Thursday, November 15, 2012

“We are completely incompetent when it comes to Computer Security and we always will be.” NOTE: I searched http://www.mandiant.com/ for information on “the Hand” but found none. Must be new or top secret or imaginary...
Haley: SCDOR hacking may not have been preventable
Gov. Nikki Haley says new layers of security are being added in the wake of a massive security breach, but she said at a news conference Wednesday that even with what is now known, there is "no way to say it could have been prevented."
The massive security breach at the South Carolina Department Revenue could earn the hackers as much as $360 million by using just 1 percent of the affected taxpayers returns, the State newspaper is reporting. [Equally fantastic... Bob]
… Investigators believe that a hacker tricked someone at the Department of Revenue into opening a file that gave the hacker access to the system. [the Password file? Bob]
At the news conference, Haley said that she has issued a second executive order that calls for cabinet agencies to be monitored 24-7. The monitoring will require the addition of four fulltime employees, with the cost of their salaries split by five cabinet agencies.
She said another layer of security will be provided by a piece of equipment called The Hand that is being purchased from the computer forensics and security company Mandiant at a cost of $160,300. She said the Hand will detect any movement of large files and will shut any effected machines down immediately and contact Department State Information Technology.
… DSIT will also monitor traffic patterns in real time to be sure no data is taken from the network.


This letter certainly comes with an abundance of something, but it doesn't smell like caution.
Delayed breach notification letter from law firm raises more questions than it answers
November 14, 2012 by admin
Here’s another notification letter submitted to the California Attorney General’s Office that left me scratching my head. It’s from the law firm of Sprechman & Associates, P.A. in Miami, a firm that specializes in collections. My comments and questions are inserted in italics:
Dear XXXXXX:
I am writing to advise you that your personally identifiable information (“Information”) may have been viewed by a former employee of Sprechman & Associates without permission. Specifically, the former employee may have viewed your name, address, date of birth, driver’s license number, and/or social security number.
“May have?” Why don’t you know? Don’t you maintain logs?
Sprechman & Associates learned of this incident in July 2012, but was unable to notify you until now because notification at that time may have interfered with a law enforcement investigation and the best known contact information for potentially affected individuals was not known until October 2012. [Why would that be? Bob]
How did you learn of it? And when did the improper access occur, if it occurred? How long was this problem going on for? Was there any indication of misuse of anyone’s information? Did law enforcement actually ask you not to disclose this sooner or did you just make that decision on your own? If they asked you to delay notification, when did they tell you that you could go ahead and notify?
Although we cannot be sure that your Information was in fact used in an inappropriate manner, in an abundance of caution we are informing you that such viewing of your information may have occurred.
What Information May Have Been Viewed, When and By Whom?
One of our employees may have performed unauthorized searches on you. This information may have included your name, address, date of birth, driver’s license number, and social security number. We are advising you of this matter in an abundance of caution, but we stress that we cannot be sure that your Information was in fact used in an inappropriate manner. In fact, we cannot even be sure that your Information was actually viewed, but we are providing this notice out of an abundance of caution.
You can’t be sure it was viewed and/or misused, but you can’t be sure it wasn’t viewed and/or misused, right? So why aren’t you offering free credit protection and restoration services?
How Have We Responded to This Issue
Nonetheless, we certainly understand that this may be cause for concern. Additional information and support resources are available through the non-profit Identity Theft Resource Center at www.idtheftcenter.org, by calling (858) 693-7935, or via e-mail at itrc@idtheftcenter.org.
Other Steps You Can Take:
[...]
So you haven’t actually done anything to respond to this issue other than notify law enforcement and send out this notification letter? How about hardening your security and access to records? How about improving auditing so you can tell who’s accessed what? How about offering affected individuals some services?
If the law firm would like to provide additional information, I’ll be happy to post it or update this entry, but overall, I find their notification and response inadequate. They do provide a phone number to call if recipients have questions, but the letter isn’t even signed by an individual – only by “Notice Department.”


For the new generation, it's not really war, it's a video game.
Israel Kills Hamas Leader, Instantly Posts It to YouTube
The Israel Defense Forces didn’t just kill Hamas military leader Ahmed al-Jabari on Wednesday as he was driving his car down the street in Gaza. They killed him and then instantly posted the strike to YouTube. Then they tweeted a warning to all of Jabari’s comrades: “We recommend that no Hamas operatives, whether low level or senior leaders, show their faces above ground in the days ahead.”
The Jabari hit is part of the biggest assault the IDF has launched in more than three years on Gaza, with more than 20 targets hit. And it’s being accompanied by one of the most aggressive social media offensives ever launched by any military. Several days before Jabari’s elimination, the IDF began liveblogging the rocket attacks on southern Israel coming from Gaza. Once “Operation Pillar of Defense” began, the IDF put up a Facebook page, a Flickr feed, and, of course, a stream of Twitter taunts — all relying on the same white-on-red English-language graphics. “Ahmed Jabari: Eliminated,” reads a tweet from 2:21 p.m. Eastern time on Wednesday.

(Related) What are the rules here? I can see keeping HOW we will respond secret, but we should be announcing (not leaking) that we WILL respond.
Obama signs secret directive to help thwart cyberattacks
President Obama has signed a secret directive that effectively enables the military to act more aggressively to thwart cyber attacks on the nation’s web of government and private computer networks.
Presidential Policy Directive 20 establishes a broad and strict set of standards to guide the operations of federal agencies in confronting threats in cyberspace, according to several U.S. officials who have seen the classified document and are not authorized to speak on the record. The president signed it in mid-October.
… An example of a defensive cyber-operation that once would have been considered an offensive act, for instance, might include stopping a computer attack by severing the link between an overseas server and a targeted domestic computer. [That's nonsense, unless the severing is done with explosives on foreign soil. Bob]
“That was seen as something that was aggressive,” said one defense official, “particularly by some at the State Department” who often are wary of actions that might infringe on other countries’ sovereignty and undermine U.S. advocacy of Internet freedom. Intelligence agencies are wary of operations that may inhibit intelligence collection. The Pentagon, meanwhile, has defined cyberspace as another military domain — joining air, land, sea and space — and wants flexibility to operate in that realm.
… But repeated efforts by officials to ensure that the Cyber Command has that flexibility have met with resistance — sometimes from within the Pentagon itself — over concerns that enabling the military to move too freely outside its own networks could pose unacceptable risks. A major concern has always been that an action may have a harmful unintended consequence, such as shutting down a hospital generator.
… Officials say they expect the directive will spur more nuanced debate over how to respond to cyber-incidents. That might include a cyberattack that wipes data from tens of thousands of computers in a major industrial company, disrupting business operations, but doesn’t blow up a plant or kill people.
The new policy makes clear that the government will turn first to law enforcement or traditional network defense techniques before asking military cyberwarfare units for help or pursuing other alternatives, senior administration officials said.


Looks like things are back to normal in New Jersey for at least one group. I wonder what the “It fell off-a da truck” price will be?
Thieves Grab 3,600 iPad Minis Worth $1.5M In JFK Airport Heist
Apple’s iPad mini seems to be a success, and that has attracted the criminal element’s attention. According to the New York Post, a shipment of Apple’s iPad mini, numbering 3,600 devices and with a total value of $1.5 million, was taken from JFK airport from the same location that a group stole $5 million in cash and $900,000 in jewelry in 1978. [Now we can film “i-Goodfellas” the sequel Bob]


Probably not going to happen.
Investigate the FBI
November 15, 2012 by Dissent
Trevor Timm of EFF has a great commentary on the FBI investigation that mushroomed and mushroomed and mushroomed. Here’s a snippet:
Congress is now demanding to know why it wasn’t informed by the Justice Department about the details of the Petraeus affair earlier. Lawmakers should instead be worried about why the public was informed of these details at all, given that no crime was committed. And instead of investigating one man’s personal life, they should investigate how to strengthen our privacy laws so this does not happen to anyone else.
The U.S. government has so far been unable to keep its colossal surveillance state in check. Now that it is so bloated it is eating itself, one hopes more people will finally pay attention.
Read more on ForeignPolicy.com.
Not only does Congress need to investigate what happened, but the DOJ OIG needs to investigate this and issue a report to the public promptly. Did the FBI act lawfully at all times or did they misuse their tools and authority? How does a complaint by someone about a few mean emails – which may be protected speech and not criminal at all – result in an investigation that looks into the communications between a ranking general and others? If it’s not even clear any crime was committed, should our government be able to snoop so extensively without judicial oversight? If a court granted the FBI a warrant, well, to be blunt, what the hell was the judge thinking or what was the judge told to justify the privacy invasion?
Trevor emphasizes the fact that the public never should have been told about this investigation at all. It’s a fair point, but would we really rather not know that our government can do these things to us?
Some of us have been saying for years that ECPA needs to be updated and more privacy protections need to be incorporated. Some of us have also been saying for years that providers need to shorten their data retention periods. If you don’t retain it, the FBI can’t get it from you. NOW will you listen to us? How many more lives or careers will be ruined until Congress and providers take steps to genuinely protect the privacy of our electronic communications?


Reporting on their grasp of the obvious? I remember a Great Aunt telling me about soldiers guarding at each bridge along a minor spur railroad in central New Jersey. Perhaps this would be a job stimulus if we let the TSA provide similar security for pipelines and the power grid?
November 14, 2012
Terrorism and the Electric Power Delivery System
"The electric power delivery system that carries electricity from large central generators to customers could be severely damaged by a small number of well-informed attackers. The system is inherently vulnerable because transmission lines may span hundreds of miles, and many key facilities are unguarded. This vulnerability is exacerbated by the fact that the power grid, most of which was originally designed to meet the needs of individual vertically integrated utilities, is being used to move power between regions to support the needs of competitive markets for power generation. Primarily because of ambiguities introduced as a result of recent restricting the of the industry and cost pressures from consumers and regulators, investment to strengthen and upgrade the grid has lagged, with the result that many parts of the bulk high-voltage system are heavily stressed. Electric systems are not designed to withstand or quickly recover from damage inflicted simultaneously on multiple components. [New Jersey found that out recently... Bob] Such an attack could be carried out by knowledgeable attackers with little risk of detection or interdiction. Further well-planned and coordinated attacks by terrorists could leave the electric power system in a large region of the country at least partially disabled for a very long time. Although there are many examples of terrorist and military attacks on power systems elsewhere in the world, at the time of this study international terrorists have shown limited interest in attacking the U.S. power grid. However, that should not be a basis for complacency. Because all parts of the economy, as well as human health and welfare, depend on electricity, the results could be devastating. Terrorism and the Electric Power Delivery System focuses on measures that could make the power delivery system less vulnerable to attacks, restore power faster after an attack, and make critical services less vulnerable while the delivery of conventional electric power has been disrupted."


Anyone taking bets? I imagine each discovery request would want “each and every contact” with everyone involved. Should make for lots of jobs for my Data Mining students...
"The Salt Lake Police department will be much more transparent with their law enforcement. A program is being rolled out to require officers wear glasses equipped with a camera to record what they see. Of course, there are several officers opposed to this idea, who will resist the change. One of the biggest shockers to me is that the police chief is in strong support of this measure: 'If Chief Burbank gets his way, these tiny, weightless cameras will soon be on every police officer in the state.' With all the opposition of police officers being recorded by citizens that we are seeing throughout the country, it is quite a surprise that they would make a move like this. The officers would wear them when they are investigating crime scenes, serving warrants, and during patrols. Suddenly Utah isn't looking like such a bad place to be. Now we just need to hope other states and departments would follow suit. It sure will be nice when there is video evidence to show the real story."


It's not only the Air Force that trys to do everything is one “swell foop.” This is much too large a project to control. What do they actually need that could be developed in six months or less?
"The U.S. Air Force has decided to scrap a major ERP (enterprise resource planning) software project after spending $1 billion, concluding that finishing it would cost far too much more money for too little gain. Dubbed the Expeditionary Combat Support System (ECSS), the project has racked up $1.03 billion in costs since 2005, 'and has not yielded any significant military capability,' an Air Force spokesman said in a statement. 'We estimate it would require an additional $1.1B for about a quarter of the original scope to continue and fielding would not be until 2020. The Air Force has concluded the ECSS program is no longer a viable option for meeting the FY17 Financial Improvement and Audit Readiness (FIAR) statutory requirement. Therefore, we are canceling the program and moving forward with other options in order to meet both requirements.'"


Perspective
… Numbers wise, in the third quarter of this year, mobile phone owners sent an average of 678 texts per month, which is down from 696 texts a month in the previous quarter. This isn’t a huge decline, but it’s the first ever decline that has been recorded. And it’s not a big concern for users, and it’s also not a big deal for carriers, since a bulk of their revenue comes from data plans.


I use LightShot myself, but each App is slightly different so you have to try them to see which “feel” best...
ScreenSnag is a downloadable desktop application that lets you easily take a photo of your computer screen. You can capture an an entire screen, region of the screen, a window, or an element on the window with single hotkey or a click.
It has a Timer option to perform screen captures at your defined intervals. It has many configuration settings depending on the situation. Save different settings’ combinations into profiles for quicker access later on.
To see all the available features of the app, download it for free from their website.
Similar tools: ImageSnatcher, Snaggy and CloudShot.


Pinterest with a focus?
Wednesday, November 14, 2012
Learnist Now Allows You to Register With Email
Learnist, which I've described in the past as Pinterest for learning, announced today that you no longer have to use Facebook or Twitter to register and use their service. You can now register for and use Learnist with an email account. The service is still available only to people who request a beta invite, but it seems that beta invites come quickly.
… Learnist provides another professional learning community in which you collaborate on the collation of resources that are beneficial to you and your students.


One of my smarter friends (Dr. Michelle Post) just published a couple of eBooks. I expect she'll be writing one a week soon.
Heaven Has Tea Parties, http://www.amazon.com/dp/B00A78LD2E, is about the loss of my mother and God's healing in this loss. All proceeds from the sale of the book will be donated to the American Parkinson Disease Association in memory of my mother, Annie.
Building Your Adjunct Platform, http://www.amazon.com/dp/B00A7HDV6Q, is a "how to" book for anyone looking to become a college/university Adjunct Instructor.

Posted by at No comments:

Wednesday, November 14, 2012

Another example for my compilation of “Worst Practices” And I think I'll file this one under “It's not rocket science!”
Agencywide Message to All NASA Employees: Breach of Personally Identifiable Information
November 13, 2012 by admin
SpaceRef posted a breach notification from NASA, dated today:
On October 31, 2012, a NASA laptop and official NASA documents issued to a Headquarters employee were stolen from the employee’s locked vehicle. The laptop contained records of sensitive personally identifiable information (PII) for a large number of NASA employees, contractors, and others. Although the laptop was password protected, it did not have whole disk encryption software, which means the information on the laptop could be accessible to unauthorized individuals. We are thoroughly assessing and investigating the incident, and taking every possible action to mitigate the risk of harm or inconvenience to affected employees.
Read more on SpaceRef.


So, who tested this “Feature” and pronounced it secure?
A Skype security flaw could allow rogue users to seize control of your account using nothing more than your email address, thanks to subpar recovery policies that can be easily gamed. The exploit depends on Skype’s policy of reminding new sign-ups of any existing usernames they have previously registered, when they attempt to re-register using the same email address. According to The Next Web, with a minor amount of tinkering, it’s possible to reset another user’s password and thus grab hold of their account.
… Skype is apparently conducting an “internal investigation” into the loophole, though for now there’s no official comment on when it might be closed off. The hack was first reported on a Russian forum roughly two months ago, it’s said, with the person responsible for discovering the exploit claiming to have told Skype about it with no apparent change in recovery security.


So the 1.7 million voter database WAS exposed, but it's no big deal. (Unless it exposes all the dead or fictional voters?)
Chicago election site exposed personal information
November 13, 2012 by admin
John Byrne and Hal Dardick report:
Chicago election board officials confirmed Tuesday that sensitive personal information for about 1,200 people was exposed online but denied allegations by a computer security firm that the breach was much broader.
The firm, Forensicon, announced it uncovered the problem while researching voting patterns. It alleged that personal information of up to 1.7 million registered Chicago voters was exposed on the website of the Chicago Board of Elections Commissioners.
An election board spokesman accused the firm of overplaying the problem. James Allen said the database of 1.7 million registered voters included no personal information beyond what is already public record—name, address and voter registration number. “Anyone can request that information from us, and we have to produce it,” Allen said. “There’s absolutely no sensitive information there.”
However, Allen said due to a mistake by the election authority, another database was inadvertently exposed online with names, addresses, drivers license numbers and the last four digits of social security numbers for around 1,200 people who had applied to work for the board in Chicago polling places on Election Day.
Read more on Chicago Tribune.


For my Computer Security students. Attach articles like this (with appropriate highlighting) to your resume when you submit it...
"A chilling article by Darkreading's Kelly Jackson Higgins describes how the growing accessibility of hacking tools like RATs (Remote Access Trojans) have made cyber-espionage possible for more than just those financially backed by large nation-states, and speculates on what the implications of this may be: 'Researchers at Norman Security today revealed that they recently analyzed malware used in phishing emails targeting Israeli and Palestinian targets and found that attackers used malware based on the widely available Xtreme RAT crimeware kit. The attacks, which first hit Palestinian targets, this year began going after Israeli targets, including Israeli law enforcement agencies and embassies around the world. Norman says the same attacker is behind the attacks because the attacks use the same command-and-control (C&C) infrastructure, as well as the same phony digital certificates. This attack campaign just scratches the surface of the breadth and spread of these types of attacks around the world as more players have been turning to cyberspying. "We're just seeing the tip of the iceberg," says Einar Oftedal, deputy CTO at Norman.'"


Imagine what they could have found out if there had been a crime...
No one’s safe from unfettered domestic surveillance. No one.
November 13, 2012 by Dissent
As a privacy advocate, you might have expected me to blog about the Broadwell-Petraeus-Kelley-Allen scandal, with emphasis on the federal govt’s ability or legal authority to snoop through the records of people who seemingly have committed no crime.
So how did the FBI get authorization to snoop? Well, it turns out that they really didn’t much authorization, and what they did need is all too easy to acquire.
Kade Ellis has a great write-up on PrivacySOS about how unfettered access endangers all of us. She’s preaching to the privacy choir, though, as we already know that we want a probable cause warrant standard for a lot of things where no warrant is currently required.
Keep in mind that this whole sordid affair only came out because someone in the FBI did a friend a favor when there was no clear legal justification for the FBI to get involved at all.
So whom do you know who has a friend in the FBI who could start an investigation of you? Are you okay with the FBI accessing your email accounts when you’ve done nothing illegal?
Will Congress hear us now? Will they start to worry about the privacy of their own accounts? One can only hope, but frankly, I’m not particularly optimistic that this scandal will lead to more protective legislation. I’d love to be proven wrong.

(Related)
Google sees more government snooping in first half of 2012
November 13, 2012 by Dissent
Graeme McMillan reports:
You may not be having an affair with a high-ranking American Intelligence Official, but that doesn’t mean that Big Brother isn’t watching you nonetheless. Or, at least, that might be the impression that you’re left with upon discovering that Google has reported a significant jump in the amount of government surveillance of online activity in recent months, especially when compared with just a few years ago.
In its latest Transparency Report, which covers the first six months of 2012, government agencies around the world made a total of 20,938 requests for access to personal data of Google users, with 34,614 user accounts affected by the requests.
Read more on Digital Trends.


Text of most papers available, haven't found the link to recordings or videos yet.
Solove: Privacy regulation a failure
November 13, 2012 by Dissent
David Perera reports:
The current U.S. approach to privacy regulation fails to account for the effects of information sharing created by the ascendance of technologies that permit things such as Big Data or fusion centers, said Daniel Solove, a noted privacy law researcher and a professor at George Washington University. He spoke Nov. 9 during a symposium on privacy and technology held by the Harvard Law Review.
The current model, which Solove dubbed the “privacy self-management approach,” takes refuge in the notion of consent, he said.
Read more on FierceGovernmentIT
[From the article:
… For more: - listen to Solove's Nov. 9 talk at the Harvard Law Review symposium


“Let's go back tho the good old days of “Separate but equal!” only without that pesky equal part.” Or am I missing something?
According to a story at Northwest Public Radio, the state of Virginia's board of education has decided to institute different passing scores for standardized tests, based on the racial and cultural background of the students taking the test. Apparently the state has chosen to divide its student population into broad categories of black, white, Hispanic, and Asian — which takes painting with a rather broad brush, to put it mildly. From the article (there's an audio version linked as well):
"As part of Virginia's waiver to opt out of mandates set out in the No Child Left Behind law, the state has created a controversial new set of education goals that are higher for white and Asian kids than for blacks, Latinos and students with disabilities. ... Here's what the Virginia state board of education actually did. It looked at students' test scores in reading and math and then proposed new passing rates. In math it set an acceptable passing rate at 82 percent for Asian students, 68 percent for whites, 52 percent for Latinos, 45 percent for blacks and 33 percent for kids with disabilities."
(If officially determined group membership determines passing scores, why stop there?) Florida passed a similar measure last month.


“Do you think we should run this by the lawyers?” “Nah, they'll just complicate things and they might cost us as much as a couple of hundred dollars!”
Papa John's pizza up against $250M lawsuit for text spam
… "After I ordered from Papa John's, my telephone started beeping with text messages advertising pizza specials," one of the plaintiffs in the case Erin Chutich said in a statement. "Papa John's never asked permission to send me text message advertisements."
Apparently, in 2010, Papa John's hired a mass text messaging service called OnTime4U to text ads to its customers as a way to boost profits. According to the lawsuit (PDF), which was certified by U.S. District Court Judge John C. Coughenour on November 9 in Seattle, certain Papa John's franchisees gave OnTime4U lists of customers phone numbers without getting consent from those individuals first.
If the judge decides that Papa John's is guilty of willfully sending the spam messages, this case could become one of the largest damages awards ever given under the federal Telephone Consumer Protection Act, which deems it illegal to send ads via text without an opt-in option. The lawsuit claims that 500,000 unwanted messages were sent to customers nationwide and that the pizza chain should pay $500 for each text.


It's like “Double Secret Probation” and AT&T is Dean Wormer! (Interesting comments, but no solution – if they want to charge you extra they will and there is nothing you can do about it.)
"As many of you know, AT&T has implemented caps on DSL usage. When this was implemented, I started getting emails letting me know my usage as likely to exceed the cap. After consulting their Internet Usage web page, I felt the numbers just weren't right. With the help of Tomato on my router, I started measuring my usage, and ended up with numbers substantially below what AT&T was reporting on a day-to-day basis. Typically around 20-30% less. By the way, this usage is the sum of inbound and outbound. At this point, I decided to contact AT&T support to determine what exactly they were defining as usage, as their web pages never really define it. Boy, did I get a surprise. After several calls, they finally told me they consider the methodology by which they calculate bandwidth usage to be proprietary. Yes, you read that right; it's a secret. They left me with the option to contact their executive offices via snail mail. Email was not an option. So, I bring my questions to you, all-knowing Slashdotters: are there any laws that require AT&T to divulge how they are calculating data usage? Should I contact my state's commerce commission or the FCC to attempt to get an answer to this?"


Just a reminder...
Everyone has their set of favorite websites. No matter what your hobbies and interests are, I’m sure you can think of at least five websites you love and visit often just off the top of your head. But just like other habits, when we’re set in our ways and our websites, we don’t always remember to look elsewhere.
… Similar websites are a great way to discover new websites, while making sure you stay on track and find things you’re really interested in. It’s time to start a new Web journey: use the tools listed below to expand your horizons and find more of your favorites!
Google Similar Pages [Chrome extension ]


If you don't get it from reading the textbook and the “How to” video is gibberish, and My lectures are not adequate, there are still thousands of resources you can try before giving up and actually asking a question...
… a few websites have set out to provide decent education in the format of online universities. However, what makes it great is that these websites offer all of their material for free (well, for the most part).

Posted by at No comments:

Tuesday, November 13, 2012

I'll repeat my call for compilation of a “Worst Practices” list so any idiot can see what not to do. Meanwhile, I'll serve them up piecemeal.
"Hardcoded usernames and passwords have been discovered in a recent line of Telstra broadband routers that allow attackers access to customer networks. The flaws meant customer unique passwords could be bypassed to access the device administrative console and LAN."


“We have no idea how to make money off of those tweets, so we'll just forbid them.”
"GeekWire's Taylor Soper reports that the University of Washington has capped live sports coverage at 20 Tweets per basketball game (45 for football) and threatens to revoke the credentials of journalists who dare exceed the Twitter limits. Tacoma News Tribune reporter Todd Dybas was reportedly 'reprimanded' after drawing the ire of the UW Athletic Dept. for apparently Tweeting too much during UW's 85-63 Sunday win over Loyola."


This can't be good. If a Google search is returning Images as they do text how would they know that an Image is defaming any more than they would know an article was false/biased/sarcastic/etc.
"Should Google be held liable for images that appear in its search results? An Australian court has said yes. 'A Melbourne man who won a defamation case against search engine giant Google has been awarded $200,000 in damages. Milorad Trkulja, also known as Michael, sued the multinational over images of him alongside a well-known underworld figure that appeared in its search results. A six-person Supreme Court jury found last month that Mr Trkulja had been defamed by the images, which he first contacted Google about removing in 2009.'"


Interesting, if only to prove that lawyers are just like anyone else... (Shocking, I know)
November 12, 2012
White Paper - Thinking Like Your Client: Strategic Planning in Law Firms
Thinking Like Your Client: Strategic Planning in Law Firms - A report from ALM Legal Intelligence, October 2012. "LexisNexis has spent the past few years highlighting the difference between the practice of law and the business of law; and the lackluster economic conditions over that same time span have only served to reinforce how important those differences are. Without a doubt, law firms have a thorough and detailed understanding of the practice part; that’s their forte. It’s the business of law part where shortfalls occur.
  • Revenue is the top priority in most strategic plans. Yet, almost half of the respondents are remiss in building, tracking and measuring client loyalty and satisfaction. Are firms overlooking the direct link between revenue and satisfied customers?
  • Profitability is the second strategic plan priority. But, fewer than half are actively focused on a non-billable hour strategy, and more than half can’t yet tell if AFAs are more profitable than hourly rates. AFAs and various pricing models have been around for a few years; they are not going away. Isn’t it time to honestly reexamine the elements that make your firm profitable?
  • Talent acquisition/retention holds the third top spot for strategic priorities, although laterals dominate the discussions and, apparently, everyone’s plans. How sustainable are growth models tied to an on-going “musical chairs” game of lateral talent shifting from firm to firm? Is anyone focused on a plan for organic growth?"


“Ye olde technology is ye beste technology” I know a couple lawyers who won't use a computer until it's easier to press the keys with their quill pens...
November 11, 2012
New on LLRX - Litigation, trial and pre-trail iPad apps for lawyers
Via LLRX - Litigation, trial and pre-trail iPad apps for lawyers: One of the most popular and rapidly growing categories of apps for lawyers are those developed for litigation, during trials and during the pretrial discovery phase. In this article, attorney, legal blogger and legal tech expert Nicole Black recommends more than a dozen affordable, flexible and innovative iPad apps to assist attorneys in their work to develop, streamline, simplify and track critical litigation processes.


I have lots of vets in my classes, so this has a future...
Iraq Veterans Launch RallyPoint: A LinkedIn For The Military (And Life After)
… According to The Bureau of Labor Statistics, while the unemployment rate among U.S. veterans has dropped to 8.3 percent, it still sits above the national average, and for younger vets, the rate is even higher. Taking up the cause of their fellow service men and women looking for a better way to find employment after life in the armed forces, two Iraq War veterans, Yinon Weiss and Aaron Kletzing, have launched RallyPoint — an online professional network that aims to empower American veterans to take greater control over their careers — both inside and outside the service.
… So, the co-founders have developed RallyPoint into a private online network accessible only by those currently on active duty, which extends to those in the National Guard, Active Reserves, ROTC or Service Academies. In the near future, Weiss says, the team will be opening the network up to former service members, retirees, Department of Defense employees, and so on. But for not, it’s focused purely on those currently serving in the armed forces.
RallyPoint is free for members and has no formal relationship with the military and doesn’t share its data with the military or chain of command, the co-founders said.


Free is good. Infinite is good. Free and Infinite is very good.
Many of us deeply value some of the tools that exist out there which make our lives so much easier. One of the best examples is Dropbox, the application which seamlessly synchronizes our files across all of our devices.
… The only real downside to Dropbox is the limited amount of storage space we can synchronize.
Bitcasa plans to change that. In short, Bitcasa is a synchronization tool which gives infinite space to whichever folders you’d like. Unlike Dropbox, Bitcasa’s main focus is actually expanding your folder’s available storage space to a virtually unlimited amount rather than synchronization. This is achieved by simply connecting the folder to Bitcasa’s cloud, where you aren’t limited to a quota.
However, the service does come with a good amount of additional features, including synchronization, easy sharing, encrypted storage, and access via their website.
While Android and iOS applications are still in the works, BitCasa is available for Windows, Mac OS X, and Linux to allow true access from any computer.


Automate everything?
Let the web do the work. A wide variety of tools are dedicated to saving you time. From email to social media to your own website, you could be wasting time doing things free services could do for you, automatically. Getting these services working takes a bit of knowledge, time and creativity, but they almost always pay off.
Interested? Then it’s time to read “Web Automation, Part 2“, by author Rahul Saigal. This manual picks up where Web Automation Part 1 left off. This time Rahul outlines ways to automate collecting citations, collecting reading material, your files on the cloud and even your website.
[In case you missed it:


Is Dilbert taking a shot at Mitt Romney? Sometimes the best thing you can say is, “I think I'll keep my mouth shut.”

Posted by at No comments:

Monday, November 12, 2012

Probably more hype, since “Cyber War” looks like the easiest way to get a larger Defense budget. However, in a globally connected world, a well funded (state sponsored?) hacker could shut down the economy of one or several countries by disabling infrastructure. Think not? Look at New Jersey.
"Blake Clayton with an excellent piece on the cyber threat to the global oil supply. His description of the August attack on Saudi Aramco, which rendered thirty thousand of its computers useless, helps make his point. From the article: 'The future of energy insecurity has arrived. In August, a devastating cyber attack rocked one of the world’s most powerful oil companies, Saudi Aramco, Riyadh’s state-owned giant, rendering thirty thousand of its computers useless. This was no garden-variety breach. In the eyes of U.S. defense secretary Leon Panetta, it was “probably the most destructive attack that the private sector has seen to date.”'"

(Related) If you want to own/destroy infrastructure, you should be practicing... A real concern would be evidence that an actor could control the attack well enough to select specific targets.
"We hear a lot about vulnerabilities in industrial control system (ICS) software. But what about real evidence of compromised SCADA and industrial control systems? According to security researcher Michael Toecker, a consultant at the firm Digital Bond, the evidence for infected systems with links to industrial automation and control systems is right under our eyes: buried in public support forums. Toecker audited support sites like bleepingcomputer.com, picking through data dumps from free malware scanning tools like HijackThis and DDS. He found scans of infected systems that were running specialized ICS software like Schweitzer Engineering Labs (SEL) AcSELerator Software and GE Power's EnerVista Software (used to configure GE electric power protection products). The infected end user systems could be the pathway to compromising critical infrastructure, including electrical infrastructure. 'With access to a protection relay through a laptop, a malicious program could alter settings in the configuration file, inject bad data designed to halt the relay, or even send commands directly to the relay when a connection was made,' Toecker wrote."


Is DHS the best place for this? Granted there is a possibility that terrorists could use a bio weapon, but would TSA-like screeners every detect it? More likely, this is a foot in the door of “Ubiquitous Social Media Monitoring”
"Nextgov reports 'The Homeland Security Department has commissioned Accenture to test technology that mines open social networks for indications of pandemics, according to the vendor.' This will kick off a year-long biosurveillance program, costing $3 million, that will log trends in public health by looking through public posts. This ties back to White House guidelines released in July that ask federal agencies to 'Consider social media as a force multiplier that can empower individuals and communities to provide early warning and global situational awareness.'"
[From the article:
The business case for the new DHS program has not been proved yet, Accenture officials acknowledged. “Our pilot program seeks to prove this case,” said John Matchette, Accenture managing director for U.S. public safety. “In theory, social media analytics would have shown timely indicators for multiple past biological and health-related events.”
In July, President Obama issued a national strategy for biosurveillance that directs federal agencies to think outside the box in detecting incidents.


How the world sees Privacy?
Global survey on Internet privacy and freedom of expression
… The publication also supplies additional sources of reference for interested readers to use to further investigate each of the subjects highlighted.
The publication explores a range of issues, such as:
  • threats to privacy that have developed through the Internet,
  • international legal standards on privacy and responses to these emerging issues,
  • complex intersections between the rights to privacy and freedom of expression,
  • UNESCO recommendations to states and corporations for better practice,
  • overview of literature, background material and tools on international and national policy and practice on privacy and freedom of expression on the Internet.
Download (English): Full version Executive summary


An interesting ethical question to kick around. At what age should we stop holding Mon and Dad accountable? Isn't this all “Public” and therefore open to a public reply?
… as a reflection of society too, it wasn't surprising (sadly) that there was a significant uptick in hate speech on Twitter as people reacted to President Obama’s re-election.
… The “geography of information” website FloatingSheep.org aggregated some 400 racist tweets from Tuesday night, mapped them, and compared states’ racist tweeting patterns. (Details on the methodology are here.)
Rather than looking in aggregate at the Twitter patterns, the Gawker Media-owned website Jezebel called out by name and Twitter handle many of the individuals who had tweeted racist reactions to the President’s re-election, first with a gallery highlighting some of the tweets and then with a follow-up story, tracking down some of these users’ identities.
Specifically, Jezebel re-published the tweets, tracked down teens' locations and their schools, called those schools and then published the schools’ responses (or lack thereof).
… Responding to Jezebel's story, GigaOm’s Mathew Ingram questioned the decision to publish the teens’ names, asking when and if it’s okay to publicize this sort of “bad behavior” from teens:


Is New Zealand that mad at the US for this bungled attempt to “enforce Copyright law?”
Kim DotCom: New Zealand will be home to new MegaUpload site
New Zealand appears to be embracing Kim DotCom and the service he's creating to replace MegaUpload.
DotCom announced on Twitter that his new cloud-storage service will use a New Zealand-based domain: Mega.co.nz. DotCom attempted to use a domain name from the West African country of Gabon, but that country's administration last week ordered that the domain, Me.ga, be suspended.
DotCom didn't waste anytime finding a new domain name.


Tools for serious writers... (Mac or Windows)
'Scapple': Very Interesting New Software From the Creator of Scrivener
I'll spare you my whole speech about the inklings of another at-least-mini golden age of Interesting Software, especially though not only for the Mac. I consider Scrivener the single most useful writing program I've ever come across; I'm fascinated by Tinderbox and TheBrain; I have come to trust and rely on both Evernote and DevonThink; and so on
… I'll spare you that speech (and you can see links to some past articles about Scrivener here) so as to get right to the new program I want to mention. It is called Scapple; it is from Literature and Latte, the small English company that produces Scrivener; it's still in open beta; and it is so easy to use and understand that you can very quickly grasp what it might and might not do for you.
An explanation of the program is here; it includes the link to download the beta version, which I'm not giving you directly because I think it's worth reading the background.


For my Computer Security geeks
Our infographic today is from Fixmo and it shows the various “threats, vulnerabilities and risks with mobile devices in enterprise”.


Not that my students would ever get bored in class, but...

Posted by at No comments:

Sunday, November 11, 2012

There are many breaches with victim counts in the 4, 5 or six digit range that I typically ignore, but occasionally I like to make the point that they continue to occur for exactly the same reasons. I think we need to change the laws so that failure to take even the most basic security measures results in an exponential increase in the fines.
By Dissent, November 10, 2012
More than 100,000 patients who take drugs to prevent blood clots are at risk of identity theft. An employee of Alere Home Monitoring, Inc. had the patient data on a laptop that was stolen. The computer file contained the names, Social Security numbers, addresses and diagnoses of patients who take anticoagulant drugs such as warfarin or Coumadin.
The company became aware [Often code for “Someone told them” Bob] of the data breach around Oct. 1, said Doug Guarino, director of corporate relations for Alere, Inc.
Read more on news-press.com.
So far, I haven’t found any statement on Alere’s web site nor any substitute notice in the media. With my usual “let’s keep digging” attitude, though, I did find where someone posted the contents of the notification they had received. I do not know if this is the complete letter, but here’s what I found:
Dear “Shezagirlie”,
We are writing to inform you of an incident that may have involved your personal information that occurred on September 23, 2012. A car belonging to an Alere Home Monitoring employee was burglarized. One of the items stolen from the car was the employee’s laptop. While the laptop was password protected, it did contain a file with your personal health information. Some of the information included in this file was your name, address, date of birth, Social Security number, and diagnosis.
[ … ]
We sincerely regret that this occurred and want to assure you that we have implemented steps to prevent it from happening again. [“We are thinking about planning to consider a policy that might go so far as to recommend closing the barn door” Bob] If you have further questions or concerns about this incident, you can contact us at 1-866-578-5412
Sincerely,
Sallie Kennedy
HIPAA Privacy Officer, Alere Home Monitoring
The recipient’s comment was spot on:
Yes, I definitely will be calling them tomorrow since I canceled my Alere INR Medicare scheme this past June. What was my information doing in a laptop. Why wasn’t it purged? Why was the employee carrying around a laptop with all that information on it? Geez…
To her questions, I would add:
1. Why weren’t the data encrypted?
2. Why was a laptop left in an unattended vehicle?
3. Was there a substitute media notice? If so, where was it published?
4. Why is there no prominently displayed notice on Alere’s home page?
5. Will HHS actually fine entities for leaving unencrypted data in cars?
Other people who received the letter were confused because they had never done business with Alere. A forum member responded:
This is how Alere got hold of the records. Anyone who dealt with QAS, Inverness Medical or Hemosense, your records are with Alere.
I cannot confirm the accuracy of that explanation, but Alere certainly should address it. We’ve seen this kind of problem before. All too often, people don’t know why or how an entity obtained their data. Entities would be well advised to include some statement in their notification letter if they had bought out another firm or entity, etc. If they don’t, people may suspect the letter is just a ruse to get their personal information and may ignore the advice to protect themselves.
I’ve sent an email inquiry to Alere’s corporate relations asking for a statement and some answers. I’ll update this entry when I get a response.

(Related) More “Worst Practices”
Bob Ward & Sons notifies online customers of security breach
November 10, 2012 by admin
Montana-based Bob Ward & Sons report that customers who ordered online between May 31 and August 3 had their names, addresses, and credit card information acquired by unauthorized individuals who used at least some of the data for fraudulent purposes.
In a letter dated October 23 to the New Hampshire Attorney General’s Office, Chad Ward writes that the firm was notified on April 30 by Discover [Don't they monitor access? Bob] that some customers had experienced fraudulent charges after making purchases on bobwards.com. A subsequent forensic investigation revealed that back on June 6, 2011, the site had been compromised, but it is not clear from their letter whether malware had been inserted by an employee falling for a phishing attempt or whether this was a hack, etc. June 2011 was a month notable for the flood of hacking reports involving members of Anonymous-related individuals and others.
Although the hackers were able to – and reportedly did – access data from June 6, 2011 through August 3, 2012, the credit card information was securely encrypted, it seems, until May 31, 2012. There’s no explanation as to how the credit card data lost their secure encryption on and after May 31.
The firm did not shut down its e-commerce site on April 30, and didn’t shut it down until August 3, when investigators were able to confirm the breach. [Why would it take anyone 3 months to look in the logs for an unauthorized user? Because they didn't keep logs until the breach was reported? Bob]
The breach affected all credit card transactions during the vulnerable time period, and included card security codes as well as card numbers. Customers were sent notification letters on October 24th. There does not seem to be any notice about the breach on bobwards.com at this time.


I'd like to see the arguments...
Ie: High Court orders Quinns to reveal passwords to receiver
November 10, 2012 by Dissent
TJ McIntyre writes:
In an interesting decision the High Court (Kelly J.) yesterday ordered that members of the Quinn family must provide passwords to personal email accounts and other information to the receiver appointed over their assets by the Irish Bank Resolution Corporation. While there’s no written judgment available, the order seems to have been made in support of the power of the receiver to recover personal assets following what the court described as a “mesmerisingly complex” asset-stripping scheme in breach of court orders.
This is significant and may well be the first time an Irish court has made an order requiring a party to civil litigation to reveal their passwords to the other side
Read more on IT Law in Ireland.


Perspective While they play with what we CAN do, I'm stuck in what we DO do...
U.S. city gets one of the world's fastest networks... for a week
Lucky Salt Lake. The annual conference of Super Computing is bringing 800Gbps of bandwidth with it to the mid-size Utah city.
… Using multiple 10 gigabit per second (Gbps) and 100Gbps circuits, SCinet links the convention center to other powerful networks around the world, including the Department of Energy's ESnet, Internet2, and National LambdaRail.
[I measured my connection at 1.1 Mbps on http://www.bandwidthplace.com/
Here's how that looks mathematically:
1,100,000 bps
800,000,000,000 bps That's 0.0001375% of Salt Lakes speed
OR They are more than 72,000 times faster than my connection.


For my students who won't read (not that I have high hopes they will adopt this Geek alternative either...)
If you are a busy person and don’t have the time to read all the online articles that are important for you, check out SoundGecko. It is a text-to-audio transcribing service that converts articles to MP3 audio format and lets you listen to them while you are driving in your car, in subway or walking home. Simply go to their website, enter the article’s link and your email address into the field and click “Get MP3″. Once the link is processed, you will get the MP3 version of the article in your email.
Furthermore, the app has an extension for Chrome. You simply press the SoundGecko button in your browser (while on the page) and it does the conversion. If you’d prefer to store the files in the cloud, the app integrates with Google Drive and Dropbox and automatically syncs the copy of your converted audio file to the cloud.


It's inevitable, but will it make me rich?
"Online education has had a fifty-year road to 'overnight' success. MIT Technology Review calls the emergence of free online education, particularly massive open online courses (MOOCs), The Most Important Education Technology in 200 Years. 'If you were asked to name the most important innovation in transportation over the last 200 years,' writes Antonio Regalado, 'you might say the combustion engine, air travel, Henry Ford's Model-T production line, or even the bicycle. The list goes on. Now answer this one: what's been the single biggest innovation in education? Don't worry if you come up blank. You're supposed to.' Writing about MOOC Mania in the Communications of the ACM, Moshe Y. Vardi worries that 'the enormous buzz about MOOCs is not due to the technology's intrinsic educational value, but due to the seductive possibilities of lower costs.' And in MOOCs Will Eat Academia, Vivek Haldar writes, 'MOOCs will almost certainly hollow out the teaching component of universities as it stands today... But all is not lost, because the other thing universities do is research, and that is arguably as important, if not more, than teaching.' So, are MOOCs the best thing since sliced bread, or merely the second coming of 1920s Postal Course Mania?"


Stuff for my students too
November 10, 2012
Speaker Presentations from Internet Librarian 2012
A range of presentations from the conference, Transformational Power of Internet Librarians: Promise & Prospect have been posted by InfoToday. A sample of the program links follow:

Posted by at No comments:
Subscribe to: Posts (Atom)