how many friends you have, it’s about how much you know and are willing to share with the world.

http://www.ileonardo.com/secure/main.php

Tools & Techniques Could be useful for e-Discovery

http://news.cnet.com/8301-13772_3-10034602-52.html?part=rss&subj=news&tag=2547-1_3-0-5

Rebus brings desktop search to scanned documents

Posted by Daniel Terdiman September 8, 2008 4:00 AM PDT

Global Warming! Global Warmiong! Let's not lose our heads people. If we aren't positive we know the cause(s) what makes us think we know the solution?

http://news.slashdot.org/article.pl?sid=08/09/07/199217&from=rss

1,500-Ship Fleet Proposed To Fight Climate Change

Posted by timothy on Sunday September 07, @03:41PM from the sponsored-by-viagra dept. Earth Transportation Technology

Roland Piquepaille writes

"According to UK and U.S. researchers, it should be possible to fight the global warming effects associated with an increase of dioxide levels by using autonomous cloud-seeding ships to spray salt water into the air. This project would require the deployment of a worldwide fleet of 1,500 unmanned ships to cool the Earth even if the level of carbon dioxide doubled. These 300-tonne ships 'would be powered by the wind, but would not use conventional sails. Instead they would be fitted with a number of 20 m-high, 2.5 m-diameter cylinders known as Flettner rotors. The researchers estimate that such ships would cost between £1m and £2m each. This translates to a US$2.65 to 5.3 billion total cost for the ships only."

[Let me understand this. We suck heat out of the air and add heat to the ocean. Can you say El Nino? Bob]

Related. Science doesn't always get it right the first time.

http://science.slashdot.org/article.pl?sid=08/09/07/1439239&from=rss

Opposable Thumbs and Upright Walking Caused By "Junk DNA"

Posted by Soulskill on Sunday September 07, @11:25AM from the stranded-pairs dept. Biotech Science

quinnlynn writes

"A group of research scientists at Yale discovered that the evolution of opposable thumbs and upright walking in humans is due to changes in the genome in the areas still classified as "junk DNA."

... In the last several years, scientists have discovered that non-coding regions of the genome, far from being junk, contain thousands of regulatory elements that act as genetic "switches" to turn genes on or off.'"

__

Someone needs to review their procedures...

http://www.pogowasright.org/article.php?story=20080906190041854

UK: Personal details of 5,000 jail staff lost

Saturday, September 06 2008 @ 07:00 PM EDT Contributed by: PrivacyNews

Jack Straw, the justice secretary, has called for an urgent inquiry into the latest government loss of computer data, a disk containing the personal details of 5,000 prison staff.

Although the prison service was informed of the loss in July, Straw, who is the minister responsible, was only made aware of it yesterday when he was contacted by a Sunday newspaper.

The hard disk containing personal details of up to 5,000 staff, including probation workers, was mislaid by a computing firm working for the Ministry of Justice more than a year ago.

According to a letter sent by the firm, EDS, on July 4, the 500GB portable hard disk contained names, dates of birth, National Insurance numbers and prison service employee numbers of about 11% of the UK prison service’s 45,000 workers.

Source - Times Online

Related When you have no clue what happened, you only HOPE the data isn't in the wrong hands (it clearly isn't in the right ones)

http://www.pogowasright.org/article.php?story=2008090706150680

UK: Lost data disc 'not in wrong hands' (follow-up)

Sunday, September 07 2008 @ 06:15 AM EDT Contributed by: PrivacyNews

A lost computer disc containing personal details about thousands of justice staff is not thought to have fallen into the wrong hands, a Government minister said.

... The hard-drive was last seen by contractors EDS in July 2007, but it was not until July this year that the private contractor informed the Prison Service and Mr Straw himself did not learn of the loss until it was uncovered by the News of the World.

The 500GB disc contained personal details including the names, dates of birth, National Insurance numbers and employee numbers of 5,000 people employed by the National Offender Management Service, who may include many prison officers as well as administrative staff and other workers.

It was shipped from offices at Mitcheldean in Gloucestershire in July 2007 for testing [Live data is not good for testing. Testing is intended to catch errors, which should not exist in live data that has already been edited. Bob] at a data centre in Washington, Tyne and Wear, and then moved to an EDS facility in Telford, Shropshire. It was only when an employee went to use it on July 2 this year that it was realised that it had gone missing. [Not a very urgent project... Bob]

Source - The Press Association

“Mission creep” only applies when you didn't plan to do something in the first place...

http://www.pogowasright.org/article.php?story=20080907060942460

UK using anti-terrorism laws to spy on noisy kids

Sunday, September 07 2008 @ 06:09 AM EDT Contributed by: PrivacyNews

Seventy-five percent of the local councils across Britain have reportedly used the Regulation of Investigatory Powers Act (RIPA) 2000, an anti-terrorism law, over the past year to spy on residents and tackle barking dogs and noisy children.

A Sunday Telegraph report said that the act gives councils the right to place residents and businesses under surveillance, trace telephone and email accounts and even send staff on undercover missions.

Source - BritainNews.net

Chrome continues to be an interesting target. Google claims to have assembled their “Terms of Use” by cut an paste from other products. Perhaps some law professor (and a philosophy professor?) will write a “guideline for privacy” that could be used instead? (Hint Hint)

http://developers.slashdot.org/article.pl?sid=08/09/06/1316257&from=rss

Development, Privacy, and Standards for Chrome

Posted by Soulskill on Saturday September 06, @10:15AM from the chrome-chrome-chrome-chrome-chrome dept.

Continuing our coverage of Google Chrome, snydeq points out an Infoworld story about looking at the new browser from a developer's perspective, and another about how WebKit should be the focus of development efforts, rather than the browsers that use it. TGdaily notes that Chrome's search box will fetch all types of data, and can be made to display banking information with little effort. ABC and coderrr have slightly more paranoid articles questioning Google's commitment to privacy. NetworkWorld suggests that Chrome's unique process model (explained here) will require the development of new measurement standards.

Sounds like an easy win...

http://xp-vista-update.net/?id=31863829103

isoHunt Sues the CRIA to Legalize BitTorrent Sites

Written by Ernesto on September 05, 2008

Following Demonoid and QuebecTorrent, the Canadian Recording Industry Association (CRIA) has threatened isoHunt with legal action. However, isoHunt has decided to launch a preemptive strike, as it turns the tables and sues the CRIA instead.

... Fung has pointed out that, like most other BitTorrent sites, isoHunt has a Copyright Policy, and takes down .torrent files when they receive an appropriate request. The CRIA simply ignored this, even though they have sent correct takedown notices to isoHunt before (and isoHunt complied), and continued to threaten with legal action.

Hack du jour “Password security” is an oxymoron.

http://digg.com/linux_unix/Recover_a_Lost_Linux_Password

Recover a Lost Linux Password

lifehacker.com — Here's a step-by-step account of the command line fix you can make by booting into "single user mode." The fix is written from an Ubuntu perspective, but applies to most any Linux system that boots with the GRUB manager. It's also a reminder that even a password-protected Linux box isn't truly protected from the curious, so encrypt your data.

http://lifehacker.com/5045857/recover-a-lost-linux-password

Related One hack gets every taxpayer? I'd call that a big target...

http://www.bespacific.com/mt/archives/019245.html

September 06, 2008

Treasury OIG: Unauthorized and Insecure Internal Web Servers Are Connected to the Internal Revenue Service Network

Treasury Inspector General for Tax Administration: Unauthorized and Insecure Internal Web Servers Are Connected to the Internal Revenue Service Network, August 26, 2008. Reference Number: 2008-20-159

• "We recommended that the Chief Information Officer establish official ownership and assign responsibilities for the web registration program, enforce IRS procedures to block unauthorized web servers from providing data over the IRS network, and require an annual scan of web servers and comparison to the web registration database to identify unauthorized web servers. [Only once a year? Bob] Unauthorized web servers should be immediately disconnected from the IRS network, and inappropriate web sites should be referred to the Treasury Inspector General for Tax Administration Office of Investigations."

Where to recruit hackers. (A great list of Hacker Conventions)

http://tech.slashdot.org/article.pl?sid=08/09/06/220210&from=rss

Hacker Conventions Ranked By Bandwidth-Per-Visitor

Posted by timothy on Saturday September 06, @06:50PM from the elbowroom-is-too-hard-to-quantify dept. Networking IT

Anonymous Coward writes

"Ever wondered how much bandwidth you will get at a hacker con? This web page tells you how much. It shows the total bandwidth and bandwidth for each visitor for all the recent hacker cons."

It looks like Defcon attendees get the short end of the stick, while those at metarheinmain chaosdays are practically swimming in bandwidth. There are a lot of other cons (a few examples listed here) which I'd like to see added to this list.

Another step towards automation of student papers. Type in a topic, answer a few simple questions and the program searches the web, collects articles, makes proper citations, and pumps out the required number of pages...

http://digg.com/tech_news/RDFa_goes_to_W3C_Proposed_Recommendation

RDFa goes to W3C Proposed Recommendation

creativecommons.org — Yesterday RDFa reached Proposed Recommendation status at the World Wide Web Consortium, the final stage before becoming a W3C Recommendation. RDFa makes data in web pages rendered for humans readable in a meaningful way by computers. It's always been difficult to bring the Semantic Web to the World Wide Web, RDFa is crucial bridging them together.

Are you ready for some e-Football?

http://news.cnet.com/8301-1023_3-10034466-93.html?part=rss&subj=news&tag=2547-1_3-0-5

In NFL deal, an extra point for Adobe's Flash

Posted by Jonathan Skillings September 6, 2008 6:40 PM PDT

Adobe Systems' Flash technology may not have qualified for the Olympics, but it is in tip-top shape for the National Football League season just getting under way.

With the bulk of NFL teams hitting the gridiron in earnest Sunday, it'll be Flash that delivers the live video streaming on the Web of NBC's Sunday Night Football games. This marks the first time that full-length NFL games are widely available online in the U.S., according to Adobe and the NFL.

You'd think crooks would have better ways to dispose of the evidence.

http://www.pogowasright.org/article.php?story=20080905222721810

Kr: `GS Caltex Leaked Personal Data of 11 Mln Customers`

Saturday, September 06 2008 @ 05:27 AM EDT Contributed by: PrivacyNews

And poof, within a week, yet a third breach that would make the Top 10 list.

Two multimedia discs containing the personal information of 11.1 million customers of GS Caltex, one of the nation`s largest oil refineries, was found on the street, police said yesterday.

Police have not yet confirmed any damage caused by the leak, but this is considered the country’s largest leak of its kind given the number of people involved.

.... The discs -- one DVD and a CD-Rom which are believed to have been thrown away -- were found early this month by an office worker in a backstreet’s trash pile near Gangnam subway station in Seoul.

The DVD contained 76 files in a folder named “GS Caltex,” including the names, social security numbers, addresses, cell phone numbers, email addresses and workplaces of customers sorted by age. The CD-Rom is believed to be a sample of the DVD as it contains only a few people’s personal data.

Source - The Dong-A Ilbo

[From the article:

“We have tentatively concluded that it is membership information collected for the bonus card issued by our company. The bonus card offers discounts for fill-ups, and is mainly issued by gas stations to compile customers’ personal information.” [Wow, what a relief! Bob]

... Experts say a GS Caltex employee likely stole the information for personal purposes given no signs of hacking and the anti-hacking system being intact.

Not sure what is going on here... Do we have another San Francisco type incident where an employee is taking control of sensitive data that the organization is not adequately protecting?

http://www.pogowasright.org/article.php?story=20080906055423925

NH: LGC employee arrested over missing data

Saturday, September 06 2008 @ 05:54 AM EDT Contributed by: PrivacyNews

The Concord police arrested a former Local Government Center employee yesterday, accusing her of removing computer backup tapes and manipulating computer information at the organization. Ruthanne Bradley, 46, was released yesterday on $25,000 personal recognizance bail and faces four Class A felony charges.

The Local Government Center - which administers benefit plans for public employees - maintains databases that include personal information for public employees throughout the state, including Social Security numbers and medical information, according to the police. The data in question had the potential to affect an estimated 190,000 current and former public employees, the police said.

There is a window of time - between 41½ hours and 60 hours - when law enforcement officials can't account for the whereabouts of the two backup tapes, said Concord Police Detective Mark Dumas of the computer crimes unit.

Source - Concord Monitor

Related - Boston Globe: NH Local Government Center worker arrested

[From the first article:

No victims have come forward thus far to say that their personal information has been used illegally, said Concord Police Lt. Keith Mitchell. [How would any victim know who to contact before the breach was disclosed? Bob]

[From the second article:

Last month, the center said the backup tapes were missing from the secured room where they are stored, then turned up in the building later. The center said an internal audit was conducted and it was found that there was no breach of personal data.

... Police, who have been investigating the matter since Aug. 6, said they couldn't definitively ascertain if the backup tapes had ever been compromised or left the building.

If I read this correctly, they kept the data online even when there was no longer a business need for it.

http://www.pogowasright.org/article.php?story=20080905124032744

Jp: Cyber-attacks leak info on Hotta customers

Friday, September 05 2008 @ 12:40 PM EDT
Contributed by: PrivacyNews

The personal data of as many as 18,000 customers have been compromised after the server of Tokyo-based pet supply firm Hotta was accessed by a hacker in China, The Yomiuri Shimbun has learned.

The company confirmed there have been at least 30 incidents of phishing for personal data and its fraudulent use. The company also said they filed a police report last month.

According to a Hotta spokesman, between January 2004 and May 2007, about 18,000 customers entered their personal details, such as name, address and e-mail address, on the company's Web site to join a membership plan for buying products off the company's Dog One Life Web site. About 4,800 customers also included credit card information.

Source - Daily Yomiuri Online

[From the article:

The company continued operating the server even after online sales activities were ended in late May last year. This June, however, the company began receiving notices from credit card companies regarding possible information theft.

Can you remember the world without Google?

http://tech.slashdot.org/article.pl?sid=08/09/05/1944214&from=rss

Google Turns 10

Posted by CmdrTaco on Friday September 05, @04:53PM from the we'll-always-be-older-and-poorer dept. Google

Ian Lamont writes

"It was on September 7, 1998 that Larry Page and Sergey Brin founded Google Inc., aiming to provide a better search engine. You can see what it looked like here. Google had a relatively good search engine technology that succeeded in burying many late 1990s competitors, and it eventually developed a successful advertising model and pledged to "do no evil." The company now has nearly 20,000 employees and a $150 billion market value, and has been acquiring or developing a host of groundbreaking technologies. When did you start using its search engine? Is the world a better place because of Google?"

When I assigned them a project to secure a Cloud based application, my students thought I was nuts. (Now of course they know I'm nuts.)

http://www.infoworld.com/article/08/09/05/Appirio-abandons-servers-and-heads-for-the-cloud_1.html?source=rss&url=http://www.infoworld.com/article/08/09/05/Appirio-abandons-servers-and-heads-for-the-cloud_1.html

Appirio opts for the cloud over servers

The company's 100-person operation relies on cloud-based, on-demand software from Google and Salesforce.com

By Paul Krill September 05, 2008

Can a business be run solely in the cloud without a server anywhere in sight? Appirio says it can and is already doing it.

Starting out with four people two years ago and growing to nearly 100 employees, the company relies on cloud-based, on-demand software from Google and Salesforce.com, said Narinder Singh, founder and chief marketing officer at Appirio.

... Annual IT costs per employee for hardware and software at Appirio are less than $1,000, as opposed to the $6,000 to $12,000 per employee that was spent at SAP when Singh worked there, he stressed.

Good article with some interesting citations

http://www.slate.com/id/2199368

Why Is the Internet So Infuriatingly Slow?

Plus, two horrible things your Internet service provider wants to do to make it speedier.

By Chris Wilson Posted Friday, Sept. 5, 2008, at 7:45 AM ET

Related

http://arstechnica.com/news.ars/post/20080904-martin-responds-to-comcast-lawsuit-we-still-want-answers.html

Martin responds to Comcast lawsuit: we still want answers

By Matthew Lasar Published: September 04, 2008 - 09:20PM CT

Federal Communications Commission Chair Kevin Martin said today that he was "disappointed" by Comcast's decision to sue the FCC over its move to sanction the company for P2P throttling. But Martin said he's glad that the cable giant says it will still comply with the Commission's Order requiring the company to reveal its Internet management policies, because the agency has lots of questions.

"Given Comcast's past failure to disclose its network management practices to its customers, it is important Comcast respond to the many still-unanswered questions about its new management techniques," Martin warned in a statement released this afternoon. Most notably, what exactly does Comcast mean when it says it will have a "protocol agnostic" management system in place by the end of the year?

And as for the bandwidth limits that Comcast has now announced: "How will consumers know if they are close to a limit?" Martin asked. "If a consumer exceeds a limit, is his traffic slowed? Is it terminated? Is his service turned off?"

Anticipating Comcast's arguments that the FCC has no jurisdiction to sanction its behavior, Martin reminded the company that when the FCC approved it and Time-Warners' acquisition of Adelphia Communications in July of 2006, the FCC "put Comcast on notice" that it would act on complaints of degraded Internet content. "Comcast nonetheless chose to close on that deal," Martin noted.

... While Free Press's Ben Scott also calls Comcast's actions "predictable," his comments concur that Capitol Hill has to address the problem. "The future of the Internet is too important to let Comcast tie it up in legal limbo," Scott said. "Congress should act now to pass net neutrality laws that clear up any uncertainty once and for all."

Is this viable? (I did find a lawyer I know in the Litigation Practice Group at Holme Roberts & Owen easily enough...)

http://www.killerstartups.com/Search/feefiefoefirm-com-find-law-firms

FeeFieFoeFirm.com - Find Law Firms

http://www.feefiefoefirm.com

Are you looking for legal help? If you are, then you should start looking through Feefiefoefirm.com. With this legal search engine, you’ll be able to find a law firm in your area willing to help you out in your court case. You’ll be able to read many court profiles, see what services they excel in, and many other things that are sure to help you in deciding whether or not you want to hire a law firm’s services. If you own a law firm, you’ll be able to submit your site to them. This will make it easier for you to get costumers, as you’ll have place where you can get free exposure. While sites like this abound, this one has a great search engine and since you can search for law firms outside of the US, it covers a lot more territory.

.

Proof that ID theft can work in both directions, not just US data being used overseas. Strange that only US citizens are being hit – does this suggest a reverse discrimination or are UAE cards flagged in some way that protects them?

http://www.pogowasright.org/article.php?story=20080904144224447

Hackers break into UAE credit network to fund US purchases

Thursday, September 04 2008 @ 02:42 PM EDT Contributed by: PrivacyNews

An international investigation is under way to find hackers believed to have stolen information from financial servers in the UAE to make fraudulent credit and debit card purchases in the US.

The scheme came to light after a number of employees at the US Embassy – and a handful of other US citizens – had unauthorised purchases show up on their credit and debit cards in recent months, prompting the embassy to issue a warning on its website.

Source - The National

What does this suggest? Google just didn't make an effort to review the EULA earlier? See if they squawk and if so we'll change it?

http://www.pogowasright.org/article.php?story=20080904144439922

Google changes Chrome EULA over privacy concerns

Thursday, September 04 2008 @ 02:44 PM EDT Contributed by: PrivacyNews

Within seconds of me posting about privacy concerns and other fixes in Chrome, I discovered that Google has now removed the clause where that said they could look under your bed, run DNA tests on your spouse, and inspect behind the ears of your kids after a bath. Or maybe it was just something about: they could collect and store you private data and re-distribute it.

I obviously know my posts had nothing to do with it, or that these other stories elicited much of a response. I do suspect that a debate on Slashdot fueled some speculation at Google about how much information the company can collect about you and your online travails.

Source - Computerworld

Apparently Pogo has been doing some reading. Here are the articles I'll probably read (more on their website.)

http://www.pogowasright.org/article.php?story=20080905052010424

Article: The Rise and Fall of Invasive ISP Surveillance.

Friday, September 05 2008 @ 05:20 AM EDT Contributed by: PrivacyNews Internet & Computers

Ohm, Paul,The Rise and Fall of Invasive ISP Surveillance(August 30, 2008).

Free full-text article available for download here

Related. Wired picked up on this one too..

http://blog.wired.com/27bstroke6/2008/09/isps-will-all-s.html

ISPs Will All Spy on Their Customers, Professor Warns

By Ryan Singel September 04, 2008 8:27:20 PM

If there's a candidate for the worst future violator of your privacy, look no further than the company you pay for broadband.

So says University of Colorado law professor and former federal prosecutor Paul Ohm, who argues in a new article that ISPs have the means, motive and opportunity to kill your online privacy.

http://www.pogowasright.org/article.php?story=20080905054156585

Article: Facebook and the Social Dynamics of Privacy

Friday, September 05 2008 @ 05:41 AM EDT Contributed by: PrivacyNews

Full-text article available for free download from SSRN

http://www.pogowasright.org/article.php?story=20080905054327556

Article: Engineering Privacy

Friday, September 05 2008 @ 05:43 AM EDT Contributed by: PrivacyNews

Full-text article available for free download from SSRN

http://www.pogowasright.org/article.php?story=20080905054722166

Article: Regulation of Converged Communications Surveillance

Friday, September 05 2008 @ 05:47 AM EDT Contributed by: PrivacyNews

Full-text article available for free download from SSRN

http://www.pogowasright.org/article.php?story=20080905055054455

Book Review: Do We Need a New Fourth Amendment?

Friday, September 05 2008 @ 05:50 AM EDT Contributed by: PrivacyNews

Full-text article available for free download from SSRN

http://www.pogowasright.org/article.php?story=20080905055355984

Article: Outrageous Invasions: The Defamation and Harassment Surrounding Media Invasion of Celebrities' Private Lives

Friday, September 05 2008 @ 05:53 AM EDT Contributed by: PrivacyNews

Source - SSRN

Complexity wrapped in obscurity based on technology.

http://www.bespacific.com/mt/archives/019235.html

September 04, 2008

New on LLRX.com - E-Discovery Update: Producing Spreadsheets in Discovery

E-Discovery Update: Producing Spreadsheets in Discovery – 2008

• In spite of great financial investment to produce these documents in a way that satisfies competing litigation needs of authenticity and full native functionality, litigants continue to disagree on a production format for these documents, according to Conrad J. Jacoby.

There seems to be a trend to adopt “industry standard” security guidelines as state law. This is simply another example. Are legislatures going to far in order to be seen “doing something?”

http://www.pogowasright.org/article.php?story=20080904144034474

'I'll be back': Vetoed data breach bill goes to Schwarzenegger again

Thursday, September 04 2008 @ 02:40 PM EDT Contributed by: PrivacyNews

An amended version of a closely watched data breach bill that was vetoed by California Gov. Arnold Schwarzenegger last October is once again headed to his desk for approval.

The bill — known as the Consumer Data Protection Act, or AB 1656 (download PDF) — basically would require retailers that accept payment card transactions to take specific precautions for protecting cardholder data and disclose more details about data breaches to consumers affected by them. But an earlier provision that would have required retailers to reimburse financial institutions for the costs involved in replacing credit and debit cards compromised in breaches has been dropped.

Source - Computerworld

Redefining “unlimited”

http://tech.slashdot.org/article.pl?sid=08/09/04/221228&from=rss

Comcast Appeals FCC's Net Neutrality Ruling

Posted by timothy on Thursday September 04, @06:12PM from the makes-one-long-for-tin-cans-and-string dept. The Internet The Courts

Ian Lamont writes

"Comcast has filed a court appeal of an FCC ruling that says the company can't delay peer-to-peer traffic on its network because it violates FCC net neutrality principles. A Comcast VP said the FCC ruling is 'legally inappropriate,' but said it will abide by the order during the appeal while moving forward with its plan to cap data transfers at 250 GB per month."

This is the first ruling of its kind? Sounds obvious to me!

http://www.pogowasright.org/article.php?story=20080904105813456

No 'Legitimate' Privacy Expectation in Data on Office Computer, Court Says

Thursday, September 04 2008 @ 10:58 AM EDT Contributed by: PrivacyNews

An employee has no reasonable expectation of privacy in personal files stored on a company-owned computer and an employer's consent makes a police search lawful, an appeals court says in a ruling of first impression in New Jersey.

The Aug. 29 ruling affirms a former bookkeeper's conviction of stealing over $650,000 in electronic fund transfers, records of which were found through warrantless searches of the laptop and desktop computers he used at work.

"We conclude ... that neither the law nor society recognize as legitimate defendant's subjective expectation of privacy in a workplace computer he used to commit a crime," Judge Marie Simonelli wrote for the three-judge panel in State v. M.A., A-4922-06.

Source - Law.com

[From the article:

Attorney General Anne Milgram's spokesman, Peter Aseltine, says she is pleased the court recognized that there is no expectation of privacy in criminal matters, just as there is none in civil matters. "That ruling was compelled under the particular facts of this case," he says. "[T]he defendant had been advised the computers were company property, the computers were connected to the company's network system and the defendant's office was never closed or locked."

Related?

Also “obvious” but not clearly defined?

http://www.pogowasright.org/article.php?story=20080905060958753

Judge Shielding IDs of Online News Commenters

Friday, September 05 2008 @ 06:09 AM EDT Contributed by: PrivacyNews

A Montana state judge is ruling that the identities of anonymous commenters posted on news sites are protected by a state's media shield law.

While Wednesday's decision does not carry legal weight with other judges across the United States, media lawyers said Thursday they believed it was the first ruling of its kind.

Source - Threat Level blog

I watch what satellite capabilities are mentioned online, no matter how bizzare.

http://yro.slashdot.org/article.pl?sid=08/09/05/1157243&from=rss

Shadow Analysis Could Spot Terrorists

Posted by kdawson on Friday September 05, @08:24AM from the made-in-the-shade dept. Privacy

Hugh Pickens writes

"An engineer at Jet Propulsion Labs says it should be possible to identify people from the way they walk — a technique called gait analysis, whose power lies in the fact that a person's walking style is very hard to disguise. Adrian Stoica has written software that recognizes human movement in aerial and satellite video footage by isolating moving shadows and using data on the time of day and the camera angle to correct shadows that are elongated or foreshortened. In tests on footage shot from the sixth floor of a building, [Is this truly comparable to satellite resolution? Wow! Bob] Stoica says his software was indeed able to extract useful gait data. Extending the idea to satellites could prove trickier, though. Space imaging expert Bhupendra Jasani at King's College London says geostationary satellites simply don't have the resolution to provide useful detail. [Spy satellites are not geostationary. Bob] 'I find it hard to believe they could apply this technique from space,' says Jasani."

Comments on the article speculate on the maximum resolution possible from KH-11 and KH-12 spy satellites.

...and for simple satellite watching...

http://science.slashdot.org/article.pl?sid=08/09/05/1231228&from=rss

Every Satellite Tracked In Realtime Via Google Earth

Posted by kdawson on Friday September 05, @09:12AM from the bejeweled-coterie dept. Space Earth

Matt Amato writes

"With the recent discussion of the ISS having to dodge some space junk, many people's attention has once again focused on the amount of stuff in orbit around our planet. What many people don't know is that USSTRATCOM tracks and publishes a list of over 13,000 objects that they currently monitor, including active/retired satellites and debris. This data is meaningless to most people, but thanks to Analytical Graphics, it has now been made accessible free of charge to anyone with a copy of Google Earth. By grabbing the KMZ, you can not only view all objects tracked in real-time, but you can also click on them to get more information on the specific satellite, including viewing it's orbit trajectory. It's an excellent educational tool for the space-curious. Disclaimer: I not only work for Analytical Graphics, but I'm the one that wrote this tool as a demo."

Mellon continues in the headlines as more details trickle out.
http://www.pogowasright.org/article.php?story=2008090405500865
SAIC stock owners' private data stolen (BNY Mellon follow-up)
Thursday, September 04 2008 @ 05:50 AM EDT Contributed by: PrivacyNews
About 38,000 people who owned or held options for SAIC stock had their personal financial information stolen due to a data breach through BNY Mellon, a financial services company.
The data loss affects people who owned restricted stock or options in the huge government contractor beginning in 1993, or who owned stock in the company after Feb. 1, 2006.
Source - The Huntsville Times


The economics of Identity Theft Perhaps a spreadsheet to help estimate your potential liability would be useful?
http://www.pogowasright.org/article.php?story=20080903204533780
Certegy Settles Consumer Data Theft Lawsuits
Wednesday, September 03 2008 @ 08:45 PM EDT Contributed by: PrivacyNews
A federal judge has approved a settlement in two class-action lawsuits filed against a St. Petersburg check authorizing company that had more than 8.4 million consumer records stolen and sold to direct marketers.
The settlement provides for a range of credit monitoring services and reimbursement of expenses for those whose identity was stolen. The company, Certegy Check Services, is also reimbursing more than $2 million in legal expenses to the law firms involved in the cases.
... Under the settlement, Certegy is required to pay $2.35 million in attorneys' fees, costs and expenses. Two representative plaintiffs, Linda Beringer and Dana M. Lockwood, were awarded $500 each. Other named plaintiffs were awarded $250 each.
Source - Tampa Tribune
[From the article:
A federal prosecutor said at the sentencing hearing that Certegy had to spend $3.2 million to notify the 5.9 million customers whose private financial information was stolen.
... According to a Web site set up to notify consumers about the settlement, www.datasettlement,com, it provides that all class members who had their personal or financial information stolen can get compensated up to $20,000 for certain unreimbursed identity theft losses caused by the data theft. The losses covered could occur from Aug. 24, 1998, to Dec. 31, 2010.
... The thefts resulted in seven class-action lawsuits, two of which were settled by Wednesday's order.


My students always give me a blank look when I insist they should “Assiduously Eschew Obfuscation” Perhaps a paper on “Translating Privacy Policies” would be useful?
http://yro.slashdot.org/article.pl?sid=08/09/04/1110235&from=rss
Privacy Policies Are Great -- For PhDs
Posted by CmdrTaco on Thursday September 04, @08:50AM from the they-have-many-advanced-degrees dept. Privacy
An anonymous reader writes
"Major Internet companies say that they inform their customers about privacy issues through specially written policies. What they don't say is that more often than not consumers would need college undergraduate educations or higher to easily wade through the verbiage. BNET looked at 20-some-odd privacy policies from Internet companies that received letters from the House about privacy practices. The easiest to read policy came from Yahoo, at a roughly 12th grade level. Most difficult? Insight Communications, which at a level of over 20 years of eduction officially puts it onto IRS Code territory."


Think of it as anti-e-Discovery... (Will this result is a law forbidding users to delete any data?)
http://mobile.slashdot.org/article.pl?sid=08/09/03/2249238&from=rss
Criminals Remote-Wiping Cell Phones
Posted by samzenpus on Wednesday September 03, @07:58PM from the this-phone-will-self-destruct dept. Cellphones IT
An anonymous reader writes
"Crafty criminals are increasingly using the remote wipe feature on the Apple iPhone and other business handsets, such as RIM's BlackBerry, to destroy incriminating evidence, the head of the UK's Serious Fraud Office Keith Foggon has warned. Foggon told silicon.com that the move away from PCs towards using mobile phones [Aside: I'll wager most IT departments have little or no control over employee phones. Bob] was causing a headache for crime fighters who were struggling to keep up with the fast pace of new handsets and platforms churned out by the mobile industry."
[Interesting Comments:
Actually, if you slot a microSD card in a BlackBerry, you can set it up to encrypt the card along with the rest of the device, and it's scrubbed along with everything else if too many wrong passwords are entered in*
*The password and encryption is done device-side, so it even works in Linux.


Speaking of e-Discovery, it's always fun to note that even Billionaire CEOs don't understand it.
http://www.infoworld.com/article/08/09/03/Judge_raps_Ellison_over_missing_emails_1.html?source=rss&url=http://www.infoworld.com/article/08/09/03/Judge_raps_Ellison_over_missing_emails_1.html
Judge raps Ellison over missing e-mails
Oracle CEO failed to preserve e-mails and interview materials that should have been supplied in connection with lawsuit filed in March 2001 against the company
By Chris Kanaracus, IDG News Service September 03, 2008
... Oracle produced only 15 e-mails sent or received by Ellison from Ellison's own files, but pulled more than 1,600 Ellison e-mails from the systems of other company workers, according to Judge Susan Illston.


It will be important to use the correct technical term to explain why Ralph nader won the election, otherwise you could look as dumb as an election commisioner....
http://techdirt.com/articles/20080819/1745382036.shtml
E-Voting Isn't Perfect, But It Takes Less Work to Corrupt Big Elections
from the O(1) dept
Thad Hall, a political scientist at Caltech, complains that e-voting critics rarely make apples-to-apples comparisons between electronic and paper voting systems. They contend that if traditional paper voting systems were subjected to the same kind of close scrutiny that e-voting endures, security experts would find flaws—ballot tampering, ballot box stuffing, and so forth—at least as serious as the problems commonly identified in touch-screen voting machines. Rice computer scientist Dan Wallach responds by pointing to a new paper he's written proposing an elegant way to think about the security of voting systems. Computer scientists use "big-O" notation to describe the complexity of algorithms. He suggests a similar terminology to describe the effort required to compromise voting systems as a function of the size of the election. A security flaw that can be compromised with an effort proportional to the number of voters N is said to be a O(N) flaw. A flaw that can be exploited with an effort proportional to the number of polling places is an O(P) flaw. A flaw that can be exploited with a constant amount of effort, regardless of the number of voters, is an O(1) flaw.
The last kind of attack is the most dangerous because it's feasible for a small number of people—perhaps even a single individual—to do a lot of damage. The reason paper-based elections tend to be better than touch-screen elections isn't that the former don't have flaws. The difference is that attacks against paper-based voting systems are far more likely to be O(N) or O(P)—that is, you have to tamper with a lot of ballots or corrupt a lot of poll workers. In contrast, because they contain re-programmable computers at their hearts, touch-screen voting systems are far more susceptible to O(1) attacks such as a custom-developed virus or a corrupt employee at the e-voting vendor. Because they allow a single individual to do extensive damage, they're much more dangerous than other kinds of attacks, even if carrying them out takes relatively more skill or effort than other attacks with O(P) or O(N) cost. The reason to prefer paper-based voting to touch-screen voting isn't that paper voting is flawless, but that the attacks against them are labor-intensive enough that it's difficult to carry out large-scale attacks without getting caught.


Browsers as the Web 2.0 Operating System
http://tech.slashdot.org/article.pl?sid=08/09/03/2244226&from=rss
Chrome Vs. IE 8
Posted by samzenpus on Wednesday September 03, @09:52PM from the put-em-up dept. The Internet Google Internet Explorer IT
snydeq writes
"Google Chrome and Internet Explorer 8 herald a new, resource-intensive era in Web browsing, one sure to shift our conception of acceptable minimum system requirements, InfoWorld's Randall Kennedy concludes in his head-to-head comparison of the recently announced multi-process, tabbed browsers. Whereas single-process browsers such as Firefox aim for lean, efficient browsing experiences, Chrome and IE 8 are all about delivering a robust platform for reliably running multiple Web apps in a tabbed format in answer to the Web's evolving needs. To do this, Chrome takes a 'purist' approach, launching multiple, discrete processes to isolate and protect each tab's contents. IE 8, on the other hand, goes hybrid, creating multiple instances of the iexplore.exe process without specifically assigning each tab to its own instance. 'Google's purist approach will ultimately prove more robust,' Kennedy argues, 'but at a cost in terms of resource consumption.' At what cost? Kennedy's comparison found Chrome 'out-bloated' IE 8, consuming an average of 267MB vs. IE 8's 211MB. This, and recent indications that IE 8 itself consumes more resources than Vista, surely announce a new, very demanding era in Web-centric computing."


From the people that brought you “Double Secret Probation?”
http://news.slashdot.org/article.pl?sid=08/09/03/181251&from=rss
Don't Share That Law! It's Copyrighted
Posted by timothy on Wednesday September 03, @02:32PM from the there-would-be-these-rules-that-everyone-knows dept. Government The Courts United States
Nathan Halverson writes
"California claims copyright to its laws, and warns people not to share them. And that's not sitting right with Internet gadfly, and open-access hero, Carl Malamud. He has spent the last couple months scanning tens of thousands of pages containing city, county and state laws — think building codes, banking laws, etc. Malamud wants California to sue him, which is almost a given if the state wants to continue claiming copyright. He thinks a federal court will rule in his favor: It is illegal to copyright the law since people are required to know it. Malamud helped force the SEC to put corporate filings online in 1994, and did the same with the patent office. He got the Smithsonian to loosen its claim of copyright, CSPAN to stop forbidding people from sharing its videos, and most recently Oregon to quit claiming copyright on state laws."
Malamud's talk at Google ("All the Government's Information") is also well worth watching.


Perhaps “Class Action as a Class Project” at your neighborhood law school? Just a way to help with tuition...
http://techdirt.com/articles/20080901/1828492144.shtml
Suing Telemarketers And Winning
from the it-is-possible dept
While we've noted the fact that many telemarketers are clearly ignoring things like the Do Not Call list, it appears that more and more people are figuring out that they can fight back on their own. Consumerist has the story of one woman who followed the suggestions at the Kill the Calls website and was able to successfully sue a telemarketer in small claims court... and win. It does sound like a fair amount of work, but for those who have the time and the anger at receiving too many intrusive telemarketing calls, apparently it can work -- even if the company in question sends its chief legal counsel across the country to defend its practices.


Nice overview!
http://www.bespacific.com/mt/archives/019223.html
September 03, 2008
CERT: Understanding Voice over Internet Protocol (VoIP)
Cyber Security Tip ST05-018 - Understanding Voice over Internet Protocol (VoIP): "Because VoIP relies on your internet connection, it may be vulnerable to any threats and problems that face your computer. The technology is still new, so there is some controversy about the potential for attack, but VoIP could make your telephone vulnerable to viruses and other malicious code. Attackers may be able to perform activities such as intercepting your communications, eavesdropping, conducting effective phishing attacks by manipulating your caller ID, and causing your service to crash. Activities that consume a large amount of network resources, like large file downloads, online gaming, and streaming multimedia, will also affect your VoIP service."


Worth getting from the library?
http://books.slashdot.org/article.pl?sid=08/09/03/137236&from=rss
Blown to Bits
Posted by samzenpus on Wednesday September 03, @11:19AM from the read-all-about-it dept. thumbnail
Ray Lodato writes
"Few people would deny that the world has changed significantly since the explosion of the Internet. Our access to immense volumes of data has made our lives both easier and less secure. Hal Abelson, Ken Ledeen, and Harry Lewis have written an intriguing analysis of many of the issues that have erupted due to the ubiquity of digital data, not only on the Internet but elsewhere. Blown to Bits: Your Life, Liberty, and Happiness After the Digital Explosion, published by Addison-Wesley, digs into many of the ramifications of making so much information available to the world at large. As I read through the book, I was alternately fascinated and horrified at what information is available, and how it is being used and abused."


...so the move by Comcast and other ISPs to limit bandwidth is a result of their internal structure, not an upstream bottleneck.
http://arstechnica.com/news.ars/post/20080903-what-exaflood-net-backbone-shows-no-signs-of-osteoporosis.html
What exaflood? 'Net backbone shows no signs of osteoporosis
By Nate Anderson Published: September 03, 2008 - 11:12AM CT
Given recent media coverage, it's easy to believe that P2P and streaming video traffic is a rising hurricane battering upon ISP levees, that ISPs are frantically sandbagging their systems against disaster, that throttling, bandwidth caps, and traffic management are urgent and absolute necessities to keep the storm surge at bay. But new research from Telegeography only confirms what we've been saying for some time: the Internet backbone isn't drowning beneath any kind of exaflood. In fact, backbone capacity has grown faster than Internet traffic in the last year—for the second year in a row.


I'll probably fond a few to amuse my students (and perhaps make a point...)
http://blog.wired.com/underwire/2008/09/review-one-minu.html
Wired.com's Picks From Filminute's Microvideo Short-List
By Hugh Hart September 03, 2008 4:20:00 PM


Economics in the People Republic. No doubt they will make it mandatory for (second class) citizens to take cabs and pay three time todays rates so cabbies can earn a “fair” income.
http://blog.wired.com/cars/2008/09/boston-cabbies.html
Boston Cabbies Wicked Mad About Green Taxi Rule
By Dave Demerjian September 03, 2008 5:18:08 PM
... The police department's hackney division, which deals with all things taxi, has decreed that all cab drivers and operators must convert their fleets to hybrids by 2015.


Hackers love a challenge. I give it three days, max.
http://hardware.slashdot.org/article.pl?sid=08/09/03/1726205&from=rss
Ghostbusters Is First Film Released On USB Key
Posted by timothy on Wednesday September 03, @01:46PM from the free-gozer dept. Movies Data Storage Entertainment
arcticstoat writes
"Are you the USB keymaster? You could be soon if you pick up PNY's new 2GB USB flashdrive, which comes pre-loaded with Ghostbusters. A spokesperson for PNY explained that it comes with a form of DRM that prevents you from copying the movie. 'They have DRM protection,' explained the spokesperson, 'so customers can download the movie onto their laptop or PC if they wish, but they have to have the USB drive plugged in to watch the movie, as the DRM is locked in the USB drive.' The music industry has been playing around with USB flash drives for a few years now, but it hasn't been a massive success yet; will USB movies fare any better?"