Are we smarter than the Ukrainians?

http://www.bbc.com/news/technology-35667989

Hackers behind Ukraine power cuts, says US report

The December 2015 incident is thought to be the first known successful hack aimed at utilities.

The report, written by the Department of Homeland Security, is based on interviews with staff at Ukrainian organisations that dealt with the aftermath of the attack.

The DHS report did not name the suspected perpetrators. [Who are we afraid of? Bob]

… It said the attack had several stages and initially involved hackers installing malware on computer systems at power generation firms in Ukraine. This gave the attackers remote access to these computers and allowed them to flip circuit breakers turning off power to 80,000 customers of western Ukraine's Prykarpattyaoblenergo utility.

… The malware is believed to have been delivered via email using a technique known as "spear phishing". This involves sending key employees carefully crafted messages that use information culled from social media to make them more convincing.

The world my Computer Security students face.

http://www.securityweek.com/breach-detection-time-improves-destructive-attacks-rise-fireeye

Breach Detection Time Improves, Destructive Attacks Rise: FireEye

… According to the just released report (PDF), the median number of days that attackers were present on a victim’s network before being discovered dropped to 146 days in 2015 from 205 days in 2014—a trend that shows positive improvement since measuring 416 days back in 2012. However, breaches still often go undetected for years, Mandiant reminded.

The breach investigations firm found that during its investigations, responders saw incidents where attackers destroyed critical business systems, leaked confidential data, held companies for ransom, and taunted executives. Some attackers were motivated by money, some claimed to be political retaliation, and others were to cause embarrassment, the report said.

(Related) Another perspective.

http://www.securityweek.com/over-700-million-data-records-compromised-2015-report

Over 700 Million Data Records Compromised in 2015: Report

… The BLI report (PDF) started benchmarking publicly disclosed data breaches in 2013 and has seen over 3.6 billion data records since. Data collected by Gemalto showed a 3.4 percent drop in the number of data breaches compared to 2014. Additionally, the total number of compromised records dropped by 39 percent, Gemalto said.

Outside attackers represented the leading source of breaches, accounting for 964 of them, or 58 percent of the total, as well as for 38 percent of the compromised records. Accidental loss or exposure of data records accounted for 36 percent of all exposed records last year, while malicious insiders accounted for only 14 percent of incidents and 7 percent of compromised records, with 238 attacks.

Confusing the non-lawyer, again. The motion is at the end of this article. Is it 65 pages or over 350 as the table of contents suggests?

http://techcrunch.com/2016/02/25/apple-files-motion-to-dismiss-the-court-order-to-force-it-to-unlock-iphone-citing-free-speech-rights/

Apple Files Motion To Vacate The Court Order To Force It To Unlock iPhone, Citing Constitutional Free Speech Rights

… In the motion, Apple hinges its argument on the fact that the FBI is attempting to greatly expand the use of the All Writs Act:

No court has ever granted the government power to force companies like Apple to weaken its security systems to facilitate the government’s access to private individuals’ information. The All Writs Act does not support such sweeping use of judicial power, and the First and Fifth Amendments to the Constitution forbid it.

[Also available on Scribed:

http://www.scribd.com/doc/300522068/Apple-Motion-to-Vacate-Brief-and-Supporting-Declarations-1

(Related) In case you forgot that Apple v FBI is not the only example of over-reach.

http://thehill.com/policy/technology/270768-justice-department-gets-earful-from-congress-over-microsoft-case

Justice Department gets earful from Congress over Microsoft case

The Justice Department faced withering criticism from House lawmakers at a Thursday hearing for its opposition to Microsoft-backed legislation aimed at limiting the geographical scope of a U.S. warrant.

The House Judiciary Committee hearing focused on a bill aimed at resolving a legal battle in which Microsoft resisted a U.S. warrant forcing it to turn over a customer’s email account stored in Ireland.

Rep. Darrell Issa (R-Calif.) said Microsoft is "being bullied by the Justice Department," comparing the fight to a case where another country was trying "to come haul your ass in" without consulting the United States.

"You are asking for the U.S. courts to summarily order U.S. corporations … to deliver to you something from another country and circumvent that other country's opportunity to tell you 'yes' or 'no.' That is essentially what you are asking for," Issa told a Justice Department official.

… Deputy Assistant Attorney General David Bitkower testified that the legislation could cut off a tool used during law enforcement investigations. The Justice Department has warned that if this tool is cut off, the government will have to rely on a slow-moving treaty system to obtain the same information.

Everyone in the room agreed that the current process of sharing law enforcement data between countries is broken and will get worse as technology products are used more broadly around the world, further ignoring national borders.

Looks like a very sweet deal for Vigilant Solutions if they can keep the public from finding out about it. Is this the future of law enforcement?

A Texas City Rescinds “No Cost” License Plate Reader Deal For Being “Big-Brotherish”

Dave Maass writes:

At the beginning of the year, the City of Kyle, Texas, approved a controversial agreement to install automated license plate recognition (ALPR) technology in its police vehicles. The devices would come at no cost to the city’s budget; instead, police would also be outfitted with credit card readers and use ALPR to catch drivers with outstanding court fees, also known as capias warrants.

With each card swipe, an added 25% surcharge would go to Vigilant Solutions, the company providing the system. As an added bonus the company would also get to keep all the data on innocent drivers collected by the license plate readers—indefinitely.

But before the license plate readers could even be installed, the Kyle city council voted 6-1 to rescind the order. The reason: public and media outcry over how the system would turn police into debt collectors and data miners.

Read more on EFF.

The problem with revealing raw intelligence is that it discloses the methods used to obtain it and possibly identifies an individual as the source.

http://www.nytimes.com/2016/02/26/us/politics/obama-administration-set-to-expand-sharing-of-data-that-nsa-intercepts.html

Obama Administration Set to Expand Sharing of Data That N.S.A. Intercepts

The Obama administration is on the verge of permitting the National Security Agency to share more of the private communications it intercepts with other American intelligence agencies without first applying any privacy protections to them, according to officials familiar with the deliberations.

The change would relax longstanding restrictions on access to the contents of the phone calls and email the security agency vacuums up around the world, including bulk collection of satellite transmissions, communications between foreigners as they cross network switches in the United States, and messages acquired overseas or provided by allies.

… The executive branch can change its own rules without going to Congress or a judge for permission because the data comes from surveillance methods that lawmakers did not include in the main law that governs national security wiretapping, the Foreign Intelligence Surveillance Act, or FISA.

Pointing out a business opportunity? Would lawyers need a secure systems too? Will the FBI object?

WhatsApp is not secure enough for patient info: Dutch privacy watchdog

Doctors who use the instant messaging service WhatsApp to communicate with each other about patients should stop doing so, according to the Dutch privacy watchdog Autoriteit Persoonsgegevens.

Read more on DutchNews.nl.

And what apps could American doctors use to communicate about patients that would be HIPAA-compliant in terms of security?

[From the article:

Dutch start-up MDLInking is currently developing a secure app for doctors which it says will remove worries about privacy. The Amsterdam-based company will soon turn a group of hackers loose on its product in a final test before a formal launch in May [Can we buy the US franchise? Bob]

The problem with audit reports like this is that they make you think the entire Department is managed incompetently. I need to run this by my Data Management students.

GAO reports on DHS HR IT failures

by Sabrina I. Pacifici on Feb 25, 2016

Homeland Security: Oversight of Neglected Human Resources Information Technology Investment Is Needed, GAO-16-253: Published: Feb 11, 2016. Publicly Released: Feb 25, 2016:

“DHS’s human resources administrative environment includes fragmented systems, duplicative and paper-based processes, and little uniformity of data management practices, which according to DHS, are compromising the department’s ability to effectively carry out its mission. DHS initiated HRIT in 2003 to consolidate, integrate, and modernize DHS’s human resources information technology infrastructure. In 2011, DHS redefined HRIT’s scope and implementation time frames… The Department of Homeland Security (DHS) has made very little progress in implementing its Human Resources Information Technology (HRIT) investment in the last several years. This investment includes 15 improvement opportunities; as of November 2015.”

• See also Homeland Security: Weak Oversight of Human Resources Information Technology Investment Needs Considerable Improvement, GAO-16-407T: Published: Feb 25, 2016. Publicly Released: Feb 25, 2016.

(Related) The problem with reports like this is that we assume DHS ONLY sees the obvious. Perhaps terrorists will hide behind the “we don't like cops” crowd. After all, nothing adds to the impact of a terrorist act like the utter failure of emergency services.

DHS Report Details “Persistent” Cyber Targeting of Police, Emergency Services

Public Intelligence reports:

Cyber attacks against law enforcement, fire departments and other emergency services have become increasingly common and are likely to increase according to a recent intelligence assessment prepared by the Department of Homeland Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC). The assessment, which was distributed to law enforcement in September 2015 and was obtained by Public Intelligence, reviewed a number of “cyber attacks against the [emergency services sector or ESS] between February 2012 and May 2015,” finding that “targeting of the ESS will likely increase as ESS systems and networks become more interconnected and the ESS becomes more dependent on information technology for the conduct of daily operations—creating a wider array of attack vectors for cyber targeting.”

Read more on Public Intelligence.

Free stuff for students (and me)

http://www.makeuseof.com/tag/join-office-insider-program-now/

This Is Why You Should Join the Office Insider Program Now

… You can choose from several routes to upgrade to Office 2016, including updates that are free or discounted, depending on which versions of Office you currently have. The easiest way, however, is to simply purchase an Office 365 subscription (which students can possibly get for free).

The Office 365 subscription comes with a free and voluntary program that you can opt into. This Office Insider Program provides several benefits that you might find useful. Here’s why you should enroll today.

No one ever said, “We can, therefore we won't.” Once the ability exists, users will want to use it!

http://www.slashgear.com/nypd-wants-access-to-all-iphones-with-a-warrant-24428764/?google_editors_picks=true

NYPD wants access to ALL iPhones (with a warrant)

The New York City Police Department says they'd like Apple to unlock every iPhone currently subject to a court-ordered search. Once the San Bernardino doors are broken down by the FBI, the NYPD has made clear: they want in, too. That'd mean every iPhone entered into evidence in a court case and subjected to a search ordered by a judge could be forced open by law enforcement, courtesy of a piece of software they've forced Apple to create. That software would be an entirely new version of iOS which the FBI (then the NYPD, and every other law enforcement agency in the USA) would then install on each iPhone, bypassing Apple's security measures, opening the locks to access data.

(Related) The only rational response? (Will they use the Kim Dotcom model?)

http://appleinsider.com/articles/16/02/25/apple-developing-iphone-and-icloud-encryption-that-counters-fbi-requested-workaround-reports-say

Apple developing iPhone and iCloud encryption that counters FBI-requested workaround, reports say

A pair of reports on Friday cite unnamed sources as saying Apple is in the process of designing next-generation encryption technology that would nullify government-requested decryption methods at the heart of a court case against involving the FBI.

It is unclear what, exactly, is being developed to thwart future incursions, but The New York Times reports Apple is working to negate a workaround requested by the FBI in its investigation of an iPhone used by San Bernardino shooter Syed Rizwan Farook. Law enforcement officials are asking Apple to design and install a custom operating system on Farook's iPhone 5c designed to bypass iOS' passcode counter, leaving the device open to a brute-force attack.

A separate report from the Financial Times claims the company is also looking to shore up its cloud service security, a task potentially more complex than devising viable on-device encryption. According to sources, Apple plans to restrict access to iCloud passkeys in much the same manner as the on-device encryption method introduced with iOS 8.

Interesting. Confirms what we thought. Perhaps the FBI could ask them to do what Apple won't?

Court filing confirms Carnegie Mellon University hacked Tor to unmask users

Ryan Whitwam reports:

The Tor Project claimed last year that researchers at Carnegie Mellon University (CMU) were behind an attack on Tor that was used to unmask users. CMU released a vague statement that strongly implied that the FBU had indeed subpoenaed the university for its research, and now we have confirmation. A court filing from one of the associated criminal cases explains how Carnegie’s Software Engineering Institute (SEI) helped the FBI track down some wanted Tor users.

Read more on ExtremeTech. See also Joseph Cox’s coverage on Motherboard.

If not North Korea, who? Will the US ever respond in kind?

http://www.securityweek.com/sony-hackers-linked-many-espionage-destruction-campaigns

Sony Hackers Linked to Many Espionage, Destruction Campaigns

For my Computer Security students.

http://knowledge.wharton.upenn.edu/article/how-the-ten-commandments-of-cyber-security-can-enhance-safety/

‘Ten Commandments’ of Cyber Security Can Enhance Safety

… As a caveat to the ‘Ten Commandments’ of cybersecurity, we remind our readers of the Mel Brooks movie A History of the World, Part I, where Brooks plays Moses. He returns from Mount Sinai with three tablets and announces: “I give you the Fifteen Commandments,” but then accidentally drops and shatters one of the stones. He quickly recovers and re-announces “The Ten Commandments.” Already, we are aware of important and emerging “commandments” that will need to be shared in the future.

In this vein — because no single sector, industry, enterprise or individual can have all the answers — we invite your continued thoughts and suggestions about a problem that must be addressed, collectively and collaboratively, before it grows to Biblical proportions.

I can't think of a more improbable introduction to coding. Another win for the Cult of Al Gore?

http://www.ted.com/talks/linda_liukas_a_delightful_way_to_teach_kids_about_computers

Linda Liukas: A delightful way to teach kids about computers

… In this talk, she invites us to imagine a world where the Ada Lovelaces of tomorrow grow up to be optimistic and brave about technology and use it to create a new world that is wonderful, whimsical and a tiny bit weird.

Tools for my students? Most are online and free!

http://www.makeuseof.com/tag/4-free-online-ocr-tools-put-ultimate-test/

4 Free Online OCR Tools Put to the Ultimate Test

If you want to convert any printed text into digital text that you can copy, paste, edit, and search, you’ll need to use Optical Character Recognition (OCR) scanners.

When you choose to scan or take a photo of a document, this will be saved in a format such as JPEG or PDF. OCR software can then recognize the letters and numbers within these documents, and convert them into a searchable PDF, or into a file that you can edit in programs like Microsoft Word.

… Seems most people now use their smartphones to do their scanning for them, I decided to use Evernote’s Scannable app (Free on iOS and Android).

How long will it take my students to find this site? Could be a fun way to kill a few minutes at the end of class…

Site creates unauthorized searchable database of info of Jacksonville State University students, faculty

Seth Boster reports:

Jacksonville State University officials learned Tuesday of a website that allows users to search for students’ personal information, including photos, addresses and phone numbers, all apparently stolen from JSU’s own database.

The site allows visitors to search using students’ names to find photographs along with birthdates, student ID numbers, fraternity and sorority affiliation and other information. Information for some former students, faculty and staff is also on the site.

Read more on The Anniston Star.

Following concerns raised on Twitter, the site has now redacted street addresses, but the database can be searched by entering just a single letter. For example, entering “A” returns 150 results that include date of birth, picture, and student ID number, as well as email address.

The site’s maintainer(s) posted the following message on a paste site:

The website is intended to be a safe yet intriguing lesson to universities and other academic institutions to value their students’ personal information. We live in an age where records that were once on paper protected by security guards are now digitized protected by nothing.

The sad truth is college aged students are very susceptible to identity theft: they post every detail of their life online and are just beginning to understand financial security.

I believe among the responsibilities of any organization that one belongs to is the protection of their subjects’ personal information. Jacksonville State University among others have failed to honor this responsibility.

You know what’s scarier than your address and phone number being released on a website? Not knowing that your SSN, credit card, and account numbers are being silently collected every day by cybercrime organizations.

In lieu of similar compromises our academic institutions will hopefully adapt from this misfortune.

If the hackers are really good – perhaps doing something never done before – you may face a Class Action lawsuit because you were not gooder? Sounds like the FTC's argument.

Scottrade Faces Consolidated Data Breach Class Action Lawsuit

There’s an update to the Scottrade breach previously reported on this blog. The breach, potentially impacting 4.6M customers, was disclosed in October 2015 but had reportedly occurred between late 2013 and early 2014. Three individuals were indicted in November, 2015.

Now Top Class Actions reports that a consolidated data breach class action lawsuit was filed in Missouri federal court last week.

“Scottrade’s cybersecurity measures were so deficient that it never realized the massive theft occurred until two years later, when federal authorities told them about it,” the Scottrade class action lawsuit states. The hackers allegedly accessed the personal identification information (PII) of Scottrade customers from September 2013 to February 2014 without detection from Scottrade, which the plaintiffs call an “inexcusable failure of Scottrade’s obligation to take reasonable steps to safeguard this information.”

[…]

The consolidated Scottrade class action lawsuit was filed on Feb. 19 by plaintiffs Andrew Duqum, Stephen Hine, Matthew Kuhns and Richard Obringer. Hine filed a separate data breach class action lawsuit in California, but Scottrade argued in December that it should be consolidated with a nearly identical case that was already pending in Missouri.

Read more on Top Class Actions.

For my Ethical Hacking students old enough to drive.

http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html

Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs

Last month I was over in Norway doing training for ProgramUtvikling, the good folks who run the NDC conferences I've become so attached to.

… I also cover how to inspect, intercept and control API requests between rich client apps such as those you find on a modern smart phone and the services running on the back end server. And that’s where things got interesting.

One of the guys was a bit inspired by what we’d done and just happened to own one of these – the world’s best-selling electric car, a Nissan LEAF:

What the workshop attendee ultimately discovered was that not only could he connect to his LEAF over the internet and control features independently of how Nissan had designed the app, he could control other people’s LEAFs.

… Let me clarify something before going any further and it’s something I harp on about in my workshops too; when a potential security flaw is identified, you’ve got to think very carefully about how you proceed with verification. [Amen! Bob]

Hard to tell if this is significant or not. All of this information is already available online, most of it is presumed to be false (users provide phoney names on such sites) and possession of such data is not proof you hacked the system. (If they have more evidence, it is not mentioned in the articles.) Why do they care? Is republishing a subset of the data a crime?

Utah pulls warrants on Southern Utah websites linked to Ashley Madison hack

Tracie Sullivan reports:

Utah authorities are investigating a website allegedly created by a Cedar City resident who published personal information of Southern Utah residents whose names were part of a 2015 website hack.

According to four search warrants unsealed last week in 3^rd District Court, a Facebook page and a website called AM Southern Utah “disclosed customers’ names, physical and email addresses for the Southern Utah area,” who had allegedly registered with Ashley Madison.

The warrants stem from a Utah investigation conducted by the State Bureau of Investigations and is part of a larger FBI investigation into the hack. No one has been charged with a crime in either investigation.

Read more on St. George News.

[From the article:

… the SBI investigator believes there has been a violation of Utah’s Computer Crimes Act, Utah Code 76-6-703. Specifically, the violation “has occurred, ‘without authorization (the suspect) gains…access to and…discloses…computer data…and thereby causes damage to another.’ The damage in this case was to the reputation of the individuals whose information was listed on amsouthernutah.com.”

Okay, maybe he didn't side with the FBI. But he still seems to be washing his wishy. Make up your mind Bill!

http://www.theregister.co.uk/2016/02/23/gates_disappointed_with_fbi_lovein_claims/

FBI v Apple spat latest: Bill Gates is really upset that you all thought he was on the Feds' side

Bill Gates says reports of him backing the FBI in the ongoing saga with Apple over the unlocking of a killer's iPhone are inaccurate.

Asked about widespread reports that the former Microsoft CEO and the world's richest man was taking the Feds' side, Gates told Bloomberg News on Tuesday that he was "disappointed" with the reporting and that it "doesn't state my view on this."

… According to Gates, however, he has a more nuanced view about "striking a balance" in providing government access to information rather than in deciding who is right, the FBI or Apple.

(Related) Just as perspective… This is one reason why the FBI will have to play wack-a-mole if they want to gain backdoors into every encryption package.

http://www.wired.com/2016/02/encrypted-messaging-app-telegram-hits-100-million-people/

Encrypted-Messaging App Telegram Now Has 100 Million Users

… Less than three years after Durov and his brother launched Telegram, he now reports that 100 million people use the free encrypted messaging app every month, up from 60 million people last May. That growth is coming from all over the world. While that’s a small number compared with the billion people who pull up WhatsApp every month, or the 800 million people who go on Facebook Messenger, it’s illustrative of the early growth that signaled each of these services had mainstream appeal. “Every day, 350,000 new users sign up for Telegram,” Durov said. “And we have zero marking budget.” In other words, Telegram is not going away.

(Related) You could dispute the claim that this is “more scholarly” but certainly it's what Congress is seeing.

http://www.bespacific.com/encryption-and-evolving-technology-implications-for-u-s-law-enforcement-investigations/

Encryption and Evolving Technology: Implications for U.S. Law Enforcement Investigations

by Sabrina I. Pacifici on Feb 23, 2016

Via FAS – CRS Report – Encryption and Evolving Technology: Implications for U.S. Law Enforcement Investigations, Kristin Finklea Specialist in Domestic Security February 18, 2016.

“Because modern-day criminals are constantly developing new tools and techniques to facilitate their illicit activities, law enforcement is challenged with leveraging its tools and authorities to keep pace. For instance, interconnectivity and technological innovation have not only fostered international business and communication, they have also helped criminals carry out their operations. At times, these same technological advances have presented unique hurdles for law enforcement and officials charged with combating malicious actors. Technology as a barrier for law enforcement is by no means a new issue in U.S. policing. In the 1990s, for instance, there were concerns about digital and wireless communications potentially hampering law enforcement in carrying out court-authorized surveillance. To help combat these challenges, Congress passed the Communications Assistance for Law Enforcement Act (CALEA; P.L. 103-414), which among other things, required telecommunications carriers to assist law enforcement in executing authorized electronic surveillance. The technology boundary has received renewed attention as companies have implemented advanced security for their products—particularly their mobile devices. In some cases, enhanced encryption measures have been put in place resulting in the fact that companies such as Apple and Google cannot unlock devices for anyone under any circumstances, not even law enforcement. Law enforcement has concerns over certain technological changes, and there are fears that officials may be unable to keep pace with technological advances and conduct electronic surveillance if they cannot access certain information. Originally, the going dark debate centered on law enforcement’s ability to intercept real-time communications. More recent technology changes have potentially impacted law enforcement capabilities to access not only communications, but stored data as well.”

[The most recent Wiretap Report to Congress is for 2014. You can find it here: http://www.uscourts.gov/statistics-reports/wiretap-report-2014

Encryption

The number of state wiretaps in which encryption was encountered decreased from 41 in 2013 to 22 in 2014. In two of these wiretaps, officials were unable to decipher the plain text of the messages. Three federal wiretaps were reported as being encrypted in 2014, of which two could not be decrypted. Encryption was also reported for five federal wiretaps that were conducted during previous years, but reported to the AO for the first time in 2014. Officials were able to decipher the plain text of the communications in four of the five intercepts.

For my Computer Security class. If the bad guys don't get you, the FTC might. If the bad guys get you, the FTC will be happy to pile on!

http://www.securityweek.com/asus-settles-ftc-charges-over-router-security

Asus Settles FTC Charges Over Router Security

The FTC filed a lawsuit against Asus claiming that the vendor has put hundreds of thousands of consumers at risk through a series of critical vulnerabilities found in its routers and related services.

The agency accused Asus that it misrepresented the security features included in its routers and falsely claimed that they can protect computers and local networks against hacker attacks, when in reality they were plagued by serious vulnerabilities that allowed malicious actors to hijack devices.

… As part of the settlement with the FTC, Asus will have to establish and maintain a comprehensive security program that is subject to external audits for a period of 20 years. The vendor will also have to ensure that customers can sign up for a security notification system designed to inform them about the availability of firmware updates and provide instructions on how to protect themselves against potential attacks.

Is this just to harass Google and Facebook?

German law authorizing privacy “class actions” goes into force

Christoph Ritzer and Sven Jacobs write:

A new German law, which grants authority to the country’s consumer and business associations to enforce compliance with data protection laws, goes into force on February 24, 2016. A representative of the German Ministry of Justice pointed out that the new enforcement powers are specifically aimed at foreign companies having their headquarters or operating from outside Germany, including the U.S.

Read more on Norton Rose Fulbright Data Protection Report.

(Related) Or part of a more general attack on “Internet stuff?”

http://www.dw.com/en/german-government-to-use-trojan-spyware-to-monitor-citizens/a-19066629

German government to use Trojan spyware to monitor citizens

… The interior ministry spokesman defended the government's decision, saying "basically we now have the skills in an area where we did not have this kind of skill." The program was already endorsed by members of the government in autumn 2015, the ministry said. [More bragging than defense... Bob]

A network of citations?

http://www.bespacific.com/free-tool-to-visualize-supreme-court-cases/

Free tool to visualize Supreme Court cases

by Sabrina I. Pacifici on Feb 23, 2016

Via Robert Ambrogi, LawSites – SCOTUS Visualization Project Shows Lines of Cases — Literally

“As lawyers, we’re all accustomed to talking about the lines of cases that create bodies of precedent for legal principles. A new tool launched this week lets you visualize lines of Supreme Court cases so that you can better analyze and study them. Called Supreme Court Citation Networks, it was created as a collaboration between the Free Law Project and The Supreme Court Mapping Project at the University of Baltimore School of Law.”

Tools & Techniques. This could be useful.

http://www.freetech4teachers.com/2016/02/tagboard-offers-new-features-for.html

Tagboard Offers New Features for Following Hashtags Across Multiple Networks

Tagboard is a tool that allows you follow a hashtag and see all of the Tweets, Instagram, Facebook, and Google+ posts about it in one place. Last year I created a tutorial video about Tagboard in which I demonstrated its primary features. Today, Tagboard added some new features that teachers will probably appreciate.

Tagboard now offers some post moderation tools. You can now block or remove posts and users within a saved Tagboard. Within a saved Tagboards you can now filter by keyword, post type, and or social network.

Applications for Education

Tagboard can be a good tool for tracking trending news stories with your students. The new moderation features will be helpful if you are planning to display a Tagboard in your classroom. Before displaying the Tagboard go through and remove any content that you don't want to share with your students.

For my next Statistics class (and a cautionary tale for Computer Security and other classes). You should ask yourself if everyone agrees with your assumptions.

http://www.theatlantic.com/business/archive/2016/02/how-mit-students-gamed-the-lottery/470349/?google_editors_picks=true

How a Group of MIT Students Gamed the Massachusetts State Lottery

Have I mentioned that I'm teaching Spreadsheets in the Spring?

http://www.makeuseof.com/tag/import-data-excel-spreadsheets-neat-easy-way/

How to Import Data Into Your Excel Spreadsheets the Neat & Easy Way

Dilbert brilliantly summarizes the good and bad of the “Gig Economy.”

http://dilbert.com/strip/2016-02-24

The biggest story on the planet? Only in my classroom.

http://www.wsj.com/article_email/justice-department-seeks-to-force-apple-to-extract-data-from-about-12-other-iphones-1456202213-lMyQjAxMTI2MjIzMzMyMTMwWj

Justice Department Seeks to Force Apple to Extract Data From About 12 Other iPhones

The Justice Department is pursuing court orders to force Apple Inc. to help investigators extract data from iPhones in about a dozen undisclosed cases around the country, in disputes similar to the current battle over a terrorist’s locked phone, according to people familiar with the matter.

The other phones are at issue in cases where prosecutors have sought, as in the San Bernardino, Calif., terror case, to use an 18th-century law called the All Writs Act to compel the company to help them bypass the passcode security feature of phones that may hold evidence, these people said.

The specifics of the roughly dozen cases haven’t been disclosed publicly, but they don’t involve terrorism charges, these people said.

(Related) I hadn't realized Bill was so far out of touch.

http://www.cnbc.com/2016/02/23/bill-gates-sides-with-fbi-in-iphone-hack-request.html?__source=google|editorspicks|&par=google&google_editors_picks=true

Bill Gates sides with FBI in iPhone hack request

Microsoft founder Bill Gates has said tech companies should be forced to cooperate with law enforcement authorities, entering a fractious debate between Apple and the U.S. government.

(Related) A Pew survey.

http://www.people-press.org/2016/02/22/more-support-for-justice-department-than-for-apple-in-dispute-over-unlocking-iphone/

More Support for Justice Department Than for Apple in Dispute Over Unlocking iPhone

(Related)

Apple vs. FBI is not “privacy vs. security.” It’s much bigger than that.

I haven’t been blogging about the Apple vs. FBI controversy, which may seem odd given that this is a privacy site. But the issues are so complex, and the available facts have been dribbling out in such a way that it’s hard to get a clear sense of what happened, what might happen, and the risks it poses.

So I’ve been following a number of people on Twitter who presumably know more about the law and/or data security than I do. And I find myself increasingly aligning with Apple because: (1) the government filed ex-parte and Apple was not given a chance to argue the motion before the magistrate issued the order, (2) the government is asking a court to compel private industry to create something solely for law enforcement’s purpose, (3) the government omitted crucial details about how it contributed to its own problems in the days following the attack, and (4) Apple stands to lose consumer trust and goodwill even if it is only cooperating under direct court order.

Can the government force Silicon Valley to spy on its customers? Timothy B. Lee asks?

And is this an issue that should be decided by the courts or by Congress?

Ironically, I’d note that all the so-called Conservatives (or as my husband calls them, the “faux-Conservatives”) who should be arguing for small government, have once again jumped on the “privacy vs. security” excuse to rationalize big government.

Apple creating code that weakens its own security is not just a slippery slope. It’s an attack/destruction of its own carefully developed product and approach to data security. Our government shouldn’t make Apple attack its own baby. Whether you call it a “backdoor,” or something else, the bottom line is that if our government gets away with this, other governments will undoubtedly similarly order Apple and other companies to assist them for their own purposes. We will all be unsafer.

#StandWithApple

Is this where Apple v FBI will drive us?

You Can’t Hide Behind Your EULA

In response to VTech’s controversial new EULA in the wake of their massive data breach, Cooley LLP has a commentary. Here are some excerpts:

Apart from being a bit mean, it goes against the basic principles of data protection and consumer law in the UK. The Data Protection Directive 95/46 EC places obligations on the data controllers and processors to take appropriate steps to protect the information from unauthorised disclosure or access, the burden is not on the data subject. Further, the Consumer Rights Act 2015 (“the Act”) was drafted with the aim of increasing fairness and transparency for consumers, which includes in respect of digital content. The Act “greylists” certain limitations of liability and considers “transferring inappropriate risks to consumers” unfair and potentially unenforceable. Were this clause to be analysed in conjunction with the Act, it is unlikely the Competition and Markets Authority and/or Trading Standards would let this slip thought the net.

What now?

In response, the ICO stated that when handling people’s personal data, organisations are responsible for keeping that data secure. It is unclear whether there will be formal consequences for VTech, but if they do not change the wording, they could come under further scrutiny.

Read more on Cooley LLP.

[The EULA that no one reads:

“You acknowledge and agree that any information you send or receive during your use of the site may not be secure and may be intercepted or later acquired by unauthorized parties.”

Perspective. Security is changing!

http://www.bbc.com/news/technology-35631456

MWC 2016: Mastercard rolls out selfie ID checks

Credit card firm Mastercard has confirmed it will accept selfie photos and fingerprints as an alternative to passwords when verifying IDs for online payments.

It follows a trial of the software carried out in the US and Netherlands last year.

The company told the BBC that 92% of its test subjects preferred the new system to passwords.

One expert said that such biometric checks had the potential to cut fraud.

However, some security researchers have questioned how easy it might be to spoof the system

Behavioral Targeting shows that identifying you is inevitable. (They use the same techniques military intelligence developed decades ago. Targeting has different consequences when the military does it.)

Article: Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation

Zuiderveen Borgesius, Frederik J., Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation (February 16, 2016). Available at SSRN: http://ssrn.com/abstract=2733115

Abstract:

Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people’s online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.

(Related) Simple, isn't it?

http://techcrunch.com/2016/02/22/attribution-by-foursquare/

Foursquare Will Tell Businesses When Their Ads Bring You Into An Actual Store

… Now, with Attribution Powered by Foursquare, the company is making its data available to advertisers even if they don’t run campaigns in the Foursquare or Swarm apps.

… President Steven Rosenblatt said the company has created a representative sample of about 1.3 million people (out of its total of 50 million active users) who have opted in to constantly share their location data with Foursquare. So his team can find users in the panel who have seen an ad, examine their behavior, then compare it to a similar group of users who didn’t see the ad. That, in turn, allows Foursquare to extrapolate how much the ad resulted in a “lift” in store visits.

Perspective. Towards replacing all lawyers with software? (Would cities be interested in my “Ticket Writing Bot?” No errors, no appeals!)

http://www.businessinsider.com/joshua-browder-bot-for-parking-tickets-2016-2?op=1

A 19-year-old made a free robot lawyer that has appealed $3 million in parking tickets

Hiring a lawyer for a parking-ticket appeal is not only a headache, but it can also cost more than the ticket itself. Depending on the case and the lawyer, an appeal — a legal process where you argue out of paying the fine — can cost between $400 to $900.

But with the help of a robot made by British programmer Joshua Browder, 19, it costs nothing. Browder's bot handles questions about parking-ticket appeals in the UK. Since launching in late 2015, it has successfully appealed $3 million worth of tickets.

… Since laws are publicly available, bots can automate some of the simple tasks that human lawyers have had to do for centuries. Browder's isn't even the first lawyer bot. The startup Acadmx's bot creates perfectly formatted legal briefs. The company Lex Machina does data mining on judges' records and makes predictions on what they will do in the future.

Perspective. An Infographic.

http://www.makeuseof.com/tag/theres-an-absurd-amount-of-domain-endings-now/

There’s an Absurd Amount of Domain Endings Now

http://cdn.makeuseof.com/wp-content/uploads/2016/02/timeline-infographic-012.jpg?1a555b

Perspective. No surprise.

http://www.bespacific.com/pew-emerging-developing-countries-gain-ground-in-the-tech-revolution/

Pew – Smartphone Ownership and Internet Usage Continues to Climb in Emerging Economies

by Sabrina I. Pacifici on Feb 22, 2016

“As the world becomes increasingly interconnected, both economically and socially, technology adoption remains one of the defining factors in human progress. To that end, there has been a noticeable rise over the past two years in the percentage of people in the emerging and developing nations surveyed by Pew Research Center who say that they use the internet and own a smartphone. And while people in advanced economies still use the internet more and own more high-tech gadgets, the rest of the emerging world is catching up.”

(Related) Consider the source considering potential markets.

http://newsroom.fb.com/news/2016/02/state-of-connectivity-2015-a-report-on-global-internet-access/

State of Connectivity 2015: A Report on Global Internet Access

State of Connectivity 2015: A Report on Global Internet Access, the second annual study by Facebook, takes a close look at the current state of global internet connectivity, how it has changed since 2014 and how we can use the data identified to generate new insights.

At the end of 2015, estimates showed that 3.2 billion people were online. This increase (up from 3 billion in 2014) is partly attributed to more affordable data and rising global incomes in 2014. Over the past 10 years, connectivity increased by approximately 200 to 300 million people per year.

While this is positive news in terms of growth, it also means that globally, 4.1 billion people were still not internet users in 2015.

The four key barriers to internet access include:

• Availability: Proximity of the necessary infrastructure required for access.
• Affordability: The cost of access relative to income.
• Relevance: A reason for access, such as primary language content.
• Readiness: The capacity to access, including skills, awareness and cultural acceptance.

Just because Free is Good!

http://www.bespacific.com/download-448-free-art-books-from-the-metropolitan-museum-of-art/

Download 448 Free Art Books from The Metropolitan Museum of Art

by Sabrina I. Pacifici on Feb 22, 2016

Via OpenCulture: “You could pay $118 on Amazon for the Metropolitan Museum of Art’s catalog The Art of Illumination: The Limbourg Brothers and the Belles Heures of Jean de France, Duc de Berry. Or you could pay $0 to download it at MetPublications, the site offering “five decades of Met Museum publications on art history available to read, download, and/or search for free.” If that strikes you as an obvious choice, prepare to spend some serious time browsing MetPublications’ collection of free art books and catalogs…”

For the gaming club.

http://www.makeuseof.com/tag/best-sites-play-free-board-games-online/

The 5 Best Sites to Play Free Board Games Online

Tools for student job hunters.

http://www.makeuseof.com/tag/11-must-chrome-extensions-job-search/

11 Must-Have Chrome Extensions For Job Search

… Let the following list of Chrome extensions help you to create an insanely effective job search workflow. You might also want to check out some great tools for finding jobs without your boss finding out.

Take a look!

http://sloanreview.mit.edu/article/we-are-open-for-business/

We Are Open For Business

On February 23 and 24, MIT Sloan Management Review is conducting an experiment. We are completely dropping the site's paygates, allowing visitors to freely explore all of our articles, reports, posts, videos, webinars, tools, and case studies.

Why? We want to encourage the world to get to know all the remarkable things that MIT SMR has to offer.

Some suggestions, as you browse:

Make sure to visit our new case study on GE, “GE's Big Bet on Data and Analtyics.” The case looks at how GE is remaking itself from a traditional manufacturer into a leader of the Industrial Internet. If you have an interest in analytics-driven innovation, you might also want to read When Health Care Gets a Healthy Dose of Data.”

http://sloanreview.mit.edu/

My Computer Security class is amused.

http://techcrunch.com/2016/02/22/in-employee-email-apple-ceo-tim-cook-calls-for-commission-on-interaction-of-technology-and-intelligence-gathering/

In Employee Email, Apple CEO Tim Cook Calls For Commission On Interaction Of Technology And Intelligence Gathering

Early this morning, Apple CEO Tim Cook sent an email out to employees about the FBI’s request to unlock an iPhone with the subject line ‘Thank you for your support’. The email outlines some responses to Cook’s open letter last week and paints the issue of Apple’s refusal to cooperate as one of civil liberties.

… Cook says that some advocates of the government’s order, which we have covered in detail here, want it to “roll back” data protections to the point at which they were as of iOS 7. In iPhones running older versions of iOS, Apple was able to extract information from devices even though they were locked with a personal pin code. Apple has never unlocked devices for the government, a common misconception among some media covering this ongoing story.

The most recent development in the case came over the weekend, when the FBI admitted that it had hastily reset the Apple ID password of terrorist Syed Farook’s iPhone 5c, removing the possibility that it could connect to Apple’s servers and perform a fresh iCloud backup.

… Additional questions have been raised about how the FBI plans to get more information than a backup would provide, even if the pass code is cracked. Some common theories are that Farook was using secure messaging apps that he left un-secured on the device, but the FBI has not given specific reasoning.

… “In the same vein, you’ll also notice that in demanding a tool, FBI has sneakily ensured that a more “open” copy of the software will have to be released (that will work on other devices) in order for it to be tested, validated, and re-tested by a defense team,” notes iPhone security researcher Jonathan Zdziarsky. “This guarantees that the hacking tool FBI is forcing Apple to write will be out in the public, where it will be in the hands of multiple agencies and private attorneys.”

Background for my Computer Security students.

http://www.bespacific.com/california-ag-releases-2016-data-breach-report-retail-and-financial-sectors-most-vulnerable/

California AG Releases 2016 Data Breach Report, Retail and Financial Sectors Most Vulnerable

by Sabrina I. Pacifici on Feb 21, 2016

EPIC – “A new report from California Attorney General Kamala Harris examines data breaches in California from 2012 to 2015. There were 657 data breaches during the last four years, which compromised over 49 million records. The retail sector experienced the largest share of breaches at 25%, followed by the financial sector at 18%. Among several recommendations, the report recommends that organizations adopt strong encryption. “Government and the private sector have a shared responsibility to safeguard consumers from threats to their privacy, finances, and personal security,” Attorney General Harris stated. The Attorney General received a 2015 EPIC Champion of Freedom Award. EPIC recently launched “Data Protection 2016,” a non-partisan campaign to make data protection an issue in the 2016 election.”

(Related) An infographic

http://www.makeuseof.com/tag/what-exactly-is-a-ddos-attack-and-how-does-it-happen/

What Exactly is a DDoS Attack and How Does it Happen?

(Related) Makes it look like a good business to be in!

http://thehill.com/policy/cybersecurity/270097-ransomware-takes-millions-baffles-law-enforcement

Ransomware takes millions, baffles law enforcement

… Law enforcement is scrambling to keep up as some victims, desperate to regain access, simply pay the price without consulting police. The FBI has even told victims to pay up — a controversial move for security experts.

“The ransomware is that good,” said Joseph Bonavolonta, assistant special agent in charge of the Cyber and Counterintelligence Program in the FBI’s Boston office, during a cybersecurity conference last fall. “To be honest, we often advise people just to pay the ransom.”

… Stu Sjouwerman, CEO for cybersecurity training firm KnowBe4, said a major operation could get off the ground for somewhere between $20,000 and $40,000. That includes “millions of email addresses” to target and a “bullet proof server.”

Within weeks, that shop could rake in millions, netting potentially a 1,000 percent return on investment, he said.

You can't rely on passwords!

South Korean government to scrap password-based authentication for online banking

Park Han-na reports:

Korean bank customers will soon be able to make online transactions without using security cards or one-time passwords (OTP) as the government is seeking ways to make online payments easier so as to drive innovation in the sector, financial authorities said Sunday.

[…]

The move is expected to encourage financial institutions to develop security tools that are more convenient and safer than the OTP and security cards that are currently used in the transfer of money through online and mobile applications.

Read more on Korea Herald.

I thought we were not going to help terrorists find targets? Have we abandoned that strategy?

http://www.bespacific.com/epa-releases-online-mapping-tool-to-help-protect-drinking-water-sources/

EPA Releases Online Mapping Tool to Help Protect Drinking Water Sources

by Sabrina I. Pacifici on Feb 21, 2016

Via EPA – “The U.S. Environmental Protection Agency today released DWMAPS – the Drinking Water Mapping Application to Protect Source Waters. This robust, online mapping tool provides the public, water system operators, state programs, and federal agencies with critical information to help them safeguard the sources of America’s drinking water. DWMAPS allows users to learn about their watershed and understand more about their water supplier. DWMAPS also lets users see if sources of their drinking water are polluted and if there are possible sources of pollution that could affect their communities’ water supply. DWMAPS can even guide users to ways they can get involved in protecting drinking water sources in their community.”

Perspective. An interesting article. Has he identified “the next big thing?”

https://medium.com/@cdixon/what-s-next-in-computing-e54b870b80cc#.we3s5r8ll

What’s Next in Computing?

A very simple to-do list in the cloud.

http://www.freetech4teachers.com/2016/02/collaboratively-create-reminders-task.html

Collaboratively Create Reminders & Task Lists on Pinside

Pinside is a free online sticky note service. Pinside can be used to create boards of notes for yourself or boards to share with others. You can create a mix of private and shared notes within one account. Sticky notes on shared Pinside boards are designed for creating to-do lists. As each item on the the notes is completed you and or your collaborators can delete completed items.

Not the clearest reporting I've ever read… I need to run this by my iPhone toting students. As I read it, the FBI forced a password change to the iCloud because that let them read all the backups. But the backups stopped back in October. If they could access the iPhone (a different password?) they could turn the backup system on again and the iPhone would send data to the iCloud where they already have access. Am I right in assuming that the iPhone password is not part of the encryption kerfuffle? Or will ten bad tries to unlock the iPhone result in erasing everything? (Not 10 failed attempts to enter the encryption key)

http://www.latimes.com/local/lanow/la-me-ln-fbi--terror-suspect-s-iphone-20160220-story.html

FBI rebuts reports that county reset San Bernardino shooter's iCloud password without consent

The FBI on Saturday rebutted media reports that San Bernardino County technicians acted without the agency’s consent [So, FBI “consent” or insistence? Bob] when they reset the password for the Apple iCloud account belonging to one of the shooters involved in the Dec. 2 terror attack at a county facility that killed 14 people.

… Apple said that in early January it provided four alternatives to access data from the iPhone besides the controversial method the FBI is now proposing.

But one of the most encouraging options was ruled out after the phone’s owner – Farook’s employer, the San Bernardino County Public Health Department – reset the password to his iCloud account in order to access data from the backup, according to Apple officials.

That means the iCloud password on the iPhone itself is now wrong, and it won’t back up unless someone can get past the phone’s passcode and change it. [Not if backup is turned off. Bob]

… When iCloud is enabled, iPhones automatically sync with the cloud if they are charging and are connected to a familiar Wi-Fi network.

Had there been no reset on the iCloud password, investigators may have been able to get a more updated backup of Farook's iPhone without any need to unlock the device itself. [I don't see how that would work. Bob]

… Federal prosecutors wrote in court filings Friday that the reset by the phone’s “owner” took place “in the hours after the attack,” and an Apple executive later said it occurred within 24 hours.

But the FBI said in its statement Saturday that agents worked with San Bernardino County technicians to reset Farook’s password on Dec. 6 – four days later – because “the county owned the account and was able to reset the password in order to provide immediate access to the iCloud back up data.

… Prosecutors still contend that unlocking the iPhone is crucial because some data does not sync to iCloud. They said the FBI has retrieved Farook’s iCloud backups up to Oct. 19, about six weeks before the attack, and an FBI affidavit suggested that Farook deliberately disabled the sync feature.

(Related) But don't take my word for it…

http://www.zdziarski.com/blog/?p=5695#more-5695

On FBI’s Interference with iCloud Backups

In a letter emailed from FBI Press Relations in the Los Angeles Field Office, the FBI admitted to performing a reckless and forensically unsound password change that they acknowledge interfered with Apple’s attempts to re-connect Farook’s iCloud backup service.

… This statement has only one of two possible outcomes:

FBI is Wrong, and was Reckless:

FBI will Compel More Assistance, and mislead the courts:

… FBI must clarify which of these two meanings their letter had. Either the FBI has recklessly interfered with the processing of evidence OR FBI has mislead the courts on the amount and the nature of assistance required by Apple under the All Writs Act.

Would Apple's encryption be “reasonable?”

California Attorney General Releases Report Defining “Reasonable” Data Security

I’ve previously posted a link to a report by the California Attorney General on breaches in California and recommendations, but I like that this post by Hunton & Williams focuses on the how the recommendations relate to “reasonable security:”

Importantly, the Report states that, “[t]he failure to implement all the [Center for Internet Security’s Critical Security] Controls that apply to an organization’s environment constitutes a lack of reasonable security” under California’s information security statute. Cal. Civ. Code § 1798.81.5(b) requires that “[a] business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”

You can read the rest of their post here, but I want to pull out one part of their summary of the recommendations:

Organizations, particularly in the health care industry, should consistently use strong encryption to protect personal information on laptops and other portable devices, and should consider it for desktop computers.

So even though HIPAA doesn’t require encryption, if you are not using strong encryption, you might be running afoul of California’s law (even though it’s a “should” and not “shall”). And this is where state attorney generals may have a significant role to play in privacy enforcement, as Danielle Citron argues in her new paper.

This should be interesting. I hope to learn lots from whatever leaks in court.

http://motherboard.vice.com/read/judge-rules-fbi-must-reveal-malware-used-to-hack-over-1000-computers-playpen-jay-michaud

Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

On Wednesday, a judge ruled that defense lawyers in an FBI child pornography case must be provided with all of the code used to hack their client's computer.

When asked whether the code would include the exploit used to bypass the security features of the Tor Browser, Colin Fieman, a federal public defender working on the case, told Motherboard in an email, simply, “Everything.”

… The case has drawn widespread attention from civil liberties activists because, from all accounts, one warrant was used to hack the computers of unknown suspects all over the world. On top of this, the defense has argued that because the FBI kept the dark web site running in order to deploy the NIT, that the agency, in effect, distributed child pornography. Last month, a judge ruled that the FBI’s actions did not constitute “outrageous conduct.”

Perspective. Unlikely to replace thumbdrives soon.

http://www.theverge.com/2016/2/16/11018018/5d-data-storage-glass

'Five-dimensional' glass discs can store data for up to 13.8 billion years

… Scientists from the University of Southampton in the UK have created a new data format that encodes information in tiny nanostructures in glass . A standard-sized disc can store around 360 terabytes of data, with an estimated lifespan of up to 13.8 billion years even at temperatures of 190°C.

Not clear how this works, but it makes great campaign fodder.

http://www.computerworld.com/article/3035145/it-careers/doj-ends-probe-of-utility-over-it-replacements-no-charges-filed.html?google_editors_picks=true

DOJ ends probe of utility over IT replacements; no charges filed

… About 500 IT workers at SCE were cut, mostly through a layoff. Some of the IT workers complained of having to train foreign replacements on an H-1B visa to remain eligible for a severance package.

… The cuts followed a decision by the utility to hire Infosys and Tata Consultancy Services to take over some its IT work. Both firms are major users of visa workers.

(Related)

http://www.computerworld.com/article/3030270/it-careers/sen-blumenthal-demands-lifting-of-it-gag-order.html

Sen. Blumenthal demands lifting of IT 'gag' order

… Approximately 200 IT workers at Northeast Utilities (now called Eversource Energy) lost their jobs in 2014.