Wednesday, September 20, 2006


News Item 7290 HP's harsh techniques.

HP's harsh techniques.

HP's hired guns did more than just fraudulently access phone records of its directors, employees, and journalists and send tracking bugs to reporters via email, they also took to data-mining those emails, according to a report in the San Francisco Chronicle.

In an ironic twist, the HP investigators also checked the phone records of Carly Fiorina, the Palo Alto company's former chief executive officer who played a critical role in initiating the probe shortly before her ouster in 2005.

HP investigators collected and analyzed thousands of e-mails and phone records, including those of its executive council members. They also sent e-mails embedded with software that could pinpoint addresses where the messages were eventually forwarded, the source said.

In a more traditional avenue of inquiry, the investigative team analyzed news reports, comparing quotes from unnamed sources with the language typically used by the company's directors.

The revelations show that the HP probe, which has engulfed one of Silicon Valley's premier companies in a major scandal, was a sophisticated operation with many people involved. The legal repercussions of the investigation, if any, remain unclear, although several investigations are pending with criminal proceedings among the possible outcomes.

A HP spokesperson defended the practice.

"As more high-ranking leakers are identified, the need to obtain intelligence from them will remain critical," the spokesperson said. "And having a HP program for questioning leakers will continue to be crucial to getting company-saving information."

The spokesperson said HP had never authorized fraud but indicated that aggressive spying techniques short of fraud remained important tools in the company's efforts to combat journalism.

"I cannot describe the specific methods used. I think you understand why," he said. "If I did, it would help the journalists and leakers learn how to resist questioning, and to keep information from us that we need to prevent new leaks on our company. But I can say the procedures were tough, and they were safe and lawful and necessary."

Note: These are not real quotes. They are plays off quotes from this New York Times article about torture and the Geneva Convention.

[27B Stroke 6]
2:13:16 PM  PermaLink   / trackback []  

News Item 7289 TSA Nabbed My I.D., Techie Says.

TSA Nabbed My I.D., Techie Says.

Mary Hodder, the brains behind video aggregator service Dabble, flew through JFK last Friday and had her identification lost by a TSA agent while they were searching through her bag. A TSA agent then refused to let her file a report and covered up his badge with his hand when she asked for his badge number, according to a post on her blog.

Hodder managed to make it home, but suspects her driver's license was given to another passenger.

At this point, I don't get my boarding pass or license back from the other agent. Later I am told that the woman who gets the Boarding Passes and Driver's Licenses, as you pass through the metal detector, hands the one she has off, and then takes the next one from the person coming through next.

But, she didn't hand it to me. She likely gave it to someone else, probably the next person in line. I get out, after they inspect my bag for secret blow-up water (you know, our liquid diet hoax by the current administration to get them reelected). I realize I don't have my ID and Boarding Pass. I go back to the TSA desk the the security area exit (I'm a few feet away), and an Agent Derreck says they have nothing of mine, without checking (across the room from where the actual thing happened). I get him to walk over in the security line to check for sure. He does and comes back empty handed. I ask, "How will I get on the plane?" He takes me to Jet Blue special services, where they cut me another Boarding Pass. But I have no DL, so the JetBlue woman asks me for other ID, and it turns out that 2 credit cards, my gym ID with picture, and costco ID with picture, are enough to get me another boarding pass. She double checks my California address verbally with me which I repeat back to her as I stand next to Agent Derreck.

While she was printing, Agent Derreck starts to talk about how TSA over in the security area has an "... ironclad process for bringing people through the metal detector." Basically, they bring one person through, check ID and boarding pass again, and then once they give it back, motion the next person through the metal detector. This is how they regulate people coming through the metal detector. As he says this, a different TSA agent, a woman, walks up the JetBlue service desk and hands a New York State Driver's License to the JetBlue woman, and says, "This person didn't get their ID back." Agentk grabs the license from the JetBlue woman's hand, and says to me, "This kind of looks like you." To which I say, "That woman has tons of blond hair, and mine is brown, plus I live in CA." He hands it back to the JetBlue woman. A couple of minutes later, another TSA agent, also a woman, walks up the the JetBlue service counter with a Driver's License from Kansas, and hands it in, saying again that someone didn't get their ID returned.

After getting my boarding pass reprinted, I say to Agent Derreck want to make a complaint about TSA. He calls Port Authority but only tells me he's called "someone" and they'll be there in a few minutes to take it.

Port Authority Officer M. Wapole (#1746) arrives, takes a report, gives me the report number, a phone number and the name of the officer and date and time. I ask for a copy of the report and he says I'm not allowed to have one. I am surprised. He says it's private property. I ask how I make the complaint against TSA and he says he's not TSA. So I go back to Agent Derreck of TSA.

Agent Derreck says he won't take a complaint. He says I can make one at www.tsa.gov (so much for people without computers). I ask for his name and the agent's name at the metal detector, and he covers his shirt. But I can see that it says "Agent Derreck" before his hand is fast enough to cover his name tag, in brass. He says, "I won't give you my name or hers." And walks off, with his hand over his right breast.

Hopefully Hodder will have more luck than Edward Hasbrouck has had in trying to figure out what happened (1, 2, 3)

Via IP list.  [27B Stroke 6]


2:05:40 PM  PermaLink   / trackback []  

News Item 7288 Not Security Theater, Security Game.

Not Security Theater, Security Game.

screenshot of airport security gameTired of whinging about the rules that prevent you from bringing bagels with cream cheese, but not bagels with butter, onto airplanes?

Give The Arcade Wire's Airport Security flash game a go and see how good you are at removing passenger's hemorrhoid cream, shirts, shoes and pants.

Careful, though, the game's pace and arbitrary rules might make you sympathetic to the poor folks who have to paw through your belongings at the airport.

Also, don't bring rules with you. For instance, snakes seem to be fine on the plane, until you get a security alert telling you otherwise.

Let me know if you can best my high score of 100 points.

[27B Stroke 6]
1:59:03 PM  PermaLink   / trackback []  

News Item 7287 Feds Want ISPs To Keep Your Data.

Feds Want ISPs To Keep Your Data.
Attorney General Alberto Gonzales told Congress Tuesday that it should require ISPs to keep data on its customers for years, ostensibly to clamp down on child pornography and terrorism.

If kept those records could be acquired through subpoena, self-issued National Security Letters, or by simple request from law enforcement. They might also increasingly be used in civil disputes, divorces and custody cases.

At Tuesday's hearing, Gonzales said he agreed with the sentiment of 49 state attorneys general who in a June letter to Congress expressed support for a federal law that would require longer retention of customer records.

"We respect civil liberties, but we have to harmonize this so we can get more information," he said.

The subject has prompted some alarm among Internet service provider executives and civil liberties groups after the Justice Department took Google to court earlier this year to force it to turn over information on customer searches. Civil liberties groups also have sued Verizon and other telephone companies, alleging that they are working with the government to provide information without search warrants on subscriber calling records.

Link.

The Bush Administration used to be formally against mandatory data retention policies before the Senate, but the document (.pdf) showing its old position is now damaged and unopenable. The broken link is accompanied by a statement that says: "Note: This document reflects the position of the United States at the time of its drafting in 2001. In light of ongoing discussions and evolving policy positions on issues relating to some substantive and procedural issues, it may no longer reflect the official position of the Department or the United States."

[27B Stroke 6]


1:33:06 PM  PermaLink   / trackback []  

News Item 7286 Terrorism no excuse for privacy breaches, says EU regulator.

Terrorism no excuse for privacy breaches, says EU regulator.

No need to change laws

Terrorism and organised crime should not be used as excuses for passing laws which undermine people's privacy and data protection rights, according to the European Data Protection Supervisor (EDPS). Existing laws do not need changed, he said.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
10:51:17 AM  PermaLink   / trackback []  

News Item 7285 People prefer iPods to biometric passports.

People prefer iPods to biometric passports.

Anyone for an iDcard?

The Home Office has tried to frighten people into taking its identity plans seriously by publishing a marketing survey it said proved their passports were easy targets for ruthless criminals.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
10:48:33 AM  PermaLink   / trackback []  

News Item 7284 HP investigation went further than previously thought.

HP investigation went further than previously thought.

Reporters followed, say leaks

Officials at Hewlett-Packard have been asked to testify to the House of Representatives which is investigating the company's media leak investigations. Chairwoman Patricia Dunn and General Counsel Ann Baskins have been asked to testify.

[The Register - Internet and Law: Digital Rights/Digital Wrongs]
10:44:01 AM  PermaLink   / trackback []  

News Item 7283 DHS Picks Cybersecurity Czar.

DHS Picks Cybersecurity Czar. Position created more than a year ago finally gets filled.  [PC World: Latest Technology News]
10:41:19 AM  PermaLink   / trackback []  

News Item 7282 New AIM Worm a Stubborn Foe.

New AIM Worm a Stubborn Foe. Sophisticated computer worm is setting up a botnet that may be hard to beat. [PC World: Latest Technology News]
10:39:11 AM  PermaLink   / trackback []  

News Item 7281 Newly Detected IE Exploit Spells Massive Spyware Trouble.

Newly Detected IE Exploit Spells Massive Spyware Trouble.

A previously undocumented flaw in Microsoft's Internet Explorer Web browser is reportedly being exploited by online criminals to install an entire kitchen sink of malicious software on any computer that visits any of a handful of sites currently exploiting the vulnerability.

[...]

Update, Sept. 19, 12:06 a.m.: I neglected to mention that IE users can mitigate this flaw by disabling Javascript in the browser. To do this, click on "Tools," then "Options," and then on the "Security" tab, scroll down to the section marked "Scripting," select either the option for "prompt" or "disable" of active scripting.

Update, Sept. 19, 12:08 p.m.: Microsoft is now acknowleging the existence of this flaw, which it said "could allow an attacker to execute arbitrary code on the user's system," and that Redmond "is aware of limited attacks that attempt to exploit the vulnerability. The security update is now being finalized through testing to ensure quality and application compatibility and is on schedule to be released as part of the October security updates on October 10, 2006, or sooner as warranted."

Microsoft may quickly find that sooner is in fact warranted in this case. It's worth noting that once again online crooks have waited until just after Microsoft releases its monthly patches to begin exploiting this new flaw (Sunbelt said it first spotted this new exploit last week, just hours after Patch Tuesday). The bad guys appear to be gaming Microsoft's patch process with a fair degree of regularity.

[Security Fix]
10:37:41 AM  PermaLink   / trackback []  

News Item 7280 Spammers Cashing in on Free Hosting Services.

Spammers Cashing in on Free Hosting Services. Junk e-mailers are using free Web pages to disguise spam sources, manipulate search engines. [PC World: Latest Technology News]
10:34:28 AM  PermaLink   / trackback []  

News Item 7279 Porn Sites Use New IE Bug to Install Spyware.

Porn Sites Use New IE Bug to Install Spyware. Visit a Russian porn site using IE 6, risk a spyware installation. [PC World: Latest Technology News]
10:31:21 AM  PermaLink   / trackback []