<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: calgary]]></title>
    <link>http://securityratty.com/tag/calgary</link>
    <description></description>
    <pubDate>Tue, 20 May 2008 06:47:48 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The Analyzer Is Among The Suspects In $1.8 Million Theft From A Canadian Company]]></title>
      <link>http://securityratty.com/article/1a3f2a8d883dec31c59c3fe3a24e0d4d</link>
      <guid>http://securityratty.com/article/1a3f2a8d883dec31c59c3fe3a24e0d4d</guid>
      <description><![CDATA[Ehud Tenenbaum, a 29-Israeli known online as the Analyzer and living in Montreal, was arrested after investigators spent nine months and found out that him and three other suspects allegedly stole...]]></description>
      <content:encoded><![CDATA[Ehud Tenenbaum, a 29-Israeli known online as &#8220;the Analyzer&#8221; and living in Montreal, was arrested after investigators spent nine months and found out that him and three other suspects allegedly stole $1.8 million from a Calgary company. The operation involved the U.S. Secret Service and municipal police in Calgary and Vancouver - as well as [...]]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 13:42:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/calgary company">calgary company</category>
      <category domain="http://securityratty.com/tag/calgary">calgary</category>
      <category domain="http://securityratty.com/tag/municipal police">municipal police</category>
      <category domain="http://securityratty.com/tag/secret service">secret service</category>
      <category domain="http://securityratty.com/tag/million">million</category>
      <category domain="http://securityratty.com/tag/ehud tenenbaum">ehud tenenbaum</category>
      <category domain="http://securityratty.com/tag/suspects allegedly">suspects allegedly</category>
      <category domain="http://securityratty.com/tag/analyzer">analyzer</category>
      <category domain="http://securityratty.com/tag/montreal">montreal</category>
      <source url="http://cyberinsecure.com/the-analyzer-is-among-the-suspects-in-theft-from-canadian-company/">The Analyzer Is Among The Suspects In $1.8 Million Theft From A Canadian Company</source>
    </item>
    <item>
      <title><![CDATA[From the Eye of a Legal Storm, Murdoch's Satellite-TV Hacker Tells All]]></title>
      <link>http://securityratty.com/article/75c4bd1099f9d260b821fdd9a841f9bd</link>
      <guid>http://securityratty.com/article/75c4bd1099f9d260b821fdd9a841f9bd</guid>
      <description><![CDATA[SAN DIEGO -- Christopher Tarnovsky feels vindicated. The software engineer and former satellite-TV pirate has been on the hot seat for five years, accused of helping his former employer, a Rupert...]]></description>
      <content:encoded><![CDATA[<p>SAN DIEGO -- Christopher Tarnovsky feels vindicated. The software engineer and former satellite-TV pirate has been on the hot seat for five years, accused of helping his former employer, a Rupert Murdoch company, sabotage a rival to gain the top spot in the global pay-TV wars.
</p><p>
But two weeks ago a jury in the civil lawsuit against that employer, NDS Group, largely cleared the company -- and by extension Tarnovsky -- of piracy, finding NDS guilty of only a single incident of stealing satellite signals, for which Dish was awarded $1,500 in damages.
</p><p>
"I knew this was going to come," Tarnovsky says. "They didn't have any proof or evidence."
</p><p>
The trial was <a href="http://www.wired.com/politics/law/news/2008/04/murdoch">years in the making</a>, yet raised more questions than it answered. It came down to testimony between admitted pirates on both sides who accused each other of lying. Now that it's over Tarnovsky, who was fired by NDS last year, is eager to tell his side of the story.
</p><p>
Dressed in loose jeans, flip-flops and a T-shirt, Tarnovsky, 37, spoke with Wired.com by phone and in an air-conditioned lab in Southern California where he's been running a <a href="http://www.flylogic.net">consultancy</a> since losing his job. Surrounded by boxes of smart cards and thousands of dollars worth of microscopes and computers used for researching chips, he talked excitedly at lightning speed about his strange journey, which began in a top-secret Pentagon communications center, and ended with him working both sides of a heated electronic war over pay TV.
</p>

<div class="feedroomstoryembedlarge">

<iframe src="http://video.wired.com/linking/index.jsp?skin=oneclip&fr_story=b9671bb032f83a50ca57ae40b194d3feb3a8d77d&rf=ev&hl=false" width="404" height="346" scrolling="no" frameborder="0"></iframe>

<div class="storyimagecaption"><p>Satellite-TV hacker Chris Tarnovsky opens his laboratory to <a href="http://blog.wired.com/27bstroke6/">Threat Level</a> reporter Kim Zetter, providing a unprecedented peek into the world of smart-card hacking.<br />
<em>Editor: Annaliza Savage<br />
Camera: Steve Raines</em></p>


</div>

</div>


<p>
His story sheds new light on the murky, morally ambiguous world of international satellite pirates and those who do battle with them.
</p><p>
The stakes are high: Earnings in the satellite-TV industry reach the billions. In the first quarter of this year alone, U.S. market leader DirecTV announced revenue of $4.6 billion from more than 17 million U.S. subscribers. Dish Network earned $2.8 billion from nearly 14 million subscribers. Although satellite piracy has greatly diminished from its peak seven to 10 years ago when the events detailed in the civil lawsuit took place, the two companies lost millions in potential revenue, and spent millions more to replace insecure smart cards used in their systems and track down dealers selling pirated smart cards.
</p><!--pagebreak--><p>
Those smart cards are at the center of the controversy over NDS, a British-Israeli company and a majority-owned subsidiary of Murdoch's News Corp. The company makes access cards used by pay-TV systems, most prominently DirecTV -- itself a former Murdoch company. Nagrastar, a plaintiff in the case and NDS's chief competitor, makes access cards used by Dish Network and other runners-up in the market.
</p><p>
According to allegations in the lawsuit, in the late '90s NDS extracted and cracked the proprietary code used in Nagrastar's cards, a fact that NDS doesn't contest. What happened next, though, is hotly disputed. Nagrastar says Tarnovsky used the code to create a device for reprogramming Nagrastar cards into pirate cards, and gave the cards to pirates eager to steal Dish Network's programming. Tarnovsky was also accused of posting to the internet a detailed road map for hacking Nagrastar's cards. 
</p><p>
Nagrastar says NDS had an obvious motive for these antics: Their own chip, the so-called P1 or "F Card," had already been thoroughly cracked by pirates, and the company wanted to level the playing field with its competitors.
</p><p>
NDS denied the allegations at trial. The company declined to comment for this article or to confirm details of Tarnovsky's employment other than to say it was pleased that the verdict "ended in a resounding affirmation of NDS and its business ethics and proper conduct."
</p><p>
Tarnovsky began his pirating career in the '90s while serving in the U.S. Army. He had a top-secret SCI security clearance working on cryptographic computers in Belgium for NATO headquarters, and spent a year at Ft. Detrick in Maryland providing support to the National Security Agency for satellite transmissions to Europe.
</p><p>
In 1996, he was stationed in Germany when his colonel sold him a used satellite-TV system, along with two pirated access cards, neither of which worked. Tarnovsky began posting on online pirate forums, and developed contacts in the community, ultimately learning how to fix the cards to access English-language programs from Sky in the United Kingdom.
</p>
<p>
After leaving the Army and returning to the States, he got a call from Ron Ereiser, a Canadian pirate who'd heard about him through the grapevine. Pirates had found a back door in the P1 card and were vigorously exploiting it to get DirecTV content. But the cards kept failing. In a game of pirate pingpong, DirecTV periodically deployed electronic countermeasures, or ECMs, in the satellite stream that killed the cards in their set-top boxes. Ereiser needed someone to fix the cards.
</p><p>
There was serious black-market money on the line. In Canada, where pirating of U.S. satellite services wasn't considered illegal until 2002, syndicates of dealers did enough business that they could afford to chip in about $50,000 to hire a programmer to reverse engineer the latest cards. Pirate cards would sell for about $200 each, with the profit split between the investors and engineers. Tarnovsky claims Canadian pirate dealers could make $400,000 in a weekend; when Reginald Scullion, a notorious pirate in Canada, was raided in 1998, authorities seized $5.5 million from his bank accounts and safe-deposit boxes, though not all of it was from piracy.
</p><p>
Ereiser, who now works as a consultant to Nagrastar, concedes that the money from piracy was good, but insists that nobody became an overnight millionaire. "It was lucrative," he said in a telephone interview. "But to suggest that millions were being made in a month is an absolute crock."
</p><p>
DirecTV's countermeasures were a nagging drag on this lucrative trade. Every time an ECM was deployed, Ereiser and other dealers would be harangued by customers demanding to have the cards fixed and their TV programs restored. 
</p><!--pagebreak--><p>
Tarnovsky, who was known online as "Big Gun," says Ereiser offered him $20,000 to fix cards that were killed by ECMs, and he agreed. Each time NDS created a countermeasure, Tarnovsky would analyze the code and find a way to circumvent the countermeasure. He did it while working full-time as a software engineer for a semiconductor company in Massachusetts.
</p><p>
"I'd be at work and I'd check the IRC (channel) to see if they'd launched their Thursday countermeasure yet," he says. "It was like a chess game for me. I couldn't wait for them to do a countermeasure because I would counter it in minutes."
</p><p>
Tarnovsky suffers from attention deficit hyperactivity disorder, which he says helped with the detailed work.
</p><p>
"I think so fast," he says.
</p><p>
It wasn't long before NDS came courting. Tarnovsky had a contact at the company to whom he'd begun passing information about holes in its software, even supplying patches to fix them. NDS offered him a job earning $65,000 a year. By the time the company fired him last year, he was earning about $245,000 in salary and bonuses and had another $100,000 in stock options, he says.
</p><p>
The company set him up in a lab in Southern California equipped with a computer, some DirecTV set-top boxes, sample DirecTV cards and NDS source code. There was no fancy equipment at first, but his relationship with NDS and the lab grew over the decade he worked with them. Tarnovsky says the job was a dream come true. While living in Europe he'd once seen a news report showing an engineer at a French satellite company writing countermeasures, sitting in a lab with smart cards piled around him on his desk.
</p><p>
"I always thought it would be so cool to be that guy," Tarnovsky says. "Finally I got the chance." 
</p><p>
Tarnovsky had two roles at NDS -- to find holes in its software and work undercover with pirates to discover what they were doing against NDS technology.
</p><p>
To conceal his relationship with NDS from pirates, few people at the company knew his identity. He used the name "Michael George" and for the first four years was paid through other companies, including, for about five months, HarperCollins, the Murdoch-owned book publisher.
</p><p>
"It was very hush-hush, because we didn't know who could be an inside informant," he says.
</p><p>
Part of his job was developing ECMs for NDS. He'd examine pirate NDS cards to determine how they worked, then send instructions to engineers in Israel to create a kill for them.
</p><p>
"I didn’t actually load the gun and pull the trigger but I got to make the bullet," Tarnovsky says. 
</p><p>
Among the countermeasures he says he created was one known among pirates as the <a href=" http://www.theregister.co.uk/2001/01/25/directv_attacks_hacked_smart_cards/">"Black Sunday" kill</a> -- an elaborate scheme that destroyed tens of thousands of pirate DirecTV cards a week before Super Bowl Sunday in 2001.
</p><p>
Instead of being delivered all at once like other measures, the Black Sunday attack code was sent to pirate cards in about five dozen parts over the course of two months, like a tank transported piece by piece to a battlefield to be assembled in the field. "They never expected us to do this," Tarnovsky says.
</p><p>
The kill didn't last long before pirates found a way to jump-start the cards. But it holds an enduring position in pirate lore; for the first time, they could see a cunning mind at work on the other side.
</p><p>
While Tarnovsky was killing cards, however, he was also helping pirates fix them. 
</p><!--pagebreak--><p>
Days before Tarnovsky began working for NDS, the company began phasing in its latest-generation smart card, the P2, which was thought to be virtually uncrackable. But word reached the company that two Bulgarian hackers working for Ereiser had cracked the P2. On NDS's instructions, Tarnovsky met with Ereiser undercover in Calgary to get the code. When he got there, Ereiser offered him $20,000 to work for him fighting whatever countermeasures NDS and DirecTV cooked up to thwart their P2 hack.
</p><p>
NDS considered it a great opportunity for Tarnovsky to maintain his pirate identity, but DirecTV insisted on some controls. Under "Operation Johnny Walker," as they dubbed it, Tarnovsky gave Ereiser a program to create pirate NDS cards, but encrypted it so no one could copy it. The program worked only with a dongle attached to Ereiser's computer and created a limited number of cards that could be killed at any time.
</p><p>
But, according to Nagrastar, Tarnovsky wasn't just helping NDS fight piracy by working undercover and creating ECMs, he was also committing piracy against NDS's competitors to weaken their place in the market.
</p><p>
After NDS engineers in Israel hacked the Nagrastar code in the late '90s, Nagrastar says Tarnovsky created a "stinger" program that turned Nagrastar cards into pirate cards. He allegedly gave the program to a Canadian named Al Menard in 1999 who sold reprogrammed Nagrastar cards for $350 each. Then in December 2000, someone anonymously posted code and detailed instructions for hacking Nagrastar's card to two websites, one of them run by Menard, exposing Dish Network to even more piracy. It was estimated in court testimony that between 100,000 and 165,000 pirated Nagrastar cards were released to the market in the wake of this posting.
</p><p>
Nagrastar says Menard began sending Tarnovsky cash from the sale of the pirate cards. At the end of August 2000, authorities acting on an anonymous tip seized two boxes destined for a mail drop Tarnovsky rented in Texas. Inside, they found a CD and DVD player with $20,000 and $20,100 concealed inside.
</p><p>
The boxes were sent from a phony address for "Regency Audio" in Vancouver to C.T. Electronics at Tarnovsky's address. A customs form for a third package that wasn't seized indicated that it was sent from Menard to Tarnovsky and also contained electronic goods.
</p><p>
Tarnovsky was in Israel at the time, and says he didn't know anything about the packages until he was notified that they'd been seized. He thinks they were sent by someone in Nagrastar's camp who was trying to frame him. He says Nagrastar's accusations about the "stinger" program were baseless, and that he never gave Menard any software.
</p><p>
On Feb. 9, 2001, U.S. Customs agents appeared at his doorstep. On advice of a lawyer, he declined to let them search his house without a warrant. Tarnovsky was never arrested or charged with any crime, but suspicions against him were mounting. NDS gave Tarnovsky a polygraph test, but asked only two, self-interested questions that never touched on the Nagrastar accusations: Had Tarnovsky sold any modified NDS smart cards, or company secrets, since he'd been working for the company? Tarnovsky answered no, and passed the test.
</p><p>
He continued to work for NDS for six years. But then last year, Nagrastar confronted NDS with a sheriff's report showing that fingerprints lifted from the seized electronics equipment sent to Tarnovsky's Texas mail drop belonged to an associate of Menard, raising suspicions again that Tarnovsky might have sold pirate Nagrastar cards without NDS's knowledge. NDS fired him.
</p><p>
Tarnovsky says his termination proves he and NDS weren't conspiring against Nagrastar. Had they been, NDS would have done anything to keep him happy, and quiet. He says the fact that Nagrastar lost the case shows he wasn't pirating on his own either.
</p><p>
"I've never sold a single Nagra card, ever," he says.
</p><p>
Although he was angry at NDS for abandoning him, he told Wired.com before the trial ended that he hoped to work for the company again.
</p><p>
"I want to make sure that NDS wins this lawsuit because that will clear my name," he said at the time.
</p><p>
When it was suggested that someone might view this as motivation for him to lie on NDS's behalf, he disagreed.
</p><p>
"That's crazy. I could go to jail," he said. "I would never perjure myself for some company."
</p><p>
Since NDS fired him he's been consulting for two semiconductor companies and a manufacturer of dongle tokens, but he misses his life in electronic warfare. If NDS doesn't want him, he says he'd be happy to work for Nagrastar -- jumping sides once again.
</p><p>
"I could design a whole entire chip for them like I did for NDS," he says. "NDS thinks today that their technology is superior to everybody else's and it probably is, because they're 17 years ahead of Nagra technologically. But Nagra could catch up overnight if they used my services.
</p><p>
"I'm a very valuable asset as far as smart-card technology goes," he adds. "I know everything about (NDS) as far as their intellectual property models go."
</p><p>
He offered his services to the company last year, while the lawsuit was pending. Nagrastar declined.
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=e479ec41ffd452c9a6deef2acea6eafc" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=e479ec41ffd452c9a6deef2acea6eafc" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=VY9TTH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=VY9TTH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=J0yWwh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=J0yWwh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=4JlE1h"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=4JlE1h" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=uuCFEH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=uuCFEH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=WYuknH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=WYuknH" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=NZYibh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NZYibh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Lvsfyh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Lvsfyh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=NXXjSH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NXXjSH" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/301513715" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/301513721" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 30 May 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/smart cards piled">smart cards piled</category>
      <category domain="http://securityratty.com/tag/cards">cards</category>
      <category domain="http://securityratty.com/tag/nds cards">nds cards</category>
      <category domain="http://securityratty.com/tag/access cards">access cards</category>
      <category domain="http://securityratty.com/tag/sample directv cards">sample directv cards</category>
      <category domain="http://securityratty.com/tag/directv cards">directv cards</category>
      <category domain="http://securityratty.com/tag/smart cards">smart cards</category>
      <category domain="http://securityratty.com/tag/nds smart cards">nds smart cards</category>
      <category domain="http://securityratty.com/tag/nds">nds</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/301513721/tarnovsky">From the Eye of a Legal Storm, Murdoch's Satellite-TV Hacker Tells All</source>
    </item>
    <item>
      <title><![CDATA[Academy Learning Centres stolen computers affect seniors]]></title>
      <link>http://securityratty.com/article/89621d79e70c35f86c3ad4252fd551ad</link>
      <guid>http://securityratty.com/article/89621d79e70c35f86c3ad4252fd551ad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/22/08

Organization
Academy Hearing Centres

Contractor/Consultant/Branch
None

Victims
Patients (mostly seniors

Number Affected
Dozens

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/academy.jpg" align="right" height="51" width="200"><font size="2"><strong>Date Reported: </strong><br>5/22/08<br><br><strong>Organization: </strong><br><a href="http://www.academyhearing.ca/index.htm">Academy Hearing Centres</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients (mostly seniors)<br><br><span style="font-weight: bold;">Number Affected:</span><br>"Dozens"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, credit-card numbers, health information and health-card numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Dozens of Calgary seniors are alarmed after learning their credit-card numbers, addresses and health-card numbers were stored on computers that were stolen recently. The Academy Hearing Centre in Brentwood Mall, which provides hearing tests and equipment, mostly to seniors, recently mailed out letters warning of the theft."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.cbc.ca/health/story/2008/05/22/cgy-info-theft.html?ref=rss">CBC News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>CBC News<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Dozens of Calgary seniors are alarmed after learning their credit-card numbers, addresses and health-card numbers were stored on computers that were stolen recently.<br><br>The Academy Hearing Centre in Brentwood Mall, which provides hearing tests and equipment, mostly to seniors, recently mailed out letters warning of the theft.<br><br>The Academy Hearing Centre refused the CBC's request for an interview, saying only that there is no need for clients to be alarmed.<br><span style="font-style: italic;">[Evan] This is it?&nbsp; Is this indicative of the service that one could expect from Academy Hearing Centres?&nbsp; Organizations should be more open and willing to talk about what they do to protect confidential information, unless they don't know themselves.&nbsp; Shame shame.</span><br><br><span style="font-weight: bold;">Victim Reaction(s):</span><br>"I got scared," said one elderly female client who purchased a hearing aid from the company.<br><br>She requested that her name not be released because she is worried about her security.<br><br>The woman said the thieves nabbed her name, address, health information and Alberta health-care number.<br><br>"It's the same thing, like somebody steals your social insurance number," she said.<br><br>She added that she was unable to change her health-card number.<br><br>"I called up Edmonton, the health insurance centre, and she said you have to wait about six months. Just have to notify your doctor, the family doctor. So somebody might be using my number, so let's hope it won't happen."<br><br><span style="font-weight: bold;">Commentary:</span><br>I wish I had more information to share about this breach, but this is all that is publicly available.&nbsp; In anyone has anything more to share, please feel free to comment.&nbsp; Posted on the Academy Learning Centres <a href="http://www.academyhearing.ca/index.htm">web site</a>:<br><br>"if there is any question left unanswered, please do not hesitate to contact one of our team directly by calling: ph: 403. 210. 2482."<br><br>If you suspect that you may be affected by this breach, or if you want more information, I suggest that you call.&nbsp; Victims can demand answers; after all they are the data owners.&nbsp; What makes this breach especially difficult is the fact that it affects customers that are generally easy victims of fraud and deception.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/29/academy.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 29 May 2008 05:14:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/seniors">seniors</category>
      <category domain="http://securityratty.com/tag/academy">academy</category>
      <category domain="http://securityratty.com/tag/centres">centres</category>
      <category domain="http://securityratty.com/tag/protect confidential information">protect confidential information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/calgary seniors">calgary seniors</category>
      <category domain="http://securityratty.com/tag/health information">health information</category>
      <source url="http://breachblog.com/2008/05/29/academy.aspx">Academy Learning Centres stolen computers affect seniors</source>
    </item>
    <item>
      <title><![CDATA[Laptop is stolen from the car of a First Calgary Savings employee]]></title>
      <link>http://securityratty.com/article/ca462afb981c52b540f08e4c0fe03c8d</link>
      <guid>http://securityratty.com/article/ca462afb981c52b540f08e4c0fe03c8d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/14/08

Organization
First Calgary Savings

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
hundreds&quot;, Calgary Sun
a few hundred&quot;,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/1stcalgary.jpg" align="right" height="50" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/14/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="https://www.1stcalgary.com/Personal/">First Calgary Savings</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"hundreds", Calgary Sun<br>"a few hundred", First Calgary Savings<br><br><span style="font-weight: bold;">Types of Data:</span><br>"clients' confidential information" in a database stored on the laptop<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The theft of a laptop computer containing hundreds of clients' confidential information from a Calgary bank employee's vehicle has raised concerns for Alberta's privacy commissioner. <br><br>In a letter sent yesterday to its customers, First Calgary Savings said a vehicle parked in a secured underground parkade was vandalized and the bank employee's laptop and cellphone stolen last month. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://calsun.canoe.ca/News/Alberta/2008/05/14/5560321-sun.html">Calgary Sun</a> <br><a href="https://www.1stcalgary.com/Personal/AboutUs/NewsandMedia/LatestNews/CorporateNews/LaptopTheft/">First Calgary Savings</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Bill Kaufmann, Sun Media (Calgary Sun)<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The theft of a laptop computer containing hundreds of clients' confidential information from a Calgary bank employee's vehicle has raised concerns for Alberta's privacy commissioner.<br><br>In a letter sent yesterday to its customers, First Calgary Savings said a vehicle parked in a secured underground parkade was vandalized and the bank employee's laptop and cellphone stolen last month. <br><br>If a complaint is lodged with the province's privacy commissioner, officials there would launch an investigation<br><br>"We're very concerned when we hear about these kinds of things," Wayne Wood, Privacy Commissioner spokesman<br><br>Soon after the theft occurred, police were notified<br><br>potentially vulnerable accounts numbering "in the hundreds, not thousands" had been red-flagged to prevent abuse and there's been no unusual activity detected, said First Calgary privacy officer Rod Banman.<br><br>As part of this employee's specialized role at First Calgary Savings, it was determined that a database had been saved onto the password protected laptop.<br><span style="font-style: italic;">[Evan] Password protection doesn't mean squat on a laptop.&nbsp; There are numerous better (more secure) methods for an employee to work with this information while mobile.&nbsp; How about keeping the database on the server (where most databases belong) and enabling remote VPN access?</span><br><br>And while he said the data was protected by a password, it doesn't appear to have been encrypted and could be vulnerable to a determined computer hacker<br><span style="font-style: italic;">[Evan] It <span style="font-weight: bold;">DOES NOT</span> take a "determined computer hacker" to access a password protected laptop.&nbsp; It takes no more than 30 seconds to create a bootable CD, turn the laptop on and run through a few menu prompts.&nbsp; Done.&nbsp; Total time: 5 minutes.&nbsp; Experience level: Novice to Intermediate.</span><br><br>"It is information somebody would love to get their hands on for identity theft purposes," said Banman.<br><span style="font-style: italic;">[Evan] This is not reassuring.&nbsp; Mr. Banman is the First Calgary privacy officer.</span><br><br>"We're doing the best we can to ensure the information is not going to impact them."<br><br>He said it's not improper for employees to carry information in such a fashion.<br><span style="font-style: italic;">[Evan] It SHOULD BE!</span><br><br>"It's information needed for our employees to do their jobs -- this is a theft and there is nothing the fault of our employees," said Banman.<br><span style="font-style: italic;">[Evan] It is the fault of poor information security management and governance.&nbsp; The person or persons responsible for information security management and governance appear(s) to have failed in his/her responsibilities.</span><br><br>We have contacted all affected member-owners, totalling a few hundred, by telephone and personal letter.<br><br>First Calgary Savings is taking all prudent steps possible to protect the privacy and security of affected member-owners.<br><br>We have undertaken several additional monitoring approaches to provide an enhanced level of protection to the affected member-owners.<br><span style="font-style: italic;">[Evan] Additional monitoring is good.&nbsp; Steps to prevent a similar occurrence would be good to, eh?</span><br><br>First Calgary Savings places the highest importance on your privacy and the security of confidential information.<br><span style="font-style: italic;">[Evan] It is so easy to make remarks like this.&nbsp; The actions that led to this breach and the comments afterwards do not support the remark though.&nbsp; Sorry, but they don't.</span><br><br>We take this event very seriously and I apologize for the understandable concerns this has caused our member-owners, especially the member-owners that were directly impacted.<br><br>I can assure all member-owners that your personal and financial information is safe and secure within our well constructed, monitored banking system.<br><br>If you have further questions or concerns please contact your branch, phone the Contact Centre at (403) 520-8000 or email info@1stcalgary.com.<br><br><span style="font-weight: bold;">Member Reaction:</span><br>A recipient of the letter, 14-year First Calgary client Doug Gablehaus, said he was "livid" to hear personal information would have been left in a vehicle.<br><br>"It's unacceptable ... that's the way identity theft goes," said Gablehaus, adding he might now take his business elsewhere.<br><span style="font-style: italic;">[Evan] When a company sees a correlation between an incident and the bottom line is often times when it decides to take action.&nbsp; It's a poor strategy (or no strategy).&nbsp; Customers leaving equates to less revenue, and less revenue gets the attention of upper management.&nbsp; Sad but true.</span><br><br>"In today's society, I don't think confidential information should be on someone's laptop and kept in their car."<br><br><span style="font-weight: bold;">Commentary:</span><br>I strongly encourage people to read the <a href="https://www.1stcalgary.com/Personal/AboutUs/NewsandMedia/LatestNews/CorporateNews/LaptopTheft/">letter</a> from First Calgary Savings.&nbsp; Tell me if you read this the same way I do.&nbsp; Sometimes I need a sanity check.&nbsp; In my opinion the letter is one of the best attempts to minimize an information security breach that I have read in some time.&nbsp; The sense that the bank sees nothing wrong with storing confidential customer information on a "password protected" laptop is very troubling.&nbsp; Out of touch with best practices, current news and general risk management.<br><br>NOTE:&nbsp; Throughout this posting I am assuming that the stolen laptop was not encrypted.&nbsp; There was no mention of encryption, and the Calgary Sun reports "</font><font size="2">it doesn't appear to have been encrypted".</font><br><font size="2"><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/20/1stcalgary.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 06:47:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/information security breach">information security breach</category>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/calgary savings">calgary savings</category>
      <source url="http://breachblog.com/2008/05/20/1stcalgary.aspx">Laptop is stolen from the car of a First Calgary Savings employee</source>
    </item>
  </channel>
</rss>
