Sunday, April 29, 2012


'cause this was actually a big deal.
Google releases FCC report on Street View probe
April 28, 2012 by Dissent
If there’s damning evidence against you, best to get the story out yourself – and best to get it out on the weekend when fewer people follow news.
Jessica Guynn has a must-read piece in today’s L.A. Times about the FCC’s investigation of Google’s wi-fi breach. Google has reportedly released the entire report, only redacting employees’ names. But here’s the kicker:
The report points the finger at a rogue engineer who, it says, intentionally wrote software code that captured payload data information — communication over the Internet including emails, passwords and search history — from unprotected wireless networks, going beyond what Google says it intended. The engineer invoked his 5th Amendment right and declined to speak to the FCC. [It's good to employ the occasional “mad scientist” Bob]
But the FCC raises the question of whether engineers and managers on the Street View project did know — or should have known — that the data was being collected.
According to the FCC report: The engineer in question told two other engineers, including a senior manager, that he was collecting the payload data. He also gave the entire Street View team a copy of a document in October 2006 that detailed his work on Street View. In it, he noted that Google would be logging such data.
Those working on Street View told the FCC they had no knowledge that the payload data was being collected. Managers of the Street View program said they did not read the October 2006 document. [Believe what you will... Bob]
Read more in the L.A. Times. So far, I’ve not found a copy of the actual report itself, but hopefully someone will point me to it. Thanks to @rford and @Walshman23 for pointing me to the actual report.
On Thursday, Google had blasted the FCC over its handling of the Street View probe and its fine for obstructing the investigation, which Google had agreed to pay. The FCC had dropped its investigation in terms of the actual core issues. In light of today’s news, one wonders why they did as it seems there was actually some evidence that the collection of unsecured wi-fi data was intentional on at least one employee’s part.
Update: Okay, now that I’ve read their report, I do understand why they didn’t pursue it. The legal issue boils down to if you’re using unsecured wi-fi, you are making your transmissions available to the general public, and the prohibitions of the Wiretap Act do not apply. [Do you think anyone at the FCC knew that before they wasted all of my tax dollars on this investigation? Bob]


It's too late to take Security seriously... Bits from a long article
By Dissent, April 28, 2012
If you were to search DataLossDB.org to find out what we knew about data breaches involving Accretive Health, you would have found one incident from last year. But that may be the tip of the iceberg. Christopher Snowbeck of Pioneer Press reports that there were others:
When a laptop computer was stolen last summer from the locked car of an Accretive Health employee, it wasn’t the first time.
In June 2010, another employee at Accretive – a Chicago-based consultant hired by the Fairview health system to work on billing issues – reported that his laptop had been stolen from a locked car parked outside a restaurant in Roseville.
In the Roseville case, the laptop was encrypted and the computer was rendered inoperable about two hours after the theft, according to documents released this week by state Attorney General Lori Swanson. So it wasn’t considered a security breach that put patient records at risk.
But lightning struck again in late July 2011, when another Accretive Health employee’s laptop was reported stolen from a locked car in Minneapolis. In the second case, the laptop wasn’t encrypted and the Fairview and North Memorial health systems wound up having to notify thousands of patients about the risk to their personal health information.
The sequence of events is part of the reason Sen. Al Franken, D-Minn., turned up the heat on Accretive Health on Friday, April 27, with a letter to the company’s CEO demanding answers to a series of questions.
“The report states that Accretive employees lost six laptops to theft in three separate incidents,” Franken’s letter states. “Is this accurate?”
Fairview and Accretive officials have said there’s no evidence [Not the same as no complaints or suspicions Bob] that any patient has been harmed by the laptop theft in Minneapolis. But they have not previously disclosed details about the June 2010 theft or the possibility that there might be a pattern of lost laptops.
Read more on Pioneer Press.
… Another shocking revelation in the Attorney General’s report was contained in a November 2011 presentation prepared by Accretive for Fairview. It noted, in part:
  • Matt Doyle (the Accretive employee whose laptop was stolen) should not have had access to patient data.
(p. 11, Volume 3). Significantly, not only should Doyle not have had access to patient data, but he comingled data from Fairview with St. John’s Hospital in Michigan – even though he shouldn’t have had the latter’s data more than a year after he left that site (Volume 6, p. 14)
… This may turn out to be one of those incidents where a breach actually does kill a business. Accretive’s stock had already dropped following the January announcement of the Attorney General’s lawsuit against them and the release of the 6-volume report triggered a 42% drop in stock prices and an investor lawsuit. Now, just 12 hours ago, Accretive announced that it had lost its contract with Fairview:
Accretive Health, Inc. (NYSE: AH - News) said today that it has received notice of termination from Fairview Health Services of its Quality and Total Cost of Care (“QTCC”) services contract. The terms of the transition have yet to be determined. The Company will update its business outlook on its quarterly earnings call on May 9, 2012.

(Related) Long letter omitted. Have fun answering this Accretive.


I suggest a year-round season on drones, with no bag limit. No doubt the paparazzi will arm themselves so celebrities will need anti-drone surface to air missiles. GreenPeace will want torpedoes for whaling ships. Tree-huggers will want missiles that “home on chain saws.” Where will the Privacy-Arms race end? Another “technology outstrips law issue?”
Hunting group to sue over remote UAV surveillance
April 28, 2012 by Dissent
In a statement, the Federation for Hunting & Conservation – Malta (FKNK), has said that “on behalf of all of its members in principle and on behalf of several of its members who have been filmed without their consent, intends to press charges in Court against German-based CABS personnel.”
“The charges will include, but are not limited to: harassment; intrusion of privacy; trespassing; spying; flying of an unmanned remote-controlled aircraft equipped with video-recording equipment at a low altitude over private property; landing of this aircraft on private-owned land; unauthorised video and photo shooting; breach of local air-traffic control regulations and related dangers; etc,” CABS said.
Read more on Gozo News.
For those as confused as I was, CABS is the Committee Against Bird Slaughter. A news item on CAB’s site this week reported:
A model aircraft employed by the Committee Against Bird Slaughter (CABS) and the German TV station RTL to discover active illegal trapping sites has been shot down. The aircraft, equipped with a video camera, was hit yesterday by shotgun pellets, but no serious damage was caused. The aircraft has been operating since the beginning of the week and had already filmed four active trapping installations from the air. A huge clap net was detected in the south of Malta yesterday. Police seized the nets as well as some half a dozen protected bird species including Robins, Yellow Wagtail and Collared Doves. (More here)


Because trivial stuff ain't worth protecting?
"In what may win awards for the silliest-sounding lawsuit of the year, a case about whether Facebook 'likes' qualify for free speech protection under the First Amendment has ended in a decisive 'no.' In the run-up to an election for Sheriff, some of the incumbent's employees made their support for the challenger known by 'liking' his page on Facebook. After the incumbent won re-election, the employees were terminated, supposedly because of budget concerns. The employees had taken a few other actions as well — bumper stickers and cookouts — but they couldn't prove the Sheriff was aware of them. The judge thus ruled that 'merely "liking" a Facebook page is insufficient speech to merit constitutional protection. In cases where courts have found that constitutional speech protections extended to Facebook posts, actual statements existed within the record.'"


One of my Math students plans to write his own algorithm. Perhaps studying this one will help. Bob's Tip: If you do find a successful algorithm, keep it to yourself (and your math professor)
"The BBC has a fascinating story about how a mathematical formula revolutionized the world of finance — and ultimately could have been responsible for its downfall. The Black-Scholes mathematical model, introduced in the 70s, opened up the world of options, futures, and derivatives trading in a way that nothing before or since has accomplished. Its phenomenal success and widespread adoption lead to Myron Scholes winning a Nobel prize in economics. Yet the widespread adoption of the model may have been responsible for the financial crisis of the past few years. It's interesting to ponder how algorithms and formulas that we work on today could fundamentally influence humanity's future."


This could be handy for grabbing the occasional cartoon.
… All the user is required to do is download the extension from the Firefox addon repository and configure the add-on to include the folders where the images can be saved. Once done, just navigate to any image on a webpage, right-click, choose the option “Save Images in Folder” and select the folder in which you want to save the image.


I don't have dedicated eBook readers, but I do have the Kindle app on my PC.
Calibre allows you to convert eBooks from any format to any other format. So, if you download a book that isn’t supported on your reader, there is no need to worry, simply use Calibre, and you will be good to go. There is almost no format that Calibre does not support. For the complete list, click here.
If all that wasn’t enough, Calibre has a beautiful eBook reader built-in. This way, if you don’t have a dedicated reader, you can use Calibre to read your favorite books right on your computer.

Posted by at No comments:

Saturday, April 28, 2012


It is never enough to simply implement a security procedure. You actually have to follow Best Practices exactly and then test it every way you can...
"A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set up by the Trustworthy Internet Movement, looks at several components of each site's SSL implementation to determine how secure the site actually is. The project looks at how each site is configured, which versions of the TLS and SSL protocols the site supports, whether the site is vulnerable to the BEAST or insecure renegotiation attacks and other factors. The data that the SSL Pulse project has gathered thus far shows that the vast majority of the 200,000 sites the project is surveying need some serious help in fixing their SSL implementations."


In Texas it's, “One revenuer, one revolution.”
"The Houston Chronicle is reporting that Amazon.com will soon start collecting sales tax from buyers in state of Texas. 'Seattle-based Amazon, which had $34 billion in sales in 2010, has long opposed collecting taxes. That has drawn fire from state governments facing budget shortfalls and from traditional brick-and-mortar retailers, who say online sellers essentially give customers an automatic discount when they don’t collect taxes. Combs has estimated the state loses $600 million a year from untaxed online sales. However, Amazon has recently begun making deals with a number of states to collect sales tax. Those deals have usually included a one- to three-year window exempting Amazon from sales tax collection.'"


A new legal niche? “If you can't be civil, we'll fit you for a civil suit?”
Teen Sues Over Facebook Bullying
A teenager in Georgia has decided to take things into her own hands after her school and police said they could do nothing about the classmates bullying her on Facebook.


Oh look, a symptom! Now, how to we cure the disease?
When Will This Low-Innovation Internet Era End?
It’s an age of unprecedented, staggering technological change. Business models are being transformed, lives are being upended, vast new horizons of possibility opened up. Or something like that. These are all pretty common assertions in modern business/tech journalism and management literature.
Then there’s another view, which I heard from author Neal Stephenson in an MIT lecture hall last week. A hundred years from now, he said, we might look back on the late 20th and early 21st centuries and say, “It was an actively creative society. Then the internet happened and everything got put on hold for a generation.”
Stephenson was clearly trying to be provocative. But he’s not alone in the judgment that we’re not actually living in an era of great innovation. Economist Tyler Cowen’s e-book-turned-book, The Great Stagnation, made similar points: Compared with the staggering changes in everyday life in the first half of the 20th century wrought by electricity, cars, and electronic communication, the digital age has brought relatively minor alterations to how we live.
… The most common response to such griping has been, just wait. Many techno-optimists base their thinking on a famous 1990 paper by economic historian Paul David, which described how, for decades, electricity had little effect on industrial productivity as manufacturers simply swapped out older energy sources for electric power but changed nothing about how they made things. It was only as new factories were built that took advantage of the unique properties of electric motors that a productivity boom ensued. Just give the digital age a bit more time, and you’ll see huge changes (and, one hopes, improvements) in how we work and live.
[A correct link to Paul David's paper:


After using Open Office for more than 10 years, perhaps it's time to move?
"If you are looking for small niche features such as interactive word count, bundled report designer, or command line filtering etc – LibreOffice beats OpenOffice hands down. 'Noting the important dates of June 1, 2011, which was when Oracle donated OOo to Apache; and Apache OpenOffice 3.4 is due probably sometime in May 2012; Meeks compared Apache OpenOffice 3.4 new features to popular new features from LibreOffice: 3.3, 3.4, 3.5. It wasn't surprising to find that LibreOffice has merged many features not found in Apache OO given their nearly year long head start.'"


This could be very useful as I try to teach my students my SOP PDQ. (LOL)
When you are browsing websites, you will come across countless abbreviations. These abbreviations can be anything, ranging from Internet slang to something specific to the website you are visiting. What you need is a tool which you can use to quickly reference abbreviations and their possible meanings without having to leave the webpage you are currently on. Here to offer you that is a service called ABBREX.
ABBREX is a free to use browser tool. It comes as an add-on for Mozilla Firefox and an extension for Google Chrome. The purpose of ABBREX is to reveal all the possible meanings of abbreviations you find on websites. Although you could easily execute a web search to find out what an abbreviation stands for, ABBREX lets you learn the abbreviation’s meaning without having to leave the webpage.
With the add-on or extension installed in your web browser, all you have to do is place your mouse pointer over an abbreviation and its meaning is shown in a floating window. Multiple meanings are shown and these are all contributed by ABBREX users.


How geeks become experts before 'normal' people even hear of the software.
OnlineBeta is a website that allows users to participate in beta tests of unreleased products. Users get a chance to review products from well-known companies such as Logitech, Dell, T-Mobile, Polycom, Kodak, Yahoo and many more. The products range from household items to video games to enterprise class hardware . The website sends only offers that might catch the interest of the users.
To use the service, you must sign up for a free account, and you will be sent offers over the period according to the information you have provided along with the beta product details.
Similar tools: BetaBait and InviteShare.

Posted by at 1 comment:

Friday, April 27, 2012


On the “Internet of Things,” who owns the data is going to be an rather important question.
Recommended Reading: The Automotive Black Box Data Dilemma
April 26, 2012 by Dissent
A tweet from the World Privacy Forum pointed out this excellent article by Willie D. Jones on ieee Spectrum. Here’s a snippet:
… “I don’t see how there can be an expectation of [EDR] privacy in a criminal case,” Gillingham insists. “When you’re driving on public land, you give up expectation of privacy.” Challenged on whether that statement conflicts with longstanding U.S. principles of search and seizure, he says, “There’s an expectation of privacy with regard to my body or my home; that’s very much different than the engine of my car.”
But there is a growing cadre of people who disagree with Gillingham, including the Court of Appeals of California, Sixth District, which overturned the manslaughter conviction in February 2011 on the grounds that law enforcement did not secure a search warrant to retrieve the data. (The other convictions were left intact.)
In the first civil lawsuits and criminal cases involving cars equipped with EDRs, auto companies claimed that they owned the data; courts eventually began ruling that it belongs to vehicle owners and lessees. But without federal laws governing who should have access to black box data, the matter was left to the states. Thus far, only 13 states have passed laws governing the ownership of EDR data.
Read more on ieee Spectrum.


What is the opposite of “viral marketing?” Perhaps this is the basis for a new Olympic sport – Copyright Enforcement.
London Olympics To Visitors: Don’t Share What You See
According to the London 2012 Olympic “conditions for ticket holders,” you are not allowed to take pictures or video of the events nor are you allowed to “exploit” any video on social networks.
… This means no Instagrams, no Tweetpics, no Facebooking (“OMG OLYMPICS!!”), and no nothing. In short, you shouldn’t tell anyone you went to the Olympics.
According to Petapixel, UK photographers are already being hassled for taking photos of the Olympic “city” from public places, which suggests perhaps that London should spring for a geodesic dome to cover the proceedings in mystery and smash cameras of errant Tweeters.


Attention stalkers!
Here Are 20 Companies Who Sell Your Data (& How To Stop Them)
April 26, 2012 by Dissent
Jon Mitchell writes:
Meet the data brokers. There’s a whole industry full of companies who make their money buying and selling our personal information. TheFTC is working on busting this dark racket wide open, but in the meantime, they’re out there. Who are they? Can we stop them? Read on to find out.
Read more on ReadWriteWeb.


Would this also apply to random interception of wireless communication?
Victory! Federal Judge Rules Against Drug Testing of Florida’s State Workers
April 26, 2012 by Dissent
Great news from Baylor Johnson of the ACLU of Florida:
Two months ago, I was sitting in a federal courtroom in Miami watching as our staff attorney, Shalini Goel Agarwal, argued for the rights of Florida state workers against invasive, suspicionless mandatory bodily-fluid searches. The ACLU of Florida, on behalf of the American Federation of State, County and Municipal Employees (AFSCME), was challenging an executive order issued by Gov. Rick Scott requiring random drug testing for state employees.
Today, a decision came down in that case affirming the privacy and personal dignity of thousands of state employees by declaring the order a violation of the Fourth Amendment. Without a “compelling need,” a search of your bodily fluids is exactly the kind of unreasonable search and seizure the Constitution clearly bars.
Read more on the ACLU’s web site and congratulations to them or their successful advocacy!

(Related) Just because it's legal doesn't mean we can't use it against you. It is much easier to look at every prescription issued by every doctor to see if anything stands out, than to gather more specific information on the street. (Drug companies won't complain about increased sales and Insurance companies are unlikely to pay for unneeded drugs.)
By Dissent, April 27, 2012
While a federal court ruled Florida’s drug-testing law unconstitutional yesterday, not all news is good news in terms of invasions of health issues. Vermont Public Radio reports:
The Vermont Senate has voted to allow police access without a search warrant to a database of Vermonters’ prescriptions maintained by the Vermont Department of Health.
In an 18-11 vote after more than two hours of debate on Wednesday, the Senate rejected the arguments of some members that allowing police access to the database would violate rights against search and seizure promised by the U.S. and Vermont constitutions.
The majority sided with those saying police access would not be unlimited, and that investigators need to be able to crack down on an epidemic of prescription drug abuse in the state.
The House earlier voted to require a search warrant before police got access to the database. A conference committee likely will have to work out the difference.
As regular readers of this blog know, I’ve been following the state laws on prescription databases and by now, many states do have laws that open up databases to law enforcement in the name of busting prescription abusers (usually pain killer medications). But since these situations are usually not emergency situations with imminent danger involved, why can’t law enforcement be required to show probable cause to obtain a warrant? Inconvenient for law enforcement, perhaps, but if the real issue is that law enforcement doesn’t have enough information to rise to the level of probable cause, do we really want them able to access someone’s prescription records?


“For every law there is a loophole.” Who said that? (Every lawyers ever born?)
The FBI Workaround For Private Companies To Share Information With Law Enforcement Without CISPA
… In 1997, long-time FBI agent Dan Larkin helped set up a non-profit based in Pittsburgh that “functions as a conduit between private industry and law enforcement.” Its industry members, which include banks, ISPs, telcos, credit card companies, pharmaceutical companies, and others can hand over cyberthreat information to the non-profit, called the National Cyber Forensics and Training Alliance (NCFTA), which has a legal agreement with the government that allows it to then hand over info to the FBI. Conveniently, the FBI has a unit, the Cyber Initiative and Resource Fusion Unit, stationed in the NCFTA’s office. Companies can share information with the 501(c)6 non-profit that they would be wary of (or prohibited from) sharing directly with the FBI.


The Congressional version of “Ready, Fire, Aim?” Perhaps, if my Ethical Hackers were to send the 248 Luddites their complete Internet dossier...
House Passes Controversial Cybersecurity Measure CISPA
The Cyber Intelligence Sharing and Protection Act, or CISPA, sponsored by Reps. Mike Rogers (R-Michigan) and Dutch Ruppersberger (D-Maryland), passed on a vote of 248 to 168.


Interesting. I thought for sure Google would pay this out of Petty Cash and move on. But as they say in Calculus, as the Money available approaches infinity, behavior becomes unpredictable.
Google pushes back against FCC fine
April 27, 2012 by Dissent
Andrew Feinberg reports:
Google is pushing back against a Federal Communications Commission proposal to fine the Internet company for snooping on people’s Wi-Fi networks using equipment in its Google Street View cars.
[...]
Google denied it had obstructed the probe by not making personnel available, saying it had let the commission take testimony from “everyone the FCC asked to meet.” The company also argued that “the fact that a certain engineer was legally unavailable did not leave any significant factual questions unanswered.”
Read more on The Hill.
[From the article:
...the engineer who wrote the offending code code would not talk to the FCC


I fall mostly into the “not so fast” crowd...
April 26, 2012
Pew - The Future of Money in a Mobile Age
The Future of Money in a Mobile Age by Aaron Smith, Janna Anderson, Lee Rainie - Apr 17, 2012
  • "Within the next decade, smart-device swiping will have gained mainstream acceptance as a method of payment and could largely replace cash and credit cards for most online and in-store purchases by smartphone and tablet owners, according to a new survey of technology experts and stakeholders. Many of the people surveyed by Elon University’s Imagining the Internet Center and the Pew Research Center’s Internet & American Life Project said that the security, convenience and other benefits of “mobile wallet” systems will lead to widespread adoption of these technologies for everyday purchases by 2020. Others—including some who are generally positive about the future of mobile payments—expect this process to unfold relatively slowly due to a combination of privacy fears, a desire for anonymous payments, demographic inertia, a lack of infrastructure to support widespread adoption, and resistance from those with a financial stake in the existing payment structure."
[Is Square the model for future electronic transactions? Bob]


For my Ethical Hackers. What went wrong? Exactly, he used his own name! And didn't test adequately. (The potential cost of Cloud computing...)
Oops! Amazon Web Services Customer Unleashes ‘Denial of Money’ Attack – on Himself


Kickstarter loves creative projects. I'd get one of these if I had a cell phone.
2-Cans-and-a-String Technology Updated for Age of Mobility


Everything changes
SketchUp Is Google’s First Divestment Ever, And It Made A Profit
Google’s sale of a previously purchased arm of the company this morning, 3D modeling software SketchUp, to Trimble, isn’t just something it does “every now and again”. It’s actually Google’s first divestment ever, according to two sources, and we’re hearing the search giant made a profit, as it sold SketchUp for more than it bought it for back in 2006.
… It wasn’t that SketchUp wasn’t working. It had 30 million activations since joining Google as part of @Last Software in March 2006. But it just didn’t fit with the direction Google is heading in. It’s a relatively niche product for architects and the construction industry, game developers, and filmmakers. It doesn’t fit with last year’s theme of inherently social product that could be tied to Google+, or this year’s plan to simplify everyone’s lives.


An interesting Charlie Rose interview
Jack Dorsey, Chairman of Twitter and CEO of Square


It's a horrible secret. Whatever you do, don't Google the words “zerg rush”

Posted by at No comments:

Thursday, April 26, 2012


Best Practices As new security tools and techniques become available, you should re-visit applications that were “cleared” using earlier, less capable tools. I suspect few organizations do, and therefore don't detect backdoors added by “cutting edge” hackers.
Cryptic Studios uncovers old hack, notifies users
April 25, 2012 by admin
A reader alerted me to a breach notification he received from Perfect World subsidiary Cryptic Studios, a massively multiplayer online role-playing game developer. You can read the web version of their notice. The hack occurred in 2010 but was only first discovered now due to “increased security analysis.”
The intruder reportedly accessed account names, handles, and encrypted passwords, at least some of which were apparently decrypted. The intruder also may have been able to access date of birth, e-mail and billing addresses, and partial credit card numbers, although Cryptic Solutions doesn’t believe that those were accessed.
As always, if you had reused passwords across sites, go change your passwords on the other sites.

(Related) ...and here's why we follow Best Practices. (Yes, I'm being repetitious and redundant. That too is a Best Practice.)
"If businesses and consumers stuck to security basics, they could have avoided all cases of Conficker worm infection detected on 1.7 million systems by Microsoft researchers in the last half of 2011. According to the latest Microsoft Security Intelligence report, all cases of Conficker infection stemmed from just two attack methods: weak or stolen passwords and exploiting software vulnerabilities for which updates existed."


Everything's big in China. When they decide to clean house, they seem to have no trouble identifying and gathering up large volumes of 'evil doers.' But then, the first time is easy. Now that they have been warned, they'll start using accounts in their lawyer's names.
Cn: 1,700 arrested on stealing personal data
April 25, 2012 by admin
Wow. He Dan reports:
Police across the country have arrested more than 1,700 people on suspicion of stealing or misusing personal information, according to the Ministry of Public Security.
Under the ministry’s deployment, police in 20 provincial-level regions, including Beijing and Shanxi, uncovered 38 operations where people’s personal details were being illegally traded, according to a statement posted on the ministry’s website on Tuesday night.
In the first-ever crackdown of its kind, 611 companies that illicitly conducted surveys were closed, and 161 unauthorized databases were destroyed.
Read more on xinhuanet.com

(Related) But if you want really big, you have to hand it to Texas.
Texas Error Exposed Over 13 Million Voters’ Social Security Numbers
April 25, 2012 by admin
I don’t know he is on other issues, but Texas Attorney General Greg Abbott is one of the most active AG’s when it comes to pursuing those who dump data or don’t secure it properly. I can only imagine how mortified he must be by this breach, which thankfully, could have been much worse if the data had fallen into the wrong hands.
From the Lone Star Project:
A legal brief filed by opponents of the Texas Voter Photo ID law reveals that Attorney General Greg Abbott exposed millions of Texas voters’ full Social Security numbers to possible theft and abuse.
The brief, filed Monday, April 23, 2012 states:
“… after vigorously fighting the production of data containing full Social Security numbers, Texas mistakenly produced to Intervenors data from the VR [voter registration] data base that contained full Social Security numbers.” (Defendant-Intervenors’ Motion for Clarification of the Trial Schedule, 4/23/12, page seven.)
Texas voters escaped public release of their Social Security numbers only because of the vigilance of conscientious lawyers working against the Voter Photo ID bill. Rather than attach the files to documents circulated to other attorneys or expose them to access by the general public, opposing counsel immediately notified the AG’s office of the bungled release of private data. Abbott then, at the expense of Texas taxpayers, sent a courier to both New York and Washington, DC to retrieve the files.
Read more on Lone Star Project.
According to the Texas Secretary of State web site, Texas had 13,269,233 registered voters in the November 2010 election.


China again. If China steals from everyone, why bother to hack anyone else?
VMWare Source Code Leak Follows Alleged Hack of Chinese Defense Contractor
Source code belonging to VMWare has leaked to the internet after apparently being stolen by a hacker who claims to have obtained it from a Chinese firm’s network.
The source code belongs to VMWare’s ESX virtual machine software product, a popular tool for creating and operating virtual computing environments. The code was posted to the Patebin web site, a repository for coders that has become a favorite for hackers to publish purloined wares.
VMWare acknowledged the leak in a note posted to the company’s web site.


Perhaps my “Technical University” could team up with the PrivacyFoundation.org and build a few for demonstration purposes? Nerf weapons anyone?
Who Has the Right to Fly a Drone Above Your Head? Finally, There's a List
While the government's use of drones in other countries has drawn scrutiny, there are plenty of drones flying in American skies on behalf of the military, law enforcement, universities, and local governments.
… Perhaps most interesting is how many universities have applied for permits. Some may be working with military grant money. [Magic words for cutting through University red tape Bob]


It's a start, but one not likely to last past November without a lot more public comment. -
The White House threatens to veto CISPA
April 25, 2012 by Dissent
This may be the strongest pro-privacy statement I’ve seen from President Obama. Let’s hope it’s not just posturing and rhetoric: [Is it from a politician? Are his lips moving? Bob]
The Administration is committed to increasing public-private sharing of information about cybersecurity threats as an essential part of comprehensive legislation to protect the Nation’s vital information systems and critical infrastructure. The sharing of information must be conducted in a manner that preserves Americans’ privacy, data confidentiality, and civil liberties and recognizes the civilian nature of cyberspace. Cybersecurity and privacy are not mutually exclusive. Moreover, information sharing, while an essential component of comprehensive legislation, is not alone enough to protect the Nation’s core critical infrastructure from cyber threats. Accordingly, the Administration strongly opposes H.R. 3523, the Cyber Intelligence Sharing and Protection Act, in its current form.
[Yada, yada, yada Bob]
The House takes up the bill Thursday and there have been a slew of proposed amendments, the vast majority of which do not address the main concerns privacy advocates have.


If I ran for President on an “eliminate TSA” platform, would Obama and Romney even notice?
"With public outcry against the TSA continuing to spread, the TSA is defending a recent episode in which a four-year-old was patted down while kicking and screaming at Wichita Airport in Kansas. From the AP article: 'The grandmother of a 4-year-old girl who became hysterical during a security screening at a Kansas airport said Wednesday that the child was forced to undergo a pat-down after hugging her, with security agents yelling and calling the crying girl an uncooperative suspect.'"


Now even those who are not Computer Security majors may listen to me.
"A German court has ruled that clients, not banks, are responsible for losses in phishing scams. The German Federal Court of Justice (the country's highest civil court) ruled in the case of a German retiree who lost €5,000 ($6,608) in a bank transfer fraudulently sent to Greece. According to The Local, a German news site, the man entered 10 transaction codes into a site designed to look like his bank's web site and his bank is not liable as it specifically warned against such phishing attacks."


Some years ago, this worked into my model for organizational change. It is very difficult to change an organization's culture, so you need to create a parallel organization. When it works the way you want it to, you fold the original organization and transfer everything to the new one. (If it doesn't work, kill it and start over.)
The A/B Test: Inside the Technology That’s Changing the Rules of Business
… Over the past decade, the power of A/B testing has become an open secret of high-stakes web development. It’s now the standard (but seldom advertised) means through which Silicon Valley improves its online products. Using A/B, new ideas can be essentially focus-group tested in real time: Without being told, a fraction of users are diverted to a slightly different version of a given web page and their behavior compared against the mass of users on the standard site. If the new version proves superior—gaining more clicks, longer visits, more purchases—it will displace the original; if the new version is inferior, it’s quietly phased out without most users ever seeing it. A/B allows seemingly subjective questions of design—color, layout, image selection, text—to become incontrovertible matters of data-driven social science.
After joining the Obama campaign, Siroker used A/B to rethink the basic elements of the campaign website. The new-media team already knew that their greatest challenge was turning the site’s visitors into subscribers—scoring an email address so that a drumbeat of campaign emails might eventually convert them into donors.
… Most shocking of all to Obama’s team was just how poorly their instincts served them during the test. Almost unanimously, staffers expected that a video of Obama speaking at a rally would handily outperform any still photo. But in fact the video fared 30.3 percent worse than even the turquoise image. [Amazing! Politicians believing facts! Bob]


One word: Multivac
"Google could go the way of the dodo if ultra intelligent electronic agents (UIEA) make their way into the mainstream, according to technology prognosticator Daniel Burrus. Siri is just the first example of how a UIEA could end search as we know it. By leveraging the cloud and supercomputing capabilities, Siri uses natural language search to circumvent the entire Google process. If Burrus is right, we'll no longer have to wade through '30,000,000 returns in .0013 milliseconds' of irrelevant search results."


Why wouldn't your local bank offer the same service? After all, “that's where the money is.” (Willie Sutton)
Buy a product on Walmart.com, pay with...cash?
The retail giant says that customers can now browse more items on its Web site, and then opt to pay with cash by heading into a local store and dropping off the Benjamins.


That will teach him to toy with Hasbro! (Should you really sue your fans?)
Hasbro Goes After Blogger In IP Theft Case
You’d never think that the world of Nerf guns and dart shooters was so intense, but Hasbro apparently sued a blogger for leaking information about unreleased Nerf products he found on Chinese marketplace Taobao using the sweetest bait imaginable: free Nerf guns.
Urban Taggers is a blog about “assault blasters” for “kidults.” Essentially they cover Nerf guns and the like and are fairly popular in the space. The lead blogger, Pocket, ran a review of an unreleased gun. A few days later, he received a note from Hasbro offering some guns to giveaway to his readers. Eager to share the blaster love, he agreed and sent his address. That’s when his troubles began.
Immediately after the emails went back and forth, Pocket received a letter from Hasbro’s lawyers accusing him of IP theft.


Perspective. Can you see shelves full of Kindles? Me neither...
http://www.bespacific.com/mt/archives/030138.html
April 25, 2012
Pew Presentation: Public libraries in the digital age
Public libraries in the digital age by Mary Madden, Kathryn Zickuhr, Apr 25, 2012 at Chief Officers of State Library Agencies: "They presented findings on the rise of e-reading, including reading-device ownership and the general reading habits/preferences of Americans. Their presentation included libraries research fact sheets:

(Related) Sci-Fi publishers are such forward thinking people I would expect nothing less...
"'Science fiction publisher Tor UK is dropping digital rights management from its e-books alongside a similar move by its U.S. partners. ... Tor UK, Tor Books and Forge are divisions of Pan Macmillan, which said it viewed the move as an "experiment."' With experiments, come results. Now users can finally read their books across multiple devices such as Amazon's Kindle, Sony Reader, Kobo eReader and Apple's iBooks. Perhaps we will see the *increase* of sales, because the new unrestricted format outweighs the decrease caused by piracy?"


Useful in my “build your own website” class...


Tools to keep in the “Oh Crap!” folder.


I'm afraid to ask. Is this for the “English for people who can't read” class?
Yesterday, I Tweeted a story from Open Culture that highlighted 12 animated Shakespeare stories. In my investigation of the video source that Open Culture highlighted, I discovered Shakespeare Animated. Shakespeare Animated is a YouTube channel containing twelve playlists ten of which are animated adaptations of Shakespeare's most famous plays. Some of the animated plays that appear in the Shakespeare Animated playlist are Romeo and Juliet, Hamlet, MacBeth, and The Taming of the Shrew. I've embedded part one of Romeo and Juliet below.
The Shakespeare Animated videos could be useful for supporting your students' reading of Romeo and Juliet or any of the nine other plays in the list. Because the plays are broken into segment they are well-suited to being used one class meeting at a time. You could show the ten to twelve minute segments
You might also like:


For my students (and my 1%)
Another Crowdfunding Player Enters The Fray: Apps Genius Launches GetFunded.com
… Like Kickstarter and many others, GetFunded will be a “crowdfunding platform for entrepreneurs who are seeking new investments in their businesses and ideas,” according to a statement from App Genius.

Posted by at No comments:

Wednesday, April 25, 2012


“Mr Chairman, Thank you for asking me to testify about medical device security. Those of you on the committee with pacemakers will want to keep a close eye on the Remote Control device in my hand...”
"The vulnerability of wireless medical devices to hacking has now attracted attention in Washington. Although there has not yet been a high-profile case of such an attack, a proposal has surfaced that the Food and Drug Administration or another federal agency assess the security of medical devices before they're sold. A Department of Veterans Affairs study showed that between January 2009 and spring 2011, there were 173 incidents of medical devices being infected with malware. The VA has taken the threat seriously enough to use virtual local area networks to isolate some 50,000 devices. Recently, researchers from Purdue and Princeton Universities announced that they had built a prototype firewall known as MedMon to protect wireless medical devices from outside interference."


Interesting, if low profile.
April 24, 2012
Guide - overview of significant cyber warfare events from the news
Cyberthings for Managers - overview of significant cyber warfare events from the news: "Cyberthings for Managers is created by Reuser’s Information Services to meet a growing demand by managers in the domain of cyber warfare for a quick overview of the most important events of the past weeks in the field, without being overwhelmed by technical details, individual incidents, or repetitions of earlier news. Cyberthings will list a summary of significant events in the world of Cyberwarfare from Governmental level down. There will be no listings of technical hacks, detailed descriptions of cyberweapons, repetitions of detailed cybercrime events, only the more strategic events will be covered." [via Marcia E. Zorn]
[Subscribe via email:
Subscribe? Mail ”subscribe cyberthings” to: cyberthings@reuser.biz
Unsubscribe? Mail ”unsubscribe cyberthings” to: cyberthings@reuser.biz
Archive. An archive of previous editions is maintained at http://www.opensourceintelligence.eu,
choose Products, then Publications.


You talk the talk, can you walk the walk? (and other Hollywood catch phrases)
April 24, 2012
CFA Report: How Identity Theft Services Measure Up to Best Practices
"The Consumer Federation of America (CFA) released Best Practices for Identity Theft Services: How Are Services Measuring Up?, which analyzes how well identity theft services are providing key information to prospective customers. The study is based on CFA’s Best Practices for Identity Theft Services, voluntary guidelines that CFA developed with the help of identity theft service providers and consumer advocates. Released last year, the best practices resulted from CFA’s first study of identity theft services in 2009, which raised concerns about misleading claims about the ability to protect consumers from identity theft, lack of clear information, and other troublesome practices."


Entirely too reasonable?
NAFCU Letter to Reps. Boehner and Pelosi on Cyber/Data Security
April 24, 2012 by admin
Via CUInsight, a letter that has some recommendations many readers might agree with:
… On behalf of the National Association of Federal Credit Unions (NAFCU), the only trade association exclusively representing our nation’s federal credit unions, I write today in regards to the issue of cyber security.
… With that in mind, NAFCU specifically recommends that the House consider the following issues related to data security as you tackle the broader issue of cyber security:
  • Payment of Breach Costs by Breached Entities: NAFCU asks that credit union expenditures for breaches resulting from card use be reduced. A reasonable and equitable way of addressing this concern would be to require entities to be accountable for costs of data breaches that result on their end, especially when their own negligence is to blame.
  • National Standards for Safekeeping Information:
  • Enforcement of Prohibition on Data Retention:


Attention paranoids!
CYBERSECURITY Threats Impacting the Nation
The nation faces an evolving array of cyber-based threats arising from a variety of sources. These threats can be intentional or unintentional. Unintentional threats can be caused by software upgrades or defective equipment that inadvertently disrupt systems, and intentional threats can be both targeted and untargeted attacks from a variety of threat sources. Sources of threats include criminal groups, hackers, terrorists, organization insiders, and foreign nations engaged in crime, political activism, or espionage and information warfare.
… The number of cybersecurity incidents reported by federal agencies continues to rise, and recent incidents illustrate that these pose serious risk. Over the past 6 years, the number of incidents reported by federal agencies to the federal information security incident center has increased by nearly 680 percent.


Law School, outside the box?
"Brooklyn Law School's Incubator and Policy Clinic (BLIP) hosted its first 'Legal Hackathon.' Instead of hacking computer code, attendees — mostly lawyers, law students, coders, and entrepreneurs — used the hacking ethos to devise technologically sophisticated solutions to legal problems. These included attempts to crowdsource mayoral candidacies in New York City and hacking model privacy policies for ISPs."


Continuing my quest for the “Next Big Thing!”
How to Spot the Future

(Related)
8 Visionaries on How They Spot the Future


Plan on a Browser with attached Cloud storage. Install Chrome on your thumb drive and you will be able to access your files from any computer. (No need to carry them through customs)
Google Set to Meld GDrive With Chrome OS

BUT...
Who owns your files on Google Drive?
… When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.
The rights that you grant in this licence are for the limited purpose of operating, promoting and improving our Services, and to develop new ones. This licence continues even if you stop using our Services (for example, for a business listing that you have added to Google Maps)."


They are completely open when stealing your data in Nigeria.


Handy API?
April 24, 2012
Millions of Harvard Library Catalog Records Publicly Available
News release: "The Harvard Library announced it is making more than 12 million catalog records from Harvard’s 73 libraries publicly available. The records contain bibliographic information about books, videos, audio recordings, images, manuscripts, maps, and more. The Harvard Library is making these records available in accordance with its Open Metadata Policy and under a Creative Commons 0 (CC0) public domain license. In addition, the Harvard Library announced its open distribution of metadata from its Digital Access to Scholarship at Harvard (DASH) scholarly article repository under a similar CC0 license... The catalog records are available for bulk download from Harvard, and are available for programmatic access by software applications via API's at the Digital Public Library of America (DPLA). The records are in the standard MARC21 format."


Stay current?
Wavii is quite simply a neat way to follow your favourite topics. Unlike your RSS feeds, Wavii is filtered so that only one headline for each story is shown to you. So, you’re able to keep track of the big events in each topic without being drowned in repeat information.
… Wavii only allows Facebook sign-in, which will upset a few people for sure.


For my fellow teachers. Perhaps we could create a lesson on how to create a lesson?
The Digital Education Revolution, Cont'd: Meet TED-Ed's New Online Learning Platform
… Back in March, TED, after realizing that teachers had begun using its iconic videos as instructional aides, launched a YouTube channel dedicated to educational videos.
Today, it's going a step further: TED-Ed is launching a suite of tools that allow teachers to design their own web-assisted curricula, complete with videos, comprehension-testing questions, and conversational tools. TED-Ed provides a template -- think Power Point slides, with populate-able fields -- that teachers can fill in with customized content: lesson titles, lesson links, student names, embedded video, test questions, and the like. Once saved, a lesson generates a unique URL, which allows teachers to track which students have watched assigned videos, how they've responded to follow-up questions, and, in general, how they've interacted with the lesson itself.


For my Starving Students (and cheap people, like me)
How to get the most free online storage
All cloud storage services offer a free plan, with varying levels of storage and features.
… let's take a look at the free upgrades some of these services are offering, and how you can take advantage of them today.
First, let's get the services out of the way that aren't currently offering free upgrades. SkyDrive, Google Drive, Cubby, and iCloud all start with a free plan, then if you need more storage you'll have to pay.
That leaves us with Dropbox and Box.

Posted by at No comments:
Subscribe to: Posts (Atom)