Congressman lambastes Chinese cyber-espionage

From the Washington Post,

The chairman of the House intelligence committee on Tuesday launched a broadside against the Chinese government and its efforts to steal commercial data and other intellectual property online, saying that Beijing’s cyber-espionage campaign has “reached an intolerable level” and that the United States and its allies have an “obligation to confront Beijing and demand that they put a stop to this piracy.”

Rep. Mike Rogers (R-Mich.) noted that it might seem odd that a lawmaker charged with overseeing the U.S. intelligence community should lament spying by another government. But he said that China’s espionage activities now extend beyond the U.S. government and military to include scores of private American companies.

Continue reading here

Homeland Security tries to shore up nation’s cyber defenses

From the Washington Post,

Screens glowed, mice clicked and lines of code scrolled on the laptop monitors of a hacker team hired by Barney Advanced Domestic Chemical Co. — or BAD Company — to break into a rival firm’s computer network.

In another room here at Idaho National Laboratory, a computer operator noticed something wrong. “They’re hitting one of our servers!” he said. The lights in the control room soon failed, and liquid gushed from a set of tanks as green and red lights flashed.

“We’ve got a spillover!” shouted the supervisor. “Call the hazmat team!”

Continue reading here.

2,700 hacking attempts on S.Korea military in year

From the AFP,

South Korea's military has seen more than 2,700 attempts to hack into its websites over the past year, a lawmaker said Wednesday, amid growing concern over North Korea's cyber warfare capability.

Kim Ok-Lee of the ruling Grand National Party said the military's websites had seen 2,772 hacking attempts from July 2010 to last month, according to data from the defence ministry.

The monthly average number of attacks has grown from some 170 last year to more than 200 in 2011, the ministry said in a report submitted to Kim.

Continue reading here

Suit Claims Real Estate Firm Hacked Rival’s Listings

From the Wall Street Journal,

Bond New York, a real estate brokerage with hundreds of upscale apartment listings around the city, has been accused of hacking into a competitor’s computer system and stealing listing information.

A.C. Lawrence & Co., a competitor firm, has filed suit in New York Civil Supreme Court, claiming that Bond has been hacking into its computer system since February and stealing exclusive listing information.

Competition among residential brokers for exclusive listings has long been fierce, the suit notes that this appear to be the first time in New York State that a brokerage has been accused of hacking into computers to steal listings.

Continue reading here

There's little privacy in a digital world

From the LA Times,

During his two-hour morning bike ride, Eric Hartman doesn't pay much attention to his iPhone.

But the iPhone is paying attention to him.

As he traverses the 30-mile circuit around Seal Beach, Hartman's iPhone knows precisely where he is at every moment, and keeps a record of his whereabouts. That data is beamed to Apple Inc. multiple times each day, whether Hartman is using his phone to take pictures, search for gas stations or check the weather.

And it's not just the iPhone that's keeping track.

Continue reading here

Facebook Targeted in Group Privacy Suit Over Internet Tracking

From BusinessWeek,

Facebook Inc., the world’s most popular social-networking service, was accused by users of the site in a class-action lawsuit of secretly tracking their Web activity after they log off.

The company assures users that “cookie” files installed on their computers to identify them and track their interactions with Facebook applications and websites while they are logged on are removed when they log off, according to a complaint in federal court in San Jose, California. Facebook admitted on Sept. 26 that the cookies track users’ Internet activity after they log off, according to yesterday’s complaint.

Continue reading here

'Lurid' malware hits Russia, CIS countries

Courtesy of ComputerWorld's Jeremy Kirk,

The latest espionage-related hacking campaign detailed by security vendor Trend Micro is most notable for the country it does not implicate: China.

Researchers from Trend Micro wrote on Thursday that they discovered a series of hacking attacks targeting space-related government agencies, diplomatic missions, research institutions and companies located mostly in Russia but also Vietnam and Commonwealth of Independent States countries. In total, the attacks targeted 1,465 computers in 61 countries.

Read more here

Coordinated ATM Heist Nets Thieves $13M

Courtesty of Brian Krebs of KrebsOnSecurity.com,

An international cybercrime gang stole $13 million from a Florida-based financial institution earlier this year, by executing a highly-coordinated heist in which thieves used ATMs around the globe to cash out stolen prepaid debit cards, KrebsOnSecurity has learned.

Jacksonville based Fidelity National Information Services Inc. (FIS) bills itself as the world’s largest processor of prepaid debit cards; FIS claims to process more than 775 million transactions annually. The company disclosed the breach in its first quarter earnings statement issued May 3, 2011. But details of the attack remained shrouded in secrecy as the FBI and forensic investigators probed one of the biggest and most complex banking heists of its kind.

Read more here.

U.S. Expresses Concern About New Cyberattacks in Japan

Courtesy of Hiroko Tabuchi of the New York Times,

The United States gave a stern warning on Wednesday over recent cyberattacks on Japan’s biggest defense contractors, the latest in a series of security breaches that have fueled concern about Tokyo’s ability to handle delicate information.

An online assault on defense contractors including Mitsubishi Heavy Industries, which builds F-15 fighter jets and other American-designed weapons for Japan’s Self-Defense Forces, began in August, but only came to light this week, prompting rebukes from Japanese officials over the timing of the disclosure. The IHI Corporation, a military contractor that supplies engine parts for fighter jets, may have also been a target, the Nikkei business daily reported.

Read more here

'Stingray' Phone Tracker Fuels Constitutional Clash

Courtesy of the Wall Street Journal's Jennifer Valentino-Devries,

For more than a year, federal authorities pursued a man they called simply "the Hacker." Only after using a little known cellphone-tracking device—a stingray—were they able to zero in on a California home and make the arrest.

Stingrays are designed to locate a mobile phone even when it's not being used to make a call. The Federal Bureau of Investigation considers the devices to be so critical that it has a policy of deleting the data gathered in their use, mainly to keep suspects in the dark about their capabilities, an FBI official told The Wall Street Journal in response to inquiries.

Read more here

Hack Obtains 9 Bogus Certificates for Prominent Websites; Traced to Iran

From Kim Zetter at Wired's Threat Level Blog,

In a fresh blow to the fundamental integrity of the internet, a hacker last week obtained legitimate web certificates that would have allowed him to impersonate some of the top sites on the internet, including the login pages used by Google, Microsoft and Yahoo e-mail customers.

The hacker, whose March 15 attack was traced to an IP address in Iran, compromised a partner account at the respected certificate authority Comodo Group, which he used to request eight SSL certificates for six domains: mail.google.com, www.google.com, login.yahoo.com, login.skype.com, addons.mozilla.org and login.live.com.

The certificates would have allowed the attacker to craft fake pages that would have been accepted by browsers as the legitimate websites. The certificates would have been most useful as part of an attack that redirected traffic intended for Skype, Google and Yahoo to a machine under the attacker’s control. Such an attack can range from small-scale Wi-Fi spoofing at a coffee shop all the way to global hijacking of internet routes.

At a minimum, the attacker would then be able to steal login credentials from anyone who entered a username and password into the fake page, or perform a “man in the middle” attack to eavesdrop on the user’s session.

Comodo CEO Melih Abdulhayoglu calls the breach the certificate authority’s version of the Sept. 11 terror attacks.

“Our own planes are being used against us in the C.A. [certificate authority] world,” Abdulhayoglu told Threat Level in an interview. “We have to up the bar and react to these new threat models. This untrusted DNS infrastructure cannot be what drives the internet going forward. If DNS was trusted, none of this would have been an issue.”

Comodo says the attacker was well prepared, and appeared to have a list of targets at the ready when he logged into the company’s system and began requesting certificates.

In addition to the bogus certificates, the attacker created a ninth certificate for a domain of his own under the name “Global Trustee,” according to Abdulhayoglu.

Abdulhayoglu says the attack has all the markings of a state-sponsored intrusion rather than a criminal attack.

“We deal with [cybercriminals] all day long,” he said. But “there are zero footprints of cybercriminals here.”

“If you look at all these domains, every single one of them are communications-related,” he continued. “My personal opinion is that someone is trying to read people’s e-mail communications. [But] the only way for this attack to work [on a large scale] is if you have access to the DNS infrastructure. The certificates on their own are no use, unless they have access to the DNS infrastructure itself, which a state would.”

Though he acknowledges that the attack could have originated anywhere, and been routed through Iranian servers as a proxy, he says Iranian president Mahmoud Ahmadinejad’s regime is the obvious suspect.

Out of the nine fraudulent certificates the hacker requested, only one — for Yahoo — was found to be active. Abdulhayoglu said Comodo tracked it, because the attackers had tried to test the certificate using a second Iranian IP address.

All of the fraudulent certificates have since been revoked, and Mozilla, Google and Microsoft have issued updates to their Firefox, Chrome and Internet Explorer browsers to block any websites from using the fraudulent certificates.

Comodo came clean about the breach this week, after security researcher Jacob Appelbaum noticed the updates to Chrome and Firefox and began poking around. Mozilla persuaded Appelbaum to withhold public disclosure of the information until the situation with the certificates could be resolved, which he agreed to do.

Abdulhayoglu told Threat Level that his company first learned of the breach from the partner that was compromised.

The attacker had compromised the username and password of a registration authority, or R.A., in southern Europe that had been a Comodo Trusted Partner for five or six years, he said. Registration authorities are entities that are authorized to issue certificates after conducting a due-diligence check to determine that the person or entity seeking the certificate is legitimate.

“We have certain checks and balances that alerted the R.A. [about the breach], which brought it to our attention,” he said. “Within hours we were alerted to it, and within hours we revoked everything.”

It’s not the first time that the integrity of web certificates has come into question.

Security researcher Moxie Marlinspike showed in 2009 how a vulnerability in the way that web certificates are issued by authorities and authenticated by web browsers would allow an attacker to impersonate any trusted website with a legitimately issued certificate.

Hacker Spies Hit Security Firm RSA

via Kim Zetter at Wired's Threat Level Blog,

Top security firm RSA Security revealed on Thursday that it’s been the victim of an “extremely sophisticated” hack.

The company said in a note posted on its website that the intruders succeeded in stealing information related to the company’s SecurID two-factor authentication products. SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds.

“While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers,” RSA wrote on its blog, “this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. We are very actively communicating this situation to RSA customers and providing immediate steps for them to take to strengthen their SecurID implementations.”

As of 2009, RSA counted 40 million customers carrying SecurID hardware tokens, and another 250 million using software. Its customers include government agencies.

RSA CEO Art Coviello wrote in the blog post that the company was “confident that no other … products were impacted by this attack. It is important to note that we do not believe that either customer or employee personally identifiable information was compromised as a result of this incident.”

The company also provided the information in a document filed with the Securities and Exchange Commission on Thursday, which includes a list of recommendations for customers who might be affected. See below for a list of the recommendations.

A company spokesman would not provide any details about when the hack occurred, how long it lasted or when the company had discovered it.

“We are not withholding anything that would adversely impact the security of our customer systems,” said spokesman Michael Gallant. “[But] we’re working with government authorities as well so we’re not disclosing any further information besides what’s on the blog post.”

RSA categorized the attack as an advanced persistent threat, or APT. APT attacks are distinctive in the kinds of data the attackers target. Unlike most intrusions that go after financial and identity data, APT attacks tend to go after source code and other intellectual property and often involve extensive work to map a company’s infrastructure.

APT attacks often use zero-day vulnerabilities to breach a company and are therefore rarely detected by antivirus and intrusion programs. The intrusions are known for grabbing a foothold into a company’s network, sometimes for years, even after a company has discovered them and taken corrective measures.

Last year’s hack into Google was considered an APT attack, and, like many intrusions in this category, was linked to China.

RSA, which is owned by EMC, is a leading firm and is most known for the RSA encryption algorithm used to secure e-commerce and other transactions. The company hosts the top-ranked RSA security conference every year.

for more information visit the Wired Threat Level Blog.

Hey AT&T customers: Your Facebook data went to China and S. Korea this morning…

From Barrett Lyons's Blog,

Quietly this morning customers of AT&T browsing Facebook did so by way of China then Korea. Typically AT&T customers’ data would have routed over the AT&T network directly to Facebook’s network provider but due to a routing mistake their private data went first to Chinanet then via Chinanet to SK Broadband in South Korea, then to Facebook. This means that anything you looked at via Facebook without encryption was exposed to anyone operating Chinanet, which has a very suspect Modus operandi.
This morning’s route to Facebook from AT&T:

route-server>show ip bgp 69.171.224.13 (Facebook's www IP address)
BGP routing table entry for 69.171.224.0/20, version 32605349
Paths: (18 available, best #6, table Default-IP-Routing-Table)
Not advertised to any peer
7018 4134 9318 32934 32934 32934

The AS path (routing path) translates to this:

1. AT&T (AS7018)
2. Chinanet (Data in China AS4134)
3. SK Broadband (Data in South Korea AS9318)
4. Facebook (Data back to US 32934)

Current route to Facebook via AT&T:

route-server>sho ip bgp 69.171.224.0/20
BGP routing table entry for 69.171.224.0/20, version 32743195
Paths: (18 available, best #6, table Default-IP-Routing-Table)
Not advertised to any peer
7018 3356 32934 32934, (received & used)

Translated: Your data goes from AT&T’s network to US based Level3 Communications to Facebook’s servers.

What could have happened with your data? Most likely absolutely nothing. Yet, China is well known for it’s harmful networking practices by limiting network functionality and spying on its users, and when your data is flowing over their network, your data could be treated as any Chineese citizens’. Does that include capturing your session ID information, personal information, emails, photos, chat conversations, mappings to your friends and family, etc? One could only speculate, however it’s possible.

This brings up a lot of questions:

• Should Facebook and or AT&T have notified their customers that their personal information was flowing over a network that they may not trust?
  
• Should Facebook enable SSL on all accounts by default?
  
• Was this actually a privacy breach or just the way the Internet functions?
  
• Does Facebook have an ethical responsibility to buy additional IP connectivity to major broadband and mobile networks to prevent routing mishaps?
  
• Is it time to focus on new options within BGP to prevent high profile sites from routing to non-authenticated networks?
  

This happens all the time — the Internet is just not a trusted network. Yet, I prefer to know that when I am on AT&T’s network, going to US located sites, my packets are not accidentally leaving the country and being subject to another nation’s policies. I guess that’s why you should not use Facebook in “bareback” mode and use HTTPS (SSL) any time you can.

Food for thought.

It’s Tracking Your Every Move and You May Not Even Know

via Noam Cohen at the New York Times,

A favorite pastime of Internet users is to share their location: services like Google Latitude can inform friends when you are nearby; another, Foursquare, has turned reporting these updates into a game.

But as a German Green party politician, Malte Spitz, recently learned, we are already continually being tracked whether we volunteer to be or not. Cellphone companies do not typically divulge how much information they collect, so Mr. Spitz went to court to find out exactly what his cellphone company, Deutsche Telekom, knew about his whereabouts.

The results were astounding. In a six-month period — from Aug 31, 2009, to Feb. 28, 2010, Deutsche Telekom had recorded and saved his longitude and latitude coordinates more than 35,000 times. It traced him from a train on the way to Erlangen at the start through to that last night, when he was home in Berlin.

Mr. Spitz has provided a rare glimpse — an unprecedented one, privacy experts say — of what is being collected as we walk around with our phones. Unlike many online services and Web sites that must send “cookies” to a user’s computer to try to link its traffic to a specific person, cellphone companies simply have to sit back and hit “record.”

“We are all walking around with little tags, and our tag has a phone number associated with it, who we called and what we do with the phone,” said Sarah E. Williams, an expert on graphic information at Columbia University’s architecture school. “We don’t even know we are giving up that data.”

Tracking a customer’s whereabouts is part and parcel of what phone companies do for a living. Every seven seconds or so, the phone company of someone with a working cellphone is determining the nearest tower, so as to most efficiently route calls. And for billing reasons, they track where the call is coming from and how long it has lasted.

“At any given instant, a cell company has to know where you are; it is constantly registering with the tower with the strongest signal,” said Matthew Blaze, a professor of computer and information science at the University of Pennsylvania who has testified before Congress on the issue.

Mr. Spitz’s information, Mr. Blaze pointed out, was not based on those frequent updates, but on how often Mr. Spitz checked his e-mail.

Mr. Spitz, a privacy advocate, decided to be extremely open with his personal information. Late last month, he released all the location information in a publicly accessible Google Document, and worked with a prominent German newspaper, Die Zeit, to map those coordinates over time.

“This is really the most compelling visualization in a public forum I have ever seen,” said Mr. Blaze, adding that it “shows how strong a picture even a fairly low-resolution location can give.”

In an interview from Berlin, Mr. Spitz explained his reasons: “It was an important point to show this is not some kind of a game. I thought about it, if it is a good idea to publish all the data — I also could say, O.K., I will only publish it for five, 10 days maybe. But then I said no, I really want to publish the whole six months.”

In the United States, telecommunication companies do not have to report precisely what material they collect, said Kevin Bankston, a lawyer at the Electronic Frontier Foundation, who specializes in privacy. He added that based on court cases he could say that “they store more of it and it is becoming more precise.”

“Phones have become a necessary part of modern life,” he said, objecting to the idea that “you have to hand over your personal privacy to be part of the 21st century.”

In the United States, there are law enforcement and safety reasons for cellphone companies being encouraged to keep track of its customers. Both the F.B.I. and the Drug Enforcement Administration have used cellphone records to identify suspects and make arrests.

If the information is valuable to law enforcement, it could be lucrative for marketers. The major American cellphone providers declined to explain what exactly they collect and what they use it for.

Verizon, for example, declined to elaborate other than to point to its privacy policy, which includes: “Information such as call records, service usage, traffic data,” the statement in part reads, may be used for “marketing to you based on your use of the products and services you already have, subject to any restrictions required by law.”

AT&T, for example, works with a company, Sense Networks, that uses anonymous location information “to better understand aggregate human activity.” One product, CitySense, makes recommendations about local nightlife to customers who choose to participate based on their cellphone usage. (Many smartphone apps already on the market are based on location but that’s with the consent of the user and through GPS, not the cellphone company’s records.)

Because of Germany’s history, courts place a greater emphasis on personal privacy. Mr. Spitz first went to court to get his entire file in 2009 but Deutsche Telekom objected.

For six months, he said, there was a “Ping Pong game” of lawyers’ letters back and forth until, separately, the Constitutional Court there decided that the existing rules governing data retention, beyond those required for billing and logistics, were illegal. Soon thereafter, the two sides reached a settlement: “I only get the information that is related to me, and I don’t get all the information like who am I calling, who sent me a SMS and so on,” Mr. Spitz said, referring to text messages.

Even so, 35,831 pieces of information were sent to him by Deutsche Telekom as an encrypted file, to protect his privacy during its transmission.

Deutsche Telekom, which owns T-Mobile, Mr. Spitz’s carrier, wrote in an e-mail that it stored six months’ of data, as required by the law, and that after the court ruling it “immediately ceased” storing data.

And a year after the court ruling outlawing this kind of data retention, there is a movement to try to get a new, more limited law passed. Mr. Spitz, at 26 a member of the Green Party’s executive board, says he released that material to influence that debate.

“I want to show the political message that this kind of data retention is really, really big and you can really look into the life of people for six months and see what they are doing where they are.”

While the potential for abuse is easy to imagine, in Mr. Spitz’s case, there was not much revealed.

“I really spend most of the time in my own neighborhood, which was quite funny for me,” he said. “I am not really walking that much around.”

Any embarrassing details? “The data shows that I am flying sometimes,” he said, rather than taking a more fuel-efficient train. “Something not that popular for a Green politician.”

Humor: CIA's 'Facebook' Program Dramatically Cut Agency's Costs

CIA's 'Facebook' Program Dramatically Cut Agency's Costs

hat tip to the Onion

Viewdle Lets the Camera Recognize Your Friends

Via the Wall Street Journal ...

Few technologies have improved as steadily as digital cameras, long a standard feature in cellphones. But a new phase may be coming, as companies like Viewdle allow smartphones to recognize who is in a photograph as it’s taken.

The broader concept–a hot topic at this week’s Mobile World Congress in Barcelona–is called augmented reality. The term refers to overlaying labels, graphics and other information on images seen through a cellphone camera viewfinder.

In the prototypical scenario, a customer looking at goods on a shelf or walking by a restaurant could see reviews or product information superimposed on the display, allowing them to make smarter purchases. Many companies are working in the field and discussing developments this week, including metaio, a Munich-based software developer that also has offices in San Francisco.

Viewdle, based in Palo Alto, Calif., has been specializing in technology that could help apply information to faces. It has developed algorithms to recognize people in photographs and apply identifying tags–an automated alternative to the tagging that many users of Facebook and other sites do manually.

That’s not an entirely new trick. But it usually requires heavy-duty computing horsepower, often carried out by connecting to servers on the Internet in a process after a photo is taken.

Viewdle, which has grown since 2007 to 60 employees, believes it is breaking new ground in allowing smartphones to do these calculations on their own–and in real time, as faces come into a camera’s field of view. (Its software works by comparing faces it detects with images that have been previously stored and identified). The company’s website features a video of five women walking down the street toward the camera, with labels popping up that identify them and post their Facebook comments in real time.

Chip makers like augmented reality, in part because it takes a lot of computing cycles. Qualcomm, for instance, is an investor in Viewdle, which is making sure its software takes advantage of Qualcomm chips.

But Viewdle is not playing favorites. At the Barcelona event, the company is announcing a development kit to help software developers create apps that take advantage of its technology, and optimizing its software also to exploit Texas Instruments’ chips as well as Google’s popular operating system for cellphones. “It will run on all Android devices,” says Jason Mitura, Viewdle’s chief product officer.

When will consumers get to see the results? Viewdle will start by offering its own app, expected to be available in late March. Besides waiting for other apps to follow, the company is also trying to get handset makers to include the capability in their products, Mitura says.

Qualcomm, meanwhile, on Tuesday announced the winners in a contest it hosted for augmented reality applications, putting up $200,000 in total prize money. Taking first place, which entitled them to $125,000, were two men from Lithuania who developed an interactive game called Paparazzi. In it, the player looking through the smartphone viewfinder sees the superimposed image of a vain celebrity.

“You try to take a picture of the virtual guy,” says Jay Wright, a Qualcomm director of business development, before the celebrity gets agitated and attacks.

while anonymity does not equal privacy, the development of technologies like this lay bare the challenges that we face as a society in protecting our privacy and security in the digital age.

Federal Officials Call For Better Privacy, Security Protections Online

Via Dennis Fisher at ThreatPost ...

The Obama administration's top information security officials hit the stage at the RSA Conference Tuesday, looking to drum up support for several of the president's key security and privacy initiatives, including a still-nebulous plan for protecting users' freedom and privacy on the Web.

The plea for help from the thousands of security experts and enterprise executives gathered here for RSA came from Howard Schmidt, the president's cybersecurity adviser and Philip Reitinger, the deputy undersecretary of the National Protection and Programs directorate at the Department of Homeland Security, who spoke as part of a town hall meeting on cybersecurity. Schmidt, a former top security official at Microsoft and eBay, used the Internet shutdown that accompanied the recent revolution in Egypt as an example of what President Obama wants to prevent.

"It is incumbent upon all of us to make sure that we preserve those freedoms," Schmidt said. "We're going to hold others accountable on Internet freedom and make sure that we do those same things ourselves. We need to lead by example."

Earlier in the day, Secretary of State Hillary Clinton gave a similar speech to a group of students at George Washington University in which she emphasized the need for some framework of rules to help guarantee a basic level of freedom online.

"For the United States, the choice is clear. On the spectrum of Internet freedom, we place ourselves on the side of openness. Now, we recognize that an open Internet comes with challenges. It calls for ground rules to protect against wrongdoing and harm. And Internet freedom raises tensions, like all freedoms do. But we believe the benefits far exceed the costs," Clinton said.

What's less clear in all of this is exactly what the Obama administration intends to do to achieve these goals. At RSA, Schmidt and Reitinger both said that in order to improve both security and privacy online, the government needs help from the private sector. This has been a common theme in government information security plans for more than a decade and the idea of more public-private partnerships has been dismissed by many in the industry as futile. But Reitinger said that they can work if done correctly.

"When we say public-private partnership, people don't know what we mean. Neither the government nor the private sector can solve these problems on their own," he said. "People hear this and think we're just going to walk away saying kumbaya. That's not what we're talking about. The successful ones actually are a partnership and they're real and outcome-focused."

None of the panelists offered much in the way of specifics on what the administration planned to do, aside from previously announced initiatives such as the plan to create online IDs. But Schmidt stressed that there were plans in the works that would get things moving.

"We need to ensure we have the safeguards in place to protect people," he said. "It's all about collaboration. We need new ways to work faster. It's critical to our future and having that economic engine that we all need."

Lawmaker Introduces New Privacy Bill

Via the Wall Street Journal ...

Rep. Jackie Speier, D-Calif., introduced a bill Friday that would give the Federal Trade Commission authority to establish an online do-not-track system.

The bill is the first in this session to specifically tackle the creation of a do-not-track system, according to a spokesman for Ms. Speier. In December, the FTC issued a report recommending the creation of a do-not-track system and suggested that lawmakers use the report as a template for legislation.

Since the FTCs recommendation, Mozilla Corp. has said it will include a do-not-track feature in an upcoming version of its Firefox Web browser. But so far, no tracking companies have publicly stated that they will participate in a do-not-track system.

In its newest Internet Explorer browser, Microsoft will allow users to stop certain websites and tracking companies from monitoring them. And Google last month began offering a tool that lets users of its Chrome browser permanently opt out of ad-tracking cookies.

Representatives of the three companies sparred gently over the merits of the differing approaches at a conference Wednesday at the University of California, Berkeley. Alex Fowler, Mozilla’s global privacy and public-policy leader, said it wanted to give users flexibility in choosing the companies they will and won’t allow to track them.

“We’ve done this intentionally because there is a spectrum of values across our users,” Mr. Fowler said. Some “don’t want to see ads or be tracked” at all, while others “see value in free services by receiving free advertising.”

Privacy issues are heating up on Capitol Hill. Earlier this week, Rep. Bobby Rush, D-Ill., re-introduced privacy legislation that he introduced during the last session of Congress. His bill would establish baseline federal privacy laws around the collection of personal data. Rep. John Kerry, D-Mass., is also expected to introduce privacy legislation in the coming weeks.

There is no comprehensive U.S. law that protects consumer privacy online. Internet privacy issues generally are policed by the FTC, which can take action only if a privacy-violating action is deemed “deceptive” or “unfair.” Last year, the Obama Administration called for a Web privacy “bill of rights” to help regulate the personal data collection industry.

Of course, these Democratic bills face challenges in the Republican House of Representatives. Ms. Speier said while the bill has two co-sponsors, both Democrats, she is “hopeful we’ll find Republican co-sponsors — we’re hopeful of finding Tea Party-Republicans, because that’s a closely held value” of Tea Party Conservatives, she told Digits.

Ms. Speier also noted support from the Consumers’ Union, Consumer Action, Consumer Federation of America, Consumers Watchdog and the American Civil Liberties Union. The Congresswoman predicted broad support because “86 percent of the public that has been polled nationally wants to have the option of not being tracked.”

Chris Lee Resigns After Craigslist Photos Come To Light

From your classmate Ife via the Huffington Post...

Rep. Chris Lee (R-N.Y.) announced early Wednesday evening that he will resign his seat in the U.S. House of Representatives.

Buffalo-based station YNN relays a statement from Lee, who has signaled that he will vacate his post immediately:

"It has been a tremendous honor to serve the people of Western New York. I regret the harm that my actions have caused my family, my staff and my constituents. I deeply and sincerely apologize to them all. I have made profound mistakes and I promise to work as hard as I can to seek their forgiveness.
"The challenges we face in Western New York and across the country are too serious for me to allow this distraction to continue, and so I am announcing that I have resigned my seat in Congress effective immediately."
News of Lee's decision to step down comes just hours after it was reported that the married congressman sent shirtless photos of himself to a woman who he connected with on the "Women Seeking Men" section of Craigslist.

HuffPost's Nick Wing reported earlier in the day:

According to Gawker, the 46-year-old married Republican responded to a listing posted last month by a 34-year-old woman looking for "financially & emotionally secure" men who "don't look like toads."
In an email, sent from an account admittedly registered to Lee, someone reportedly replied, claiming to be a 39-year-old, "6ft 190lbs blond/blue," "divorced" "lobbyist."
After a few flirty back-and-forths, the woman told Gawker that Lee sent her a picture of himself, sans shirt.
Asked for comment, Lee's spokesman provided a denial and claimed that the congressman's email account had been hacked.
"The Congressman is happily married," the spokesman told Gawker. "The only time he or his wife posted something online was to sell old furniture when they changed the apartment they keep in DC."

__
UPDATE: "People cheat everyday, but only dumb people get caught," said the woman who received the half-naked photos. She gave a full interview to TheLoop21.com on Wednesday night.

Her blunt evaluation comes after receiving flirty emails that used the congressman's name, originated from the email address associated with his Facebook profile (since deleted), and contained photos that clearly seemed to show his face -- and shirtless torso. So much for internet anonymity.

The woman, who works in government, requested to maintain her own anonymity in exchange for the accounts provided to Gawker and TheLoop21. HuffPost spoke with a friend of the woman who confirmed her story about getting the emails and photos after posting a personal ad on Craigslist.

In the interview with TheLoop21.com, the woman said she figured the story put forward by Lee's spokesman about a hacker was "bullsh*t."

"Dating in D.C. sucks," she summed up. Click here for more.

Denying allegations

Interesting thoughts from Lawrence on maintaining our reputations in the digital age ...

Trust and reputation are two important aspects of civilization. The former is often influenced by the latter. You would not trust someone who has been charged with fraud or other such crimes. You would not vote for a politician that has been accused of (often sexually) harassing interns. In the last century, we relied on a wide array of evidence to judge whether the individual was guilty or not. Evidence such as video surveillance tapes, phone records, credit card bills and many other things. I listed these forms of evidence because I want to discuss their legitimacy in court in the 21st century.

Technology has a advanced dramatically in the recent years and we have become capable of incredible feats often experienced in movies (i.e. avatar) or less often in the form online theft (by hackers all over the world) draining your bank account.
My worry is that video surveillance and many other things might be easily altered to fit the crime (or not). Thus undermining their validity as evidence in court.
I’ll give you a few illustrations. Facebook accounts can be hacked, therefor the content also, can be altered. Imagine someone ‘unearthing’ incriminating pictures of you on Facebook and consequently, you are arrested and put on trial. You know that the pictures are fake because you never found yourself in the situation depicted on the picture. Of course you don’t, they were photo-shopped by someone who has something to gain by you going to prison. The jury does not believe your account and sends you to prison for whatever you have done (not fair, I know). Replace Facebook in this whole story with other things like credit card bills or phone call records and come to the same conclusion.

The modern court of tomorrow will pick up on these practices and revise their list of approved forms of evidence (excluding things like mentioned above).
Imagine a politician that did sexually harass an intern and it was caught on tape. This politician happened to have many allies and enemies. In court, the politician could clame that the person on the video is not really him, but a virtually rendered version of him by animators and programmers (think about animated movies these days). The court has reason to believe him because he has many enemies who would gain by faking something like this.

Therefore, technology (hacking etc) can render many forms of evidence useless.

My concern is the way we use the internet and how we behave on it. How will we be able to hold each other accountable (online) if all the things we do (good or bad) can be brushed off as conspiracy if someone presses charges?