Monday, February 5, 2007

Former Ark. governor hit with ethics complaint over destroyed hard drives. Former Ark. governor hit with ethics complaint over destroyed hard drives. An Arkansas resident has filed an ethics complaints against the state's former governor, Mike Huckabee, who ordered the destruction of hard drives in 83 state computers and four servers before leaving office. Huckabee is now eyeing a run for the GOP presidential nomination. [Computerworld Privacy News] 10:21:11 PM  PermaLink   / trackback []

Technology News: Consumer: New Site Encourages Community Web Surfing Me.dium.com tracks your Web browsing habits and reveals which sites are being visited at any given moment by people and friends with similar patterns. Those people and their sites appear as colored icons in a Web browser session. The point is to let you see when some of your friends or even a crowd of strangers are gathering on a site presumed to be of interest to you. 10:11:30 PM  PermaLink   / trackback []

FTC to release ID theft data. FTC to release ID theft data. The Federal Trade Commission on Wednesday will release its latest "Consumer Sentinel" statistical analysis on identity theft, a precursor to a more comprehensive report later this year on ID fraud. [Computerworld Privacy News] 9:08:11 PM  PermaLink   / trackback []

Senator, witnesses say health IT office is dropping ball on privacy "I fear that HHS is not acting fast enough" to build privacy and security into the emerging Nationwide Health Information Network, Akaka said. The senator's position was bolstered by testimony from Mark Rothstein, director of the Institute for Bioethics, Health Policy and Law at the University of Louisville School of Medicine in Louisville, Kentucky. In Kolodner's office, "the focus on privacy is currently lagging behind" work on technical issues such as network architectures, Rothstein testified. And Carol Diamond, managing director of the Markle Foundation's health programs, said privacy and security policies should be finalized before technology is developed. "If technology is developed in advance of, or in the absence of, the relevant policy framework, our nation runs the risk of inappropriate uses of personal information followed by a public clamor for hasty remedies," Diamond said. "In those circumstances, we may find ourselves retrofitting complex technologies at great costs....This unnecessary cycle will undermine the sustainability of a health information sharing network." 3:23:12 PM  PermaLink   / trackback []

IOL: Who watches the watchers? Chicago - In some cities in Europe and the United States, a person can be videotaped by surveillance cameras hundreds of times a day, and it's safe to say that most of the time no one is actually watching. But the advent of "intelligent video" - software that raises the alarm if something on camera appears amiss - means Big Brother will soon be able to keep a more constant watch, a prospect that is sure to heighten privacy concerns. Combining motion detection technology with the learning capabilities of video game software, these new systems can detect people loitering, walking in circles or leaving a package. 3:18:44 PM  PermaLink   / trackback []

Research Reveals Data Loss Still Major Threat Despite Increased Corporate Efforts. Research Reveals Data Loss Still Major Threat Despite Increased Corporate Efforts. Focus on threat of outside attacks overlooks danger employee behavior. [GT: Security and Privacy] 3:13:18 PM  PermaLink   / trackback []

VA data missing again. VA data missing again. The Department of Veterans Affairs is again the victim of data loss. A VA-owned, portable hard drive potentially containing personal information on an unknown number of veterans has been reported missing from a VA facility in Alabama. The VA announced Feb. 2 that a department employee at a medical facility in Birmingham, Ala., reported that the hard drive may have been stolen. In May 2006, a laptop computer and external hard drive containing personal data on about 26.5 million veterans and their families were stolen from the home of a VA employee in suburban Maryland. The laptop and hard drive were recovered a month later, and FBI officials said the data most likely had not been compromised. But the theft became a department scandal because several high-ranking VA officials failed to deal with the loss expeditiously. [FCW: Privacy] 3:08:16 PM  PermaLink   / trackback []

GAO questions HHS efforts to secure electronic health records. GAO questions HHS efforts to secure electronic health records. The Government Accountability Office is calling on the Department of Health and Human Services to come up with a plan to protect the security of health data exchanged electronically. HHS said it's already doing so. [Computerworld Privacy News] 3:03:33 PM  PermaLink   / trackback []

German court bans police from spying on PCs. German court bans police from spying on PCs. A decision from Germany's highest court resolves confusion over police power to covertly install spyware on the computers of suspected criminals. [Computerworld Privacy News] 2:57:02 PM  PermaLink   / trackback []

U.S. Set to Begin a Vast Expansion of DNA Sampling - New York Times The Justice Department is completing rules to allow the collection of DNA from most people arrested or detained by federal authorities, a vast expansion of DNA gathering that will include hundreds of thousands of illegal immigrants, by far the largest group affected. The new forensic DNA sampling was authorized by Congress in a little-noticed amendment to a January 2006 renewal of the Violence Against Women Act, which provides protections and assistance for victims of sexual crimes. The amendment permits DNA collecting from anyone under criminal arrest by federal authorities, and also from illegal immigrants detained by federal agents. Over the last year, the Justice Department has been conducting an internal review and consulting with other agencies to prepare regulations to carry out the law. The goal, justice officials said, is to make the practice of DNA sampling as routine as fingerprinting for anyone detained by federal agents, including illegal immigrants. Until now, federal authorities have taken DNA samples only from convicted felons. The law has strong support from crime victims' organizations and some women's groups, who say it will help law enforcement identify sexual predators and also detect dangerous criminals among illegal immigrants. [...] While the proposed rules have not been finished, justice officials said they were certain to bring a huge new workload for the F.B.I. laboratory that logs, analyzes and stores federal DNA samples. Federal Bureau of Investigation officials said they anticipated an increase ranging from 250,000 to as many as 1 million samples a year. The laboratory currently receives about 96,000 samples a year, said Robert Fram, chief of the agency's Scientific Analysis Section. [...] "What this does is move the DNA collection to the arrest stage," said Erik Ablin, a Justice Department spokesman. "The general approach," he said, "is to bring the collection of DNA samples into alignment with current federal fingerprint collection practices." He said the department was "moving forward aggressively" to issue proposed regulations. The 2006 amendment was sponsored by two border state Republicans, Senator Jon Kyl of Arizona and Senator John Cornyn of Texas. In an interview, Mr. Kyl said the measure was broadly drawn to encompass illegal immigrants as well as Americans arrested for federal crimes. He said that 13 percent of illegal immigrants detained in Arizona last year had criminal records. [...] The F.B.I. also loads DNA profiles from local and state police into the federal database and runs searches. Only seven states now collect DNA from suspects when they are arrested; of those, only two states are authorized by their laws to send those samples to the federal database. [...] Many groups warned that the measure would compound already severe backlogs in the F.B.I.'s DNA processing. Mr. Fram of the F.B.I. said there had been an enormous increase in the samples coming to the databank since it started to operate in 1998, but no new resources for the bureau's laboratory. Currently about 150,000 DNA samples from convicted criminals are waiting to be processed and loaded into the national database, Mr. Fram said. 2:38:44 PM  PermaLink   / trackback []

US Set on Expansion of Security DNA Collection. US Set on Expansion of Security DNA Collection. An anonymous reader dropped us a link to this New York Times article about a 'vast expansion' of DNA sampling here in the US. A little-noticed rider to the January 2006 renewal of the 'Violence Against Women Act' allows government agencies to collect DNA samples from any individual arrested by federal authorities, and from every illegal immigrant held for any length of time by US agents. The goal is to make DNA collection as routine a part of detainment as fingerprinting and photography. Privacy experts and immigrant rights groups are decrying this initiative already. Many are also skeptical of lab throughput, as FBI analysts indicate this may increase intake by as much as a million samples per year. There is already a backlog of 150,000 samples waiting to be entered into the agency's database. [Slashdot: Your Rights Online] 2:28:59 PM  PermaLink   / trackback []

My Way News - States Challenge Nat'l Driver's License States will have to comply by May 2008. If they do not, driver's licenses that fall short of Real ID's standards cannot be used to board an airplane or enter a federal building or open some bank accounts. About a dozen states have active legislation against Real ID, including Arizona, Georgia, Hawaii, Massachusetts, Missouri, New Hampshire, Oklahoma, Utah and Wyoming. Missouri state Rep. James Guest, a Republican, formed a coalition of lawmakers from 34 states to file bills that oppose or protest Real ID. Though most states oppose the law, some such as Indiana and Maryland are looking to comply with Real ID, Sundeen said. 2:25:01 PM  PermaLink   / trackback []

More States Challenging National Driver's Licenses. More States Challenging National Driver's Licenses. berberine writes  "A revolt against a national driver's license, begun in Maine last month, is quickly spreading to other states. The Maine Legislature on Jan. 26 overwhelmingly passed a resolution objecting to the Real ID Act of 2005. The federal law sets a national standard for driver's licenses and requires states to link their record-keeping systems to national databases. Within a week of Maine's action, lawmakers in Georgia, Wyoming, Montana, New Mexico, Vermont and Washington state also balked at Real ID. They are expected soon to pass laws or adopt resolutions declining to participate in the federal identification network. Maine's rejection was recently discussed on slashdot."  [Slashdot: Your Rights Online] 2:22:19 PM  PermaLink   / trackback []

Retailers, Banks Trade Blame in Data Thefts. Retailers, Banks Trade Blame in Data Thefts. The Washington Post today ran a story I wrote about data breach legislation being crafted on Capitol Hill. Lawmakers are looking to respond to the almost daily disclosures of companies, schools and government agencies suffering data breaches or otherwise exploiting consumers' personal data. Since February 2005, when data mining giant ChoicePoint divulged that it had sold data on 145,000 consumers to criminals, there have been more than 100 million instances in which Americans have had their personal data compromised due to data breaches and mishaps, according to Privacy Rights Clearinghouse. It's difficult to find a policy issue that's more timely than data privacy and security. Based on my recent interviews, it is clear that this issue is shaping up to be a slugfest between the retail industry and small banks. A recent high-profile data breach at TJX, the Massachusetts-based parent of discount retailers TJ Maxx and Marshalls, happened in the backyard of House Financial Services Committee Chairman Barney Frank (D-Mass.). According to Frank, retailers like TJX are not doing enough to protect their customers' data (TJX said hackers had broken into its credit and debit card processing network for six months last year and in a separate period in 2003). Frank wants retailers to bear more of the costs that banks incur when canceling new accounts, issuing new cards and dealing with the fallout from angry and confused customers. I suspect that his argument is likely to resonate strongly with many consumers. Retailers tell a different story. Mallory Duncan, senior vice president of the National Retail Federation, sums up their point of view: "Most of the larger banks have very sophisticated, round-the-clock fraud monitoring systems in place, but a lot of the smaller institutions don't have those systems," he said. "These institutions have abdicated their responsibilities in this regard, and now they want retailers to pay for it." The rest of the story is here. Security Fix will be keeping a close eye on this key issue. I will be moderating a panel on possible legislative solutions to data privacy and breach problems at the RSA Security conference in San Francisco next Tuesday. If you're heading out there as well, please drop by the panel to join in the conversation; I plan to leave plenty of time for Q&A. [Security Fix] 2:08:21 PM  PermaLink   / trackback []

Super Bowl-Related Web Sites Hacked. Super Bowl-Related Web Sites Hacked. A recent vist to some Super Bowl host sites could mean an infected PC. [PC World: Latest Technology News] 1:54:25 PM  PermaLink   / trackback []

Super Bowl Site Trojan Aims to Nab Passwords. Super Bowl Site Trojan Aims to Nab Passwords. This story was updated at 3:02 p.m. Please read the entire post. -- The official Web site of Dolphin Stadium -- the location of this weekend's Super Bowl XLI game -- has been infected with a Trojan horse program. The virus seeks to download keystroke-logging software on Windows machines if users visit the site without the latest security updates from Microsoft, security experts warn. Websense said the site still hosts the virus, and it advises people to steer clear of the site for now. The Trojan tries to use two different exploits to break into Windows PCs; one of them was fixed by a patch Microsoft issued just last month.. It is clear that the bad guys are counting on major traffic to the site this weekend. According to Websense, the site is receiving a large number of visitors, thanks in part to some Super Bowl search terms that prominently link to the site. According to Web traffic-monitoring firm Alexa, the stadium site receives about 784,000 hits per week. If you haven't been diligent about applying Microsoft patches, please take a moment to do that now by visiting Microsoft Update. Microsoft always advises consumers to better protect themselves by visiting only "trusted sites." However, this type of attack highlights that even popular consumer sites can harbor serious problems. High-profile Web sites like Dolphin Stadium's should do even a rudimentary security review to thwart this type of attack. Update, 3:02 p.m. ET: Stadium spokesman George Torres now says the site has been cleaned up. I've confirmed his claims with a few outside experts. It also appears that the same virus may have been seeded into other sites. The main "podcasts" page on the Web site for the Center for Disease Control and Prevention appears to have been infected at some point (ah, the irony). It is unclear when that could have occurred, and it does not appear to be there now. The folks at CDC are checking on the situation. There obviously are multiple sites currently infected with this Trojan, so make sure you're up to date on Microsoft patches. This attack depends on the user allowing Javascript computer code to run in the browser. I often plug the "noscript extension for Mozilla's Firefox browser, which helps block this attack even on machines that do not have the patch. [Security Fix] 1:46:38 PM  PermaLink   / trackback []

Google's Master Plan (Video). Google's Master Plan (Video). Here[base ']s a slick video by some German students about privacy concerns with Google[base ']s ability to collect personal information. Little heavy on conspiracy theories (Google DNA?), and totally lacking in any theoretical analysis (that[base ']s what my dissertation is for), but nice to see some effort going into communicating these concerns to a broader audience. [via Google Blogoscoped] [michaelzimmer.org] 1:44:45 PM  PermaLink   / trackback []

TiVo and User Privacy. TiVo and User Privacy. The San Francisco Chronicle reports that TiVo is collecting and selling data on what parts of broadcasts people are rewinding for review and what commercials they are skipping. Dubbed [base "]StopWatch,[per thou] this data-collection practice reflects the growing ease with which various media and Internet service providers can collect and exploit vast amounts of information about consumers[base '] everyday habits. TiVo maintains that there is little privacy threat to end users, arguing that [base "]We don[base ']t know what any particular person is watching,[per thou] and [base "]We only know what a random, anonymous sampling of our user base is watching.[per thou] While it is probably true that they are only accessing and selling a random, anonymous sampling of usage data, the larger concern is that user data is collected and stored in the first place. The fact that they only sample a random subset of the data is only a temporary comfort (and perhaps only a temporarily self-imposed restriction). And given the aftermath of AOL[base ']s botched release of [base "]anonymized[per thou] user data, I have less comfort with TiVo[base ']s claim that the data is truly anonymous. TiVo is trying to do the right thing, but I[base ']m concerned that their execution might fail. Time will tell. (And this would make an excellent case study for any student looking to explore the privacy implications of new media technologies[sigma]hint hint) [michaelzimmer.org] 1:40:02 PM  PermaLink   / trackback []

TiVo sees if you skip those ads TiVo revealed the other day that it's offering TV networks and ad agencies a chance to receive second-by- second data about which programs the company's 4.5 million subscribers are watching and, more importantly, which commercials people are skipping. This raises a pair of troubling questions: Is TiVo, which revolutionized TV viewing with its digital video recording technology, now watching what people watch? And is it selling that sensitive info to advertisers and others? The answers, apparently, are no and no. "I promise with my hand on a Bible that your data is not being archived and sold," said Todd Juenger, TiVo's vice president and general manager of audience research and measurement. "We don't know what any particular person is watching," he said. "We only know what a random, anonymous sampling of our user base is watching." Still, privacy advocates say TiVo's new data service -- dubbed StopWatch -- reflects the growing ease with which companies could, if they so choose, collect and exploit vast amounts of information about consumers' everyday habits. "It's a constant struggle to maintain your privacy in the modern era," said Kurt Opsahl, a staff attorney at San Francisco's Electronic Frontier Foundation. "We have entered an era in which more and more information about you is being collected and maintained." He added: "In the past, you had a lot of privacy protection because information about you was too difficult to collect and sort. Now that protection is gone because computers can do it." TiVo's potential to monitor (and embarrass) millions of people was made clear in 2004 after Janet Jackson's right breast made a surprise appearance during the Super Bowl halftime show. TiVo reported that this fleeting glimpse of celebrity flesh "drew the biggest spike in audience reaction TiVo has ever measured ... as hundreds of thousands of households used TiVo's unique capabilities to pause and replay live television to view the incident again and again." 1:37:53 PM  PermaLink   / trackback []

Google to address Indian security concerns. Google to address Indian security concerns. The Indian government is in talks with Google to address longstanding concerns over too-sharp resolution of Google Maps imagery depicting sensitive areas of the country. [Computerworld Data Mining News] 1:33:17 PM  PermaLink   / trackback []

Super Bowl Virus Spreads. Super Bowl Virus Spreads. The game's over and patches are available, but many sites are infected with malicious code. [PC World: Latest Technology News] 1:29:48 PM  PermaLink   / trackback []