Interesting. Maybe this is how one should handle a breach. On the other hand, Wal-Mart never states that the data was limited to Illinois. How big was this?

http://www.databreaches.net/?p=3156

Wal-Mart employee data compromised; 48,000 affected

April 20, 2009 by admin
Filed under: Business Sector, Insider, Theft, U.S.

Well, I haven’t found anything more on this from any news source and it’s always odd to find out about a U.S. breach from a non-U.S. source, but International Supermarkets is reporting that:

It has come to light that Wal-Mart has suffered a breach in its staff data system due to a former employee leaving their job with confidential records. The information is said to refer to 48,000 members of staff in the state of Illinois, America.

Anyone have a notification or more on this? If so, please send it in. Their report says that the breach was mid-2007 but is only being reported in the media now.

Update: Aha! I see that over this past weekend, the good folks over at OSF uploaded the notification to Illinois (pdf) even though there are no media reports linked. Yet another reason to have reports to states publicly available. According to the notification, 48,686 residents of Illinois were affected.

Perhaps we let them take false information? Nah, too Machiavellian. But then I find it difficult to believe the military had lousy security over classified information.

http://it.slashdot.org/article.pl?sid=09/04/21/1257202&from=rss

Computer Spies Breach $300-bil Fighter-Jet Project

Posted by CmdrTaco on Tuesday April 21, @09:25AM from the we're-still-number-one-at-this dept. Security The Military United States

suraj.sun writes

"Computer spies have broken into the Pentagon's $300 billion Joint Strike Fighter project — the Defense Department's costliest weapons program ever — according to current and former government officials familiar with the attacks. Similar incidents have also breached the Air Force's air-traffic-control system in recent months, these people say. In the case of the fighter-jet program, the intruders were able to copy and siphon off several terabytes of data related to design and electronics systems, officials say, potentially making it easier to defend against the craft"

Looks like the government is setting up protections for when (not if) security fails.

http://www.databreaches.net/?p=3167

HHS offers health IT privacy guidelines

April 21, 2009 by admin Filed under: Breach Laws, Federal, Healthcare Sector, Legislation, U.S.

Brian Robinson reports in Government Health IT:

The Health and Human Services Department has begun overhauling the privacy and security rules that govern personal health information, which is considered vital to attempts by Congress and the Obama administration to broaden the adoption of electronic health records.

HHS published guidance on April 17 that outlines the ways that health information can be protected from security breaches. It builds on rules in the Health Insurance Portability and Accountability Act (HIPAA).

Read more (external site).

[From the Government Health article:

The latest guidance also provides legal safeguards for those who adhere to it. Although covered entities and businesses are not required to follow it, the technologies and methodologies it describes “create the functional equivalent of a safe harbor,” HHS said. Therefore, those who use them will not have to provide the kinds of notifications the HITECH Act requires in the event of a security breach.

No surprise? There must be money it malware... (Good overview video)

http://www.atthebreach.com/blog/record-breaking-malware-growth/

April 20, 2009

Record Breaking Malware Growth

According to the latest report by F-Secure, malware has had explosive growth during the last half of 2008 with trends continuing into 2009.

The report sites that 2007 doubled over the previous 2006 records, and 2008 more than tripled the 2007 numbers in total malware instances found. The database with signature based definitions is now over 1.5 million with 1 million of those added in 2008.

There's money in “feel good” too. But you have to actually take it.

http://blog.wired.com/business/2009/04/susan-boyle-nev.html

Susan Boyle YouTube Video: 100 Million Hits, So Where's the Money? [Updated]

By Eliot Van Buskirk April 20, 2009 1:46:50 PM

Susan Boyle's Britain's Got Talent video is on track to become the most popular video in the history of YouTube, amassing nearly 100 million views in its first nine days and earning the producers of the program a serendipitous, potential windfall that should already be in the millions.

Update, 6:58pm EST: Hours later, a Google spokeswoman responded to our e-mail and phone queries with some surprising news: "That video is not being monetized." have a call in to Sony/BMG to try to determine why the $500,000 or more Boyle's video should have generated so far is apparently being left on the table, despite the fact that Sony/BMG is a confirmed, revenue-sharing partner of YouTube (as is Fremantle, the Sony/BMG division that produces the show).

… As a contestant, Boyle would likely not have a piece of the action — yet. And it isn't clear what deal Cowell, a judge and producer of the show, and his label, Sony/BMG have with YouTube as part of their revenue-sharing deal. If it's half a cent per play — a typical figure for such deals — that would translate into a $500,000 payday so far. And if Google sold a decent amount of video overlays on the video (earning an estimated $20 per thousand views), Cowell and company would be owed millions more in revenue sharing. [Again, Google says it somehow didn't sell a single ad against these 100 million or so views; see update above.]

If a law falls in the forest and no one notices, does it make a noise?

http://blog.wired.com/27bstroke6/2009/04/scholars-reject.html

Scholars Reject Obama's Stance on Warrantless Cell-Phone Records

By David Kravets April 20, 2009 4:02:57 PM

Two legal scholars say the Obama administration is wrong to claim the Fourth Amendment prohibition against unreasonable searches and seizures does not apply to customer cell-site location information that mobile phone carriers retain.

"Because CSLI acquisition is hidden, indiscriminate and intrusive, and because it reveals information over a period of time, it should be subject to the highest level of Fourth Amendment oversight (the same procedures used for wiretapping and video surveillance)," the scholars wrote late Friday.

The scholars are Susan Freiwald, of the USF School of Law, and Peter Swire, of Ohio State University.

Shouldn't all organizations have rules for employees representing the company?

http://yro.slashdot.org/article.pl?sid=09/04/20/2330230&from=rss

Telstra Lays Down Law On Social Media

Posted by ScuttleMonkey on Monday April 20, @11:20PM from the doing-more-harm-than-good dept.

Kerrieanne writes to tell us that Australian telecommunications giant Telstra has become the first major player down under to lay down the law with respect to social media. Still recovering from the shakeup surrounding a Telstra worker using the name of the communications minister on Twitter, they have released a six-page set of guidelines on the use of Facebook, Twitter, and other similar websites for both company and personal use.

"Under the guidelines, which are backed up with the threat of disciplinary action, employees using sites on official Telstra business should disclose who they are, ensure they do not give away confidential information and treat other users with respect. They are required to complete an accreditation process and undergo training to update their 'knowledge on emerging social trends and evolving best practice in social media.'"

[So I went to a Telstra Blog site: http://www.nowwearetalking.com.au/opinion/blog-how-the-3rs-empower-telstra-staff-online-225

Download a copy of Telstra's 3Rs guardrails (PDF 67KB)

This could be a very useful research tool...

http://www.bespacific.com/mt/archives/021161.html

April 20, 2009

Google Announces News Timeline

Google News Blog: "Today, we're announcing Google News Timeline--a new feature on Google Labs that organizes many different types of search results on a zoomable, graphical timeline. Google News Timeline presents search results from a wide range of sources. You can search and browse results from Google News, including headlines, quotes, photos from our Hosted News partners, and YouTube partner videos. You can also search for thousands of archival newspapers and magazines from Google News Archive Search and Google Book Search."

For historians?

http://www.bespacific.com/mt/archives/021083.html

April 20, 20090

The World Digital Library Has Launched

"The World Digital Library will make available on the Internet, free of charge and in multilingual format, significant primary materials from cultures around the world, including manuscripts, maps, rare books, musical scores, recordings, films, prints, photographs, architectural drawings, and other significant cultural materials. The objectives of the World Digital Library are to promote international and inter-cultural understanding and awareness, provide resources to educators, expand non-English and non-Western content on the Internet, and to contribute to scholarly research."

Now this is something I've got to play with.

http://www.makeuseof.com/tag/how-to-convert-programs-to-run-on-a-u3-drive-with-packagefactory/

How To Convert Any Windows Program to Run on a U3 Drive

Apr. 20th, 2009 By Guy McDowell

… Eure.ca has developed software called PackageFactory that takes your desktop application and converts it into a U3P application to run on your U3 drive. Best of all, it’s free for personal use!

Customers are fair game, but don't mess with employee (my?) data!

http://www.switched.com/2009/04/18/myspace-fires-employee-after-data-breach/

MySpace Fires Employee After Data Breach

by Warren Riddle — Apr 18th 2009 at 8:03AM

… On Monday, workers for the social networking site learned of a data breach orchestrated by a fellow employee, who collected names, Social Security numbers and compensation information of many of his co-workers. Fox Entertainment Group (the company that operates MySpace) sent e-mails to all employees alerting them to the incident, and assured them that no bank account or medical information was compromised.

Fox Entertainment promptly terminated the perpetrator; a departure from the typical MySpace and Facebook firing stories we often cover here at Switched. The internal e-mail, which was forwarded to TechCrunch, told employees that the thief used the acquired data to "annoy selected individuals," but did not send the information to any third parties.

An illustration of your lack of privacy.

http://www.readwriteweb.com/archives/identify_google_people_with_two_keystrokes.php

Identify: Google People With Two Keystrokes

Written by Marshall Kirkpatrick / April 18, 2009 11:54 PM

… About this time last year Google's Brad Fitzpatrick, also the creator of OpenID, led the development of the Google Social Graph API. It's a search engine for all the webpages that we identify as profiles online and it tracks the connections between pages linked together for a single person. At a small event today in Sebastapol, California, British developer Glenn Jones demonstrated the most compelling tool I've seen yet for leveraging this powerful technology.

Called simply Identify, Jones's tool is a Firefox plug-in you can evoke from any web page that has links tagged rel="me". Just click the control key and the "i" key to get a pop-up offering information put together from all around the web about the person the page is associated with. It works on Twitter profile pages, LinkedIn pages, blogs with good markup and other profile pages.

Gosh, they must be pirates or something.

http://digg.com/tech_news/TPB_FTW_The_Pirate_Bay_Blog

TPB FTW - The Pirate Bay Blog

thepiratebay.org — The Pirate Bay guys explain in their latest blog post that they do not want donations since they won't pay those "silly" fines. Instead, they want you to seed a bit more, buy a shirt, and vote!

In the 70's, no one thought much about encryption.

http://www.wired.com/politics/security/news/2009/04/fleetcom

The Great Brazilian Sat-Hack Crackdown

By Marcelo Soares

CAMPINAS, Brazil — On the night of March 8, cruising 22,000 miles above the Earth, U.S. Navy communications satellite FLTSAT-8 suddenly erupted with illicit activity. Jubilant voices and anthems crowded the channel on a junkyard's worth of homemade gear from across vast and silent stretches of the Amazon: Ronaldo, a Brazilian soccer idol, had just scored his first goal with the Corinthians.

… "This had been happening for more than five years," says Celso Campos, of the Brazilian Federal Police. "Since the communication channel was open, not encrypted, lots of people used it to talk to each other."

We could, but we don't?

http://news.cnet.com/8301-1009_3-10222698-83.html?part=rss&subj=news&tag=2547-1_3-0-5

Secure software? Experts say it's no longer a pipedream

by Elinor Mills April 20, 2009 4:00 AM PDT

… Last year, Microsoft began offering free SDL tools so outside developers can assess their practices and analyze their software designs to look for security weaknesses.

The tools for writing secure code are getting better, so developers are less likely to make mistakes, said Johannes Ullrich, chief security researcher at the SANS Institute security organization.

Microsoft isn't alone in providing help to the developer community. HP is offering a free tool that helps find holes in Flash applications, and last week announced tools that nonsecurity professionals can use to do security testing. IBM sells a tool for Flash and Ajax developers, and last week the CERT Coordination Center at Carnegie Mellon released an open-source tool for testing ActiveX code.

… A Forrester survey commissioned by Veracode and released last week found that only 34 percent of companies have a comprehensive software development lifecycle process that integrates application security and 57 percent of organizations don't have systematic application security training programs for developers.

What strategic business objective does this accomplish?

http://yro.slashdot.org/article.pl?sid=09/04/20/0126246&from=rss

eReader.com Limits E-book Sales To US Citizens

Posted by timothy on Sunday April 19, @11:07PM from the geography-is-destiny dept. Books

An anonymous reader writes

"eReader.com seems to have begun applying distribution restrictions to its library. I first noticed that there was a FAQ page about distribution restrictions this morning. When I tried to order a few books this afternoon I simply couldn't — a large banner on the order confirmation told me the books had distribution restrictions. I checked a number of titles but it seems a large number of books are no longer available to non-US citizens like me. It is interesting to note that this policy change got implemented shortly after Barnes&Noble purchased Fictionwise. I have no idea if the new owners are behind this new policy but it seems crazy to restrict sales of ebooks. I've bought dozens of ebooks from eReader the past 4 years. I still have 15 dollar store credit but cannot buy any of the books I am interested in."

(Right now, the link that should display these new geographic restrictions returns an error message that says the page is being updated.) Sounds like Barnes & Noble is taking its cues from Apple.

Which is most logical? Most just?

http://www.databreaches.net/?p=3136

Data Breach Notification Law Across the World from California to Australia

April 18, 2009 by admin Filed under: Breach Laws, Commentaries and Analyses, Non-U.S., U.S.

Alana Maurushat of University of New South Wales has published a review and comparison that is available online at bepress.com in pdf format. The abstract:

Data breach notification and disclosure laws are emerging around the globe. The following article and table examine the specifics of data breach notification frameworks in multiple jurisdictions. Over the year of 2008, Alana Maurushat of the Cyberspace Law and Policy Centre, with research assistance from David Vaile and student interns Renee Watts, Nathalie Pala, Michael Whitbread, Eugenie Kyung-Eun Hwang and David Chau, compiled the data. The table represents a detailed survey of data breach disclosure requirements in 25 countries, conducted by surveying those current or proposed statutory or similar instruments setting out the nature and conditions of such requirements to give notice. The Centre hopes that the table will be useful to compare and contrast elements of data breach notification schemes. The researchers at the CLPC will research the effectiveness of such schemes in future projects.

So, it will be illegal for me to find out what's on the RFID tag attached to my purchase? Or the one on that yard sale item that claims to have a year left on the warranty? Shouldn't all of this be open?

http://www.pogowasright.org/article.php?story=20090418073057137

Washington State Adopts Second RFID Privacy Law

Saturday, April 18 2009 @ 07:30 AM EDT Contributed by: PrivacyNews

Washington State Governor Christine Gregoire has signed into law a bill prohibiting the scanning of an RFID tag by anyone except the business or agency that issued that tag, with certain exceptions.

The legislation, known as House Bill (HB) 1011, lists a dozen such exceptions, including situations in which the scanning is part of a sales transaction initiated by the tag holder, or data from an individual's identification device is remotely read or stored in the course of an act of good-faith security research, experimentation or scientific inquiry. The law is set to go into effect on July 26, 2009.

Source - RFID Journal

Oh look, an open can of worms!

http://yro.slashdot.org/article.pl?sid=09/04/19/007219&from=rss

Internet Archive Seeks Same Online Book Rights As Google

Posted by timothy on Sunday April 19, @01:26AM from the from-a-to-z-and-back-again dept. Books The Internet

Miracle Jones writes

"Brewster Kahle's Internet Archive has jumped on Google's 'Authors Guild' settlement and asked to be included as a party defendant, claiming that they ought to get the same rights and protections from liability that Google will receive when the settlement is approved by federal court. From the Internet Archive's letter to Judge Denny Chin: 'The Archive's text archive would greatly benefit from the same limitation of potential copyright liability that the proposed settlement provides Google. Without such a limitation, the Archive would be unable to provide some of these same services due to the uncertain legal issues surrounding orphan books.'"

Hell no! I determine which truth is THE truth, and it's whatever I answered on my test – not what that defamatory textbook says!

http://www.pogowasright.org/article.php?story=20090418105746245

The Dynamic Balance Between Free Speech and Privacy Interests (commentary)

Saturday, April 18 2009 @ 10:57 AM EDT Contributed by: PrivacyNews

There have been a host of apocalyptic warnings in the blogosphere about the First Circuit’s recent decision holding that truth is not an absolute defense to a defamation claim. One blogger dubbed it “the most dangerous libel decision in decades,” and nearly everyone predicts it could have serious implications for journalists. But instead of joining the chorus of First Amendment advocates decrying the decision, I propose we take a step back to calmly examine the simple but extremely controversial idea that the truth could be defamatory.

Source - Sarah Hinchliff, on CIS

Related Another “Should it be that public” question?

http://news.cnet.com/8301-17852_3-10222755-71.html?part=rss&subj=news&tag=2547-1_3-0-5

The city where every arrest gets Twittered

by Chris Matyszczyk April 18, 2009 11:12 AM PDT

… A Twitter page, headlined "Denton Police," fed details of every arrest the department had performed, coupled with TwitPic mugshots.

This remarkable, real-time communication between the police and outside world surely was a futuristic forerunner to Texas' progression towards secession.

Until it was revealed to be the work of University of North Texas senior, Brian Baugh.

“You are still innocent until proven guilty, but we need the DNA because eventually you're gonna commit a crime.” There are no ethical concerns until someone says, “HEY!”

http://www.bespacific.com/mt/archives/021145.html

April 18, 2009

NYT: F.B.I. and States Vastly Expand DNA Databases

F.B.I. and States Vastly Expand DNA Databases, by Solomon Moore: "Law enforcement officials are vastly expanding their collection of DNA to include millions more people who have been arrested or detained but not yet convicted. The move, intended to help solve more crimes, is raising concerns about the privacy of petty offenders and people who are presumed innocent. Until now, the federal government genetically tracked only convicts. But starting this month, the Federal Bureau of Investigation will join 15 states that collect DNA samples from those awaiting trial and will also collect DNA from detained immigrants — the vanguard of a growing class of genetic registrants. the F.B.I., with a DNA database of 6.7 million profiles, expects to accelerate its rate of growth from 80,000 new entries a year to 1.2 million by 2012 — a 17-fold increase. F.B.I. officials say they expect DNA processing backlogs — which now stand at more than 500,000 cases — to increase."

It's my proposal as well. Interesting comments.

http://tech.slashdot.org/article.pl?sid=09/04/18/1739236&from=rss

Why Is Connectivity So Cheap In Stockholm?

Posted by timothy on Saturday April 18, @03:30PM from the umlauts-defy-gravity dept. Networking The Almighty Buck IT

lpress writes

"Symmetric, 100 Mbps service in Stockholm, costs $11/month. Conditions in every city are different, but part of the explanation for the low cost is that the city owns a municipal fiber network reaching every block. They lease network access to anyone who would like to offer service. The ISPs, including incumbent telephone and cable companies, compete on an equal footing."

Conflict between old and young tech users. Specific look at legal profession.

http://www.bespacific.com/mt/archives/021142.html

April 18, 2009

New Study Examines Technology Generation Gap in the Workplace

News release: "A national survey of American white collar workers found that while technology is widely embraced among working professionals, significant gaps exist among generations regarding its use and application in the workplace. The newly released Technology Gap Survey found generational differences in the effect of technology on workplace etiquette, the blurring boundaries between personal and professional tasks, and the impact of technology overload. The survey – commissioned by LexisNexis, a leading provider of content-enabled workflow solutions – examined the impact of technology in the workplace. It compared technology and software usage among generations of working professionals, including Boomer (ages 44-60), Generation X (ages 29-43) and Generation Y (ages 28 and younger)."

• The Technology Gap Survey was commissioned by LexisNexis. WorldOne Research, an international market research agency specializing in the collection and analysis of data for leading organizations, conducted this survey of 450 professionals.

[Correct link to the survey: http://www.lexisnexis.com/media/pdfs/LexisNexis-Technology-Gap-Survey-4-09.pdf

For the White Hat Hacker Club?

http://it.slashdot.org/article.pl?sid=09/04/18/1630223&from=rss

DHS Seeks "Ethical Hackers" To Protect Federal Net Infrastructure

Posted by Soulskill on Saturday April 18, @01:21PM from the loaded-phrases dept. Security Government

Death Metal sends this excerpt from an AP report:

"General Dynamics Information Technology put out an ad last month on behalf of the Homeland Security Department seeking someone who could 'think like the bad guy.' Applicants, it said, must understand hackers' tools and tactics and be able to analyze Internet traffic and identify vulnerabilities in the federal systems. In the Pentagon's budget request submitted last week, Defense Secretary Robert Gates said the Pentagon will increase the number of cyberexperts it can train each year from 80 to 250 by 2011. With warnings that the US is ill-prepared for a cyberattack, the White House conducted a 60-day study of how the government can better manage and use technology (PDF) to protect everything from the electrical grid and stock markets to tax data, airline flight systems, and nuclear launch codes. ... Nadia Short, vice president at General Dynamics Advanced Information Systems, said the job posting for ethical hackers fills a critical need for the government."

Find free software that does what commercial software does.

http://www.osalt.com/

osalt.com

Find open source software alternatives to well-known commercial software

You should know how to get the most out of these services.

http://www.makeuseof.com/tag/10-youtube-url-tricks-you-should-know-about/

10 Youtube URL Tricks You Should Know About

Apr. 18th, 2009 By Varun Kashyap

Would you like the President to comment on your website?

http://host-d.oddcast.com/php/workshop_UI/door=237&cl=86&AID=0

Global Warming! Global Warming! Another Al Gore “fact”

http://news.slashdot.org/article.pl?sid=09/04/18/2059204&from=rss

Antarctic Ice Is Growing, Not Melting Away, At Davis Station

Posted by timothy on Saturday April 18, @05:13PM from the weather-is-what-you-get dept. Earth Science

schwit1 writes

"A report from The Scientific Committee on Antarctic Research says that Antarctic ice is growing, not melting away. Ice core drilling in the fast ice off Australia's Davis Station in East Antarctica by the Antarctic Climate and Ecosystems Co-Operative Research Centre shows that last year, the ice had a maximum thickness of 1.89m, its densest in 10 years. The average thickness of the ice at Davis since the 1950s is 1.67m. A paper to be published soon by the British Antarctic Survey in the journal Geophysical Research Letters is expected to confirm that over the past 30 years, the area of sea ice around the continent has expanded."

Soon your computer will do everything for you, except open the pod bay door...

http://news.cnet.com/8301-17939_109-10222414-2.html?part=rss&subj=news&tag=2547-1_3-0-5

Gmail now knows who you want to e-mail

by Josh Lowensohn April 17, 2009 2:15 PM PDT

Google's Gmail Labshas just rolled out a useful, but mildly creepy feature that gives you suggestions on who you should e-mail based on previous conversations.

Related What other fun things can Google do?

http://www.techcrunch.com/2009/04/16/google-maps-now-shows-views-from-webcams/

Google Maps Now Show Views From Webcams

by Erick Schonfeld on April 16, 2009

The latest layer to be turned on in Google Maps is one for webcams. Just click on the “More” button on the top right of each map right next to the “Traffic” button. When you do that, it shows you thumbnails from different public Webcams around the world as tracked by Webcams.travel.

You don’t see an actual video, just the most recent still image captured by the Webcam.

This seems a bit far out, but then I'm having trouble seeing any other use for Twitter and its ilk. (Are they recommending using Twitter to communicate or Twitter-taping users to find terrorist wanna-bes?

http://www.upi.com/Emerging_Threats/2009/04/16/Social-media-tools-could-support-security/UPI-74281239924717/

Social-media tools could support security

Published: April 16, 2009 at 7:31 PM

WASHINGTON, April 16 (UPI) -- National Defense University researchers are encouraging the U.S. Defense Department to develop a strategy to use social media to strengthen national security.

… "If you work in national security, some of these things happening in other countries may affect your job or mission. What's happening over the past couple years is people in other countries are using Facebook, Twitter and blogs to organize. In some cases, even when government security knew it was happening, they were overwhelmed by the amount of people who show up."

This is interesting. Someone actually got it right?

http://yro.slashdot.org/article.pl?sid=09/04/17/1710205&from=rss

Looking Back at Copyright Predictions

Posted by ScuttleMonkey on Friday April 17, @01:48PM from the 20-20-hindsight dept.

Techdirt has an interesting look back at some of the more interesting predictions on copyright. The article looks at two different pre-DMCA papers and compare them to what has happened in the world of copyright.

"The second paper is by Pamela Samuelson, and it discusses (again, quite accurately) the coming power grab by "copyright maximalists" via the DMCA, entitled The Copyright Grab. It clearly saw the intention of the DMCA to remove user rights, and grant highly questionable additional rights and powers to copyright holders in an online world. Samuelson lays out many concerns about where this is headed -- including how these proposals appear to trample certain fair use rights -- and in retrospect, her fears seem to have been backed up by history. Samuelson, by the way, has just written a new paper that is also worth reading pointing out how ridiculous current copyright statutory rates are -- an issue of key importance in the ongoing Tenebaum lawsuit, which (thankfully) the judge in the case is going to consider."

Related? This could have been a Liberal theme, but the RIAA was there first with big contributions.

http://news.slashdot.org/article.pl?sid=09/04/17/2041208&from=rss

Swedish Pirate Party Gains 3000 Members In 7 Hours

Posted by ScuttleMonkey on Friday April 17, @05:33PM from the unintended-consequences dept. Politics

An anonymous reader writes

"Due to outrage over the verdict in The Pirate Bay trial, the Swedish Pirate Party has gained 3000 members in less than 7 hours. It is now bigger than 3 of the 7 parties represented in the Swedish parliament. 'Ruling means that our political work must now be stepped up. We want to ensure that the Pirate Bay activities — to link people and information — is clearly lawful. And we want to do it for all people in Sweden, Europe and the world, continues Rick Falk Vinge. We want it to be open for ordinary people to disseminate and receive information without fear of imprisonment or astronomical damages.'"

Never point out the flaws in a politician's reasoning – wait for some 12-year-old to do it for you.

http://news.cnet.com/8301-1023_3-10222512-93.html?part=rss&subj=news&tag=2547-1_3-0-5

YouTube's legal end-run irks Korean officials

by Stephen Shankland April 17, 2009 3:23 PM PDT

Google's advice on sidestepping a South Korean law against anonymous YouTube video postings and comments doesn't seem to be sitting well with some of the country's authorities.

Google, citing free-speech concerns, on Monday said it will comply with the Korean law--but by prohibiting uploads and comments rather than by requiring people to verify their identities. And it told people they could work around the constraint by visiting another country's version of the video-sharing site.

Now the backlash is beginning to set in, according to one Korean media report.

"Korea Communications Commission network policy official Hwang Cheol-jeung says that the commission will be examining whether or not Google has engaged in illegal activities in any of the various services it operates in South Korea," the Hankyoreh reported Friday, saying that could include many more Google activities than just YouTube.

[“You made us look dumb. Now we must look for something so we can get even. We've been too lazy to do this before, and we're probably not smart enough to find anything, so we'll have to make something up.” Bob]

A tool for addressing my fans... Just as soon as I get some. Or perhaps I could record a seminar...

http://www.killerstartups.com/Web-App-Tools/procaster-com-showcase-who-you-are

ProCaster.com - Showcase Who You Are

http://www.procaster.com/

Procaster is a unique desktop application that is completely integrated with the Mogulus streaming service, an online video broadcast solution. This solution stands as a player that you can use to start streaming live. Linear and on-demand content can be streamed as well.

… This solution allows users to broadcast live, and broadcast virtually anything at that. Games, webcams and desktops are fully accounted for. This tool is very simple and it can be used by many people.

Ethics and the White hat Hacker Club

http://news.cnet.com/8301-1009_3-10222373-83.html?part=rss&subj=news&tag=2547-1_3-0-5

Teen Twitter worm writer gets job, spreads new worm

by Elinor Mills April 17, 2009 2:02 PM PDT

The teenager who takes credit for the worms that hit Twitter earlier this week has been hired by a Web application development firm and on Friday released a fifth worm on the microblogging site, he said.

… Mooney is not the first hacker to have parlayed online stunts into profit.

… Rowland said he plans to help guide Mooney away from pranks and toward a promising career as a white hat hacker.

Tool for my website students

http://news.cnet.com/8301-17939_109-10222664-2.html?part=rss&subj=news&tag=2547-1_3-0-5

DoInk lets you draw, animate in your browser

by Josh Lowensohn April 17, 2009 5:49 PM PDT

DoInk is a free online drawing and animation tool that runs right in your browser. You can treat it like Microsoft Paint and use it to do just a quick doodle, or take advantage of its layer cloning and vector-based designs to create relatively advanced animations.

Toys for my students. (I want the USB Panic Button)

http://news.cnet.com/8301-17939_109-10222031-2.html?part=rss&subj=news&tag=2547-1_3-0-5

How to hide your tracks at work

by Don Reisinger April 18, 2009 6:00 AM PDT

We all spend some of our time at work doing things that have nothing to do with our job. We surf the Web. We play games. Sure, we all need our downtime, and the enlightened manager knows that. But still, we'd rather just surf in private than deal with the raised eyebrows.

That's why we need ways to ensure that when our boss surprises us or sneaks up behind us, she'll think that we're actually working. Here's a list of apps and services that help.

Rule 56: Data Breaches are always bigger than initial reports suggest.

http://www.databreaches.net/?p=3127

(Update) Laptop theft from Vavrinek, Trine, Day and Co. reportedly affected 50 banks

April 17, 2009 by admin Filed under: Business Sector, Financial Sector, Subcontractor, Theft, U.S.

Add Mission Bank to what may become a whole list of banks affected when six laptops were stolen from accounting firm Vavrinek, Trine, Day and Co. on or about March 5. Borrego Bank was the first bank we learned about. Now Mission Bank, which reports that it first learned about the theft on April 1, reports that it notified all of its customers. According to a news report by James Chilton of the Kingman Daily Miner, Mission Bank president Darrell Lautaret “noted that the compromised data includes that of roughly 50 other banks. In the month and a half since the burglary, he said none of the banks involved has reported any incidence of related identity theft.”

Even so, one wonders whether data on customers from all approximately 50 banks were left unencryped on the stolen laptops, and if so, what the banks’ agreements with the accounting firm required in terms of security.

I love it! This is the first such lawsuit I've seen. Do you suppose there was any language addressing this in their contract/service agreement?

http://www.databreaches.net/?p=3118

LA: Lawsuit filed over data theft

April 17, 2009 by admin Filed under: Business Sector, Hack, ID Theft, U.S.

Joe Gyan Jr. of The Advocate http://www.2theadvocate.com/news/43149297.html:

A Baton Rouge seafood restaurant from which more than 1,800 patron credit card numbers were stolen in April 2008 is suing the providers of its computers and software.

On the Half Shell, which has one eatery on Bluebonnet Boulevard and another in Prairieville, claims Acadiana-based Computer World Inc. and Radiant Systems Inc. of Georgia should have been able to prevent the thefts.

[...]

The suit says the thieves gained access to the credit card data via the remote access software — PC Anywhere — sold, installed and maintained by the defendants.

Read more in The Advocate.

[From the article:

The suit alleges there were “inadequate security measures and/or precautions in place to prevent attackers from gaining access’’ to the Radiant Aloha point-of-sale system at the Bluebonnet location.

The suit also says there was no firewall in place in the POS systems at the time of the compromise, and that no anti-virus software was installed in the POS terminals.

The suit alleges negligence, fraud, breach of contract, and breach of express and implied warranties.

Unfortunately, I see this far too often.

http://www.databreaches.net/?p=3124

(Follow-up) UK: Human error blamed for data loss

April 17, 2009 by admin Filed under: Healthcare Sector, Lost or Missing, Non-U.S.

A health trust did not take adequate steps to prevent the loss of a memory stick with data on 6,360 prisoners and ex-prisoners, a report has said.

The USB stick was being used to back up clinical databases at HMP Preston when it was lost on 30 December.

A report found that human error was to blame, but that procedures on data security had not been adhered to.

NHS Central Lancashire said it had taken action and reminded staff of their responsibilities.

The data lost was encrypted but the password had been written on a note which was attached when it was misplaced. The USB stick has not been found.

Read more on BBC

Convergence of IP Law and Computer Law?

http://news.slashdot.org/article.pl?sid=09/04/16/1945246&from=rss

The Long-Term Impact of Jacobsen v. Katzer

Posted by timothy on Thursday April 16, @06:00PM from the stabs-in-the-dark dept. The Courts GNU is Not Unix Software Patents

snydeq writes

"Lawyer Jonathan Moskin has called into question the long-term impact last year's Java Model Railroad Interface court ruling will have on open source adoption among corporate entities. For many, the case in question, Jacobsen v. Katzer, has represented a boon for open source, laying down a legal foundation for the protection of open source developers. But as Moskin sees it, the ruling 'enables a set of potentially onerous monetary remedies for failures to comply with even modest license terms, and it subjects a potentially larger community of intellectual property users to liability.' In other words, in Moskin's eyes, Jacobsen v. Katzer could make firms wary of using open source software because they fear that someone in the food chain has violated a copyright, thus exposing them to lawsuit. It should be noted that Moskin's firm has represented Microsoft in anti-trust litigation before the European Union."

Attention records managers! When your DVDs fail, so do your backups?

http://blog.wired.com/gadgets/2009/04/cracked-netflix.html

Netflix Subscribers See Red Over Cracked Blu-ray Discs

By Priya Ganapati April 16, 2009 7:15:33 PM

More than a common blogger ranter, this was Google's privacy guy in Europe.

http://www.pogowasright.org/article.php?story=20090416083949746

The Cloud: policy consequences for privacy when data no longer has a clear location

Thursday, April 16 2009 @ 08:39 AM EDT Contributed by: PrivacyNews

Cloud Computing has become one of the more influential tech trends of our day. The Cloud is roughly analogous to remote computing, where computing and storage move away from your personal device to servers run by companies. A simple example might be online photo albums, which allow users to move their pictures off personal computers and into a secure and accessible space on the Web. Some Cloud services, like Hotmail, have been around for roughly a decade. And others have appeared since; almost all of Google's services, for example, run in the Cloud. As these services become more widely used, it's important to ask how our privacy laws and regimes should deal with this new phenomenon.

Source - Peter Fleischer

Personal surveillance tools are popular.

http://www.atthebreach.com/blog/want-to-see-what-other-people-txt-dont-fall-for-it/

Want to see what other people TXT? Don’t Fall For It.

Websense has recently detected a new scam aimed at infecting systems with malware. The scam includes an email that tells people that by clicking a link and installing and application, they can see other peoples SMS messages. So slooths and wood be snoops are in danger of infection if they aren’t careful.

IT Governance: What do you mean, you don't have a strategy/policy/procedure? What will you do when Al Gore comes calling?

http://hardware.slashdot.org/article.pl?sid=09/04/16/1819206&from=rss

Why IT Won't Power Down PCs

Posted by timothy on Thursday April 16, @02:42PM from the sheer-cussedness dept. Power Businesses The Almighty Buck IT

snydeq writes

"Internal politics and poor leadership on sustainable IT strategies are among the top reasons preventing organizations from practicing proper PC power management — to the tune of $2.8 billion wasted per year powering unused PCs. According to a recent survey, 42 percent of IT shops do not manage PC energy consumption simply because no one in the organization has been made responsible for doing so — this despite greater awareness of IT power-saving myths, and PC power myths in particular. Worse, 22 percent of IT admins surveyed said that savings from PC power management 'flow to another department's budget.' In other words, resources spent by IT vs. the permanent energy crisis appear to result in little payback for IT."

Mostly patting themselves on the back, but eventually, non-encrypted drives will be the exception and inability to access the data (I forgot my pass-phrase) will become increasingly common.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9131684

Full disk encryption comes to SSDs for mobile devices, laptops

Dell adds encrypted drives to its Latitude line of laptops

By Lucas Mearian

April 16, 2009 (Computerworld) Samsung Electronics Co. announced today it is shipping its first self-encrypting solid-state disk (SSD) drives.

… Full disk encryption (FDE) is already a standard feature on some desktop and laptop hard disk drives, including Seagate's Momentus 5400 FDE.2 laptop drive.

Not a popular decision with the commenters. Perhaps the courts will permit this some day...

http://news.slashdot.org/article.pl?sid=09/04/17/0423250&from=rss

Appeals Court Says RIAA Hearing Can't Be Streamed

Posted by timothy on Friday April 17, @01:39AM from the may-not-is-more-like-it dept. The Courts

NewYorkCountryLawyer writes

"The US Court of Appeals for the First Circuit has overturned a lower court order permitting webcast of an oral argument in an RIAA case, SONY BMG Music Entertainment v. Tenenbaum, in Boston. As one commentator put it, the decision gives the RIAA permission to 'cower behind the same legal system they're using to pillory innocent people.' Ironically, the appeals court's own hearing had been webcast, via an mp3 file. The court admitted that this was not an appropriate case for a 'prerogative writ' of 'mandamus,' but claimed to have authority to issue a writ of 'advisory mandamus.' The opinion came as a bit of a surprise to me because the judges appeared, during the oral argument, to have a handle on the issues. The decision gave me no such impression. From where I sit, the decision was wrong in a number of respects, among them: (a) it contradicted the plain wording of the district court rule, (b) it ignored the First Amendment implications, and (c) there is no such thing as 'advisory' mandamus or 'advisory' anything — our federal courts are specifically precluded from giving advisory opinions."

Another unpopular verdict. Their criteria seem to include Google, browsers, storage manufacturers, etc.

http://yro.slashdot.org/article.pl?sid=09/04/17/110235&from=rss

Pirate Bay Trial Ends In Jail Sentences

Posted by timothy on Friday April 17, @07:10AM from the even-non-commercial-use dept. The Courts

myvirtualid writes

"The Globe and Mail reports that the Pirate Bay defendants were each sentenced Friday to one year in jail. According to the article, 'Judge Tomas Norstrom told reporters that the court took into account that the site was "commercially driven" when it made the ruling. The defendants have denied any commercial motives behind the site.' The defendants said before the verdict that they would appeal if they were found guilty. 'Stay calm — Nothing will happen to TPB, us personally or file sharing whatsoever. This is just a theater for the media,' Mr. Sunde said Friday in a posting on social networking site Twitter."

[From the article:

The court found the defendants guilty of helping users commit copyright violations "by providing a website with ... sophisticated search functions, simple download and storage capabilities, and through the tracker linked to the website."

Support for my “pay by the drink” business model for media.

http://news.cnet.com/8301-1023_3-10221501-93.html?part=rss&subj=news&tag=2547-1_3-0-5

Google bringing pay-per-view to YouTube

by Stephen Shankland April 16, 2009 2:51 PM PDT

So far, YouTube has been a free, advertising-supported service, but Google plans to build payment mechanisms into its video-sharing site.

"With respect to how it'll get monetized, our first priority is on the advertising side. We do expect over time to see micropayments and other forms of subscription models coming as well," said Google Chief Executive Eric Schmidt after the company reported first-quarter profits Thursday. "We'll be announcing additional things in that area literally very, very soon."

Related. I think dropping cable for content on the Internet will be a “big thing” this year. This might be a project for the Hacker Club.

http://www.popularmechanics.com/technology/how_to/4313545.html

How to Ditch Your Cable Provider Without Giving Up on TV

Let's face it. You don't like your cable provider (here's why). Yet the average American cable subscriber pays more than $700 per year on subscription fees. But with the right combination of antenna and Internet streaming sources, you can get the shows and movies you like without the expense.

By Glenn Derene Published in the May 2009 issue.

Another possible Hacker Club project. Locate, acquire, analyze, defeat? Mostly the FBI trying to convince someone (congress?) that they're cool.

http://it.slashdot.org/article.pl?sid=09/04/17/0534232&from=rss

The Secret History of the FBI's Classified Spyware

Posted by timothy on Friday April 17, @08:12AM from the but-we-just-want-to-peek dept. Security Privacy United States

An anonymous reader writes

"A sophisticated FBI-produced spyware program has played a crucial behind-the-scenes role in federal investigations into extortion plots, terrorist threats and hacker attacks in cases stretching back at least seven years, according to newly declassified documents obtained by Wired.com. The so-called 'computer and internet protocol address verifier,' or CIPAV, is delivered through links to websites controlled by the FBI, and it silently reports back to a government server in Virginia. Among other cases, the FBI used it to track a Swedish hacker responsible for cracking thousands of computers at national labs and NASA's JPL in 2005."

[From the article:

As first reported by Wired.com, the software, called a "computer and internet protocol address verifier," or CIPAV, is designed to infiltrate a target's computer and gather a wide range of information, which it secretly sends to an FBI server in eastern Virginia. The FBI's use of the spyware surfaced in 2007 when the bureau used it to track e-mailed bomb threats against a Washington state high school to a 15-year-old student. [Clearly not new, certainly not sophisticated. Bob]

… The documents, which are heavily redacted, do not detail the CIPAV's capabilities, but an FBI affidavit in the 2007 case indicate it gathers and reports a computer's IP address; MAC address; open ports; a list of running programs; the operating system type, version and serial number; preferred internet browser and version; the computer's registered owner and registered company name; the current logged-in user name and the last-visited URL.

Did you ever want to be a twit? If so, be a good one.

http://www.killerstartups.com/Web20/tweepmeup-com-all-there-is-to-know-about-twitter

TweepMeUp.com - All There Is To Know About Twitter

http://tweepmeup.com/

This website aims to let you know “everything there is to know about Twitter”. In order to do so, it includes a host of Twitter tips, tricks and free downloads.

… On the other hand, links to worthwhile Twitter tools and resources like the TweetMyBlogWP plugin and Twitter’s info pack are included and prominently displayed.

Related, Celebrity Twit?

http://news.cnet.com/8301-17939_109-10222030-2.html?part=rss&subj=news&tag=2547-1_3-0-5

Twitter's big day? Here comes Oprah

by Stephen Shankland April 17, 2009 7:26 AM PDT

Is this type of service useful? No one Evites me anywhere, but the wife forwarded one recently because in included directions.

http://news.cnet.com/8301-17939_109-10220916-2.html?part=rss&subj=news&tag=2547-1_3-0-5

10 Evite alternatives: The good and the bad

by Don Reisinger April 16, 2009 4:45 PM PDT

I recently used Evite to send invitations for a party … Overall, I was pleased … the site's user interface made it too complicated … there's no Evite app on Facebook nor Twitter integration

... So I set out to find some alternatives to Evite to see if they could provide a better service.

“Big fleas have little fleas upon their backs to bite them, and little fleas have lesser fleas, and so ad infinitum.” This could be an interesting test for my web site students...

http://news.cnet.com/8301-17939_109-10221086-2.html?part=rss&subj=news&tag=2547-1_3-0-5

National Geographic's Infinite Photograph will mesmerize you

by Josh Lowensohn April 16, 2009 2:32 PM PDT

National Geographic has a fun new feature called the Infinite Photograph that takes over 300,000 photos collected from its archives and submitted by users, and turns them into a giant photo mosaic. It lets you zoom in infinitely, making your way deeper into each photo as it breaks down into smaller photos of various colors.

Isn't there a risk (to your credibility) if you don't tell the press?

http://www.databreaches.net/?p=3095

North Carolina breach data, 2007- March, 2009

April 15, 2009 by admin Filed under: Breach Reports, U.S.

Between January 2007 and March 19, 2009, North Carolina received 231 notifications of breaches under their breach reporting requirements. NC’s statute includes breaches involving paper records as well as electronic records, but only breaches requiring notification of 1,000 individuals or more must be reported to NC’s Consumer Protection Division of the Attorney General’s Office. Hence, smaller breaches are not included in these statistics.

In response to a request, NC provided a summary log of all incidents, which I have uploaded to this site, here (.xls). Inspection of their summary indicates a number of breaches that had not been reported in the media.

The Open Security Foundation has requested the underlying documents for the breaches reported in the log and will be uploading the documents to their Primary Sources files.

I know these tend to run together, but didn't I point to this about two weeks ago?

http://www.identitytheftblog.info/identity-theft/data-breach-organized-crime/1366

Rise in Data Breaches, Organized Crime Involved

April 15th, 2009 Rob Douglas

… Today, Verizon has released this year’s edition of the report - the 2009 Verizon Business Data Breach Investigations Report examining data breaches that occured in 2008.

[The Report: http://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

I wonder if some law school students and my tech students could write an article answering this question? Perhaps a series of similar questions: Technology for the Non-Technical Professional? (Note that the comments include many suggestions for storing lawyers...)

http://ask.slashdot.org/article.pl?sid=09/04/15/1743215&from=rss

Online Storage For Lawyers?

Posted by timothy on Wednesday April 15, @02:19PM from the due-diligence-best-practices dept. Data Storage Privacy The Courts

alharaka writes

"I have a relative that has been a lawyer for over two decades. In passing conversation, he revealed to me that he has a great deal of his data stored on floppies. Naturally, as an IT guy, I lost it on him, telling him that a one-dimensional storage strategy of floppies was unacceptable. If he lost those files, his clients would be enraged. Since I do not know much about online data storage for lawyers, I read a few articles I found on Google. A lot of people appear to recommend CoreVault, since a few bar associations, including Oklahoma, officially endorsed them. That is not enough for me. Do any Slashdotters have info on this topic? Do you have any companies you would recommend for online data storage specifically for lawyers? As a lawyer with recognition in NJ, NY, CA, and DC, are there any rules and regulations you know of regarding such online storage he must comply with? I know IT and not law. I am aware this is not a forum for legal advice, but do any IT professionals who work for law firms know about such rules and regulations?"

How to win friends (and new customers) and influence people (wait... are politicians people?)

http://www.pogowasright.org/article.php?story=20090416052030434

Se: ISP sabotages file sharing law

Thursday, April 16 2009 @ 05:20 AM EDT Contributed by: PrivacyNews

Broadband operator Bahnhof has begun destroying the IP address details of its customers in an open and fully legal bid to undermine Sweden's new anti-file sharing laws.

Source - The Local (Sweden)

[From the article:

The new file sharing law is based on the European Union's Intellectual Property Rights Enforcement Directive (IPRED) and allows courts to order internet operators to hand over details that identify suspected illegal file sharers.

As such, the law enables Internet Service Providers (ISPs) to retain the IP addresses of file sharers. But ISPs also remain at liberty to destroy information about their users if they so wish.

How to lose friends and (negatively) influence people.

http://www.pogowasright.org/article.php?story=20090415080553682

UK: Britons lose confidence in insurance company data protection

Wednesday, April 15 2009 @ 08:05 AM EDT Contributed by: PrivacyNews

Recent research undertaken by DQM Group indicates that public confidence in the ability of insurance companies to keep personal data secure has fallen away in the past year. According to the study, only 32.6% of respondents claimed they trusted the insurance industry to look after their personal data. This compares to 62% in 2008 and represents a move from above average to below average, when compared with all sectors.

Source - Insurance Daily

“Surprise, surprise, surprise!” G. Pyle

http://www.pogowasright.org/article.php?story=20090416051600660

N.S.A.’s Intercepts Exceed Limits Set by Congress

Thursday, April 16 2009 @ 05:16 AM EDT Contributed by: PrivacyNews

The National Security Agency intercepted private e-mail messages and phone calls of Americans in recent months on a scale that went beyond the broad legal limits established by Congress last year, government officials said in recent interviews.

Source - NY Times

Wouldn't this fit precisely into the “newspapers are dying” school?

http://www.bespacific.com/mt/archives/021123.html

April 15, 2009

Pew Report - The Internet's Role in Campaign 2008

"Some 74% of internet users--representing 55% of the entire adult population--went online in 2008 to get involved in the political process or to get news and information about the election. This marks the first time that a Pew Internet & American Life Project survey has found that more than half of the voting-age population used the internet to get involved in the political process during an election year. Several online activities rose to prominence in 2008. In particular, Americans were eager to share their views on the race with others and to take part in the online debate on social media sites such as blogs and social networking sites."

• The Internet's Role in Campaign 2008 - A majority of American adults went online in 2008 to keep informed about political developments and to get involved with the election. April 2009

For my Computer Security students

http://www.bespacific.com/mt/archives/021116.html

April 15, 2009

Symantec Internet Security Threat Report Volume XIV: April, 2009

"The Symantec Internet Security Threat Report offers analysis and discussion of threat activity over a one-year period. It covers Internet threat activities, vulnerabilities, malicious code, phishing, spam and security risks as well as future trends. The fourteenth version of the report, released April 14, 2009, is now available."

• Internet Security Threat Report Volume XIV: April, 2009 - Analysis of threat activity January - December 2008.

• Executive Summary: April, 2009

Geeky stuff.

http://books.slashdot.org/article.pl?sid=09/04/15/1327247&from=rss

The Rootkit Arsenal

Posted by samzenpus on Wednesday April 15, @01:53PM from the protect-ya-neck dept. thumbnail

Nicola Hahn writes

"One of the first things I noticed while flipping through this hefty book is the sheer number of topics covered. Perhaps this is a necessity. As the author puts it, rootkits lie "at the intersection of several related disciplines: computer security, forensics, reverse-engineering, system internals, and device drivers." Upon closer inspection, it becomes clear that great pains have been taken to cover each subject in sufficient depth and to present ideas in a manner that's both articulate and well organized. This accounts for the book's girth; it weighs in at roughly 900 pages."

Another mystery breach? Why would pharmaceutical companies operate point of sale terminals? Do they mean drugstores? Perhaps something was lost in translation?

http://www.databreaches.net/?p=3066

Five Romanians arrested for hacking into U.S. pharmaceutical companies

April 14, 2009 by admin Filed under: Hack, Healthcare Sector, ID Theft, Malware, U.S.

Dan Kaplan of SC Magazine reports that five people have been arrested for illegally accessing computer systems belonging to unnamed U.S. pharmaceutical companies.

The hackers allegedly installed keylogger software to steal card data on point-of-sales systems.

Lucian Constantin reports that according to a DIICOT press release (in Romanian), the remote administration system used by the companies was the entry point for the hackers. The hacks reportedly began in November 2007. Constantin also reports:

Two of the suspects have received temporary 29-day arrest terms, while the rest have been released after 24 hours. All of them will face charges of unauthorized access to a computer system and intercepting electronic data, performing fraudulent financial operations by utilizing electronic payment methods, as well as money laundering, under Romanian law.

So…. does anyone remember seeing any U.S. pharmaceutical company report a hack/keylogger breach, because I don’t.

Evderyone wants to be Big Brother

http://yro.slashdot.org/article.pl?sid=09/04/15/0055241&from=rss

Mexican Government To Document Cell Phone Use

Posted by Soulskill on Tuesday April 14, @11:36PM from the i'm-sure-criminals-will-oblige dept. Cellphones Government

Alyssey writes

"The Mexican government wants to have a database to track every cellphone number in the country (in Spanish, Google translation) and whom it belongs to. They want to tie in the CURP (Unique Registration Population Code in Spanish, like the Social Security Number in the US) with cellphone numbers. If Mexicans don't send in their number and CURP via SMS before April 10, 2010, their cellphone number will be blocked. The new law was published back in February and is going into effect now."

Which way would you argue?

http://www.pogowasright.org/article.php?story=20090414121136619

Why a national data breach notification law makes sense (commentary)

Tuesday, April 14 2009 @ 12:11 PM EDT Contributed by: PrivacyNews

As we await the 60-day federal cybersecurity review from Melissa Hathaway, acting senior director for cyberspace for the National Security and Homeland Security Councils , there is something else that could be done. It seems to me that the federal government could take another related action to help protect the private information of U.S. citizens while reducing the cost of doing so. In my humble opinion, it is time to create a single federal data breach disclosure law.

Source - Jon Oltsik, on cnet

Perhaps we need to update more than the PCI standard?

http://blog.wired.com/27bstroke6/2009/04/pins.html

PIN Crackers Nab Holy Grail of Bank Card Security

By Kim Zetter April 14, 2009 10:55:00 PM

Hackers have crossed into new frontiers by devising sophisticated ways to steal large amounts of personal identification numbers, or PINs, protecting credit and debit cards, says an investigator. The attacks involve both unencrypted PINs and encrypted PINs that attackers have found a way to crack, according to the investigator behind a new report looking at the data breaches.

… "We're seeing entirely new attacks that a year ago were thought to be only academically possible," says Sartin.

… The revelation is an indictment of one of the backbone security measures of U.S. consumer banking: PIN codes. In years past, attackers were forced to obtain PINs piecemeal through phishing attacks, or the use of skimmers and cameras installed on ATM and gas station card readers. Barring these techniques, it was believed that once a PIN was typed on a keypad and encrypted, it would traverse bank processing networks with complete safety, until it was decrypted and authenticated by a financial institution on the other side.

But the new PIN-hacking techniques belie this theory, and threaten to destabilize the banking-system transaction process.

Information about the theft of encrypted PINs first surfaced in an indictment last year against 11 alleged hackers accused of stealing some 40 million debit and credit card details from TJ Maxx and other U.S. retail networks. The affidavit, which accused Albert "Cumbajohnny" Gonzalez of leading the carding ring, indicated that the thieves had stolen "PIN blocks associated with millions of debit cards" and obtained "technical assistance from criminal associates in decrypting encrypted PIN numbers."

But until now, no one had confirmed that thieves were actively cracking PIN encryption.

… PIN hacks hit consumers particularly hard, because they allow thieves to withdraw cash directly from the consumer's checking, savings or brokerage account, Sartin says. Unlike fraudulent credit card charges, which generally carry zero liability for the consumer, fraudulent cash withdrawals that involve a customer's PIN can be more difficult to resolve since, in the absence of evidence of a breach, the burden is placed on the customer to prove that he or she didn't make the withdrawal.

This will be interesting as hackers force users to proxy... But then ignorance of the technology is no excuse.

http://yro.slashdot.org/article.pl?sid=09/04/14/2234253&from=rss

Using Net Proxies Will Lead To Harsher Sentences

Posted by Soulskill on Tuesday April 14, @07:37PM from the no-word-on-mask-and-cape-penalties dept. Privacy

Afforess writes

"'Proxy servers are an everyday part of Internet surfing. But using one in a crime could soon lead to more time in the clink,' reports the Associated Press. The new federal rules would make the use of proxy servers count as 'sophistication' in a crime, leading to 25% longer jail sentences. Privacy advocates complain this will disincentivize privacy and anonymity online. '[The government is telling people] ... if you take normal steps to protect your privacy, we're going to view you as a more sophisticated criminal,' writes the Center for Democracy and Technology. Others fear this may lead to 'cruel and unusual punishments' as Internet and cell phone providers often use proxies without users' knowledge to reroute Internet traffic. This may also ultimately harm corporations when employees abuse VPN's, as they too are counted as a 'proxy' in the new legislation. TOR, a common Internet anonymizer, is also targeted in the new legislation. Some analysts believe this legislation is an effort to stop leaked US Government information from reaching outside sources, such as Wikileaks. The legislation (PDF, the proposed amendment is on pages 5-15) will be voted on by the United States Sentencing Commission on April 15, and is set to take effect on November 1st. The EFF has already urged the Commission to reject the amendment."

Is this gathering information or just filtering out stuff I don't need? Does the birth of an industry cause the death of another or does the death of an industry cause the birth of another? In either case, shouldn't I know this type of information?

http://www.nytimes.com/2009/04/13/technology/start-ups/13hyperlocal.html?adxnnl=1&adxnnlx=1239796846-VhHKiTLTtmoWRXBJJYSmEQ

‘Hyperlocal’ Web Sites Deliver News Without Newspapers

By CLAIRE CAIN MILLER and BRAD STONE

Published: April 12, 2009

If your local newspaper shuts down, what will take the place of its coverage? Perhaps a package of information about your neighborhood, or even your block, assembled by a computer.

A number of Web start-up companies are creating so-called hyperlocal news sites that let people zoom in on what is happening closest to them, often without involving traditional journalists.

The sites, like EveryBlock, Outside.in, Placeblogger and Patch, collect links to articles and blogs and often supplement them with data from local governments and other sources. They might let a visitor know about an arrest a block away, the sale of a home down the street and reviews of nearby restaurants.

… Still, said Peter Krasilovsky, a program director at the Kelsey Group, which studies local media, many small businesses have never advertised outside the local Yellow Pages and are an untapped online ad market whose worth his firm expects to double to $32 billion by 2013.

What about the middle-of-the-road extremists?

http://www.bespacific.com/mt/archives/021106.html

April 14, 2009

DHS Reports on Rightwing and Leftwing Extremists

• Via FAS: Unclassified - Rightwing Extremism: Current Economic and Political Climate Fueling Resurgence in Radicalization and Recruitment, 7 April 2009. Prepared by the Extremism and Radicalization Branch, Homeland Environment Threat Analysis Division. Coordinated with the FBI.

• Via FOXNews: Unclassified - Leftwing Extremists Likely to Increase Use of Cyber Attacks over the Coming Decade, 26 January 2009, (U) Prepared by the Strategic Analysis Group, Homeland Environment and Threat Analysis Division.

I have strong evidence that this isn't as bad as it sounds. The porn industry hasn't adopted it yet.

http://www.bespacific.com/mt/archives/021105.html

April 14, 2009

EPIC Demands Disclosure of Documents Detailing "Virtual Strip Search" Airport Scanners

"Today, EPIC filed a Freedom of Information Act request demanding disclosure of records detailing airport scanners that take naked pictures of American travelers. Security experts describe the "whole body imaging" scanners as virtual strip searches. The Transportation Security Administration plans to make the scans mandatory at all airport security checkpoints, despite prior assurances that whole body imaging would be optional. EPIC's request seeks documents concerning the agency's ability to store and transmit detailed images of naked U.S. citizens. For more information, see EPIC's Whole Body Imaging page and EPIC's FOIA Litigation Manual."

When you need coordinates for your armed drones...

http://singlefunction.com/tinygeocoder/

TinyGeocoder

TinyGeocoder is a nifty service that translates an address to latitude and longitude coordinates, better known as Geo-coding.

The history of the world according to geeks

http://www.maximumpc.com/article/features/cpu_retrospective_the_life_and_times_x86

A Brief History of CPUs: 31 Awesome Years of x86

Posted 04/14/09 at 12:00:00 PM | by Paul Lilly