Centennial Man: 2013-10-13

Saturday, October 19, 2013

Another small event here in Colorado. My statistics students are suggesting that we should turn the bell curve upside down since we only seem to see very large breaches or very small ones. Something I'll need to think about.

CO: Drive with students’ medical info stolen from nurse’s unattended car

CBS in Denver reports that a suitcase containing a thumb drive with approximately 100 students’ unencrypted medical information was stolen from a school nurse’s car on October 5. The car had been left in a parking lot.

The drive reportedly contained confidential health information for students from Eagleton, Castro and Munroe Schools. That information included medications, health-related letters and medical histories.

And of course, this would be covered by FERPA, not HIPAA.

This is not the first time we’ve seen student health info stolen from a school nurse’s or employee’s unattended vehicle. And this is going to keep happening until the federal government or states really crack down and impose meaningful consequences on districts that do not have policies in place that they monitor and enforce to protect students’ personal information. [Amen Bob]

You have to call this a management failure. Either they failed to detect that the software had not been updated or did know and failed to give a damn.

http://news.cnet.com/8301-13578_3-57608283-38/nsa-site-where-snowden-worked-hadnt-updated-anti-leak-software-says-report/?part=rss&subj=news&tag=title

NSA site where Snowden worked hadn't updated anti-leak software, says report

The NSA facility where Edward Snowden worked when he walked off with a hoard of secret documents had failed to update its anti-leak software, according to a report.

The computer network at the National Security Agency site in Hawaii didn't yet have the bandwidth to effectively run the updated program, an unnamed US official told news agency Reuters.

Other US government facilities had begun installing the updated software in accord with a presidential directive made in response to the WikiLeaks-Bradley Manning document dump. The "insider threat" monitoring software is reportedly made by Raytheon.

Always useful (even if it doesn't say “Don't leave an unencrypted thumb drive in your car.”) and not just in California.

Attorney General Kamala D. Harris Issues Guidelines to Health Care Industry on Medical Identity Theft

Attorney General Kamala D. Harris today released guidelines on preventing and remedying medical identity theft, including best practice recommendations for the health care industry and tips for consumers. The guidelines are part of a report, Medical Identity Theft: Recommendations for the Age of Electronic Medical Records, which frames the escalated migration to electronic medical records as an opportunity for the healthcare industry to address this problem.

“Medical identity theft has been called the privacy crime that can kill,” said Attorney General Harris. “As the Affordable Care Act encourages the move to electronic medical records, the health care industry has an opportunity to improve public health and combat medical identity theft with forward-looking policies and the strategic use of technology.”

Medical identity theft occurs when an individual uses someone else’s personal information to obtain medical goods or services. For example, a thief may use stolen information to submit fraudulent bills, a doctor or provider may use patient information to write fraudulent prescriptions or an individual may use someone else’s information to obtain treatment.

The report focuses on the impact of identity theft on the accuracy of medical records and argues that the serious risk that inaccuracies pose is not always adequately addressed by existing healthcare industry procedures.

A companion information sheet for consumers, First Aid for Medical Identity Theft, describes the signs of medical identity theft and provides tips on what to do in response. The signs of possible medical identity theft include notice of a data breach from a health care provider, an unknown item in an Explanation of Benefits from a health insurer, a call from a debt collector about an unfamiliar medical bill and questions about your identity or health conditions at intake in a doctor’s office or hospital.

The report can be found here: http://bit.ly/1eup6NO (https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/medical_id_theft_recommend.pdf)

The guide for consumers can be found here: http://bit.ly/1gnDICS (https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/cis_16_med_id_theft.pdf)

SOURCE: Attorney General Kamala D. Harris, October 17, 2013

Obvious, but difficult to solve.

Half Of Federal Agency Security Breaches Caused By Lack Of User Compliance

MeriTalk, a public-private partnership focused on improving the outcomes of government IT, today announced the results of its new report, “Cyber Security Experience: Cyber Security Pros from Mars; Users from Mercury.” The study, underwritten by Akamai Technologies, Inc. , compares what cyber security professionals report about their agency’s security with what end users – Federal workers – actually experience. According to the report, agencies often fail to take the user experience into account when deploying cyber security solutions. As a direct result, end users often circumvent security measures and open their agencies up to data theft, data loss, and denial-of-service attacks.

Read more of their press release on Dark Reading.

PR speak? Note that they never say “The doctor did not take patient records,” because he did. But they did fire the security guard who caught him doing it. Well done, VA.

VA says its patient records weren’t compromised

Lois Henry reports:

Responding to allegations that a doctor had taken confidential patient records out of the Bakersfield Veterans Administration clinic, the VA announced Thursday that three separate investigations over the course of seven months showed that no such patient information had been “released into the community or abused in any way.”

“We are confident that these results confirm that veterans in Bakersfield and Kern County did not have their personal information compromised,” said David Holt, the VA Los Angeles associate director who was in Bakersfield Thursday to talk to the media and meet with veterans at the clinic just west of downtown Bakersfield.

He praised clinic staff for being vigilant and reporting their suspicions, but repeated several times that veterans had no cause for concern about their personal information.

Some of the original tipsters weren’t convinced.

Read more on the Bakersfield Californian.

[From the article:

While the doctor was not found to have compromised patient information, Holt said, he did violate VA policies.

"Excessive use of a copy machine," Holt said. "It was a minor violation."

Holt confirmed the doctor is no longer with the VA but refused to say whether he was fired. The security guard, meanwhile, employed by a private contractor, was let go.

Interesting. Does your policy address situations like these? (How would you clean up your records?)

We don’t store credit card data…. oh wait, we are storing it?

A firm can have a great policy of not storing credit card numbers, but if the policy isn’t followed by staff, trouble can result.

eReplacementParts.com learned this lesson the hard way. They discovered that despite their non-storage policy, credit card information of some customers had been stored. In some cases, the storage was due to the customer providing their credit card number in an email to the firm. In other cases, it was because customer service personnel entered the customer’s credit card number in the “order comments” field.

In any event, some credit card information was on their server when it got hacked on February 5, but the firm didn’t discover the presence of credit card numbers until September 26.

eReplacementParts.com did not offer those affected any free services, but notes that they have no evidence that any one individual’s credit card information was viewed or accessed – only that it resided on a server that was accessed.

You can read their notification to New Hampshire and affected customers here.

Not gonna work, unless you can confirm that user “Dude#4” who logs on from San Francisco, is in fact a citizen of the EU?

Europe Moves to Shield Citizens’ Data

James Kanter reports:

Lawmakers here have introduced a measure in the European Parliament that could require American companies like Google and Yahoo to seek clearance from European officials before complying with United States warrants seeking private data.

Friday, October 18, 2013

Small, but local. Was someone stealing office supplies and selling them at a yard sale?

CO: Pueblo Community College student privacy breach revealed

Student records from Pueblo Community College, including Social Security numbers, were found by a Pueblo woman in a box of office supplies purchased at a South Side yard sale last summer in Pueblo.

Read more on Pueblo Chieftain (sub. req. for full access).

For my Ethical Hackers. This is NOT how you do it. When researching, always have a document in process that starts, “Once upon a time, there was a bank robber.” Interesting that the narcs were looking at bank robbery video...

http://news.cnet.com/8301-17852_3-57607774-71/alleged-bank-robbers-google-search-what-happens-if-you-rob-bank/?part=rss&subj=news&tag=title

Alleged bank robbers' Google search: 'What happens if you rob bank?'

[From the Boston.com article:

Narcotics detectives who viewed surveillance footage believed they recognized McLoud, a suspect in the ongoing investigation of a heroin ring based at 51 Torrey St., just around the corner from the bank, police said.

When you look up “naiveté” in the dictionary, guess whose picture you find. If indeed he was “uniquely qualified” why did he give the files to journalists.

http://news.cnet.com/8301-13578_3-57608099-38/edward-snowden-zero-chance-russia-china-nabbed-files/?part=rss&subj=news&tag=title

Edward Snowden: Zero chance Russia, China nabbed files

NSA leaker Edward Snowden says he didn't take top-secret agency files with him when he fled to Moscow and that he was also able to protect the documents from Chinese spies.

… "As part of Snowden's flight from American justice, he went to two of the most repressive and technologically sophisticated countries on Earth. (Hong Kong is, of course, part of China)," Toobin wrote, continuing later with: "An American citizen walks into their countries bearing the keys to our most secret programs, and both -- both! -- China and Russia decline to take even a peek. That is a preposterous proposition."

In the interview with Risen, however, Snowden claims he was uniquely qualified to foil any attempts by China to access his cache of documents. As an NSA contractor, he says, he was well-versed in Chinese cyberspying programs and even taught a course on Chinese cybercounterintelligence.

As for Russia, Snowden said he gave his entire cache of classified materials to journalists before he left Hong Kong -- and kept no copies for himself -- "because it wouldn't serve the public interest" for him to hang onto the files.

And then there are the merely delusional... Too bad he didn't realize it wasn't 1955 until after the election.

http://news.cnet.com/8301-17852_3-57607985-71/anthony-weiner-id-probably-be-mayor-if-it-wasnt-for-the-web/?part=rss&subj=news&tag=title

Anthony Weiner: I'd probably be mayor if it wasn't for the Web

The still disappointed candidate says that if this was still 1955, he would have been elected mayor.

A TED talk for my students who don't have time to read... (and how Big Data defeats privacy)

http://www.ted.com/talks/alessandro_acquisti_why_privacy_matters.html

Alessandro Acquisti: Why privacy matters

The line between public and private has blurred in the past decade, both online and in real life, and Alessandro Acquisti is here to explain what this means and why it matters. In this thought-provoking, slightly chilling talk, he shares details of recent and ongoing research -- including a project that shows how easy it is to match a photograph of a stranger with their sensitive personal information.

Of course they can. Perhaps reporters should read at least a summary of how instant messaging and email systems work.

Contrary to public claims, Apple can read your iMessages

Dan Goodin reports:

Contrary to public claims, Apple employees can read communications sent with its iMessage service, according to researchers who have reverse engineered it.

The finding, delivered Thursday at a Hack in the Box presentation titled How Apple Can Read Your iMessages and How You Can Prevent It, largely echoes the conclusion Ars reached in June.

Thursday, October 17, 2013

Think of it as a research project collecting “Strategies for Effective Data Breach Lawsuits?”

U. of Arizona law school notifying over 9,000 former students and applicants whose SSN may have been accessed by hacker

You won’t find it on their home page, but if you dig into the U. of Arizona‘s web site, you’ll find this notice, posted today:

Personal information of certain former law students and applicants to the University of Arizona James E. Rogers College of Law may have been exposed after being stored on a server in error. The University has attempted to notify all those affected by personal letter and set up a toll-free number to answer questions.

The University of Arizona is informing certain former law students and applicants to the James E. Rogers College of Law that an unauthorized intruder may have had access to their personally identifiable information.

An intruder accessed a server hosting the College of Law public website on July 29. Analysis of the server showed that the intruder may have accessed old class rosters and applicant lists that were stored on the server in error. The investigation identified 9,080 individuals whose names and social security numbers were potentially accessible.

[...]

The University no longer uses social security numbers as personal identifiers except where required by law. Instead, all students, alumni, faculty and staff, and others whose records are kept for business reasons are assigned a personal University identification number. The files stored on the compromised web server predated this policy by several years.

The Arizona Daily Star reported this incident earlier today.

For my Computer Security students – this is how you get hired.

http://www.wired.com/opinion/2013/10/how-to-design-and-defend-against-the-perfect-backdoor/

How to Design — And Defend Against — The Perfect Security Backdoor

By Bruce Schneier

… Having lost that public battle, the NSA decided to get its backdoors through subterfuge: by asking nicely, pressuring, threatening, bribing, or mandating through secret order. The general name for this program is BULLRUN.

Sliding down that slippery slope like an Olympic Luge. This seems to be “Wouldn't it be nice” data rather than “We can significantly reduce our risk” data.

The Great Canadian Personal Data Grab

A reader kindly sent along this link to a post by Michael Geist:

The Royal Bank of Canada updated its mobile application for Android users earlier this month. Like many banking apps, the RBC version allows users to view account balances, pay bills, and find bank branches from their smartphone. Yet when users tried to install the app, they were advised that the bank would gain access to a wide range of personal data.

The long list of personal data – far longer than that found in comparable applications from banks such as TD Canada Trust or Bank of Montreal – included permission to use the device’s camera, to read the user’s call history, to access the user’s Internet browsing habits, and to even check out their browser bookmarks. After users took to Twitter and the Google app review section to complain, RBC advised that it would update the app and that users should “stay tuned” about the permission requirements.

My weekly technology law column (Toronto Star version, homepage version) notes that RBC is not alone in requiring users to disclose more personal information in order to access services. Aeroplan, the loyalty program linked to Air Canada, sent an email last week to hundreds of thousands of Canadians notifying them that it too was changing its data collection practices.

The company disclosed that holders of its popular financial credit cards (which can be used to earn Aeroplan points based on total spending) will soon be required to grant it access to detailed financial activity. Starting next year, Aeroplan will be privy to all cardholder transactions, including merchant names, transaction amounts, and dates of the transactions.

Read more on Michael’s blog. I guess I won’t be using Aeroplan any more!

Clearly, Congress hasn't seen this yet. My Statistics students could have explained it to them.

http://www.bespacific.com/poll-the-new-american-center/

Poll – The New American Center

“An exclusive Esquire-NBC News survey [rendered in a series of infographics that accompany the data for each respective question/answer] shows us that everything we are told about politics in America today—that there is no middle ground between left and right, blue and red, us and them—is wrong. The data, compiled by the Benenson Strategy Group (pollster for Obama for America ’08 and ’12) and Neil Newhouse of Public Opinion Strategies (lead pollster for Romney for President), show us there is a large group of American voters—even a majority—who make up a New American Center that is passionate, persuadable, and very real. They are merely waiting for Washington to find them.” ["The Benenson Strategy Group and Public Opinion Strategies conducted a nationwide survey from August 5 through 11, 2013, with 2,410 registered voters. They applied a k-means clustering technique to group respondents into "segments" based on attitudinal and demographic commonalities and like-mindedness. They conducted eight iterations of the clustering to optimize the differentiating variables that feed into the segmentation methodology. The segments were formed based on commonalities across their demographics; psychographics; political, social, and economic values; and lifestyles. The pollsters selected the segmentation solution that yielded the most unique and differentiated clusters."] Esquire, November 2013 issue.

For my “starving students” (Unfortunately, a series of infographics. )

http://www.makeuseof.com/tag/200-ways-to-make-money-online/

200 Ways To Make Money Online

Wednesday, October 16, 2013

Surveillance sneaks in on little cat's feet... What happens when the police run out of “It's for the children,” “We gotta catch terrorists,” and “These guys are criminals!” justifications?

http://news.cnet.com/8301-17852_3-57607599-71/florida-police-use-cameras-to-track-cars-in-red-light-districts/?part=rss&subj=news&tag=title

Florida police use cameras to track cars in red-light districts

I guess I missed this (guess I should read the Intelligence Act more carefully) Could be interesting if the volume is a great as I think it is.

http://www.bespacific.com/congressional-notification-for-authorized-public-disclosure-of-intelligence-information/

Congressional Notification for Authorized Public Disclosure of Intelligence Information

Steven Aftergood/Secrecy News: “A new Department of Defense directive requires the Pentagon to notify Congress whenever a DoD official discloses classified intelligence to a reporter on an authorized basis, or declassifies the information specifically for release to the press. The new directive on “Congressional Notification for Authorized Public Disclosure of Intelligence Information” applies to all components of the Department of Defense. It was issued last week — despite the government shutdown — in response to a provision in the FY2013 Intelligence Authorization Act (section 504) that was passed by Congress last year as part of an effort to stem leaks of classified information.”

Perspective. Looks like a bright future for my Computer Forensics students!

Statistic of the Day?

More than half of all Koreans have become victims of identity theft since September 2011, when laws were tightened to prevent the practice.

According to a report submitted to Saenuri Party lawmaker Kim Young-joo by the Ministry of Security and Public Administration, 29.26 million people reported being victims of identity theft every year since 2011. Supposing there were not too many repeat reports, that boils down to 57.4 percent of Korea’s total population of 50.9 million.

SOURCE: Chosun

Interesting. Will we learn and implement?

http://blogs.hbr.org/2013/10/indias-secret-to-low-cost-health-care/

India’s Secret to Low-Cost Health Care

… The ultra-low-cost position of Indian hospitals may not seem surprising — after all, wages in India are significantly lower than in the U.S. However, the health care available in Indian hospitals is cheaper even when you adjust for wages: For example, even if Indian heart hospitals paid their doctors and staff U.S.-level salaries, their costs of open-heart surgery would still be one-fifth of those in the U.S.

(Related) IBM wants a piece of that Health Care money/

http://www.theverge.com/2013/10/15/4837828/ibms-watson-wants-to-fix-americas-doctor-shortage

IBM's Watson wants to fix America's doctor shortage

Isn't there a “Fund” to ensure remote communities are connected to the telephone network? Is that no longer a strategic goal? (Or has it been lobbied away?)

http://www.nytimes.com/2013/10/15/technology/on-a-new-jersey-islet-twilight-of-the-landline.html?_r=0

On a New Jersey Islet, Twilight of the Landline

Hurricane Sandy devastated this barrier island community of multimillion-dollar homes, but in Peter Flihan’s view, Verizon Communications has delivered a second blow: the telecommunications giant did not rebuild the landlines destroyed in the storm, and traditional telephone service here has now gone the way of the telegraph.

I can probably adapt, or I could offer an offline “How to learn online” class.

http://www.bespacific.com/gallup-in-u-s-online-education-rated-best-for-value-and-options/

Gallup – In U.S., Online Education Rated Best for Value and Options

Viewed as weakest in terms of trusted grading and acceptance by employers by Lydia Saad, Brandon Busteed, and Mitchell Ogisi

“Still something of a novelty, online education is seen relatively positively by Americans for giving students a wide range of curricula options and for providing good value for the money. However, Americans tend to think it provides less rigorous testing and grading, less qualified instructors, and has less credence with employers compared with traditional, classroom-based education. Public perceptions about online education’s ability to deliver education in a format most students can succeed in, as well as its ability to tailor instruction to the individual, are more mixed, but tilt negatively. In line with these views, Americans’ overall assessment of Internet-based college programs is tepid at best. One-third of Americans, 34%, rate such online programs as “excellent” or “good.” The majority calls them “only fair” or “poor.” In contrast, two-thirds of Americans (68%) rate four-year colleges and universities as excellent or good, and nearly as many (64%) rate community colleges this highly.”

Amusing. In Colorado the colors could change 50 times per day!

http://news.cnet.com/8301-17938_105-57607600-1/mood-cars-paint-reacts-to-temperature-changes/?part=rss&subj=news&tag=title

Mood cars: Paint reacts to temperature changes

Useful, because I know there are millions of you out there looking for ways to send me money!

http://news.cnet.com/8301-1023_3-57607474-93/square-cash-lets-anyone-send-money-by-e-mail-for-free/?part=rss&subj=news&tag=title

Square Cash lets anyone send money by e-mail -- for free

Square launched a free service Tuesday that lets anyone send money via email to anyone else.

The service, known as Square Cash, was previously available only in an invite-only beta. For now, at least, it is only available in the United States.

Square Cash doesn't require either person in a transaction to have a Square account, and there are no fees, said product manager Brian Grassadonia. In order to send money, all that's required is for the sender to address an e-mail to the recipient, with a CC: to cash@square.com, and the amount in the e-mail's subject line. The body of the email can contain any information the sender wants.

Although users don't need a Square Cash account, both the sender and the recipient must link their e-mail address to a debit card, Grassadonia explained. That step takes place after the e-mail is sent. Once a recipient has gone through that process, that person can then send someone else money without having to re-enter their debit card number. The funds are deposited directly in the recipient's bank account, and not in a stored balance account.

Might be useful...

Convert Everything Lite

– , as the name suggests, converts whatever units of measurement you can think of, on your Android phone. These include things like angles, oven temperature, metric unit, clothing sizes, text conversions, digital image resolution, temperature, currency, and more.

Tuesday, October 15, 2013

Redundantly defining “Everything” Perhaps it would be quicker to list the bits NSA doesn't bother with. Oh wait, they collect “Everything!!”

NSA collects millions of e-mail address books globally

Barton Gellman and Ashkan Soltani report:

The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans, according to senior intelligence officials and top secret documents provided by former NSA contractor Edward Snowden.

The collection program, which has not been disclosed before, intercepts e-mail address books and “buddy lists” from instant messaging services as they move across global data links. Online services often transmit those contacts when a user logs on, composes a message, or synchronizes a computer or mobile device with information stored on remote servers.

Monday, October 14, 2013

Mark your calendars. Drop by http://privacyfoundation.org/ for details. Register. Learn!

The Privacy Foundation at the University of Denver Sturm College of Law presents:

Big Data Privacy: Business & Government

Friday, October 25, 2013 10:00 AM—1:00 PM

Contact Privacy Foundation Administrator Cindy Goldberg at cgoldberg@law.du.edu

or Anne Beblavi at abeblavi@law.du.edu, or call 303-871-6303

Generating and using Big Data...

http://www.bespacific.com/paper-the-massive-metadata-machine/

Paper – The Massive Metadata Machine

The Massive Metadata Machine: Liberty, Power, and Secret Mass Surveillance in the U.S. and Europe, Bryce Clayton Newell, University of Washington – The Information School, October 11, 2013. I/S: A Journal of Law and Policy for the Information Society (ISJLP), 10, 2014

“This paper explores the relationship between liberty and security implicated by secret government mass surveillance programs. It includes both doctrinal and theoretical analysis. Methodologically, the paper examines judicial reasoning in cases where parties have challenged secret government surveillance programs on Constitutional or human rights grounds in both United States’ Courts and at the European Court of Human Rights (EctHR). Theoretically, this paper will draw on theories in the fields of law, surveillance studies, and political theory to question how greater recognition of citizen rights to conduct reciprocal surveillance of government activity (for example, through expanded rights to freedom of information) might properly balance power relations between governments and their people. Specifically, the paper will question how liberal and neo-republican conceptions of liberty, defined as the absence of actual interference and the possibility of arbitrary domination, respectively, and the jurisprudence of the ECtHR can inform the way we think about the proper relationship between security and liberty in the post-9/11, post-Snowden United States of America.”

Now that's an interesting idea. Is this like saying banks are too big to fail, only backwards? (Plaintiffs are too big for Google to survive?)

Privacy Class Actions May Be Too Big to Settle

Scott Graham writes:

Plaintiffs appear to be in the driver’s seat in two big privacy class actions against Google. The suits over Gmail and Street View have survived motions to dismiss, and the Ninth Circuit has emphatically rejected Google’s appeal in the Street View case.

This is a point where settlement discussions would typically intensify. But is it possible plaintiffs now have too much leverage?

With potential classes of many millions of people and statutory damages ranging as high as $10,000 per violation under the Wiretap Act, the parties could confront a scenario where the case is simply too expensive to strike a deal.

Centennial Man

Saturday, October 19, 2013

Friday, October 18, 2013

Thursday, October 17, 2013

Wednesday, October 16, 2013

Tuesday, October 15, 2013

Monday, October 14, 2013

Search This Blog

Followers

Blog Archive

Links

About Me