Centennial Man: 2010-10-10

Saturday, October 16, 2010

Now you can be a parent and Big Brother at the same time! Unfortunately, there's an App for that.

http://www.makeuseof.com/tag/3-effective-cell-phone-surveillance-apps/

3 Most Effective Cell Phone Surveillance Apps to Monitor Your Kids [Android]

Use M-Spy to Listen In

Have you ever heard those urban legends that the CIA or NSA can connect to any cellphone in the world and hear what’s going on in the room? Well, with M-Spy from the Android Market, you can do that too. After you download and install M-Spy to your phone, all you have to do is set up a PIN number, and the phone is immediately enabled to act as your own personal audio bug no matter where it is.

Use the Android as an IP Webcam

While audio is useful, it would be even more useful if you could position your Android phone to monitor your home while your kids are being cared for or home alone. Using the IP Webcam app on the Android Market, you can transform your Android into an IP webcam.

Remotely Sense Motion, Movement or Sound

One of the most advanced remote surveillance apps is RL Watcher. This application lets you enable your phone to remotely sense movement, sound or even just the slightest motion of your phone.

Each remote sensor can be individually enabled so that you can receive a notification any time each sensor is tripped. Notifications of any activity can be via SMS, e-mail or by phone. For example, you can set the phone up so that if it moves, it’ll call you at any phone number and you can listen in to whatever is going on where the phone is situated.

Did you ban your teen from using their car? Put your Android phone in the car while you’re at work, and it’ll call you if the car starts moving. Put it in an empty room, and it’ll email you when there’s movement in the room. The possibilities are endless.

A re-hash of the Wall Street journal articles. PeakYou worked no better than some others I've tried.

http://yro.slashdot.org/story/10/10/15/1340244/Data-Miners-Scraping-Away-Our-Privacy?from=rss

Data Miners Scraping Away Our Privacy

Posted by Soulskill on Friday October 15, @10:08AM

"Twig, writing for Corrente, reports on data scrapers. They are not looking for passwords and such; scrapers are looking at blogs and forums searching for material relevant to their corporate clients. We are assured that the information is 'anonymized' to protect the identities of forum participants. However, a tool called PeekYou permits users to connect online names with real world identities. No worries, though — if you have a week to spare, you can opt-out of some of the larger data banks."

“If you advertise it, they will come.” Field of Madison Avenue Dreams.

http://www.phiprivacy.net/?p=4509

Who would send Angie’s List their sensitive medical info??!

By Dissent, October 15, 2010

Danger, Will Robinson!

Angie’s List has reportedly started offering a new service to resolve complaints consumers/patients may have about their doctors. But to do so, it reportedly requires users to sign a release that is Very Bad News.

According to the Medical Justice Blog, which has called attention to this dangerous release, it says, in part:

[My doctor] is hereby authorized to discuss and disclose all protected health information about me in its possession (whether in oral, written, or electronic form) to Angie’s List….

I understand that this includes routine medical treatment information (such as admission records, doctors order sheets, progress and notes, surgical records, laboratory records, and office notes)…

[My doctor is authorized to send] records relating to communicable diseases – which may include hepatitis, sexually-transmitted diseases, H.I.V. and AIDS. …-)…

[My signature also authorizes my doctor] sending records relating to drug or alcohol abuse, or drug or alcohol related diseases (whether or not covered by 42 C.F.R. Part 2), and psychiatric, psychological or counseling records…

[...]

I understand that information that I provide to Angie’s List or information that is used or disclosed in accordance with this Authorization may be used by Angie’s List to provide content for Angie’s List publications such as magazines, websites, or other works…

Wow. Angie’s List is not a HIPAA-covered entity. While patients can waive their own privacy and confidentiality and send anyone their records, no HIPAA-covered entity should participate in this at all. And frankly, neither should any patient, in my opinion.

Patients: if you have a complaint that you can’t resolve with your physician or health care provider, there are professional boards to hear your complaint. And if you can’t convince them, see a lawyer about your legal options. Sharing your sensitive information with a business is just plain privacy-dangerous.

Smart, but a few years late?

http://it.slashdot.org/story/10/10/15/2315205/How-Cornell-Plans-To-Purge-Campus-Computers-of-Personal-Data?from=rss

How Cornell Plans To Purge Campus Computers of Personal Data

Posted by timothy on Friday October 15, @07:27PM

"Cornell lost a laptop last year with SSNs. Now, they've mandated scanning every computer at the University for the following items: social security numbers; credit card numbers; driver's license numbers; bank account numbers; and protected health information, as defined by HIPAA. The main tools are Identityfinder (commercial software for Windows and Mac), spider (Cornell software for Windows from 2008) and Find_SSN (python script from Virginia Tech). The effort raises both technical questions (false positives, anyone?) and practical issues (should I trust closed source software to do this?). Have other Universities succeeded at removing confidential data? Success, here, should probably be gauged in terms of diminished legal liability after the attempted clean up has been completed."

Note: this program affects the computers of university employees and offices, rather than students' personal machines.

[Software mentioned:

Find_SSN http://security.vt.edu/Find_SSNs/index.html

Identityfinder http://www.identityfinder.com/us/ [There is a free home version Bob]

Cornell's “spider” http://www2.cit.cornell.edu/security/tools/

Interesting. They seem to be saying (again) that they are overselling their systems. “We want everyone to buy our unlimited data plans but we don't want them to use them. A few high volume users/applications can overwhelm our network, so we need to block them and charge more.”

http://mobile.slashdot.org/story/10/10/15/2124217/Can-Apps-Really-Damage-a-Cellular-Network?from=rss

Can Apps Really Damage a Cellular Network?

Posted by Soulskill on Friday October 15, @05:59PM

"In FCC filings earlier this year, T-Mobile described how the behavior of one Android IM app nearly brought their cellular data network to a breakdown in one city. Even more interesting, the US carrier describes how just the 300,000 unlocked iPhones on their network caused massive spikes in data usage. T-Mobile is using these anecdotes as evidence that mobile carriers should be able to retain control over the applications and devices on their network to ensure quality of service for all users. Do they have a point?"

Cell phone is 'gadget of choice' for Americans

U.S. consumers crave their gadgets, but the cell phone rules them all, according to a new Pew Internet study.

Among the 3,000 adults surveyed, 85 percent own cell phones. Mobile phones are especially in demand among younger adults, with 96 percent of 18- to 29-year-olds owning one. But even among those 65 and older, 58 percent have a cell phone.

Bad, but what can you expect when research is so carefully hidden (to protect patent rights?)

http://science.slashdot.org/story/10/10/15/1934228/Meta-Research-Debunks-Medical-Study-Findings?from=rss

Meta-Research Debunks Medical Study Findings

Posted by Soulskill on Friday October 15, @03:48PM

"From The Atlantic comes the story of John Ioannidis and his team of meta-researchers, who have studied the overall state of medical research and found it dangerously and widely lacking in trustworthiness. Even after filtering out the journalistic frippery and hyperbole, the story is pretty disturbing. Some points made in the article: even the most respected, widely accepted, peer-reviewed medical studies are all-too-often deeply flawed or outright wrong; when an error is brought to light and the conclusions publicly refuted, the erroneous conclusions often persist and are cited as valid for years, or even decades; scientists and researchers themselves regard peer review as providing 'only a minimal assurance of quality'; and these shortcomings apply to medical research across the board, not just to blatantly self-serving pharmaceutical industry studies. The article concludes by saying, 'Science is a noble endeavor, but it's also a low-yield endeavor … I'm not sure that more than a very small percentage of medical research is ever likely to lead to major improvements in clinical outcomes and quality of life.' I've always been somewhat suspicious of research findings, but before this article I had no idea just how prevalent untrustworthy results were."

(Related) Let's hope that somewhere there is an aspiring garage-based inventor of the cure for the common cold.

http://science.slashdot.org/story/10/10/15/1452226/The-Spread-of-Do-It-Yourself-Biotech?from=rss

The Spread of Do-It-Yourself Biotech

Posted by Soulskill on Friday October 15, @11:30AM

"Are you an electronics hobbyist or a garden shed tinkerer? If so, then move aside, because there's a new kid on the block: the DIY biotechnologist. The decreasing price of biotech instrumentation has made it possible for everyday folks (read: biotech geeks) with a few thousand dollars to spare to equip their garages and parents' basements with the necessary 'tools of the trade.' Some, like PCR machines, are available on eBay; other utensils are hacked together from everyday appliances and some creativity. For example: microscopes out of webcams and armpit E. coli incubators. Nature News has an article on the phenomenon, describing the weird and wonderful fruits of biotech geek ingenuity, like glow-in-the-dark yogurt. One could draw parallels with the early days of computer building/programming. It may be that we're looking at a biotech revolution, not just from the likes of Craig Venter, but from Joe-next-door hacking away at his E. coli strain. What are the Steve Wozniaks of biotech working on right now?"

I like Gertner a lot and this article is worth a read, but I had a chilling thought.. Do you suppose I could translate this curve to reflect how my students see the classes I teach?

http://news.cnet.com/8301-13556_3-20019730-61.html?part=rss&subj=news&tag=2547-1_3-0-20

Gartner's hype cycle: Tablets, gestures, and cloud

Gartner's "Hype Cycle" ... The underlying concept is pretty simple. New technologies enter the market, become the subject of breathless hype, fail to immediately live up to the most breathless hyperbole, start to therefore be perceived as failures, and finally become useful for the mainstream market in a realistic, measured way.

Gartner's 2010 Hype Cycle for Emerging Technologies Free, registration required.

For your Swiss Army folder...

http://www.makeuseof.com/dir/fileminx-free-instant-file-converter/

Fileminx: Free Instant File Converter Online

Ever received an email with an attachment that you couldn’t open because you didn’t have the required program on your system? Asking the sender to resend the file is not always an option since that’d require a lot of time and even then the sender might not have the same software stack as you have. Thankfully, Fileminx is here to save us from all the back and forth emails.

www.fileminx.com

Similar tools: Online-Converter, DocsPal, OnlineFontConverter and Text2MindMap.

Also read related articles:

5 Easy-to-use Freeware Video Converters
10 Great Apps to Convert Audio & Video Files in Linux
Top Free Media Converters for Windows

For my Geeks...

http://www.makeuseof.com/dir/mozilla-firefox-addon-builder-building-firefox-addons/

Firefox Addon Builder: A Web Tool To Simplify Building Firefox Addons

Mozilla Firefox Add-on Builder is a free online developer tool. Its aim is quite straightforward: to simplify the process of building firefox addons.

You start by creating an account on the add-ons website here. Next you will need the Add-on Builder Helper Firefox add-on; this add-on will help you try out add-ons and it can be found here. With these things set, you can start coding your add-on in the edit area.

You can start from scratch or, to add functionality, you could use one of the various APIs available in the code library.

builder.mozillalabs.com

Also read related articles: Web Developer Toolbar for Firefox and How to Make Your Own Firefox Addon.

Web enabled Business Models.

http://news.slashdot.org/story/10/10/16/0427239/How-to-Heartlessly-Arbitrage-Used-Books-With-a-PDA?from=rss

How to Heartlessly Arbitrage Used Books With a PDA

Posted by timothy on Saturday October 16, @08:03AM

"Michael Savitz writes at Salon how he makes a living armed with a laser bar-code scanner fitted to a Dell PDA. [Automating the “look up” Bob] Savitz haunts thrift stores and library book sales to scan hundreds of used books a day and instantly identify those that will get a good price on Amazon Marketplace. 'My PDA shows the range of prices that other Amazon sellers are asking for the book in question,' writes Savitz. 'Those listings offer me guidance on what price to set when I post the book myself and how much I'm likely to earn when the sale goes through.' Savitz writes that on average, only one book in 30 will have a resale value that makes it a "BUY" but that he goes through enough books to average about 30 books sold per day. 'If I can tell from a book's Amazon sales rank that I'll be able to sell it in one day, I might accept a projected profit of as little as a dollar. The more difficult a book will be to sell, the more money the sale needs to promise.' [Economics 101 Bob] Savitz writes that people scanning books sometimes get kicked out of thrift stores and retail shops and that libraries are beginning to advertise that no electronic devices are allowed at their sales. 'If it's possible to make a decent living selling books online, then why does it feel so shameful to do this work?' concludes Savitz."

I'm a huge fan of WolframAlpha and my Math students quickly become fans too.

http://www.freetech4teachers.com/2010/10/wolfram-alpha-word-widgets.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+freetech4teachers%2FcGEY+%28Free+Technology+for+Teachers%29

Saturday, October 16, 2010

Wolfram Alpha Word Widgets

Wolfram Alpha is known as a computation and statistics search engine, but Wolfram Alpha offers more than that. Two of examples of this are found in Wolfram's new word widgets. Wolfram now offers a dictionary widget that provides users with definitions, synonyms, and pronunciations.

[Classic Word Calculator http://developer.wolframalpha.com/widgets/gallery/view.jsp?id=b3f44d9054402de39441e165a4bdfe0

The Fun Word Calculator provides users with anagrams, rhyming words, and the Scrabble value of words.

[Fun Word Calculator http://developer.wolframalpha.com/widgets/gallery/view.jsp?id=9f655cc8884fda7ad6d8a6fb15cc001e

[I also recommend:

Using Wolfram|Alpha in the Classroom http://www.wolframalpha.com/educators/

Friday, October 15, 2010

A couple of points: First, the potential harm of Identity Theft isn't just in the first or second year after the event. Second, a well planned fraud may go for years without detection – unlike the small time 'quick buck' copycats we see so frequently. Three, I'm beginning to suspect the police generally don't trust the organizations breached to help in an investigation.

http://www.databreaches.net/?p=14696

Orange Regional Medical Center asks investigators for info on breach

October 14, 2010 by admin

Following revelations yesterday by the FBI and U.S. Attorney’s Office of a massive Medicare fraud scam that utilized patient data stolen, in part, from Orange Regional Medical Center in New York, I asked the center whether they had known about the breach when it occurred in 2005 and whether and when patients were notified of the breach. In response, the center sent me this e-mail statement:

Orange Regional Medical Center was very concerned to learn from news reports that we were among several NY healthcare facilities from which patient identities had been allegedly obtained in 2005 by an organized crime ring, for the purposes of committing Medicare fraud. We were not aware of this Medicare fraud scheme until learning of it from news outlets; and we consider ourselves among the victims of this conspiracy. Orange Regional regards the protection of patient information to be among our highest priorities and we take any purported breach of patient information very seriously.

We have reached out to the FBI, Department of Justice and Office of the Inspector General and asked that they share with us any information relating to this incident and, specifically, whether this breach occurred within Orange Regional or outside at a site unrelated to Orange Regional. Presently, we are awaiting information.

In light of a statement in the indictment linking stolen patient data directly to a breach at ORMC in 2005, it sounds like the center had no idea that there had been a breach and still does not really know about it.

This is not the first time we’ve seen law enforcement withhold information about breaches from breached entities, but now that they’ve indicted people, it would be helpful if they informed the breached entities what they know about how the breaches occurred and which patients’ data were stolen so that the hospitals can contact their patients to make proper notification and offer apologies and support, as appropriate.

Technologically illiterate or simply too inept to steal patient data on you own? Let HHS help!

http://www.phiprivacy.net/?p=4500

HHS covets role as ‘data sugar daddy’ to app developers

By Dissent, October 15, 2010

Mary Mosquera reports:

The Health & Human Services Department plans in December [In time for Christmas? Bob] to release significantly more health-related data to spur commercial development of new software applications designed to help patients, providers and policymakers make better health care decisions.

National, state and county health performance data sets will be made available via the Internet to HHS’s “Health Indicators Warehouse,” according to Todd Park, HHS’s chief technology officer, who said HHS will also set up a permanent “one stop shop” Web site for public access to community health data and health-related data from other federal agencies.

“We want to keep flooding the market with more and more data from our vaults,” said Park, who views government as an enabler of business innovation and a source of support to developers and programmers looking to use public data in useful applications and services.

Thursday, October 14, 2010

The Privacy Foundation brochure for their seminar on the “Legal Implications of Internet Advertising” has been added to their website: http://privacyfoundation.org/

Identity theft: “So easy, even a politician can do it?” I wonder if this will be the basis for yet another “Attack ad?”

http://www.databreaches.net/?p=14652

MA: Court papers allege Cahill camp laptops stolen

October 13, 2010 by admin

Dave Wedge reports on allegations that laptops containing personal information of campaign donors were stolen for political purposes:

Laptops containing personal information of Tim Cahill donors were reported stolen from aides to Paul Loscocco just days before the supporters received requests for contributions to the Charlie Baker campaign, a top Cahill aide claims in new court papers.

Wednesday, October 13, 2010

Is this merely another case of poor security management or do companies truly believe that “it can't happen to us?”

http://www.phiprivacy.net/?p=4327

Watch those portable devices, Tuesday edition

By Dissent, October 12, 2010

Maryland-based HomeCall Inc. recently notified the Maryland Attorney General’s Office that an employee’s portable point-of-care device was stolen. The device contained names, addresses, SSN, medical record number, diagnoses, and treatment information. HomeCall reports that the device was “multi-level password protected” (but not encrypted). In correspondence to those affected, HomeCall stated that the device required a user/pass to login and then a second user/pass to access the program containing the patients’ electronic medical records. Eleven Maryland residents were notified of the breach and the company subsequently encrypted all portable devices.

What a pity that so many entities wait until after they’ve had a breach to encrypt. After all this time, is there really still any excuse not to either have encrypted sensitive data on devices or have implemented some equally effective security?

Nothing says encryption solves all problems. Here the data was apparently encrypted with the wrong key.

http://www.databreaches.net/?p=14618

Encryption didn’t prevent this breach

October 12, 2010 by admin

A report to the Maryland Attorney General’s Office from ING gave me pause because I don’t remember ever seeing a security issue like this before in a breach report. In their notification, ING writes (emphasis added by me):

ReliaStar Life Insurance Company (RLIC) is responsible for premium administration for RLIC insurance products purchased by employees of our clients. An encrypted electronic file containing the personal information of one client’s employees, including several Maryland resident (sic), was inadvertently made available to another company’s Human Resources (HR) department due to an isolated administrative error. The encrypted file included the individual’s (sic) name and social security number. Our password-based registration encryption system prohibits the wrong addressee from opening an encrypted e-mail. Because the e-mail was addressed to the wrong client, that client was able to open the e-mail.

The receiving (incorrect) employer notified ING on June 3 and ING worked with them to securely delete the file and protect the data.

Of the individuals affected, 473 were Maryland residents.

Why different rules to cover the same data?

http://blog.securityarchitecture.com/2010/10/lots-of-health-data-breaches-reported.html

Tuesday, October 12, 2010

Lots of health data breaches reported to HHS, only trivial ones to FTC

With just over a year having passed since the health data breach notification rules mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act went into effect, and interesting contrast has emerged between the breaches disclosed to the Department of Health and Human Services (HHS) by HIPAA-covered entities and business associates and those disclosed to the Federal Trade Commission (FTC) by organizations that provide personal health records (PHRs) and associated services, but are not covered by HIPAA. As reported on Monday and evidenced by the complete listing of breaches posted by the FTC, as far as the FTC is aware there have been no major breaches (those involving 500 or more individuals) in the past year. All 13 of the breaches reported to the FTC involved lost or stolen credentials, which presumably could result in an unauthorized party gaining access to a user's personal health information, but no actual loss of data seems to have been involved. It may or may not be interesting to note that all the breaches reported also came from one company: Microsoft. [Perhaps they are the only ones in compliance? Bob] In contrast, the current count of breaches reported to HHS is 181, all of which involve 500 or more individuals, many of which apparently involve loss or theft of data (or laptops or other paper or electronic record storage devices).

It seems fair to ask, can any substantial conclusions be drawn from the paucity of breaches reported to the FTC or their relative triviality? No one appears to be suggesting that the data protection practices of organizations subject to the FTC's data breach rule are superior to those of those covered under HHS' rules, so why so few breaches reported to the FTC? Several possible explanations come to mind, only some of which have anything to do with security or privacy practices:

The population of organizations subject to the rule is small. The FTC's Health Breach Notification Rule, following language in the HITECH Act (§13407), applies specifically to "vendors of personal health records" and third-party service provides who are not covered by HIPAA. The total number of these vendors is very small relative to the number of covered entities and business associates subject instead to HHS' rules.
Breaches of encrypted data do not have to be reported. Following HITECH (§13402), Both the HHS and FTC data breach notification rules apply to breaches of unsecured data, meaning data that has not been "rendered unusable, unreadable, or indecipherable" through the use of recommended technologies such as data encryption. It is possible that some PHR vendors who might have suffered relevant incidents had no cause for concern, and no reason to disclose them, because the data in question was encrypted.
Not many people use PHRs from non-HIPAA-covered vendors. This is not meant to imply that vendors like Dossia, Google, and Microsoft have so few users of their PHRs that there wouldn't potentially rise to the level of a major breach if a data loss occurred, but instead to suggest that there may be more attractive targets for malicious attackers to go after among health care organizations.
Technology company employees (may) have better security awareness. Surely a suggestion open to challenge, but with the frequency with which health data breaches occur do to intentional or inadvertent misuse by employees (that is, authorized users), PHR vendors whose business depends to a great extent on their ability to secure customer's data might logically make security and privacy awareness a higher priority among the employees who have access to the data. Also, it shouldn't be overlooked that, unlike employees of health care organizations, PHR vendor employees have little or no reason to access personal health information stored in their systems.

I seems to learn more about the law reading articles that claim the judge got it wrong than I do when reading articles the attempt to summarize the entire field.

http://www.pogowasright.org/?p=15824

Romano and Facebook: Muddling Toward the Law of Privacy on Social Networks

October 12, 2010 by Dissent

David K. Isom writes:

Those of us who watch the development of the law of electronic discovery, information security and privacy usually have nothing better to do on a Saturday night (except last Saturday when we saw the movie “The Social Network”) than kibitz about how information on Facebook and other social networks is impacting and will likely impact civil lawsuits. Last month, a New York trial court in Romano v. Steelcase took a crack at some of these issues. While the New York court got the bottom line right — relevant information on Facebook and other social media is generally discoverable — some of its reasoning is baffling, some wrong and some spot on.

Read more on InfoLawGroup. I had previously commented as a non-lawyer that I thought the judge reached the right decision but via faulty logic. I am delighted to see David try to explain what was confusing or wrong from a legal perspective.

If they monitored social networks without a specific threat (granted, for a high profile event) why would they just stop after the inauguration?

http://www.pogowasright.org/?p=15835

New FOIA Documents Reveal DHS Social Media Monitoring During Obama Inauguration

October 12, 2010 by Dissent

Jennifer Lynch of EFF writes:

This is part two of a two part series. Read part one.

As noted in our first post, EFF recently received new documents via our FOIA lawsuit on social network surveillance that reveal two ways the government has been tracking people online: Citizenship and Immigration’s surveillance of social networks to investigate citizenship petitions and the DHS’s use of a “Social Networking Monitoring Center” to collect and analyze online public communication during President Obama’s inauguration. This is the second of two posts describing these documents and some of their implications.

In addition to learning about surveillance of citizenship petitioners, EFF also learned that leading up to President Obama’s January 2009 inauguration, DHS established a Social Networking Monitoring Center (SNMC) to monitor social networking sites for “items of interest.” In a set of slides [PDF] outlining the effort, DHS discusses both the massive collection and use of social network information as well as the privacy principles it sought to employ when doing so.

Centennial Man

Saturday, October 16, 2010

Friday, October 15, 2010

Thursday, October 14, 2010

Wednesday, October 13, 2010

Search This Blog

Followers

Blog Archive

Links

About Me