Centennial Man: 2009-12-27

Saturday, January 02, 2010

Surely this comes as no surprise... Supreme court decisions are even published.

http://yro.slashdot.org/story/10/01/02/0247236/Using-Fourth-Party-Data-Brokers-To-Bypass-the-Fourth-Amendment?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Using Fourth-Party Data Brokers To Bypass the Fourth Amendment

Posted by Soulskill on Friday January 01, @11:07PM from the one-party-per-amendment dept.

An anonymous reader writes

"Coming out of Columbia Law School is an article about commercial data brokers and their ability to provide information about individuals to the US government despite Fourth Amendment or statutory protections (abstract, full PDF at Download link). Quoting: 'The Supreme Court has held that the Fourth Amendment does not protect information that has been voluntarily disclosed to a third-party or obtained by means of a private search. Congress reacted to these holdings by creating a patchwork of statutes designed to prevent the government's direct and unfettered access to documents stored with third-parties; thus, the government's access is fettered by various statutory requirements, including, in many cases, notice of the disclosure. Despite these protections, however, third-parties are not restricted from passing the same data to other private companies (fourth-parties), and after the events of September 11, 2001, the government, believing that it needed a greater scope of surveillance, turned to the fourth-parties to access the personal information it could not acquire on its own. As a consequence, the fourth-parties, unrestricted by Fourth Amendment or statutory concerns, delivered — and continue to deliver — personal data en masse to the government.'"

eConspiracy! And, it is self-documenting!

http://mashable.com/2009/12/31/drunken-drivers-evade-the-cops-with-twitter/

Drunk Drivers Evade the Cops With Twitter

December 31st, 2009 | by Brenna Ehrlich

Twitter has become the ultimate turncoat lately, functioning as a soldier for the police and drunken drivers alike.

We reported last week that inebriated drivers in Texas are to be outed on Twitter, and now cops report that the culprits themselves are using the microblogging site to inform others of the location of sobriety checkpoints.

(Related) Over-cooperation?

http://games.slashdot.org/story/10/01/02/0310211/Man-Tracked-Down-and-Arrested-Via-emWoWem?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Man Tracked Down and Arrested Via WoW

Posted by Soulskill on Saturday January 02, @02:09AM from the time-to-bubble-hearth dept.

kabome writes with this excerpt from a story about an alleged drug dealer who was located by law enforcement thanks to World of Warcraft:

"Roberson’s subpoena was nothing more than a politely worded request, considering the limits of his law enforcement jurisdiction and the ambiguity of the online world. 'They don’t have to respond to us, and I was under the assumption that they wouldn’t,' said Roberson. ... Blizzard did more than cooperate. It gave Roberson everything he needed to track down Hightower, including his IP address, his account information and history, his billing address, and even his online screen name and preferred server. From there it was a simple matter to zero in on the suspect's location."

Big Brother by proxy.

http://www.pogowasright.org/?p=6741

U.S. security rules would break privacy laws, Canadian airlines contend

January 1, 2010 by Dissent Filed under Featured Headlines, Non-U.S., Surveillance

Jim Bronskill of the Canadian Press reports:

Canada’s major airlines say they will be forced either to break privacy laws or to ignore new American air security rules unless the federal government comes up with a response to U.S. demands for passenger information.

The National Airlines Council of Canada, which represents the four largest Canadian carriers, is pleading with the government to find “a permanent solution” to the dilemma posed by the U.S. Secure Flight program.

The program would collect the name, gender and birth date of the approximately five million Canadians who fly through American airspace en route to destinations such as the Caribbean, Mexico and South America, even if their planes don’t touch the ground in the States.

Friday, January 01, 2010

I suspect lawyers are finding ways around the disclosure laws, but I'm a bit of a cynic.

http://www.databreaches.net/?p=9239

Breach reports decline in 2009, but what does it mean?

December 31, 2009 by admin Filed under Commentaries and Analyses, Of Note

As of today’s date, breach compilations by both the Identity Theft Resource Center and Open Security Foundation indicate that there were fewer breach reports in 2009 relative to 2008. While some of the apparent decrease may be due to two sources used last year not being available online for the second half of this year, the entire decrease cannot be attributed to these two sources.

So why are breach reports down relative to last year? Are more entities now using encryption and safer methods of transporting data leading to a reduced number of breaches or reduced number of breaches that would trigger a breach disclosure? Has the arrest of a number of master cybercriminals put a significant dent in cybercrime? Either would be cause for some celebration. But there are other possible explanations for why breach reports might be down that would not be cause for celebration, such as:

Entities deciding not to report or disclose breaches despite any mandatory disclosure laws because of the cost of notification during these rough economic times;
Entities referring incidents to law enforcement in the partial hope that law enforcement will ask them not to disclose or reveal the breach so as not to interfere with any investigation;
Breaches becoming more sophisticated and entities not even realizing that they have been breached;
The media getting bored with breach reporting and not giving it as much coverage;
2008 may have represented an anomaly, as inspection of OSF’s nifty graphic at the top of their homepage suggests, with breach reports returning to pre-2008 levels in the spring, or;
None of the above.

So… why do you think that breach reports declined in 2009?

“We don't encrypt sensitive data. We don't log access to sensitive data. We don't check for files (even videos) being uploaded to our system. So we sure as heck aren't going to make any effort to protect you! Love, Your Alma Mater”

http://www.databreaches.net/?p=9257

WA: 130,000 at risk after computer breach at EWU

December 31, 2009 by admin Filed under Breach Incidents, Education Sector, Hack, U.S.

Levi Pulkkinen reports:

Following a computer breach earlier in December, Eastern Washington University will be notifying 130,000 current and former students that their identifying information may have been compromised.

While it remains unclear whether any students or alumni have had their identities stolen due to the breach, officials with the Cheney-based university are preparing to mail letters to those put at risk, a spokesman said.

Discovered during an assessment in early December, the breach was found in a system carrying student records dating back to 1987. Current and former students’ Social Security numbers, names and birth dates are stored on the system, which has since been secured.

While investigators found no evidence any information was taken — those behind the breach appeared to be storing video files on the system — those concerned their identities may have been stolen are encouraged to check their credit statements.

Thursday, December 31, 2009

Small, but increasing in frequency. We even know why. At some point, it will become so expensive they will need to fix their security. (Perhaps a discount for good security and a penalty for bad?)

http://www.databreaches.net/?p=9222

Ca: Debit-card fraud hits Guelph bank customers

December 30, 2009 by admin Filed under Breach Incidents, ID Theft, Non-U.S., Skimmers

Vik Kirsch reports:

TD Canada Trust customers stood in long lineups in at least one Guelph branch Tuesday to replace debit cards after cash was stolen from their accounts or as a precaution against this high-tech theft.

“The lineup was just incredible,” customer Irene Hayes said after replacing her debit card to guard against further theft. She said she had $400 missing from her account, but was assured by bank staff it would be replaced within a few days.

“At least we’re getting it back, but I’m sure there are people who are going to be in dire straits about this,” Hayes said, noting she talked to one person in line, a student who said he had several thousand dollars missing from a school tuition account.

Bank branch staff run off their feet Tuesday were too busy to comment. And while TD Canada Trust corporate spokesperson Tashlin Hirani couldn’t readily provide details, she noted in an email response that “debit fraud is a growing problem that impacts all banks and their customers.”

It’s often due to “a compromised merchant terminal or PIN (personal information number) pad” at a retailer such as a gas station, restaurant or grocery store, Hirani said.

Wednesday, December 30, 2009

Apparently, there are ways around the notification laws. (Amazing what a smart lawyer and a dumb manager can do) More news leaks out. How many retailers were hacked? Will we ever know?

http://www.databreaches.net/?p=9211

Target Co was victim of hacker Albert Gonzalez

December 29, 2009 by admin Filed under Breach Incidents, Business Sector, Hack, Malware, Of Note, U.S.

Target Co said it was among the victims of computer hacker Albert Gonzalez, mastermind [...if someone who noticed that there is no WiFi security can be called a mastermind. Bob] of the biggest identity theft in U.S. history.

[...]

Target spokeswoman Amy Reilly said her company was among the victims, having had an “extremely limited” number of payment card numbers stolen by Gonzalez about two years ago.

She declined to say how many card numbers had been stolen, and described the term of the exposure as brief.

“A previously planned security enhancement was already under way at the time the criminal activity against Target occurred,” Reilly said. “We believe that, at most, only a tiny fraction [...of the millions and millions... Bob] of guest credit and debit card data used at our stores may have been involved.”

She said that Target had notified the card issuers, leaving them to tell their customers. [Is that legal? Bob]

Tuesday, December 29, 2009

If it's just a bunch of local crooks, this will end here. But, if it's a roving national gang, this could become more than an irritation.

http://www.databreaches.net/?p=9189

La. restaurants suffering credit card ‘nightmare’

December 28, 2009 by admin Filed under Business Sector, ID Theft, U.S.

Jason Brown of The Advocate has a story today about restauranteurs’ lawsuits against Radiant Systems and Computer World, a lawsuit covered previously on the blog. Of note, Brown cites a Secret Service agent involved in the case:

Luiz Velez, resident agent in charge of the Secret Service’s Baton Rouge office, said each hack involved restaurants using Internet-based computer systems. [Any restaurant attached to the Internet could be vulnerable. Bob]

Velez said more than 100,000 cards were exposed and conservatively placed the fraud loss for area banks at about $1.2 million.

Although 100,000 cards and $1.2 million might not sound huge when contrasted to mega-breaches like Heartland Payment Systems’ breach, this particular breach reportedly caused at least one restaurant to close its doors and another to give up taking credit cards. And of course, we only know about less than a dozen or so restaurants. Could there be other restaurants using this POS software that also had breaches that we haven’t learned about yet? It seems likely.

Charles Y. Hoff, general counsel for the Georgia Restaurant Association and one of the attorneys assisting in the Lafayette lawsuit, said he has received a multitude of calls from restaurant owners all over the country regarding similar claims.

“It is not isolated and it is something that is a real concern on a national level,” Hoff said.

“Intent” is not the same as “capability. “ I may intend to carve the Turkey, but when my crazy cousin Eddie pushes me over the edge, I suddenly find what my new electric carving knife is capable of.

http://www.pogowasright.org/?p=6667

Einstein and Citizens’ Privacy

December 28, 2009 by Dissent Filed under Govt, Surveillance

Einstein is an intrusion detection – and soon an intrusion prevention – system the government is deploying to safeguard government IT systems. Some cybersecurity experts contend Einstein has the potential to intrude on the privacy of individual Americans, a concern Philip Reitinger dismisses.

Reitinger, deputy undersecretary of the Department of Homeland Security’s National Protection and Programs Directorate and director of the National Cybersecurity Center, says the only purpose of Einstein is to protect government networks.

“To that end, it is not our intention to go out and seek things like personally identifiable information,” Reitinger said in the second of a two-part interview with GovInfoSecurity.com. “Our intent is instead, say, what constitutes an attack? What is malicious traffic? And when we see something that is malicious traffic, that is an attempt to compromise a government system, and quite conceivably impair the privacy of Americans who data is held or the people who are working on those government systems, that we can detect that and stop it, and do a better job of actually protecting privacy.”

Source: GovInfoSecurity. You can listen to Part 1 of Eric Chabrow’s interview with Reitinger here.

I haven't pointed to Bruce recently. But he still writes a good logical blog.

http://www.schneier.com/blog/archives/2009/12/separating_expl.html

Schneier on Security

A blog covering security and security technology.

December 26, 2009

Separating Explosives from the Detonator

… For years I've been saying this:

Only two things have made flying safer [since 9/11]: the reinforcement of cockpit doors, and the fact that passengers know now to resist hijackers.

This week, the second one worked over Detroit. Security succeeded.

… I wish that, just once, some terrorist would try something that you can only foil by upgrading the passengers to first class and giving them free drinks. [Amen Bob]

(Related) Follow-up on the over reaction to an inept terrorist. (I'll also use this in my Statistics class.)

http://www.fivethirtyeight.com/2009/12/odds-of-airborne-terror.html

The Odds of Airborne Terror

by Nate Silver @ 1:58 PM 12.27.2009

… Over the past decade, according to BTS, there have been 99,320,309 commercial airline departures that either originated or landed within the United States. Dividing by six, we get one terrorist incident per 16,553,385 departures.

… There were a total of 674 passengers, not counting crew or the terrorists themselves, on the flights on which these incidents occurred. By contrast, there have been 7,015,630,000 passenger enplanements over the past decade. Therefore, the odds of being on given departure which is the subject of a terrorist incident have been 1 in 10,408,947 over the past decade. By contrast, the odds of being struck by lightning in a given year are about 1 in 500,000. This means that you could board 20 flights per year and still be less likely to be the subject of an attempted terrorist attack than to be struck by lightning.

(Related) More fun facts! Make you want to buy more life insurance?

http://johnbakersblog.co.uk/odds-of-dying-in-a-terrorist-attack/

Odds of Dying in a Terrorist Attack

john baker, March 28th, 2009.

You are 12,571 times more likely to die from cancer than from a terrorist attack

You are 11,000 times more likely to die in an airplane accident than from a terrorist plot involving an airplane

You are 17,600 times more likely to die from heart disease than from a terrorist attack

You are 1048 times more likely to die from a car accident than from a terrorist attack

You are eight times more likely to be killed by a police officer than by a terrorist

Could this happen here?

http://entertainment.slashdot.org/story/09/12/29/0110253/UK-Consumers-To-Pay-For-Online-Piracy?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

UK Consumers To Pay For Online Piracy

Posted by samzenpus on Tuesday December 29, @01:51AM from the music-rolls-down-hill dept.

Wowsers writes

"An article in The Times states that UK consumers will be hit with an estimated £500m ($800m US) bill to tackle online piracy. The record and film industries have managed to convince the government to get consumers to pay for their perceived losses. Meanwhile they have refused to move with the times, and change their business models. Other businesses have adapted and been successful, but the film and record industries refuse to do so. Surely they should not add another stealth tax to all consumers."

[From the article:

The Digital Economy Bill would force internet service providers (ISPs) to send warning letters to anyone caught swapping copyright material illegally, and to suspend or slow the connections of those who refused to stop. ISPs say that such interference with their customers’ connections would add £25 a year to a broadband subscription.

Ministers have not estimated the cost of the measures but say that the cost of the initial letter-writing campaign, estimated at an extra £1.40 per subscription, will lead to 40,000 households giving up their internet connections. Impact assessments published alongside the Bill predict that the measures will generate £1.7 billion in extra sales for the film and music industries over the next ten years, as well as £350 million for the Government in extra VAT.

[I'm not sure any of those numbers have a basis in reality. Bob]

This kind of article makes for great projects in my Computer Security class.

http://www.pogowasright.org/?p=6664

Code That Protects Most Cellphone Calls Is Divulged

December 28, 2009 by Dissent Filed under Featured Headlines, Other

Kevin J. O’Brien reports:

A German computer engineer said Monday that he had deciphered and published the secret code used to encrypt most of the world’s digital mobile phone calls, in what he called an attempt to expose weaknesses in the security of the world’s wireless systems.

The action by the encryption expert Karsten Nohl aimed to question the effectiveness of the 21-year-old GSM algorithm, a code developed in 1988 and still used to protect the privacy of 80 percent of the world’s mobile calls.

“This shows that existing GSM security is inadequate,” Mr. Nohl, 28, told about 600 people attending the Chaos Communication Congress, a four-day computer hacker’s conference that runs through Wednesday here. “We are trying to push operators to adopt better security measures for mobile phone calls.”

Monday, December 28, 2009

"All your blood are belong to us!” It's not unethical if you never ask yourself if it's unethical.

http://www.pogowasright.org/?p=6631

Ie: Hospital keeps secret DNA file

December 27, 2009 by Dissent Filed under Breaches, Featured Headlines, Other

Mark Tighe reports:

A Dublin hospital has built a database containing the DNA of almost every person born in the country since 1984 without their knowledge in an apparent breach of data protection laws.

The in Temple Street is under investigation by the Data Protection Commissioner (DPC) since The Sunday Times discovered it has a policy of indefinitely keeping blood samples taken to screen newborn babies for diseases.

Unknown to the DPC, the hospital has amassed 1,548,300 blood samples from “heel prick tests” on newborns which are sent to it for screening, creating, in effect, a secret national DNA database. The majority of hospitals act on implied or verbal consent and do not inform parents what happens to their child’s sample.

Centennial Man

Saturday, January 02, 2010

Friday, January 01, 2010

Thursday, December 31, 2009

Wednesday, December 30, 2009

Tuesday, December 29, 2009

Monday, December 28, 2009

Search This Blog

Followers

Blog Archive

Links

About Me