Wednesday, March 14, 2007

Honoring Sunshine Week. The Total Information Awareness project FOIA saga. Honoring Sunshine Week. 27B tells the sad tale of requesting open records on the government's Total Information Awareness project. 44 months later, still no word. In 27B Stroke 6. [Wired News: Top Stories] 4:29:39 PM  PermaLink   / trackback []

FBI Slips Demand Patriot Act Cuts. FBI Slips Demand Patriot Act Cuts. A probe finds the bureau abused its expanded powers to obtain Americans' private records. Time to put the G-men on a shorter leash. Commentary by Jennifer Granick. [Wired News: Top Stories] 4:25:02 PM  PermaLink   / trackback []

Swap your stuff using the latest peer-to-peer network Downloading by Mail. Swap your stuff using the latest peer-to-peer network -- the U.S. Postal Service. By Jeff Howe from Wired magazine. [Wired News: Top Stories] 4:22:33 PM  PermaLink   / trackback []

Citizen Journalism Wants You! Citizen Journalism Wants You!  Wired News, Wired magazine and NewAssignment.Net invite you to join an open-ended experiment in distributed journalism. Project leader Jay Rosen explains all.Plus: Wired Meets Assignment Zero. [Wired News: Top Stories] 4:19:01 PM  PermaLink   / trackback []

U.S. Spy Case Will Be Heard. U.S. Spy Case Will Be Heard. A Northern California judge will hear arguments in the case of two American lawyers who say they can prove the U.S. spied on them without a warrant. The government says the case should never be heard. In 27B Stroke 6. [Wired News: Top Stories] 4:17:14 PM  PermaLink   / trackback []

Sun CSO: Endless Internet Growth Keeps Security on Back Burner. Sun CSO: Endless Internet Growth Keeps Security on Back Burner. Q&A: Whitfield Diffie, chief security officer at Sun and co-inventor of public-key cryptography, talks about the state of computer security and Microsoft[base ']s role in it. [Computerworld Privacy News] 4:07:25 PM  PermaLink   / trackback []

Four Colorado Counties Placed on Election Watch List. Four Colorado Counties Placed on Election Watch List. Errors with voting machines, delays in voting, inadequate security cited. [GT: Security and Privacy] 4:04:05 PM  PermaLink   / trackback []

ID Fraud Manufacturing Ring Uncovered in Arizona. ID Fraud Manufacturing Ring Uncovered in Arizona. Three month investigation of Arizona Homeland Security Fraudulent Identification Task Force (AFIT) uncovers one of the largest manufacturers of fraudulent identification in Southern Arizona. [GT: Security and Privacy] 4:00:48 PM  PermaLink   / trackback []

Airport security targets the inside threat - CNN.com TAMPA, Florida (CNN) -- The Transportation Security Administration carried out surprise inspections on workers at five airports in Florida and Puerto Rico on Monday, one week after a baggage handler in Orlando allegedly used his airport credentials to smuggle more than a dozen firearms into a commercial jetliner. Some 160 TSA officers, backed by Federal Air Marshals and local police, searched airplanes for contraband, shined flashlights in airport vehicles and patted down contractor employees involved in airport security. The five airports inspected were in Tampa, Orlando, Miami, Fort Lauderdale and San Juan, Puerto Rico. The airport crackdown will continue through the week, spreading to other regions in the country as TSA increases random, unannounced searches targeting those who could misuse their access within the system. "We realize the insider threat is a real threat, and we have to address it," said TSA spokesman Christopher White. 3:58:40 PM  PermaLink   / trackback []

Latest ID-Theft Worry? Copiers. Latest ID-Theft Worry? Copiers. Digital photocopiers use hard drives to store data. If not properly secured, they can be vulnerable to data thieves. By the Associated Press. [Wired News: Security Blanket] 3:55:53 PM  PermaLink   / trackback []

FCW.com News - Bill would protect information about students from recruiters An amendment to the No Child Left Behind (NCLB) Act seeks to keep military recruiters from accessing secondary students' personal data by requiring parents to choose to share that information rather than having to opt out of sharing it. Rep. Mike Honda (D-Calif.) introduced the legislation March 6. The Student Privacy Protection Act would require local school systems to obtain written consent before releasing information on secondary school students to military recruiters or their agents. The measure will next be referred to the House Education and Labor Committee sometime during this session, said a spokesperson for Honda. That committee's chairman, Rep. George Miller (D-Calif.), is a co-sponsor of the bill. Because of a provision in the NCLB, school districts are directed to give information about students to military recruiters unless parents explicitly request that their children's data remains private. Since the enacting of NCLB, secondary schools have been supplying the names, addresses and telephone numbers of students to recruiters sponsored by the military services. However, schools often failed to make parents aware of the option to keep that information private, Honda said. 3:54:06 PM  PermaLink   / trackback []

Dispute surfaces over certification for personal health records n a rare instance of public dissent, an American Health Information Community AHIC) workgroup has split over whether to recommend that product certification be available for personal health record software. AHIC, a high-level advisory committee to the Department of Health and Human Services, sided with the majority on its Consumer Empowerment Workgroup and voted unanimously in favor of the certification recommendation. A minority -- five members of the 23-person workgroup -- took the position that certification would be premature and the top priority should be privacy and security policies for PHRs. "The risks [of certification now] outweigh any potential benefits," the dissenters said in a letter to AHIC. The workgroup's task is to foster widespread adoption of PHRs. One of its leaders, Dr. Rose Marie Robertson, told AHIC that the group believes PHRs will be more widely used if consumers do not have to sit at a computer and enter all their health information. Instead, the PHRs could be populated by data from doctors, health plans, drug stores, or elsewhere. 3:51:04 PM  PermaLink   / trackback []

Medical data on Blue Cross members may be lost | CNET News.com WellPoint, one of the nation's largest health insurers, has begun notifying 75,000 members of its Empire Blue Cross and Blue Shield unit in New York that a CD holding their vital medical and other personal information has disappeared. The information was on an unencrypted disc that a subcontractor recently sent to Magellan Behavioral Services, a company in Avon, Conn., that specializes in monitoring and coordinating mental health and substance abuse treatments for insurance companies. Empire began notifying the affected consumers by mail on Saturday that their records--including their names, Social Security numbers, health plan identification numbers and description of medical services back to 2003--had been lost. [...] Before shipping the information to Magellan, the coding and passwords that protect the privacy of the information was removed by a Magellan subcontractor, Lisa Ann Greiner, an Empire spokeswoman, said Tuesday. Janlori Goldman, the director of the Health Privacy Center, a nonprofit organization in Washington, said the error was an "egregious breach of privacy." She said that insurance companies were responsible under a federal privacy law for ensuring that their contractors use adequate security procedures. Greiner said that the subcontractor, Health Data Management Services, worked for Magellan, not Empire. "If any contract was breached, we are going to take direct action," she said. 3:45:41 PM  PermaLink   / trackback []

SignOnSanDiego.com > Technology -- Official: Yahoo didn't violate laws in case of jailed journalist HONG KONG - Investigators said Wednesday there was not enough evidence to show that Yahoo Inc.'s Hong Kong branch provided private information that helped convict a Chinese reporter accused of leaking state secrets. The case raised questions about whether Internet companies should cooperate with governments that deny freedom of speech and frequently crack down on journalists. Yahoo! Hong Kong Limited was accused of helping Chinese authorities by Hong Kong lawmaker Albert Ho, who filed a complaint last year with the city's privacy commissioner. Ho alleged the Internet company provided information that helped convict journalist Shi Tao, sentenced to 10 years in jail in 2005 on mainland China. 3:43:01 PM  PermaLink   / trackback []

Photocopiers: The newest ID theft threat. Photocopiers: The newest ID theft threat. Photocopiers made in recent years often have hard drives that store what's been duplicated -- making them a potential target for identity thieves. [Computerworld Privacy News] 3:40:11 PM  PermaLink   / trackback []

CDT Calls for Judicial Approval of National Security Letters. CDT Calls for Judicial Approval of National Security Letters. CDT is calling on Congress to require judicial supervision of FBI requests for access to the sensitive records of US citizens to protect privacy and national security. Recent revelations regarding violations in the use of so-called "national security letters" have shown that no matter how many internal controls the FBI adopts, self-certification is not sufficient when the government is obtaining the sensitive financial and communications records of citizens. CDT believes Congress should reform the law and adopt a reasonable system of judicial checks and balances. [Center for Democracy and Technology] 3:35:59 PM  PermaLink   / trackback []

DMCA Abuser Apologizes for Takedown Campaign. DMCA Abuser Apologizes for Takedown Campaign. Michael Crook Agrees to Stop Attacks on Free Speech San Francisco - Michael Crook, the man behind a string of meritless online copyright complaints, has agreed to withdraw those complaints, take a copyright law course, and apologize for interfering with the free speech rights of his targets. The agreement settles a lawsuit against Crook filed by the Electronic Frontier Foundation (EFF) on behalf of Jeff Diehl, the editor of the Internet magazine 10 Zen Monkeys. Diehl was forced to modify an article posted about Crook's behavior in a fake sex-ad scheme after Crook sent baseless Digital Millennium Copyright Act (DMCA) takedown notices, claiming to be the copyright holder of an image used in the story. In fact, the image was from a Fox News program and legally used as part of commentary on Crook. But Crook repeated his claims and then attempted to use the same process to get the image removed from other websites reporting on his takedown campaign. "Crook's legal threats interfered with legitimate debate about his controversial online behavior," said EFF Staff Attorney Jason Schultz. "Public figures must not be allowed to use bogus copyright claims to squelch speech." In addition to withdrawing current complaints against Diehl and every other target of his takedown campaign and taking a copyright law course, Crook has also agreed to limit any future DMCA notices to works authored or photographed by himself or his wife, or where the copyright was specifically assigned to him. All future notices must also include a link to EFF information on his case, as well as the settlement agreement. Crook has also recorded a video statement to apologize and publicize the dangers of abusing copyright law. "We're pleased that Crook has taken responsibility for his egregious behavior," said EFF Staff Attorney Corynne McSherry. "Hopefully, this will set a precedent to prevent future abuse of the law by those who dislike online news-reporting and criticism." The settlement with Michael Crook is part of EFF's ongoing campaign to protect online free speech from the chilling effects of bogus intellectual property claims. EFF recently filed suit against the man who claims to have created the popular line dance "The Electric Slide" for misusing copyright law to remove an online documentary video that included footage of people trying to do the dance. For the video statement from Michael Crook: http://blip.tv/file/169553 For more on Diehl v. Crook: http://www.eff.org/legal/cases/diehl_v_crook/ Contacts: Corynne McSherry Staff Attorney Electronic Frontier Foundation corynne@eff.org Jason Schultz Staff Attorney Electronic Frontier Foundation jason@eff.org [EFF: Breaking News] 3:33:48 PM  PermaLink   / trackback []

OpenCongress OpenCongress brings together official government data with news and blog coverage to give you the real story behind each bill. 3:30:38 PM  PermaLink   / trackback []

Google Cooperating with Mumbai & Brazilian Police. Google Cooperating with Mumbai & Brazilian Police. Boing Boing has two good posts detailing how Google has been cooperating with Mumbai and Brazilian authorities to help censor content and track down offenders on their Orkut social networking service. In the Mumbai case: The Indian Express and other regional media are reporting that Google[base ']s social networking service Orkut will cooperate with the Mumbai Police to share IP addresses of users who post [base ']Äúobjectionable content[base ']Äù on Orkut. If reports are to be believed, the police need only email a complaint to Orkut, and Orkut will send back the personally identifying data, no questions asked. The police are said to be targeting a number of [base "]problematic[per thou] Orkut posts, including items that criticize various public figures in India, others that glorify Indian mobsters, and [base "]anti-Indian words.[per thou] The latter probably has to do with a group on Orkut called [base "]I Hate India,[per thou] which pissed off Indian officials so much, they decided to sue Google over it last October. And the Brazilian matter: Google has designed a special Orkut admin tool for deleting or blocking illegal content, and given Brazilian police access to this tool. This means that if you[base ']re on Orkut and you say something that in Brazil could be considered illegal (such as celebrity gossip, Consumerist-style corporate bashing, mistreating animals), the Brazilian police can censor the community where this [base "]illegal[per thou] speech is seen. Much more if you follow the links. [michaelzimmer.org] 11:39:49 AM  PermaLink   / trackback []

Viacom, YouTube, and Privacy. Viacom, YouTube, and Privacy. Yesterday[base ']s top tech policy story was the copyright lawsuits filed by Viacom, the parent company of Comedy Central, MTV, and Paramount Pictures, against YouTube and its owner Google. Viacom[base ']s complaint accuses YouTube of direct, contributory, and vicarious copyright infringement, and inducing infringement. The complaint tries to paint YouTube as a descendant of Napster and Grokster. Viacom argues generally that YouTube should have done more to help it detect and stop infringement. Interestingly, Viacom points to the privacy features of YouTube as part of the problem, in paragraph 43 of the complaint: In addition, YouTube is deliberately interfering with copyright owners[base '] ability to find infringing videos even after they are added to YouTube[base ']s library. YouTube offers a feature that allows users to designate [base "]friends[per thou] who are the only persons allowed to see videos they upload, preventing copyright owners from finding infringing videos with this limitation[sigma]. Thus, Plaintiffs cannot necessarily find all infringing videos to protect their rights through searching, even though that is the only avenue YouTube makes available to copyright owners. Moreover, YouTube still makes the hidden infringing videos available for viewing through YouTube features like the embed, share, and friends functions. For example, many users are sharing full-length copies of copyrighted works and stating plainly in the description [base "]Add me as a friend to watch.[per thou] Users have many good reasons to want to limit access to noninfringing uploaded videos, for example to make home movies available to family members but not to the general public. It would be a shame, and YouTube would be much less useful, if there were no way to limit access. Equivalently, if any copyright owner could override the limits, there would be no privacy anymore [~] remember that we[base ']re all copyright owners. Is Viacom really arguing that YouTube shouldn[base ']t let people limit access to uploaded material? Viacom doesn[base ']t say this directly, though it is one plausible reading of their argument. Another reading is that they think YouTube should have an extra obligation to police and/or filter material that isn[base ']t viewable by the public. Either way, it[base ']s troubling to see YouTube[base ']s privacy features used to attack the site[base ']s legality, when we know those features have plenty of uses other than hiding infringement. Will future entrepreneurs shy away from providing private communication, out of fear that it will be used to brand them as infringers? If the courts aren[base ']t careful, that will be one effect of Viacom[base ']s suit. Share This [Freedom to Tinker] 11:36:38 AM  PermaLink   / trackback []

Apple Releases a Bushel of Software Patches. Apple Releases a Bushel of Software Patches. Today turned out to be "Patch Tuesday" after all, only the security updates were released by Apple instead of Microsoft. Apple issued security updates to plug at least 46 separate security holes in its operating system and other software. The updates are available through Apple's site or via the built-in Software Update feature. Nearly one-third of the fixes mend flaws outlined in the controversial Month of Kernel Bugs and Month of Apple Bugs projects from November 2006 and January 2007, respectively. Also included was a patch for a serious flaw in Apple's Software Update application. A number of the patches address third-party applications built for use on Mac OS X and Mac OS X Server systems. Today's bundle fixes at least seven bugs in the MySQL database software, and two flaws in OpenSSH, a tool used to encrypt online communications. Other programs patched in this release include iPhoto, QuickDraw, and Adobe's Flash Player. [Security Fix] 11:35:07 AM  PermaLink   / trackback []

Tracking the Password Thieves. Tracking the Password Thieves. The Washington Post today ran a story I wrote about an epidemic of data theft being fueled by password-stealing viruses and phishing attacks. In some ways, the story behind the reporting that went into the piece is just as interesting, so I'd like to share a few of those details. I based the story in part on a cache of stolen data I found online (more on how I obtained it in a bit). The data was being compiled by a password-stealing virus that had infected many thousands of computers worldwide; the particular text file that I found included personal information on 3,221 victims scattered across all 50 U.S. states. Using a custom-built application that makes use of the Google Maps API, I was able to chart the approximate locations of the victims. This was possible because at the beginning of each record was the virus's best guess of the longitude and latitude of the infected computer's Internet address. This so-called "geo-IP" process is far from perfect: Sometimes these automated guesses are disturbingly accurate, and other times they are miles wide or completely wrong. The approximate location of the 3,221 U.S. residents victimized by this virus (Data gathered by washingtonpost.com; image courtesy Secure Science Corp. and Google). Scammers collect information about the location of their victims because it becomes useful when they want to conduct fraud with a hijacked credit or debit card account. The idea here is to evade a key component of fraud detection in the financial industry -- transaction location tracking. If Joe in Georgia starts suddenly withdrawing money or making purchases in Nigeria or Europe when his last transaction was an hour earlier in Atlanta, Joe's bank is going to flag the transactions as fraudulent and in all likelihood cancel the card. [Security Fix] 11:30:56 AM  PermaLink   / trackback []