Friday, March 3, 2006


News Item 5371 InformationWeek | E-Mail | AOL Defends Certified Mail Plans | March 2, 2006

AOL has no intention of swaying from its certified e-mail course, and at least one analyst firm said it shouldn't feel any pressure to do so.

In a statement following the press conference of the coalition of organizations rallying against AOL's proposed use of GoodMail's Certified Email pay-to-send service, AOL said, "Implementation of this timely and necessary safety and security measure for our members takes place in the next 30 days. Mark it on your calendars."

Ferris Research analyst Richi Jennings commented that "Those that run e-mail services are perfectly entitled to act on user spam complaints. As the saying goes, "My server, my rules."

The coalition, characterized AOL's move as an "e-mail tax" that "disempowers" regular people and a "step toward dismantling the free and open Internet." "The very existence of online civic participation and the free Internet as we know it are under attack," according to Eli Pariser, executive director of MoveOn.org Civic Action.

"Balderdash and piffle," replies Jennings. "Nothing's really changed. If users are complaining about some e-mail, service providers will block the sender, whether or not they pay some sort of a bond or fee. There's no substantive change here. If you're an existing sender with a good reputation, you should have nothing to worry about . . . well, nothing new anyway.


11:57:33 PM  PermaLink   / trackback []  

News Item 5370 AOL Won't Budge on Email Tax.

AOL Won't Budge on Email Tax. deman1985 writes "InformationWeek reports that AOL has no intentions to budge on its use of certified email. The company today released a statement apparently in response to the vast amounts of criticism over the past week from consumers and various organizations. From the article: 'We believe more choices, and more alternatives, for safety and e-mail authentication is a good thing for the Internet, not bad,' said an AOL spokesman. 'Everything that AOL has in place today free for e-mail senders remains -- and will only improve.' The programs critics aren't so optimistic, but that doesn't seem to be hampering the company's plans. In a quote that could only be labeled short and sweet, AOL announced, 'Implementation of this timely and necessary safety and security measure for our members takes place in the next 30 days. Mark it on your calendars.'" [Slashdot: Your Rights Online]
11:53:35 PM  PermaLink   / trackback []  

News Item 5369 Congress raises broadcast flag for audio | CNET News.com

Digital radio receivers without government-approved copy-prevention technology likely would become illegal to sell in the future, according to new federal legislation announced Thursday.

Rep. Mike Ferguson, a New Jersey Republican, said his bill--which would enforce a so-called Broadcast Flag for digital and satellite audio receivers--was necessary to protect the music industry from the threat of piracy.

Ferguson's proposal would grant the Federal Communications Commission the power to enforce "prohibitions against unauthorized copying and redistribution" for both digital over-the-air radio and digital satellite receivers.

11:46:40 PM  PermaLink   / trackback []  

News Item 5368 Audio Broadcast Flag Introduced in Congress.

Audio Broadcast Flag Introduced in Congress.   Declan McCullagh writes  "We found out in mid-2004 that the RIAA was lobbying the FCC for an audio version of the broadcast flag. But because a federal appeals court slapped down the FCC's video version last year, the RIAA needs to seek formal authorization from Congress. That process finally began today when the audio flag bill was introduced. It would hand the FCC the power to set standards and regulate digital and satellite radio receivers, and RIAA Chairman Mitch Bainwol says it strikes "a balance that's good for the music, good for the fans, and good for business." The text of the bill is available online."  [Slashdot: Your Rights Online]
11:43:02 PM  PermaLink   / trackback []  

News Item 5367 Breach notification laws: When should companies tell all?

Breach notification laws: When should companies tell all? While a patchwork of state laws may force companies to pay more attention to data security, there's little consensus on when they should be required to disclose breaches. [Computerworld Privacy News]
7:47:53 PM  PermaLink   / trackback []  

News Item 5366 Ohio Secretary of State sued over ID info posted online.

Ohio Secretary of State sued over ID info posted online. Ohio Secretary of State Kenneth Blackwell is being sued in a fight over the use of some residentsÂ[base '] Social Security numbers on state Web sites, where publicly searchable retail purchase records are stored. [Computerworld Privacy News]
7:45:51 PM  PermaLink   / trackback []  

News Item 5365 State college in Colorado warns 93,000 after laptop theft.

State college in Colorado warns 93,000 after laptop theft. A state college in Denver believes it may have lost sensitive information on more than 93,000 students after one of the school's laptop computers was stolen from an employee's home late last month. [Computerworld Privacy News]
7:31:17 PM  PermaLink   / trackback []  

News Item 5364 RFID: Sign of the (End) Times?

RFID: Sign of the (End) Times?  Christian millennialists have seen the apocalypse augured in everything from Social Security numbers to movable type. A new book warns that that the long-dreaded "mark of the beast" could be an RFID chip. For real this time. By Mark Baard. [Wired News: Security Blanket]
7:29:17 PM  PermaLink   / trackback []  

News Item 5363 FCC Probes Caller-ID Fakers.

FCC Probes Caller-ID Fakers. Caller-ID spoofing services let users appear to be dialing from any phone number they choose. Now federal investigators are trying to get the real names of anonymous callers. By Kevin Poulsen. [Wired News: Security Blanket]
7:26:00 PM  PermaLink   / trackback []  

News Item 5362 An Australian Perspective on DMCA Rulemaking.

An Australian Perspective on DMCA Rulemaking.

As we explained in our report, "DMCA Triennial Rulemaking: Failing the Digital Consumer," the DMCA's triennial rulemaking process has been a conspicuous failure when it comes to addressing the legitimate concerns of American digital consumers. The rulemaking was created by Congress as a "safety valve" to craft exceptions to the DMCA to permit noninfringing uses of DRMd media. (The latest rulemaking is going on right now before the Copyright Office, with a final report due in October.)

In a highly-anticipated report, an Australian parliamentary committee criticizes many aspects of the U.S. rulemaking process, rejecting it as a blueprint for a similar Australian process. The report will be of interest to other countries seeking a sensible way to respond to the U.S. effort to export its unbalanced DMCA regime through recent free trade agreements (FTAs).

Thanks to a free trade agreement with the U.S. that came into force in January 2005, Australia is in the process of re-writing its own Technological Protection Measure law to "harmonize" with the U.S. DMCA. The AUS FTA allows Australia to enact its own "safety valve" procedure to approve 4 year exceptions to the general prohibition on circumventing DRM. The parliamentary committee report provides recommendations on how to draft the Australian legislation that will set up that procedure. It follows an extensive public consultation, where, not surprisingly, entertainment industry lobbyists urged the Australians to ape the U.S. rulemaking process, and Australian academics, librarians and public interest groups called for a more careful approach.

The Australian parliamentary committee identified the flaws in the U.S. procedure, opting to go its own way. In particular, the report criticizes the following aspects of the US rulemaking procedure:

  • The report takes aim at a flaw in the foundation of the DMCA rulemaking enterprise: it authorizes exceptions for acts of infringement, but not for the necessary tools. The report goes so far as to say that this is "a lamentable and inexcusable flaw" that "verges on absurdity," transforming any exceptions that might be granted into "little more than empty promises."
  • The U.S. Copyright Office requires that all proposed exceptions identify a "class of works" without reference to any characteristics of the users of the works. This puts noninfringing users (e.g., educators wanting to extract clips from DVDs) in the perverse position of having to argue for unnecessarily broad exceptions (e.g., all movies released on CSS-protected DVDs). The Australian report rejects this approach, explicitly recommending that use-based exceptions be permitted.
  • The U.S. Copyright Office requires that those seeking DMCA exceptions demonstrate that the adverse impact of DRM on their noninfringing uses is "substantial". The Australian report rejects this view, concluding that "any adverse impact that can be credibly demonstrated to exist or have existed should be enough."
  • According to the Australian report, if DRM has not yet had an adverse impact on a noninfringing use, proponents of an exception need only show that the adverse impact is "reasonably forseeable." The U.S. Copyright Office approach, in contrast, requires those seeking DMCA exceptions to show, by a preponderance of evidence, that adverse impact is likely. The Australians reject the "preponderance" standard, noting that "[s]uch a threshold virtually requires the proponent of the exception to prove the case beyond doubt before the relevant circumstances have arisen."
  • The Australian report notes that even "individual or isolated incidents of alleged adverse impacts" should be considered, and explicitly contrasted its view with that of the U.S. Copyright Office. The report was particularly scathing of the Copyright Office's dismissive attitude toward consumer inconvenience, specifically deriding the notion that consumers should be expected to buy a different DVD player for every DVD region if they want to enjoy foreign DVDs they have legitimately acquired. It specifically notes that financial imposts that are incurred, or likely to be incurred, to make a non-infringing use of a work due to DRM are pertinent for the "credible demonstration of an adverse impact".

The entire report is required reading for any interested in how our trading partners should respond to the on-going U.S. effort to export the DMCA.

As Australian academic Kim Weatherall notes in her excellent summary, the report also makes thoughtful recommendations about how to avoid some of the problems experienced in the U.S. under the overbroad DMCA, including the need to retain a nexus between anti-circumvention sanctions and copyright infringement, and mechanisms for addressing anti-competitive and non-copyright-related uses of DRM such as region-coding on DVDs. Good news indeed.

[EFF: Deep Links]
7:14:59 PM  PermaLink   / trackback []  

News Item 5361 Copy Protection Coming to (Digital) Radio?

Copy Protection Coming to (Digital) Radio?

Today, Rep. Mike Ferguson (R-N.J.) introduced the "Audio Broadcast Flag Licensing Act of 2006," H.R. 4861, a House companion bill to the Senate's broadcast flag bill.

This bill would require that all future digital radios (both terrestrial, like HD Radio, and satellite, like XM and Sirius) "include prohibitions on unauthorized copying and redistribution of transmitted content." The FCC would be tasked with working out the details.

This is the culmination of months of lobbying by the RIAA to lock down the "record" button on your next radio. Despite the fact that, under existing copyright law, building and using digital radio recorders is clearly legal, thanks to the Audio Home Recording Act (a point we explained in detail before the FCC in 2004).

H.R. 4861 is chilling in at least three ways:

  • If this becomes law, you would need a license from the FCC to build a radio receiver and be forced to incorporate DRM if your receiver has a record button. In other words, satisfying the Code of Federal Regulations would come before satisfying your customers.
  • Notice that "unauthorized" copying and redistribution will be prohibited, rather than unlawful copying and redistribution. Translation: unless you get permission, it's forbidden, even if it would be a fair use or perfectly legal under the AHRA.
  • The bill says that the restrictions "shall not be inconsistent with the customary use of broadcast content by consumers to the extent such use is consistent with the purposes of this act and other applicable law." As we've discussed before, this freezes fair use based on yesterday's "customary uses," rather than leaving room for tomorrow's innovators. Remember, time shifting with your VCR was not "customary" in 1976, nor was platform-shifting CDs to your iPod in 1997.

For a picture of what the RIAA considers permissible, take a look at the comments they filed with the FCC on this topic back in 2004. Here's the list of restrictions they asked for then:

  • Receivers may only record or permit recording of covered content: (a) in direct and immediate response to a consumer pressing a record button; (b) based on a date and time preprogrammed by the consumer.
  • Preprogrammed recordings shall be for a minimum period of 30 minutes in duration.
  • A replay buffer may be used to initiate a recording of a previously broadcast transmission provided that the buffer does not exceed 30 minutes in duration.
  • Each recording of covered content shall be stored and retrieved as a singe continuous session and may not be divided into recordings of individual songs on an automated or non-automated basis using ID information or audio characteristics.
  • The application of these usage rules to covered content shall be stored and associated in a robust manner with any recordings of such covered content.
  • ID information shall be recorded only in a manner that effectively limits its use to display during simultaneous audio playback.
  • No recording device shall record covered content based on ID information.
  • All recordings of covered content must employ robust encryption methods to bind and limit playback to the recording device.
  • Playback of covered content shall be solely on a session basis and shall not be linked in any way to ID information.
  • Playback of covered content shall be at normal speed (defined as within 10% of the speed at which the content was originally recorded). Playback may skip forward and backward at higher speeds within the recorded session without playing any sound provided that no skipping, either forward or backward, shall be permitted to the beginning or end of a song using ID information.

"RIAA believes that these rules appropriately balance the interests of users in recording material off-the-air while protecting the interests of the music industry...."

Neither I nor the Copyright Act agrees.

[EFF: Deep Links]
7:11:14 PM  PermaLink   / trackback []  

News Item 5360 Wal-Mart details its RFID journey.

Wal-Mart details its RFID journey. A little more than a year after Wal-Mart Stores began requiring big supppliers to use RFID tags, the retailer is seeing a return on its investment and pushing more partners to use the supply chain technology. [Computerworld Data Mining News]
7:05:54 PM  PermaLink   / trackback []  

News Item 5359 Survey finds mixed feelings on Web censorship.

Survey finds mixed feelings on Web censorship. Almost have of those surveyed recently about the issue of Internet censorship said governments shouldn't be allowed to restrict online searches. But 40% said search engine companies should follow local laws -- even those that restrict information. [Computerworld Data Mining News]
7:03:22 PM  PermaLink   / trackback []  

News Item 5358 Unified Identity Management.

Unified Identity Management. Tom Olzak submits this paper which explores the common identity and privacy challenges facing Internet users are they move from one content location to another. By Tom Olzak. [Infosec Writers Latest Security Papers]
7:01:05 PM  PermaLink   / trackback []  

News Item 5357 CDT Offers Proposal to Protect Political Speech Online.

CDT Offers Proposal to Protect Political Speech Online. CDT today offered a legislative proposal that would exempt the vast majority of individual speakers on the Internet from campaign finance laws, without creating loopholes that could be easily exploited by state political parties and large donors. CDT drafted the proposal in response to mounting efforts in the House of Representatives to pass a measure (HR 1606) that doesn't go far enough to protect the rights of political speakers on the Internet. That bill was offered in response to a proposal by the Federal Elections Commission to apply campaign finance laws to Internet communications. [Center for Democracy and Technology]
6:58:48 PM  PermaLink   / trackback []  

News Item 5356 The Practical Nomad blog: Who is watching the watchers?

FBI takes airport spy devices (by Mark-Alexander Pieper, [Guam] Pacific Daily News, 4 March 2006):

FBI agents have taken custody of mini-surveillance cameras and listening devices found Thursday at the island's airport.... Several listening devices and at least three small cameras were found after the Guam Department of Customs and Quarantine received a tip from U.S. Customs, said Guam Customs Director Rick Blas. The devices were concealed in the area where customs agents check arriving passengers and their bags.

At least two of the cameras were "live," or in operation, when they were discovered, Blas said, adding that local officials do not yet know where the camera signals were going. A possible link to terrorist activity has been ruled out, according to Guam Homeland Security Adviser Frank Blas Jr....


6:57:25 PM  PermaLink   / trackback []  

News Item 5355 UK parents to get online check of 8m child workers records.

UK parents to get online check of 8m child workers records.

Monumental security and privacy disaster ahoy...

The UK Government today announces plans for a massive data, security and privacy own goal, in the shape of the Safeguarding Vulnerable Groups Bill. The Bill, which is intended to widen and centralise the vetting of people working with children (approximately 8 million individuals), will allow (indeed, compel) employers, including parents hiring nannies and childminders, to check the records of potential employees online.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
6:52:18 PM  PermaLink   / trackback []  

News Item 5354 DoJ 'to probe music download pricing'.

DoJ 'to probe music download pricing'.

Spitzer enquiry proving fruitful?

US Department of Justice investigators have begun to probe major music labels' download pricing policies, sources close to the world's four biggest recording companies told Billboard magazine.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
6:49:48 PM  PermaLink   / trackback []  

News Item 5353 Google Moving Search Records Out of China.

Google Moving Search Records Out of China. Aims to prevent Chinese government access to records without Google permission. [PCWorld.com - Latest News Stories]
6:47:50 PM  PermaLink   / trackback []  

News Item 5352 Computer ills hinder NSA - baltimoresun.com

Two technology programs at the heart of the National Security Agency's drive to combat 21st-century threats are stumbling badly, hampering the agency's ability to fight terrorism and other emerging threats, current and former government officials say.

One is Cryptologic Mission Management, a computer software program with an estimated cost of $300 million that was designed to help the NSA track the implementation of new projects but is so flawed that the agency is trying to pull the plug. The other, code-named Groundbreaker, is a multibillion-dollar computer systems upgrade that frequently gets its wires crossed.

The downfall of the Cryptologic Mission Management program has not previously been disclosed. While Congress raised concerns about the agency's management of Groundbreaker in a 2003 report, the extent and impact of its inadequacies have not been discussed publicly.

Intelligence experts told The Sun that as a result of these failures, agency computers have trouble talking to each other and frequently crash, key bits of data are sometimes lost, and vital intelligence can be overlooked - all as the agency aggressively argues for broader surveillance power under the president's warrantless wiretapping program.

Moreover, there are no agency-wide controls to make sure effective fixes are put in place, and, with the demise of the mission management program, none will be in place anytime soon.
6:46:12 PM  PermaLink   / trackback []  

News Item 5351 OMB delivers positive IT security report

The Office of Management and Budget today presented its report on managing information security systems to Congress. The report showed steady progress in closing security gaps in federal agencies.

OMB's report, "FY2005 Report to Congress on Implementation of the Federal Information Security Management Act of 2002," found 85 percent of IT systems to be certified and accredited -- a 19-percent increase from last year. The quality of the certifications and accreditations at the agencies also increased, with 17 of 25 agencies rated as satisfactory or better. Corrective plans of action were deemed effective for 19 agencies.

However, some areas still need improvement. The report found that nine agencies rarely or sometimes check information systems used by contractors. It noted that one agency did not evaluate that element in its report. Also, testing of security controls dropped by four percent from fiscal 2004, and efforts to report security incidents, such as the spread of an Internet worm, were sporadic, according to the report.

OMB reported that six agencies had weak agencywide plans of action and milestones, and eight agencies were rated as poor for their quality of certification and accreditation processes.

To get the highest rating under the Expanded E-Government Scorecard, agencies must have inspectors general verify their departmentwide IT security remediation process, rate their certification and accreditation process as satisfactory, and have 90 percent of their IT systems properly secured.


6:43:12 PM  PermaLink   / trackback []  

News Item 5350 Security Pipeline | Q&A: Got Data? Beware Privacy Pitfalls, Big Brother

With controversy swirling around ID theft and electronic surveillance by the government, what should corporations do to protect customer data? Jim Dempsey, policy director at The Center for Democracy & Technology (CDT), spells out controversial advice such as "gather less data" and seemingly dire warnings such as "if you gather the data, the government will come calling." Whether you view CDT as an advocate or an adversary, its voice is being heard on Capitol Hill, so it's important to be aware of its stance on important corporate data policies and related issues.
6:40:05 PM  PermaLink   / trackback []  

News Item 5349 Is your staff a threat to your organization's security?

Is your staff a threat to your organization's security? A couple of thousand years ago the Roman poet Juvenal asked "Quis custodiet ipsos custodies?" That is, who will watch the watchers? In over 20 years of consulting, hand-holding, troubleshooting and securing networks one of the most frequently asked questions I hear from business leaders is "How do I keep sensitive data from the prying eyes of the network administrators?" [Identity mangement news]
6:35:03 PM  PermaLink   / trackback []