Friday, August 17, 2012

Catching up to the 9 year old script kiddies...
"The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios and Terry McCorkle, are just the latest in a series of vulnerabilities found in the esoteric ICS software packages that control utilities and other critical systems. The string of bugs reported by Rios and McCorkle include a directory traversal issue that gives an attacker the ability to access files that should be restricted. The researchers also discovered that the Niagara software stores user credentials in an insecure manner. There are publicly available exploits for some of the vulnerabilities."


“Download our 'surveil yourself' App!”
"Motorists are being invited to help develop a new driving app that could earn them a discount of 'up to 20%' on their motor insurance. British insurer Aviva is using smartphone technology to create individual driver profiles that will be used to calculate tailored pay-how-you-drive premiums. The driver behavioral app, Aviva RateMyDrive, will monitor motorists taking part in the test for 200 miles, including acceleration, braking and cornering. This data is then turned into an individual score which helps determine the motorist's premium, with 'safer' drivers earning up to 20% off their deal."


Don't worry, it's just that DHS worker bees don't know what policy DHS executive leadership has implemented.
EPIC FOIA – Documents Shed Further Light on Homeland Security Pursuit of Crowd Surveillance
August 17, 2012 by Dissent
From EPIC.org:
New documents obtained by EPIC under the Freedom of Information Act provide further details on a DHS plan to use an multiples surveillance technologies to search people in public spaces. Previous EPIC FOIA work produced records about a similar DHS program, which the government agency subsequently claimed it had cancelled. However, the new documents obtained by EPIC show that the DHS was still pursuing mobile crowd surveillance as recently as 2011. The technologies include “intelligent video,” backscatter x-ray, Millimeter Wave Radar, and Terahertz Wave, and could be deployed at subway platforms, sidewalks, sports arenas, and shopping malls. For more information, see EPIC: EPIC v. DHS (Mobile Body Scanners FOIA Lawsuit) and EPIC: Electronic Frisking


So if you ask to see an image, that's okay but we don't store the image so you can't see it unless we think it's related to a crime in which case you can't see it because it's evidence...” So what actually changes?
Nation’s police chiefs adopt drone code of conduct (updated)
August 16, 2012 by Dissent
Stephen Dinan reports:
The nation’s police chiefs have adopted a code of conduct for their use of drones, including letting any images captured by unmanned aerial vehicles, or UAVs, be open to inspection by the public, and that the images not be stored unless they are evidence of a crime or part of an ongoing investigation.
The chiefs also said that if they plan to fly drones over an area where they are likely to spot criminal activity and where they would be intruding on someone’s “reasonable expectations of privacy,” they should seek to get a search warrant first.
Read more on Washington Times.
Update: Thanks to Ryan Calo, who pointed me to the full code of conduct. The full code contains a statement on image retention that was omitted in the media report:
IMAGE RETENTION:
1. Unless required as evidence of a crime, as part of an on-going investigation, for training, or required by law, images captured by a UA should not be retained by the agency.
2. Unless exempt by law, retained images should be open for public inspection.
The “for training” in (1) seems like a pretty permissive standard, and it would be better if that were limited.


That does it. I'm creating “None of the above” to accept donations.
Text Message Donations Good for Democracy, Risky for Privacy
In June, the Federal Election Commission announced that political campaigns will soon be able to accept donations via text message. This new option will empower thousands of citizens, especially young and low-income people who have less money to give but tend to use cellphones at a greater rate, to participate more actively in the political process.
… But this proposal also has a potential downside: a loss of privacy.
An outdated patchwork of statutes has created a complex web of standards governing law enforcement’s access to communications handled by third-party providers. This includes differential treatment for the content of communications and for the “metadata” about those communications.


Actually, this would explain a lot about the RIAA and MPAA.


Tools to torture students? “Dude! No electric guitars? No window shattering bass? No cursing? You call this music?”
"Just under two years ago Musopen launched a Kickstarter campaign covered here on Slashdot. Today that project is complete with the release of a large amount of classical recordings into the public domain. This brings an extensive collection of high quality classical music into the public domain. The project music is hosted on the Musopen site, and on archive.org."


'cause you never know when you might need a “∑” or a “μ” or a “∛”
… what if you want to type something that is not readily available on the keyboard? If that’s the case you need to check out PiliApp Symbol. It has hundreds of symbols available for you to use however you wish.


Of course this come out right at the end of my Statistics class. I would like my students to give this a try.
How Statwing Makes It Easier To Ask Questions About Data So You Don’t Have To Hire a Statistical Wizard
Statwing is a Y-Combinator startup that translates the arcane technical terminology into plain english so you can do data analysis on your own.


So many students don't know how to do this...

Thursday, August 16, 2012

Gaming the gamers...
"Anonymous has claimed a new attack on Sony PlayStation Network and this time around it seems that it has managed to hack nearly 10 million user accounts and and as a proof of the hack dumped more than 3000 credentials online in the form of a pastebin post. The notorious hacktivist group is claiming that the entire set of hacked credentials contains over 10 million PSN accounts and that the file is of around 50GB."


Some still in it for the money...
… According to press reports from Australia, an Eastern European criminal syndicate targeted a small Australian business enterprise and hacked their way to details of half a million credit cards from the company’s network.
Losses from fraudulent purchases made with the stolen credit card details could total up to $25 million. To pre-empt the use of these credit cards, Australian banks have placed the cards on a high-alert watch list.


States can sponsor some serious hacking for “chump change” Is that what's happening here?
Reuters hacked (again) with fake story of Saudi minister's death
Someone must have it out for Reuters. For the second time in two weeks, the blogging platform for the news source's Web site has been hacked into and false stories have been illicitly published.
Today's sham article reported that Saudi Arabia's Foreign Minister Prince Saud al-Faisal had died, according to Reuters. The first bogus story, posted earlier this month, was about the rebel Free Syrian Army suffering setbacks in their battle against Syrian President Bashar al-Assad's regime.
"Reuters did not report the false story and the post was immediately deleted," Reuters News' director of global communications Barb Burg said in a statement. "We are working to address the problem."
In addition to the Web site's blogging platform, Reuters' Twitter account was also hacked in the past two weeks. Hackers got into the Reuters Tech account, renaming it TechMe, and false tweets were posted about the Syrian rebels being defeated in a major battle.
It's still unclear who is behind these news hacks. But Reuters hints that it may have been pro-government forces in Syria. In its article today it writes, "Saudi Arabia has emerged as a staunch opponent of Assad."

(Related) Hacking as CyberWar?
Syrian dissidents besieged by malware attacks
As the Syrian civil war continues to escalate, pro-government forces are allegedly carrying out a cyberwar against local dissidents.
Syrian activists, journalists, and government opposition groups are under a barrage of targeted malware attacks, according to the watchdog group Electronic Frontier Foundation. What this malware does is deceptively install surveillance software into a computer under the guise of protecting the computer from viruses. Its name is AntiHacker.


Think they'll be available in Walmart soon?
"Today, tens of thousands of license plate readers (LPRs) are being used by law enforcement agencies all over the country—practically every week, local media around the country report on some LPR expansion. But the system's unchecked and largely unmonitored use raises significant privacy concerns. License plates, dates, times, and locations of all cars seen are kept in law enforcement databases for months or even years at a time. In the worst case, the New York State Police keeps all of its LPR data indefinitely. No universal standard governs how long data can or should be retained."


Is Facebook making its own global law? (Might be an interesting title for a research paper)
Germans reopen Facebook privacy inquiry, but what can they really do?
August 15, 2012 by Dissent
Kevin J. O’Brien reports:
Data protection officials in Germany reopened an investigation into Facebook’s facial recognition technology Wednesday, saying the social networking giant was illegally compiling a vast photo database of users without their consent.
The data protection commissioner in Hamburg, Johannes Caspar, said he had reopened his investigation, which he had suspended in June, after repeated attempts to persuade Facebook to change its policies had failed.
Read more on NY Times, where O’Brien discusses the possible outcomes or consequences. Overall, this case illustrates how difficult it may be for countries to compel compliance with EU privacy laws when the company is headquartered in the U.S. In this case, Facebook also has a headquarters in Ireland, but the Irish Data Protection Commissioner had previously concluded that notice, not consent, was required. The Irish DPC came under pressure when the EU privacy panel indicated that consent – and not just notice – was required.
During the comment period for the FTC’s proposed settlement with Facebook, EPIC wrote to the FTC about the issue of photo tagging and compilation of biometric data. The FTC responded:
(2) You urge the Commission to prohibit Facebook from creating facial recognition profiles without users’ express consent.
The comprehensive privacy program described above will require Facebook to implement practices that are appropriate to the sensitivity of the “covered information” in question, which is very broadly defined in the order and would include biometric data. Moreover, the biennial audits of its privacy practices will help ensure that Facebook lives up to these obligations. Although the order does not specifically require that Facebook obtain a user’s consent for the creation of facial recognition data, the order’s broad prohibition on deception is designed to ensure that Facebook will be truthful with users about such practices. Likewise, the affirmative express consent requirement, described above, is designed to ensure that Facebook upholds privacy settings that it offers to users to protect such information.
So there’s no help there in closing the gap between EU privacy and U.S. privacy law.


This sounds interesting...
August 15, 2012
Paper - A Technology-Centered Approach to Quantitative Privacy
Gray, David C. and Citron, Danielle Keats, A Technology-Centered Approach to Quantitative Privacy (August 14, 2012). Available at SSRN
  • "Our analysis and proposal draw upon insights from information privacy law. Although information privacy law and Fourth Amendment jurisprudence share a fundamental interest in protecting privacy interests, these conversations have been treated as theoretically and practically discrete. This Article ends that isolation and the mutual exceptionalism that it implies. As information privacy scholarship suggests, technology can permit government to know us in unprecedented and totalizing ways at great cost to personal development and democratic institutions. We argue that these concerns about panoptic surveillance lie at the heart of the Fourth Amendment as well. We therefore propose a technology-centered approach to measuring and protecting Fourth Amendment interests in quantitative privacy. As opposed to proposals for case-by-case assessments of information “mosaics,” which have so far dominated the debate, we argue that government access to technologies capable of facilitating broad programs of continuous and indiscriminate monitoring should be subject to the same Fourth Amendment limitations applied to physical searches."


What's to hide? We know what the technology can do, so it must be a legal maneuver?
ACLU Sues FBI to Get GPS-Tracking Memos
In the wake of the Supreme Court’s decision earlier this year striking down the use of a GPS tracker on a suspect’s car without a warrant, the FBI issued two memos to agents with new guidelines for the use of the surveillance technology.
But the agency is withholding those memos from the public and has failed to respond to a records request submitted by the American Civil Liberties Union in July to obtain the documents.
On Tuesday, the ACLU filed a lawsuit against the FBI (.pdf), seeking the immediate release of the documents on the grounds that the public has a strong interest in knowing how the FBI is complying with the ruling.


If you want to work for me, you must love me.” How Victorian.
Virginia deputy fights his firing over a Facebook 'like'
A Virginia sheriff's deputy has been fired for liking his boss's political opponent -- on Facebook.
Now Daniel Ray Carter Jr. is fighting back in court, arguing that a "like" should be protected by his First Amendment right to free speech. It's a case that could settle a significant question at a time when hundreds of millions of people express themselves on Facebook, sometimes merging their personal, professional and political lives in the process.
According to court documents, the case began when Sheriff B.J. Roberts of Hampton, Virginia, fired Carter and five other employees for supporting his rival in a 2009 election.


Possibly related?
August 15, 2012
The State of the First Amendment: 2012
"The First Amendment Center has supported an annual national survey of American attitudes about the First Amendment since 1997. The State of the First Amendment: 2012 is the 16th survey in this series. This year’s annual survey repeats some of the questions that have been administered since 1997 and includes new questions on the role of religion in the presidential election, attitudes about government’s control of the Internet, and opinions about the use of copyrighted material on the Internet. This report summarizes the findings from the 2012 survey, and where appropriate, depicts how attitudes have changed over time. The first section of this report presents the survey methodology used to conduct the State of the First Amendment research. The second section highlights the key findings from the 2012 project. The final section presents the complete survey results including question wording and trend data."


What do you bet that schools won't read this...
August 15, 2012
FTC Advises Parents How to Protect Kids' Personal Information at School
News release: "A new school year usually means filling out paperwork like registration forms, health forms, and emergency contact forms, to name a few. The Federal Trade Commission wants parents to know that many school forms require personal and sensitive information that, in the wrong hands, could be used to commit fraud in their child’s name. A criminal can use a child’s Social Security number to get government benefits, open bank and credit card accounts, or rent a place to live. Most parents and guardians don’t expect their child to have a credit file, and rarely order or monitor a child’s credit report. Child identity theft may go undetected for years – until the child applies for a job or loan and discovers problems in a credit report. To help limit the risks of child identity theft, the Federal Trade Commission offers Protecting Your Child’s Personal Information at School. It explains how the federal Family Educational Rights and Privacy Act protects the privacy of student records and gives parents of school-age children the right to opt out of sharing contact information with third parties. It also suggests that parents ask their child’s school about its directory information policy, learn about privacy policies of sports or music activities that are not school-sponsored, and find out what to do if their child’s school experiences a data breach. The second publication, Safeguarding Your Child’s Future, offers tips on how to keep your child’s data safe at home and online, and explains the warning signs of child identity theft. It also explains how parents and guardians can check whether their child has a credit report, and what to do if the report has errors."


How trivial can $340 million be? (It's good to be a banker!)
Standard Chartered agrees $340m settlement with US regulator over Iran
Standard Chartered has fended off threats by a New York regulator to revoke its banking licence for alleged breaches of US sanctions. Chief executive Peter Sands is however under intense pressure after the bank agreed to pay $340m (£220m) despite insisting that it had committed only minor breaches of the rules.
Barely 24 hours before the bank was due to attend a hearing with the New York department of financial services (DFS), the regulator announced the surprise settlementwhich also includes the installation a monitor for at least two years to evaluate the bank's risk controls. Inspectors from the DFS will be installed at the bank's office in New York and the bank will "permanently install personnel" in New York solely to ensure that it adheres to money laundering laws.


This should be interesting. (Silly me, I thought they would have had to do this when they asked for extradition)
New Zealand court says FBI must disclose MegaUpload evidence
The lawyers for Kim DotCom and MegaUpload continue to rack up court victories in New Zealand.
One of the country's courts has ordered the United States to turn over evidence it says it has that proves DotCom committed criminal acts of piracy. The U.S. Attorney's office has accused DotCom, founder of the cloud-storage service, of operating MegaUpload as a criminal enterprise.
U.S. officials say that MegaUpload made over $175 million by enabling users to store pirated digital media, including movies, music and software, on the company's servers. They accuse him of encouraging the looting and wish to extradite him to this country to stand trial.
But New Zealand doesn't appear ready to take the word of the FBI that DotCom and six other MegaUpload managers committed crimes. They want to see the proof.


For my Data Mining / Data Analysis students: Drool baby, drool!
Google’s Dremel Makes Big Data Look Small
… Since the rise of Hadoop, Google has published three particularly interesting papers on the infrastructure that underpins its massive web operation. One details Caffeine, the software platform that builds the index for Google’s web search engine. Another shows off Pregel, a “graph database” designed to map the relationships between vast amounts of online information. But the most intriguing paper is the one that describes a tool called Dremel.
… “You have a SQL-like language that makes it very easy to formulate ad hoc queries or recurring queries — and you don’t have to do any programming. You just type the query into a command line,” says Urs Hölzle, the man who oversees the Google infrastructure.
The difference is that Dremel can handle web-sized amounts of data at blazing fast speed. According to Google’s paper, you can run queries on multiple petabytes — millions of gigabytes — in a matter of seconds.


If the US ever gets people to Mars, we're going to have to rent space... Go India!
neo12 writes in with the news that India plans on being the 6th country to launch a mission to mars.
"Making the first formal announcement on the country's Mars mission, Prime Minister Manmohan Singh on Wednesday said India will send a mission to the Red Planet that will mark a huge step in the area of science and technology. 'Recently, the Cabinet has approved the Mars Orbiter Mission. Under this Mission, our spaceship will go near Mars and collect important scientific information,' he said addressing the nation from the ramparts of the Red Fort on the occasion of the 66th Independence Day."


For my “Intro” classes. I like a bit of reiteration with my redundant repetition...


For my Computer Security students

Wednesday, August 15, 2012

Hey, maybe we don't need no stinking badges!
Location, location, location: two warrantless surveillance cases in the courts
August 14, 2012 by Dissent
EFF has issued a press release about U.S. v. Jones, a case in the District Court for the District of Columbia:
A federal district court is poised to determine whether the government can use cell phone data obtained without a warrant to establish an individual’s location. In an amicus brief filed Monday, the Electronic Frontier Foundation (EFF) and the Center for Democracy & Technology (CDT) argue that this form of surveillance is just as unconstitutional as the warrantless GPS tracking the U.S. Supreme Court already shot down in this case.
“Location data is extraordinarily sensitive. It can reveal where you worship, where your family and friends live, what sort of doctors you visit, and what meetings and activities you attend,” said EFF Senior Staff Attorney Marcia Hofmann. “Whether this information is collected by a GPS device or a mobile phone company, the government should only be able to get it with a warrant based on probable cause that’s approved by a judge.”
Read more on EFF.
Meanwhile, in the Sixth Circuit, the Court of Appeals has issued its opinion in U.S. v. Skinner , and it’s not good news for privacy advocates. Unlike Jones, law enforcement did not attach a GPS to a suspect’s car, but did ping his cellphone to discover his location. Here’s the beginning of the opinion:
When criminals use modern technological devices to carry out criminal acts [If the cell phone was just “along for the ride” would the decision have been different? Bob] and to reduce the possibility of detection, they can hardly complain when the police take advantage of the inherent characteristics of those very devices to catch them. This is not a case in which the government secretly placed a tracking device in someone’s car. The drug runners in this case used pay-as-you-go (and thus presumably more difficult to trace) cell phones to communicate during the cross- country shipment of drugs. Unfortunately for the drug runners, the phones were trackable in a way they may not have suspected. The Constitution, however, does not protect their erroneous expectations regarding the undetectability of their modern tools.
The government used data emanating from Melvin Skinner’s pay-as-you-go cell phone to determine its real-time location. This information was used to establish Skinner’s location as he transported drugs along public thoroughfares between Arizona and Tennessee. As a result of tracking the cell phone, DEA agents located Skinner and his son at a rest stop near Abilene, Texas, with a motorhome filled with over 1,100 pounds of marijuana. The district court denied Skinner’s motion to suppress all evidence obtained as a result of the search of his vehicle, and Skinner was later convicted of two counts related to drug trafficking and one count of conspiracy to commit money laundering. The convictions must be upheld as there was no Fourth Amendment violation, and Skinner’s other arguments on appeal lack merit. In short, Skinner did not have a reasonable expectation of privacy in the data emanating from his cell phone that showed its location.
Citing Knotts, the opinion explains:
There is no Fourth Amendment violation because Skinner did not have a reasonable expectation of privacy in the data given off by his voluntarily procured pay- as-you-go cell phone. If a tool used to transport contraband gives off a signal that can be tracked for location, certainly the police can track the signal. The law cannot be that a criminal is entitled to rely on the expected untrackability of his tools. Otherwise,dogs could not be used to track a fugitive if the fugitive did not know that the dog hounds had his scent. A getaway car could not be identified and followed based on the license plate number if the driver reasonably thought he had gotten away unseen. The recent nature of cell phone location technology does not change this. If it did, then technology would help criminals but not the police. It follows that Skinner had no expectation of privacy in the context of this case, just as the driver of a getaway car has no expectation of privacy in the particular combination of colors of the car’s paint.
Lest you think this just applies to criminals, the court hastens to assure that the lack of expectation of privacy from government pings applies to us all. In a footnote, they write:
We do not mean to suggest that there was no reasonable expectation of privacy because Skinner’s phone was used in the commission of a crime, or that the cell phone was illegally possessed. On the contrary, an innocent actor would similarly lack a reasonable expectation of privacy in the inherent external locatability of a tool that he or she bought.
You can read the full opinion here.

(Related) Who was confused?
Sixth Circuit Rules That Pinging a Cell Phone to Determine Its Location is Not a Fourth Amendment “Search”
August 15, 2012 by Dissent
Orin Kerr offered some comments on yesterday’s opinion in U.S. v. Skinner, previously mentioned on this blog. Here’s part of his commentary:
1) Unless I’m just missing something obvious, the opinion seems pretty vague on the technological facts. The majority opinion initially says that the government obtained a court order ordering the cell phone company to release “cell site information, GPS real-time location, and ‘ping’ data” for the phone used by the suspect. It then says that the government tracked the suspect’s location by “pinging” the cell phone over three days. Later on, the majority opinion (and the concurrence) refers to the location information as “GPS location information.” But cell-cite information and GPS information are different, and “pinging” the cell phone could mean actively sending a request for cell-site data, actively sending a request for GPS data, or something else. So I’m a bit murky on the facts of what happened, which makes it hard to know what to make of the court’s analysis.
2) The murkiness of the facts are particularly unfortunate because the reasoning of the majority opinion relies heavily on cell phones broadcasting location information as just part of the way that they work. But if pinging the cell phone means actively sending a request to the phone to return its current GPS location, that’s not just how cell phones work: That’s the product of the cell phone provider setting up a mechanism by which the government can manipulate the phone into revealing its location. That seems to be a very different category of Fourth Amendment problem than a problem of how a technology “naturally” works.
Read more on The Volokh Conspiracy.


Beware who you “Friend?”
No Fourth Amendment violation when government looked at Facebook profile using friend’s account
August 14, 2012 by Dissent
Evan Brown writes:
U.S. v. Meregildon, — F.Supp.2d —, 2012 WL 3264501 (S.D.N.Y. August 10, 2012)
The government suspected defendant was involved in illegal gang activity and secured the assistance of a cooperating witness who was a Facebook friend of defendant. Viewing defendant’s profile using the friend’s account, the government gathered evidence of probable cause (discussion of past violence, threats, and gang loyalty maintenance) which it used to swear out a search warrant.
Read more about the case on Internet Cases.


Will the EU follow?
"The German Federal Court of Justice has ruled that ISPs have to turn over to rights-holders the names and addresses of illegal file sharers, but only 'if a judge rules that the file sharer indeed infringed on copyright,' said the court's spokeswoman, Dietlind Weinland. The ruling overturns two previous rulings by regional courts and is significant because the violation doesn't have to happen on a commercial scale, but applies whenever 'it is possible to know who was using an IP address at the time of the infringement,' the court said."


Is this another “all parties must consent” issue?
Former ACORN Worker Can Sue Right-Winger on Privacy Claim
August 14, 2012 by Dissent
Matt Reynolds reports:
A federal judge refused to throw out claims that a right-wing activist violated the privacy of an ACORN worker who was taped counseling defendant James O’Keefe, who sought advice on how to fill his house with underage prostitutes.
Juan Carlos Vera sued O’Keefe and his associate Hanna Giles in Federal Court on privacy claims, after O’Keefe secretly filmed Vera at an ACORN office in National City in 2009.
Read more on Courthouse News.


A little anti-social might be called for here... Similar to: “Attention all burglars: We're going to be out of town starting...”
Dell CEO’s Kid Overshares on Social Media
The twitter account for Alexa Dell, daughter of Dell founder Michael Dell, has been deactivated following security concerns prompted by her detailed account of the family’s whereabouts.
The security of the CEO, who expects to spend $2.7 million in 2012 t0 keep his family safe, came under question after an photo of Zachary Dell was posted by his sister Alexa on photo-sharing app Instragram, according to Bloomberg Businessweek
The teenager shared a photo of Zachary devouring cuisine in a private plane on a trip to Fiji. But, that’s not all, the magazine reported. Like millions of others who use social network sites, she would often-times detail the time, date and location of many events attended by the family, including trips to New York City and a high school graduation dinner, according to Bloomberg Businessweek.


Testing software should mean you test all of it. (This somewhat conflicts with earlier reports) And running new or old software, you should always know what is happening and which program does what.
New submitter alexander_686 points out a Bloomberg article about the cause of Knight Capital Group's $440 million algorithmic trading disaster from a couple weeks ago. The report says a dormant software system was accidentally activated on August 1, which immediately began increasing stock trade volumes by a factor of 1,000. The Wall Street Journal has further details:
"Knight Capital Group Inc.'s accidental trades earlier this month were triggered by a flawed upgrade of trading software that caused an older trading system connected to the computer code to inadvertently go 'live' on the market, according to people familiar with the matter. The errors at Knight on Aug. 1 involved new code the Jersey City, N.J.-based brokerage designed to take advantage of the launch of a New York Stock Exchange trading program, which was introduced that day to attract more retail-trading business to the Big Board, the people say. ... When NYSE Euronext trading floor officials called Knight at about 9:35 a.m. to try to pinpoint the cause of unusual swings in dozens of stocks, just after the Big Board opened for trading, Knight traders and their supervisors had a difficult time detecting where in its systems the problem was located, say people familiar with the morning's events. The NYSE had to call Knight several times before deciding to shut the firm off, the people say."

Tuesday, August 14, 2012

Phil does good software. Adding the Seals is interesting, but probably not significant. Perhaps they could market to law firms for client communications?
Email Privacy Pioneer Launches Silent Circle To Protect Mobile, Internet Calls
August 14, 2012 by Dissent
An Internet privacy veteran and inventor of a popular email encryption scheme is launching a suite of new products next month that will allow people to scramble their mobile phone calls, e-mails, text messages and Internet voice and video calls.
Phil Zimmermann, creator of the standard email encryption known as PGP, which stands for ‘Pretty Good Privacy’, will roll out the private, encrypted communications tools on September 17 through his company, Silent Circle.
The software will be available for download to iPhones, Androids, desktops and laptops worldwide, and will give customers the ability to scramble their mobile and Internet voice calls and messages, including those conducted via Skype and FaceTime.
Read more on RedOrbit.


No mention of the resolution of the 'excessive force' claim. If the quotes were published in a newspaper article there would have been no violation (and everyone could claim they were mis-quoted) Would this also apply to a live TV interviewer asking the same questions? (Perhaps answering with a camera in your face is “consent?”)
Anatomy of a Privacy Victim
August 14, 2012 by Dissent
Stewart Baker writes:
Adam Mueller, a police-the-police campaigner, has been convicted and sentenced to three months in jail for recording and posting telephone conversations with a police captain, a high school principal and a school secretary in Manchester, NH. Mueller was calling for comment on a student’s cell phone video allegedly showing a Manchester officer using excessive force. The conviction has led to sympathetic coverage in both the left and right blogospheres.
But one point hasn’t gotten much coverage. It turns out that Mueller was convicted of violating a privacy law.
He had recorded a conversation “without the consent of all parties to the communication,” a violation of NH 570-A:2. New Hampshire is one of about a dozen “all party consent” states.
Read more on The Volokh Conspiracy

(Related) Another pesky Privacy law
By Dissent, August 14, 2012
Rich Daly reports:
Strong state privacy laws continue to complicate health information exchanges’ efforts to ease health-data sharing, a senior federal health technology official said Monday. And a key to overcoming such obstacles may be greater use of meta tags.
Joy Pritts, chief privacy officer in the Office of the National Coordinator for Health Information Technology, told a Washington health policy gathering that some health information exchanges are not accepting electronic health records containing mental health or substance-abuse data. Their refusal stems from concerns that certain state medical privacy laws that are more strict than federal law and require individual patient agreement before their data is shared preclude exchanges’ use of the information.
The proposed solution – meta-tagging sensitive elements and requiring patient permission to open the protected elements – may not be an adequate solution, however. In the last few years, we have seen all too many hacks of data that custodians may have believed were secure. As long as the sensitive data are embedded, they will be at some level of risk of acquisition and viewing by unauthorized individuals.
Read more on Modern Healthcare (free subscription required)


Perhaps the law does apply to Hulu
Hulu’s attempt to dismiss privacy lawsuit fails
August 13, 2012 by Dissent
Hulu’s attempt to dismiss a consolidated class action complaint alleging violations of the Video Privacy Protection Act (VPPA) failed when federal Magistrate Judge Laurel Beeler denied their motion on Friday.
The lawsuit (previous coverage) is one of a few that were filed over the use of re-spawning cookies (“supercookies”). In this case, the plaintiffs allege that their personally identifiable information was shared, without their knowledge or consent, with third parties that included online ad networks, metrics companies,and social networks such as Scorecard Research (“Scorecard”), Facebook, DoubleClick, GoogleAnalytics, and QuantCast.
Hulu’s arguments – all of which were rejected by the court – claimed that the plaintiffs did not have standing, a streaming service was not covered by the VPPA, and even if it was, the sharing of data was part of the firm’s “usual course of business,” and hence, did not violate the Act.
Their motion to dismiss also argued that the plaintiffs were not paid “subscribers” to their service. The VPPA talks about “consumers,” defined as renters, purchasers, or subscribers. Hulu argued – unsuccessfully – that the term “subscriber” should involve some payment, and since the plaintiffs hadn’t paid anything, they had no standing. The court disagreed.
In September 2011, Congressmen Markey and Barton asked the FTC to investigate the use of re-spawning cookies as a deceptive and unfair practice under the FTC Act. The FTC, however, has not taken any action that has been made public as of this date. .
In light of Hulu’s failure to get a dismissal of the lawsuit, can a settlement be far behind?


The tools of Big Brother
Big Brother is watching UAE’s kids: National ID cards roll-out
August 13, 2012 by Dissent
Emirati and expatriate children under the age of 15 across the country have to register for a national ID card by September 30 to avoid fines. There is however an exception for expatriate children whose visa is set to expire later this year…. Except the two exempted categories, most UAE residents have already registered for national ID cards, Al Khoury said. “About 95 per cent of the population has already registered as the deadline for all other categories has ended,” he said.
Read more on Albawaba.


We can, therefore we must?
Scottish police have snooped on emails and calls 85,000 times in the last five years
August 13, 2012 by Dissent
Mark Aitken reports:
Scots police have secretly accessed people’s private email and phone records more than 85,000 times in the last five years.
But each application to telecom firms for the information can contain requests for several different individuals, so the true scale of the scrutiny is far greater.
Northern Constabulary, who serve a population of 300,000, made more than 20,000 snooping applications – roughly one for every 15 people in the area.
Yesterday, one civil liberties campaigner warned Scotland was moving towards the same levels of surveillance as China and Iran.
Read more on Daily Record.


An argument we will have here in the US
Australian Privacy Foundation slams privacy amendments
August 13, 2012 by Dissent
Chris Jager reports:
The Australian Privacy Foundation (APF) has slammed the Federal Government’s proposed amendments to privacy legislation as a “lost opportunity” in improving areas such as credit reporting practices and protection from data off-shoring.
APF board member Nigel Waters told a Senate inquiry late last week that the proposed bill would “significantly weaken” privacy protections for Australians.
The amendments would introduce a new set of privacy principles aimed at improving practices within both Government and the private sector, while providing the Privacy Commissioner with new powers, and the ability to fine companies up to $1.1 million for repeated breaches of the law.
However, Waters criticised the proposed amendments for further complicating aspects of the privacy regime, stating the act would fail to meet current international best practice standards.
Read more on ITnews.


“Can't tell your claims without a scorecard!” (I still don't get it.)
All of Apple's patent claims against Samsung in one chart


Problems are inevitable, so we might as well create a few “I told ya so” articles
FAA Documents Raise Questions About Safety of Drones in U.S. Airspace


Good managers find enabling lawyers – the other kind are a dime a dozen. (It's much easier to say, “You can't do that!” than it is to say, “Here's what you must do before you do that.”)
"In the documentary Scared Straight! a group of inmates terrify young offenders in an attempt to 'scare them straight'" (hence the show's title) so that those teenagers will avoid prison life. A 2002 meta-analysis of the results of a number of scared straight and similar intervention programs found that they actively increased crime rates, leading to higher re-offense rates than in control groups that did not receive the intervention. For those considering the use of social media in their business, it is quite easy to read Navigating Social Media Legal Risks: Safeguarding Your Business as a scared straight type of reference. Author Robert McHale provides so many legal horror stories, that most people would simply be too afraid of the legal and regulatory risks to every consider using social media."
Keep reading for the rest of Ben's review.


Perspective (and it's not like they have just one) What other industries will need data centers of this scale?
"JPMorgan Chase spends $500 million to build a data center, according to CEO Jamie Dimon. That figure places the firm's facilities among the most expensive in the industry, on a par with investments by Google and Microsoft in their largest data centers. Dimon discussed the firm's IT spending in an interview in which he asserts that huge data centers are among the advantages of ginormous banks. Dimon also offered a vigorous defense of the U.S. banking industry. 'Most bankers are decent, honorable people,' Dimon says. 'We're wrapped up in all this crap right now. We made a mistake. We're sorry. It doesn't detract from all the good things we've done. I am not responsible for the financial crisis.'"


The strait is a mere 21 miles wide, the channel much narrower, but you would think that a 333meter long tanker would be noticed even at night. The Porter at 154 meters should be agile enough to avoid the tanker. So what really happened?
US Navy ship collides with oil tanker in Gulf
DUBAI, United Arab Emirates — A U.S. Navy guided missile destroyer was left with a gaping hole on one side after it collided with an oil tanker early Sunday just outside the strategic Strait of Hormuz.
The collision left a breach about 10 feet by 10 feet (three by three meters) in the starboard side of USS Porter. No one was injured on either vessel, the U.S. Navy said in a statement.
The collision with the Panamanian-flagged and Japanese-owned bulk oil tanker M/V Otowasan happened about 1 a.m. local time.


For my Ethical Hackers.
"NASA's Curiosity rover has now been on the surface of Mars for just over a week. It hasn't moved an inch after landing, instead focusing on orienting itself (and NASA's scientists) by taking instrument readings and snapping images of its surroundings. The first beautiful full-color images of Gale Crater are starting to trickle in, and NASA has already picked out some interesting rock formations that it will investigate further in the next few days. Over the weekend and continuing throughout today, however, Curiosity is attempting something very risky indeed: A firmware upgrade. This got me thinking: If NASA can transmit new software to a Mars rover that's hundreds of millions of miles away... why can't a hacker do the same thing? In short, there's no reason a hacker couldn't take control of Curiosity, or lock NASA out. All you would need is your own massive 230-foot dish antenna and a 400-kilowatt transmitter — or, perhaps more realistically, you could hack into NASA's computer systems, which is exactly what Chinese hackers did 13 times in 2011."


Perspective and a case study for my Business Continuity students. Be careful who you annoy..
WikiLeaks endures a lengthy DDoS attack
… "The attack is well over 10Gbits/second sustained on the main WikiLeaks domains," read one of several tweets the organization posted on Friday. "The bandwidth used is so huge it is impossible to filter without specialized hardware, however... the DDoS is not simple bulk UDP or ICMP packet flooding, so most hardware filters won't work either. The range of IPs used is huge. Whoever is running it controls thousands of machines or is able to simulate them."


It's no longer a few wax cylinders... With a Google account (and audio & video gear) I could stream seminars to a global audience.
Google Nerds Request Entry to Your Rock Concert
The internet has revolutionized the distribution of music over the past 15 years, but the staging of big concerts and smaller live shows has remained steadfastly analog. Musicians who worried that tools like Napster and BitTorrent undermined their livelihoods could take solace in the notion that they’d still make money off ticket sales.
But today Google launched a feature that could be hugely disruptive to the concert business. You wouldn’t necessarily know it from its complicated title — Google+ Hangouts On Air Studio Mode — but the new feature finally takes live concert streaming from an occasional internet curiosity requiring big-company expertise to something any band can do.
By making it easier to stage live shows for far-flung fans, Google will change the music business in ways that are hard to predict. Clearly, established artists will still be able to charge for live, face-to-face shows — a video conference might be better than no concert, but it’s not yet a substitute for the real thing. At the same time, Google’s mass video conferences can open doors. At least one artist is already saying she’s found stardom through a precursor to Google+ Hangouts On Air Studio Mode that launched four months ago.


Is this the new Yahoo?
Yahoo unveils #HashOut, a social media talk show
As a slew of Internet companies have started creating their own content, Yahoo is also getting in the game.
The Web pioneer announced today that it is working on a social media talk show called #HashOut with some big-hitter names like Arnold Schwarzenegger's ex-wife and journalist Maria Shriver, Princeton professor Anne-Marie Slaughter, "Lost" co-creator Damon Lindelof, and more.
Yahoo is deeming the show as "a new way to talk about the news," and says that it is also "the first talk show conducted over social media."

Monday, August 13, 2012

I'm sure it's not because “We don't want to start that debate before the election.” It must be because of a technical glitch, even if we have to create the glitch ourselves... Perhaps it just expired and we need to start another?
"The Electronic Privacy Information Center posted a brief and detailed notice about the removal of a petition regarding security screenings by the TSA at US airports and other locations. 'At approximately 11:30 am EDT, the White House removed a petition about the TSA airport screening procedures from the White House 'We the People' website. [now “We the second class People” Bob] About 22,500 of the 25,000 signatures necessary for a response from the Administration were obtained when the White House unexpectedly cut short the time period for the petition. The site also went down for 'maintenance' following an article in Wired that sought support for the campaign."

(Related) It has nothing what-so-ever to do with Security Theater that costs more that a Broadway show.
JFK's $100M security system breached
A man on a personal watercraft who became stranded in a New York bay easily breached Kennedy Airport's security system by walking undetected through two runways and into a terminal.
The New York Post reports that the 31-year-old man swam to a Jamaica Bay shore and then walked past motion sensors and closed-circuit cameras of the airport's state-of-the-art Perimeter Intrusion Detection System. The $100 million system is meant to safeguard against terrorists.
The man climbed an 8-foot-tall perimeter fence and made his way to Terminal 3.
He approached a Delta Airlines worker, who alerted authorities.
The Port Authority of New York and New Jersey is investigating. The agency says it plans to meet with the security system's maker this week.


So IP lawyers, is this how it should be done?
"New research (PDF) shows that Intellectual Ventures is tied to at least 1,300 shell companies whose sole purpose is to coerce real companies into buying patent license that they don't want or need. Those who resist the "patent trolls" are dragged into nightmarish lawsuits."


Why secret? By now even the terrorists must know we're there. Are we doing something that citizens would not like? (Unlikely, Romney would jump on that) So it must be that the CIA is running the drones, and they won't talk about anything. (Why doesn't that make me all warm an fuzzy?)
Hidden History: America’s Secret Drone War in Africa
More secret bases. More and better unmanned warplanes. More frequent and deadly robotic attacks. Some five years after a U.S. Predator Unmanned Aerial Vehicle flew the type’s first mission over lawless Somalia, the shadowy American-led drone campaign in the Horn of Africa is targeting Islamic militants more ruthlessly than ever.
Thanks to media accounts, indirect official statements, fragmentary crash reports and one complaint by a U.N. monitoring group, we can finally begin to define — however vaguely — the scope and scale of the secret African drone war.
The details that follow are in part conjecture, albeit informed conjecture. They outline of just one of America’s ongoing shadow wars — and one possible model for the future U.S. way of war. Along with the counterterrorism campaigns in Pakistan, Yemen and the Philippines, the Somalia drone war demonstrates how high-tech U.S. forces can inflict major damage on America’s enemies at relatively low cost … and without most U.S. citizens having any idea it’s even happening.


Why we need Data Mining (to find relevant data) and Data Analytics (to make sense of what we find)
August 12, 2012
The Problem of Data - Council on Library and Information Resources
The Problem of Data, Lori Jahnke and Andrew Asher, Spencer D. C. Keralis with an introduction by Charles Henry. August 2012. CLIR Pubublication No. 154. “Every day, we create 2.5 quintillion bytes of data—so much that 90% of the data in the world today has been created in the last two years alone.” IBM, Bringing Big Data to the Enterprise
  • This extraordinary and often cited statistic is an apt quantitative introduction to our technological era, increasingly referred to as the era of Big Data. The massive scale of data creation and accumulation, together with the increasing dependence on data in research and scholarship, are profoundly changing the nature of knowledge discovery, organization, and reuse. As our intellectual heritage moves more deeply into online research and teaching environments, new modes of inquiry emerge; digital data afford investigations across disciplinary boundaries in the sciences, social sciences, and humanities, further muddling traditional boundaries of inquiry. Jahnke and Asher explore workflows and methodologies at a variety of academic data curation sites, and Keralis delves into the academic milieu of library and information schools that offer instruction in data curation. Their conclusions point to the urgent need for a reliable and increasingly sophisticated professional cohort to support data-intensive research in our colleges, universities, and research centers."

(Related) Never ever analyze data in isolation (or by pre-defining a target group based on your perceptions and assumptions)
August 12, 2012
Big Data, Big Impact: New Possibilities for International Development
Big Data, Big Impact: New Possibilities for International Development: "The amount of data in the world is exploding - large portion of this comes from the interactions over mobile devices being used by people in the developing world - people whose needs and habits have been poorly understood until now. Researchers and policymakers are beginning to realize the potential for channeling these torrents of data into actionable information that can be used to identify needs & provide services for the benefit of low-income populations. This discussion note is a Call-to-action for stakeholders for concerted action to ensure that this data helps the individuals and communities who create it."

Sunday, August 12, 2012

Congress will ignore this, perhaps because no one in their offices speaks Australian?
"Australian Attorney-General Nicola Roxon has been forced to back down on her government's unpopular plan to force ISPs to store the web history and social networking of all Australians for two years. The plan has been deeply unpopular with the public, with hackers attacking the government's spy agency. Public servants at the spy agency promoting the scheme been scathing of the government, saying: 'These reforms are urgently needed to deal with a rapidly evolving security environment, but there isn't much appetite within the government for anything that attracts controversy,' but a document on the scheme released under the Freedom of Information Act had 90% of it redacted to prevent "premature unnecessary debate." Roxon hasn't dropped the unpopular scheme entirely, but only delayed it until after the next election."


Much more on the Google “settlement” What's really going on here?
In the wake of FTC settlements, confusion and dissent remain
August 11, 2012 by Dissent
In a somewhat frustrating Twitter chat following the Google settlement, one of the first questions – tweeted by Berin Szoka of TechFreedom – was, “How can message sent by today’s ruling be “clear” when there’s no admission of liability?” It was a question that had also been raised by one commissioner who had dissented from the settlement, J. Thomas Rosch. In his dissent, Rosch wrote, in part:
First, the Stipulated Order for Permanent Injunction and Civil Penalty Judgment provides that “Defendant denies any violation of the FTC Order, any and all liability for the claims set forth in the Complaint, and all material allegations of the Complaint save for those regarding jurisdiction and venue.” Yet, at the very same time, the Commission supports a civil penalty of $22.5 million against Google for that very same conduct. Condoning a denial of liability in circumstances such as these is unprecedented.
[More...]


Tech has been doing some interesting stuff...
"A new malware intelligence system developed at Georgia Tech Research Institute is helping organizations share threat intelligence and work together to understand malware and cyber attacks. Dubbed "Titan", the system lets members submit threat data and collaborate on malware analysis and classification. Unlike some other systems, members contribute data anonymously so no one would know which specific organizations had been affected by a specific attack. Titan users also get reports on malware samples they have submitted, such as the potential harm, the likely source, the best remedy, and the risks posed by the sample. The analysis is based on what GTRI researchers learn by reverse-engineering the malware. The project currently analyzes and classifies an average of 100,000 pieces of malicious code each day and growing. While other information sharing initiatives have been launched, many are by vendors, which sometimes sparks concern that the vendor may have some bias, and may be pushing a certain product. Not the case with Titan."


No longer a “fringe” event.
It seems to be the new trend in schools and companies all across the world – BYOD.
… The advantages to coming to class or to the office with your own laptop or tablet (for example) are obvious. It’s yours, you’ve customized the hell out of it, and you have the entire discography of Guns n’ Roses burned to MP3 on the hard drive. Plus you’re more likely to have Windows 7 while the poor secretary in the corner is struggling with Windows 98. But then there’s the cons – theft, damage, incompatibility with colleagues devices, hooking up to the inept company network and getting a virus, and worst of all, your colleagues seeing your Kylie Minogue desktop wallpaper.
Our infographic today is on the subject of BYOD. Do you bring your own device to school or work? If so, what are the pros and cons for you?