Centennial Man: 2010-09-26

Saturday, October 02, 2010

Interesting M.O. Were their procedures so weak it was easy for the bad guys to replace POS terminals or did they happen to have an ALDI T-shirt and therefore looked “official?” Either way, this is a big (geographically) crime.

http://www.databreaches.net/?p=14383

(Update) ALDI breach reports mushroom, customers in 11 states affected

October 1, 2010 by admin

The breach involving ALDI grocery stores is apparently larger than earlier reports suggested as reports trickle in from Pittsburgh and other areas. The chain has updated its statement on its website today:

October 1, 2010

ALDI Inc. recently learned that, from approximately June 1, 2010 to August 31, 2010, tampered payment card terminals were illegally placed in some ALDI stores, enabling unauthorized individuals to fraudulently obtain payment card information from a limited number of our customers. [“Limited” to everyone who used a Debit or Credit card on these terminals...” Bob] The tampered terminals were capable of capturing information such as name, card account number and PIN. We believe some terminals in a limited number of stores in the following areas may have been impacted:

Connecticut (limited to greater Hartford area)
Georgia (limited to greater Atlanta area)
Illinois (limited to greater Chicago area)
Indiana (limited to greater Indianapolis area)
Maryland
New Jersey
New York (limited to greater Rochester area and Lower Hudson Valley)
North Carolina (limited to greater Charlotte and Raleigh areas)
Pennsylvania (limited to greater Pittsburgh and Philadelphia areas)
South Carolina (limited to greater Charlotte area)
Virginia (limited to greater Washington, D.C. area)

[...]

ALDI says that they are a leader in the international grocery retailing industry, serving Europe, the USA and Australia and that they have over 1,000 stores in 29 states, serving 18 million customers each month.

Perspective. If you have “covered up” your security breach, would you be surprised to learn your customers no longer trusted you?

http://www.databreaches.net/?p=14330

Staring into the abyss: how many breaches go unreported?

October 1, 2010 by admin

While compiling data breach reports submitted to Maine a few months ago, one of the things I discovered (no pun intended), was that Discover submits batched reports to at least two states. Their reports indicate how many Discover card members are affected by the incidents, but their logs don’t provide much detail about the incidents themselves.

I’m concerned that for many of the breaches they report, we have never seen breach reports filed by the entities themselves nor media reports on the incidents. For now, though, let’s start with what I found when I received one batch of their reports to NYS. Keep in mind as you read the summaries that we are only talking about the number of Discover card users affected by the incidents and for only two states. The numbers affected by each incident could be considerably higher, but since the entities themselves never filed breach reports with NYS or Maine, I have no additional information at this time.

[Details omitted Bob]

Taken together, these breach summaries from Discover to two states suggest that there are many reportable breaches that are not getting reported to states by the breached entities themselves. Based on what I obtained, I would estimate that as a crude guess, there might easily be 70 or more business/hospitality sector breaches each year where the entities have not filed breach reports as required by just these two states. And that’s just for those using Discover cards.

The fact that in at least some cases, breaches are seemingly remained undetected for long periods continues to be a concern. But who, if anyone, is working with Level 4 merchants to help them comply with breach reporting requirements after they do realize that they’ve had a breach?

This is where one uniform breach-reporting requirement and standardized form would be a boon, as it should promote greater compliance with reporting requirements. Of course, we need Congress to actually pass such a bill, but hey, one can always hope.

Is there any suggestion that this “collection” is random or even ubiquitous? Surely collection of everything at a crime scene would be okay, even without the criminal's “consent?”

http://www.phiprivacy.net/?p=4059

Article: DNA Theft: Recognizing the Crime of Nonconsensual Genetic Collection and Testing

By Dissent, October 1, 2010

Elizabeth E. Joh of the U.C. Davis has an article in a forthcoming issue of the Boston University Law Review (Vol. 91, 2011). Here’s the abstract:

The fact that you leave genetic information behind on the discarded tissues, used coffee cups, and smoked cigarettes everywhere you go is generally of little consequence. The trouble arises when third parties are interested in retrieving this detritus of everyday life for the genetic information you’ve left behind. These third parties may be the police, and the regulation over their ability to collect this evidence is unclear. [Refuse has rights? Bob]

And the police aren’t the only people who are curious about your genetic information. Whether the victims are celebrities, private persons with secrets to keep, or just the targets of nosy third parties with bad intentions, if someone wants to collect and analyze another person’s DNA without consent, they can do so. Committing DNA theft is as easy a sending in a used tissue to a company contacted over the internet, and waiting for an analysis by email. A quick on-line search reveals many companies that offer “secret” or “discreet” DNA testing. The rapid proliferation of companies offering direct-to-consumer genetic testing at ever lower prices means that both the technology and motives exist for DNA theft.

Yet in nearly every American jurisdiction, DNA theft is not a crime. [Can you steal that which has been discarded? Bob] Rather, the nonconsensual collection and analysis of another person’s DNA is virtually unconstrained by law. This article explains how DNA theft poses a serious threat to genetic privacy and why it merits consideration as a distinct criminal offense.

You can download the full article on SSRN. Via the Markle Foundation, @tracyannkosa and @MarieAndreeW

Should a government have access to every citizens communications?

http://www.pogowasright.org/?p=15163

India rejects RIM’s encryption key suggestion

October 1, 2010 by Dissent

Ben Woods reports:

Indian authorities are unhappy with suggestions proposed by BlackBerry manufacturer Research In Motion in response to requests for access to encrypted device data, according to reports.

The Indian Economic Times suggested on Friday that Research In Motion’s (RIM) proposals were not satisfactory to the Department of Telecommunications (DoT). The proposals included DoT directly approaching enterprises to request encryption keys for the manufacturer’s smartphones.

In an internal memo seen by the newspaper, the Indian authorities noted that they were still unable to monitor or intercept email or instant messages sent through RIM’s encrypted BlackBerry Enterprise Server (BES).

Friday, October 01, 2010

“A breach ain't a breach until we says it's a breach!”

http://www.phiprivacy.net/?p=4038

Update on my FOI request to HHS/OCR for breach reports

By Dissent, September 30, 2010

I received a phone call from OCR this morning to discuss my FOI request for the breach reports HHS is receiving under HITECH regulations. I had requested electronic copies of the reporting forms breached entities submitted via HHS’s web site. The conversation was a bit of an eye-opener for me.

First, it turns out that they cannot give me many of the reports just yet, because under their policies, they treat each and every report as a self-reported complaint that requires an investigation for compliance with HIPAA’s privacy rule. Because investigations are not public while they are ongoing, anything the breached entity submitted would be exempt from production under FOI. Once the investigations are closed, however, then they can provide the records.

Slightly over one dozen cases reported since the new reporting went into effect in September 2009 have now been closed, and I will be sent those records very soon. It took a while to figure out whether I really wanted the full investigation records or just some summary documents. I decided that for now, getting the breach report and the closure letter would, in combination with the HHS/OCR web site entries, probably give me enough information to determine if particular breaches involved SSN or financial information, and what happened (how the breach occurred).

So stay tuned, and great thanks to OCR for their call and helpfulness. I will probably have to file a new FOI request each month for the rest of my life, but hey, at least now I understand the process and we will be getting more data.

Apparently, your cell phone is now a party line...

http://yro.slashdot.org/story/10/09/30/1640223/Many-More-Android-Apps-Leaking-User-Data?from=rss

Many More Android Apps Leaking User Data

Posted by CmdrTaco on Thursday September 30, @01:30PM

"After developing and using TaintDroid, several universities found that of 30 popular free Android apps, half were sharing GPS data and phone numbers with advertisers and remote servers. A few months ago, one app was sending phone numbers to a remote server in China but today the situation looks a lot more pervasive. In their paper (PDF), the researchers blasted Google saying 'Android's coarse grained access control provides insufficient protection against third-party applications seeking to collect sensitive data.' Google's response: 'Android has taken steps to inform users of this trust relationship and to limit the amount of trust a user must grant to any given application developer. We also provide developers with best practices about how to handle user data. We consistently advise users to only install apps they trust.'"

You don't have to be a rocket scientist, but you do need to THINK!

http://news.cnet.com/8301-13880_3-20018103-68.html?part=rss&subj=news&tag=2547-1_3-0-20

Security doesn't have to be complicated

Last week, I wrote about two simple ways to thwart Web spies. One of the methods prevents Web sites from activating your PC's built-in video camera and microphone without your permission.

In a comment posted in response to that article, a reader by the screen name of "BirdDog01" supplied a foolproof solution to the video portion of that equation: put a piece of duct tape over the camera lens. Aesthetics aside, that approach is about as simple and straightforward as they come.

A video has been making the rounds lately that shows crooks installing a card-skimming device and video camera at an ATM in the U.K. (Lifehacker provides a link to the video along with several ATM-safety tips.)

The video shows several ATM users shielding the keypad with one hand as they enter their personal identification number (PIN) with the other. I've been aware of this scam for some time and consider myself a prudent, suspicious ATM user, but I never thought to cover the keypad. Doh!

But does he see what I see?

http://www.pogowasright.org/?p=15100

FTC Consumer Protection Head Shares New Vision for Consumer Privacy

September 30, 2010 by Dissent

David Vladeck, the head of the Bureau of Consumer Protection at the Federal Trade Commission, shared his vision for consumer privacy protection with an audience at the IAPP’s Privacy Academy on September 30, 2010.

[...]

Mr. Vladeck noted three key areas for future enforcement. The FTC will (1) bring more cases involving “pure” privacy, i.e., cases involving practices that attempt to circumvent consumers’ understanding of a company’s information practices and consumer choices; (2) focus enforcement efforts on new technologies (Mr. Vladeck noted that, to assist staff attorneys in bringing these sorts of cases, the FTC has hired technologists to assist and also have created mobile labs to respond to the proliferation of smart phones and mobile apps); and (3) increase international cooperation on privacy issues (Mr. Vladeck cited the FTC’s recently-announced participation in the Global Privacy Enforcement Network).

Read more about his presentation on Hunton & William’s Privacy and Information Security Law Blog.

Christopher Wolf also blogs about the presentation on Chronicle of Data Protection.

“We don't need no stinking Congress!”

http://www.techdirt.com/articles/20100929/20293711230/even-without-coica-white-house-asking-registrars-to-voluntarily-censor-infringing-sites.shtml

Even Without COICA, White House Asking Registrars To Voluntarily Censor 'Infringing' Sites

from the censorship-through-political-pressure? dept

While there's been increasing attention paid to the "Combating Online Infringement and Counterfeits Act" (COICA), the proposed law that would allow the government to require ISPs and registrars to block access to websites deemed to be "dedicated to infringing activities," it looks like the White House (which we had thought was against censoring the internet) appears to be working on a backup plan in case COICA doesn't pass.

That is, while most folks have been focused on COICA, the White House's Intellectual Property Enforcement Coordinator (IP Czar) Victoria Espinel has apparently been holding meetings with ISPs, registrars, payment processors and others to get them to agree to voluntarily do what COICA would mandate. While the meeting is carefully focused on stopping websites that sell gray market pharmaceuticals, if registrars start agreeing to censoring websites at the behest of the government, it's as if we're halfway to a COICA-style censorship regime already. ICANN, who manages the internet domain name system was asked to attend the meeting, but felt that it "was not appropriate to attend" such a meeting.

How 'geeky' do they need to be?

http://www.wired.com/threatlevel/2010/10/supreme-court-2010-2011-term/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

All Rise: Supreme Court’s Geekiest Generation Begins

The U.S. Supreme Court begins a new term Monday with a slew of technology and civil rights issues queued on its docket, some of which could have far-reaching implications for the Freedom of Information Act, copyright, warrantless searches of private residences, the “state secrets” privilege and freedom of expression.

The cases we’re tracking involve regulation of videogame sales, the limits of the Copyright Act’s first-sale doctrine and the power of the government to collect sensitive data on employees. Another case asks whether convicted defendants have a right to use modern DNA testing to prove their innocence.

Ruling on these issues is a rapidly changing high court, with four new appointees in five years, creating the youngest court in the modern, digital age.

“You’re getting a new generation of justices. You’ve got justices who text on their phones, who do e-mail, who actually use a computer,” says Thomas Goldstein, the SCOTUSblog founder who has argued nearly two dozen cases before the Supreme Court. “That can have real consequences. It makes a difference.”

… Here is a summary of some of the upcoming cases that have been granted a hearing by the Supreme Court:

Costco Wholesale v. Omega, 08-1423

Oral argument Nov. 8

Question presented: Does the first-sale doctrine apply to imported goods manufactured abroad?

Schwarzenegger v. Entertainment Merchants Association, 08-1448

Oral argument Nov. 2

Question presented: May the states ban the sale or rental of violent video games to minors?

Skinner v. Switzer, 09000

Oral argument Oct. 13

Question presented: Do convicts have a right to post-conviction DNA testing?

National Aeronautics and Space Administration v. Nelson, 09-530

Oral argument Oct. 5

Question presented: How much personal information may the federal bureaucracy dig up about its workers?

Federal Communications Commission v. AT&T, 09-1279

Oral argument not scheduled

Question presented: The Freedom of Information Act exempts the government from disclosing law enforcement records if they “constitute an unwarranted invasion of personal privacy.” Does that personal exemption apply to a corporation, in this case AT&T?

Boeing Company v. United States and General Dynamics v. United States, 09-1298

Oral argument not scheduled

Question presented: Can the government claim a party owes it money while invoking the “state secrets” privilege to prevent a defense to that claim?

Kentucky v. King, 09-1272

Oral argument not scheduled

Question presented: Did Kentucky police, when first knocking on a suspected drug dealer’s door and then kicking it down, create their own emergency to bypass the need for a warrant to enter a private residence?

Hummm. Perhaps a student project? (A La Linus Torvalds?)

http://hardware.slashdot.org/story/10/09/30/1528229/Linux-May-Need-a-Rewrite-Beyond-48-Cores?from=rss

Linux May Need a Rewrite Beyond 48 Cores

Posted by CmdrTaco on Thursday September 30, @12:47PM

"There is interesting new research coming out of MIT which suggests current operating systems are struggling with the addition of more cores to the CPU. It appears that the problem, which affects the available memory in a chip when multiple cores are working on the same chunks of data, is getting worse and may be hitting a peak somewhere in the neighborhood of 48 cores, when entirely new operating systems will be needed, the report says. Luckily, we aren't anywhere near 48 cores and there is some time left to come up with a new Linux (Windows?)."

“'cause I may not be the most perfect teacher in the whole wide world?”

http://www.makeuseof.com/tag/8-awesome-websites-free-college-courses-online/

8 Awesome Websites to Take Free College Courses Online

MIT OpenCourseware

Carnegie Mellon OpenLearning

Khan Acadamy

University of California at Berkeley

Stanford University iTunesU

Tufts OpenCourseware

Open University LearningSpace

Johns Hopkins OpenCourseware

Since we're using Windows 7 now, it pays to learn some tricks...

http://www.makeuseof.com/tag/25-cool-windows-7-keyboard-tricks-impress-friends/

25 Cool Windows 7 Keyboard Tricks That Will Impress Your Friends

Note that some of these shortcuts will only work if Windows Aero is enabled. If Aero effects are disabled on your computer, it might not be powerful enough to support resource intensive graphical features.

The following articles describe lots of additional keyboard tricks and shortcuts to make use of:

'cause you can never have enough free stuff...

http://www.downloadspy.net/

DOWNLOADSPY.NET

DownloadSpy is a huge archive of free and free-to-try software programs for all operating systems. We review and categorize these products in order to allow the visitor to find the exact product they and their system needs.

Ditto

http://www.smashingapps.com/2010/09/30/the-lesser-known-but-very-cool-windows-apps-you-might-be-looking-for.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SmashingApps+%28Smashing+Apps%29

The Lesser Known (But Very Cool) Windows Apps You Might Be Looking For

I've been asking my students to organize what they learn by using Wikis or Mind Maps. Perhaps it's time to go further?

http://www.friedbeef.com/5-reliable-ways-to-look-for-freelance-writing-jobs/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Friedbeef+%28FriedBeef%27s+Tech%29

5 Reliable Ways To Look For Freelance Writing Jobs

Thursday, September 30, 2010

Are they sending a message or will everyone be subject to fines for slow compliance? (I hope it is the latter...)

http://www.phiprivacy.net/?p=4014

Did the punishment fit the “crime?” (the Lucile Salter Packard Hospital breach fines)

By Dissent, September 29, 2010

Jason C. Gavejian writes about a hospital breach that is causing waves because of the exorbitant fine the state imposed.

Lucile Salter Packard Children’s Hospital at StanfordUniversity was fined $250,000 earlier this year by the California Department of Public Health (“CDPH”) for an alleged delay in reporting a breach under California’s health information privacy law. What makes this fine particularly disconcerting for health care providers is the relatively small number of patient records which were subject to the breach when compared to the considerable fine imposed. [It's not how many patients were involved, it's your failure to protect your records! Bob] For employers generally, this fine could establish a timing and penalty standard which is examined and utilized by other adminstrative entities.

Personally, I think the significant issue/concern is not the number of patients affected (532) but the time issue. The hospital had confirmed that PHI were on the stolen computer by Feb. 1. Under California’s law, the state’s position is that the hospital had five (5) business days from that point to notify both the state and affected patients. The hospital, however, did notify the state or affected patients until February 19 — after it confirmed that it could not recover the computer.

CDPH informed the hospital of the fine due to the reporting of the incident 11 days late on April 23, 2010. It is unclear if the fine was tied to a failure to notify the affected individuals or the CDPH. The hospital is appealing the fine asserting its communication to CDPH was appropriate given that no unauthorized or inappropriate access took place to require it to notify affected individuals.

As much as I empathize with the hospital, the statute does not appear to be give them wiggle room on this:

A clinic, health facility, home health agency, or hospice to which subdivision (a) applies shall report any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the department no later than five business days after the unlawful or unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice.

Does stealing a computer provide “unlawful access” to the patients’ records? If so, it seems to me that the clock started running on Feb. 1. I understand the hospital’s view and I understand that the stolen computer had software that enabled the hospital to know that it had not been turned on, but there is nothing in the statute that would seemingly toll the deadline for that.

CDPH’s report can be found here (pdf).

This incident highlights the seriousness of potential data breaches, regardless of size, and the urgency with which these situations must be addressed. It also highlights an often asked question as to whether laptops that go unrecovered would constitute unauthorized access or acqisitiion (sic) of protected information.

I think the answer is obvious: if an entity loses control of a device that contains unsecured PHI, it may or may not have been acquired by someone, but if you know it was stolen, then it was acquired. Whether it will ever be accessed or not is another question, but entities need to err on the side of caution and assume the worst and notify promptly.

The HIPAA regulations also shed light on this issues stating, “if a computer is lost or stolen, we do not consider it reasonable to delay breach notification based on the hope that the computer will be recovered.”

Agreed. Whether the fine should be this steep is another matter, though. I personally think it’s quite harsh.

Read Jason C. Gavejian’s full commentary without my interspersed remarks on Workplace Privacy Data Management & Security Report.

Now this is an interesting legal argument – even if it only applies to Napoleon.

http://www.pogowasright.org/?p=15070

Oui, Defamation Can be Automatic

September 30, 2010 by Dissent

Marie-Andrée - who unlike this blogger can actually speak French and is a lawyer to boot – provides a commentary and explanation of a recent French court ruling that Eric Schmidt was guilty of defamation because of Google Suggest results. She writes, in part:

The Court noted that “algorithms or software solutions proceed from the human mind before being implemented.” The court also doubted the purely automatic character of the search results, as results were not the same on “Google Suggest” and “Recherches Associées” (associated research), which is a list of suggested research made to users, based on their original search terms. Results were not the same on the Yahoo search engine either. Therefore, the Court expressed doubt about the technological neutrality of the results.

The Court also noted that “not all research terms entered by Internet users are taken into account by the Google search engine in order. One of Google’s exhibits in the September 2010 case was a statement by Google that “[it] appl[ies] a limited set of policies regarding removal of pornography, violence and hatred”, which, according to the French Court, “confirms the possibility of at least a retrospectively human intervention capable of preventing the most obvious damage related to the search features at stake.”

Read her full commentary on Online Reputation and the Law.

[The article concludes:

It seems that if Mr. Schmidt could have proven the neutrality of the algorithm, he could have won the case. However, in order to prove neutrality, it would have been necessary for Google to discard any voiced concerned of its users, and to avoid complying with their requests to suppress offensive terms. Probably not a good result for society.

Someone wants to slap Big Brother's wrist! (and Big Brother know who he is and where he lives and works and what roads he takes to work and what medications he takes and... )

http://www.pogowasright.org/?p=15054

EU takes UK to court over internet privacy

September 30, 2010 by Dissent

The UKPA reports:

The European Commission is taking the UK to court for breaking EU rules on safeguarding internet privacy.

The move follows complaints to the Commission from British internet users that they have been targeted by advertisers based on an analysis of their “internet traffic”.

A Commission statement said it first launched legal proceedings in April last year amid concerns about how the UK authorities dealt with citizens’ concerns over the use of “behavioural advertising” by internet service providers.

The complaints were handled by the UK Information Commissioner’s Office, the UK personal data protection authority and police forces responsible for investigating cases of illegal interception of communications.

[...]

As Chris Williams of The Register tells it:

The European Commission is suing the UK government over authorities’ failure to take any action in response to BT’s secret trials of Phorm’s behavioural advertising technology.

The Commission alleges the UK is failing to meet its obligations under the Data Protection Directive and the ePrivacy Directive.

The action follows 18 months of letters back and forth between Whitehall and Brussels. The Commssion demanded changes to UK law that have not been made, so it has today referred the case to the European Court of Justice in Luxembourg.

Wednesday, September 29, 2010

All in all, Heartland has responded well to their breach. Therefore I'm inclined to believe this indicates how difficult it is to implement encryption on large numbers of devices at customer sites rather than any great reluctance on Heartland's part..

http://www.databreaches.net/?p=14228

Heartland Payment Systems bolsters encryption

September 28, 2010 by admin

Ellen Messmer reports:

Heartland Payment Systems, which last year suffered a devastating data breach, has been on a mission to secure payment-card processing .

After introducing the E3 terminal for point-of-sale transactions last May, which has gone into use with about 5,000 Heartland merchant customers for encryption of sensitive cardholder data, Heartland Tuesday introduced yet another encryption device, called the E3 magnetic stripe reader wedge, which will be available next month.

Read more about how the E3 wedge works on Network World.

It's one thing if a small business has an existing wire transfer relationship with the bank. It's something else when the crooks can open one for you!

http://www.databreaches.net/?p=14249

Wire-transfer fraud poses a growing problem

September 29, 2010 by admin

Doreen Hemlock filed this report last week:

Identity theft takes many forms, but Lenny Vigliotti never imagined it would show up as somebody wiring $12,000 from his South Florida saving account through multiple banks to end up in the Ukraine.

Nearly three months after he noticed the money missing, he’s yet to recoup the cash. As investigations proceed, he’s found out there’s a chance he may never get those savings back either.

Rules governing wire transfers place a larger burden on account holders than laws on credit cards or debit cards, Vigliotti has learned. And his Fort Lauderdale bank says he may not have met required security requirements on his computer system — even though he has secured wireless, firewalls, anti-virus software and other protection — and so, the bank may not be liable to pay him back.

“They say someone got into my computer, not their system,” said Vigliotti, a Hollywood resident. “But my point is: If you know fraud is a problem, and you see an account that has never had wire-transfers before, how do you let someone with a fax take out thousands of dollars without checking? All they needed to do was call me and ask: Are you applying for wire transfers? And I would have said: What are you talking about?”

Centennial Man

Saturday, October 02, 2010

Friday, October 01, 2010

Thursday, September 30, 2010

Wednesday, September 29, 2010

Search This Blog

Followers

Blog Archive

Links

About Me