<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: eastern]]></title>
    <link>http://securityratty.com/tag/eastern</link>
    <description></description>
    <pubDate>Mon, 16 Jun 2008 05:37:36 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Network failure delays flights across U.S.]]></title>
      <link>http://securityratty.com/article/3ae8d8161ff688b918f55bc632df4eaf</link>
      <guid>http://securityratty.com/article/3ae8d8161ff688b918f55bc632df4eaf</guid>
      <description><![CDATA[A network failure at a Georgia facility is being blamed for multiple flight delays across the eastern United States, including flights departing from major Northeastern cities such as Boston, New York...]]></description>
      <content:encoded><![CDATA[A network failure at a Georgia facility is being blamed for multiple flight delays across the eastern United States, including flights departing from major Northeastern cities such as Boston, New York and Washington, D.C.]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network failure">network failure</category>
      <category domain="http://securityratty.com/tag/major northeastern cities">major northeastern cities</category>
      <category domain="http://securityratty.com/tag/multiple flight delays">multiple flight delays</category>
      <category domain="http://securityratty.com/tag/georgia facility">georgia facility</category>
      <category domain="http://securityratty.com/tag/flights">flights</category>
      <category domain="http://securityratty.com/tag/boston">boston</category>
      <category domain="http://securityratty.com/tag/washington">washington</category>
      <category domain="http://securityratty.com/tag/york">york</category>
      <category domain="http://securityratty.com/tag/eastern">eastern</category>
      <source url="http://www.networkworld.com/news/2008/082608-faa-delays.html?fsrc=rss-security">Network failure delays flights across U.S.</source>
    </item>
    <item>
      <title><![CDATA[Cybersecurity lacking in Africa, official says]]></title>
      <link>http://securityratty.com/article/5425c8ae0f8c057c443b246c940ba8cd</link>
      <guid>http://securityratty.com/article/5425c8ae0f8c057c443b246c940ba8cd</guid>
      <description><![CDATA[Africa will not realize the benefits of IT without improvements in cybersecurity, the secretary general of the Common Market for Eastern and Southern Africa (COMESA) said...]]></description>
      <content:encoded><![CDATA[Africa will not realize the benefits of IT without improvements in cybersecurity, the secretary general of the Common Market for Eastern and Southern Africa (COMESA) said today.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=19659?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=19659?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 24 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/africa">africa</category>
      <category domain="http://securityratty.com/tag/southern africa">southern africa</category>
      <category domain="http://securityratty.com/tag/common market">common market</category>
      <category domain="http://securityratty.com/tag/cybersecurity">cybersecurity</category>
      <category domain="http://securityratty.com/tag/benefits">benefits</category>
      <category domain="http://securityratty.com/tag/secretary">secretary</category>
      <category domain="http://securityratty.com/tag/improvements">improvements</category>
      <category domain="http://securityratty.com/tag/eastern">eastern</category>
      <category domain="http://securityratty.com/tag/comesa">comesa</category>
      <source url="http://www.networkworld.com/news/2008/082508-cybersecurity-lacking-in-africa-official.html?fsrc=rss-security">Cybersecurity lacking in Africa, official says</source>
    </item>
    <item>
      <title><![CDATA[MI5 on Terrorist Profiling]]></title>
      <link>http://securityratty.com/article/bb80acbf5bcef69e830e8c656c41335c</link>
      <guid>http://securityratty.com/article/bb80acbf5bcef69e830e8c656c41335c</guid>
      <description><![CDATA[There's no profile : MI5 has concluded that there is no easy way to identify those who become involved in terrorism in Britain, according to a classified internal research document on radicalisation...]]></description>
      <content:encoded><![CDATA[<p>There's <a href="http://www.guardian.co.uk/uk/2008/aug/20/uksecurity.terrorism1">no profile</a>:</p>

<blockquote>MI5 has concluded that there is no easy way to identify those who become involved in terrorism in Britain, according to a classified internal research document on radicalisation seen by the Guardian.

<p><br />
[...]</p>

<p>The main findings include: </p>

<p>• The majority are British nationals and the remainder, with a few exceptions, are here legally. Around half were born in the UK, with others migrating here later in life. Some of these fled traumatic experiences and oppressive regimes and claimed UK asylum, but more came to Britain to study or for family or economic reasons and became radicalised many years after arriving.</p>

<p>• Far from being religious zealots, a large number of those involved in terrorism do not practise their faith regularly. Many lack religious literacy and could actually be regarded as religious novices. Very few have been brought up in strongly religious households, and there is a higher than average proportion of converts. Some are involved in drug-taking, drinking alcohol and visiting prostitutes. MI5 says there is evidence that a well-established religious identity actually protects against violent radicalisation. </p>

<p>• The "mad and bad" theory to explain why people turn to terrorism does not stand up, with no more evidence of mental illness or pathological personality traits found among British terrorists than is found in the general population.</p>

<p>• British-based terrorists are as ethnically diverse as the UK Muslim population, with individuals from Pakistani, Middle Eastern and Caucasian backgrounds. MI5 says assumptions cannot be made about suspects based on skin colour, ethnic heritage or nationality. </p>

<p>• Most UK terrorists are male, but women also play an important role. Sometimes they are aware of their husbands', brothers' or sons' activities, but do not object or try to stop them.</p>

<p>• While the majority are in their early to mid-20s when they become radicalised, a small but not insignificant minority first become involved in violent extremism at over the age of 30.</p>

<p>• Far from being lone individuals with no ties, the majority of those over 30 have steady relationships, and most have children. MI5 says this challenges the idea that terrorists are young men driven by sexual frustration and lured to "martyrdom" by the promise of beautiful virgins waiting for them in paradise. It is wrong to assume that someone with a wife and children is less likely to commit acts of terrorism.</p>

<p>• Those involved in British terrorism are not unintelligent or gullible, and nor are they more likely to be well-educated; their educational achievement ranges from total lack of qualifications to degree-level education. However, they are almost all employed in low-grade jobs.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=GwMQnK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=GwMQnK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=nvC4JK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=nvC4JK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 02:18:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mi5">mi5</category>
      <category domain="http://securityratty.com/tag/terrorism">terrorism</category>
      <category domain="http://securityratty.com/tag/british terrorism">british terrorism</category>
      <category domain="http://securityratty.com/tag/british terrorists">british terrorists</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <category domain="http://securityratty.com/tag/violent radicalisation">violent radicalisation</category>
      <category domain="http://securityratty.com/tag/majority">majority</category>
      <category domain="http://securityratty.com/tag/individuals">individuals</category>
      <category domain="http://securityratty.com/tag/internal research document">internal research document</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/mi5_on_terroris.html">MI5 on Terrorist Profiling</source>
    </item>
    <item>
      <title><![CDATA[Don't-Miss NAC Events This Week]]></title>
      <link>http://securityratty.com/article/5103aff88fcf95fa28427084698dc33c</link>
      <guid>http://securityratty.com/article/5103aff88fcf95fa28427084698dc33c</guid>
      <description><![CDATA[FYI, thanks for bearing with me these couple of weeks. I spent a week in a lab with no Internet access at all, which made blogging life (and actually ALL life) very difficult. Upon returning, Ive been...]]></description>
      <content:encoded><![CDATA[FYI, thanks for bearing with me these couple of weeks. I spent a week in a lab with no Internet access at all, which made blogging life (and actually ALL life) very difficult. Upon returning, I&#8217;ve been in the process of following up on the <a href="http://securityuncorked.squarespace.com/security-uncorked/2008/7/10/the-dns-issue-of-2008.html">DNS vulnerability</a> which has now been accidentally released. And, as I mentioned in an earlier post, I&#8217;m smack in the middle of <a href="http://securityuncorked.squarespace.com/security-uncorked/2008/7/8/a-better-blog-coming-up.html">moving this blog</a><p> to a new, fuller-featured platform.&nbsp;</p><p><br></p><p>I did want to make sure you have a couple of important links and info! There are a couple of don&#8217;t-miss webcasts and events <span style="text-decoration: underline;">this week</span> if you&#8217;re interested in NAC technologies. <br></p><ul><li><strong>Live Debate from Network World: </strong>Snyder vs Stiennon- Duel of the NAC Experts<br>Tuesday, July 22nd, 3:00pm Eastern <a class="offsite-link-inline" target="_blank" title="Network World Live NAC Debate" href="http://www.networkworld.com/community/node/30152">More info</a></li>
</ul><ul><li><strong>2008 NAC Survey from Information Week</strong>: Mike Fratto reviews the 2008 Report<br>Wednesday, July 23rd, 2:00pm Eastern <a class="offsite-link-inline" target="_blank" title="Mike Fratto Reviews the NAC Report 2008" href="http://www.informationweek.com/blog/main/archives/2008/07/2008_nac_survey.html">More info</a></li>
</ul><br><p>If you want to read the report, you can download the entire <a class="offsite-link-inline" target="_blank" title="2008 NAC Report by Mike Fratto" href="http://www.nac.informationweek.com/">Information Week 2008 NAC Report by Mike Fratto </a>free, for a limited time. The report covers all the main NAC vendor offerings and contains a variety of interesting survey results. You&#8217;ll be hearing from me soon about the contents of the report and my thoughts on the product details, roadmaps and features.&nbsp;</p><p>Enjoy!<br></p><p># # #<br></p>
]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 09:59:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/information week">information week</category>
      <category domain="http://securityratty.com/tag/entire information week">entire information week</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/report covers">report covers</category>
      <category domain="http://securityratty.com/tag/nac report">nac report</category>
      <category domain="http://securityratty.com/tag/00pm eastern">00pm eastern</category>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/mike fratto free">mike fratto free</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/7/22/dont-miss-nac-events-this-week.html">Don't-Miss NAC Events This Week</source>
    </item>
    <item>
      <title><![CDATA[Florida's Agency for Health Care Administration reports a breach]]></title>
      <link>http://securityratty.com/article/9fbf858547c6670a14d3e4ee147593fc</link>
      <guid>http://securityratty.com/article/9fbf858547c6670a14d3e4ee147593fc</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/7/08

Organization
State of Florida

Contractor/Consultant/Branch
Agency for Health Care Administration

Victims
registered organ donors

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ahca.jpg" width="111" align="right" height="42"><font size="2"><strong>Date Reported: </strong><br>7/7/08<br><br><strong>Organization: </strong><br><a href="http://www.myflorida.com/">State of Florida</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.fdhc.state.fl.us/">Agency for Health Care Administration</a> <br><br><span style="font-weight: bold;">Victims:</span><br>registered organ donors<br><br><span style="font-weight: bold;">Number Affected:</span><br>"about 55,000"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, birth dates, driver license numbers and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"TALLAHASSEE, Fla. - State health officials say a security breach in the Organ and Tissue Donor Registry may have exposed thousands of donors' personal information, including their social security numbers."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ahca.myflorida.com/Organ/faq.htm">AHCA FAQs</a> <br><a href="http://www.heraldtribune.com/article/20080707/APN/807071178">Sarasota Herald-Tribune</a> <br><a href="http://www.wctv.tv/home/headlines/24080734.html">WCTV CBS News</a> <br><a href="http://www.baltimoresun.com/topic/orl-b3report09_508jul09,0,4124063.story">Orlando Sentinel</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Sarasota Herald-Tribune<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>TALLAHASSEE, Fla. - State health officials say a security breach in the Organ and Tissue Donor Registry may have exposed thousands of donors' personal information, including their social security numbers.<br><br>The Agency for Health Care Administrations said Monday it has corrected the flaw, which may have allowed unauthorized users to view the personal information of roughly 55,000 donors.<br><br>"We stopped all access to the database, identified the flaws and corrected them."<br><span style="font-style: italic;">[Evan]&nbsp; This breach makes me wonder a couple of things.&nbsp; Is information security testing part of the development lifecycle and change control?&nbsp; I also wonder if AHCA uses a formal change control process with segregated development, test, and production environments.</span><br><br>The database includes donors' names, addresses, birth dates and driver license numbers.<br><br>The agency is sending letters to inform individuals of the flaw.<br><span style="font-style: italic;">[Evan] What kind of flaw, do you suppose?&nbsp; A Code flaw, an administrative/process flaw, a configuration flaw?</span><br><br>AHCA Secretary Holly Benson said they have not received any indication that the information was accessed inappropriately.<br><span style="font-style: italic;">[Evan] No logging?&nbsp; Logging of the systems, processes, and people accessing confidential information is a must.&nbsp; Extensive logging would be able to determine if the information "was accessed inappropriately" (assuming the logs weren't subject to unauthorized modification).</span><br><br>The breach happened on June 20 and was fixed a day later, but officials say they thought it best to make the public aware.<br><span style="font-style: italic;">[Evan] What does the "breach happened on June 20" mean?&nbsp; It could mean that a flaw was detected on June 20, but could have been in existence for longer.&nbsp; It could mean that a vulnerability was actually exploited on June 20.&nbsp; I guess it really depends on your definition.&nbsp; I assume that the author means that something changed (code push, updated information, configuration, etc.) on June 20.</span><br><br>"If you have not received a letter our logs note that your information was not affected by this security flaw."<br><br>A couple of FAQs:<br>Q: If I have additional questions regarding this issue, what should I do?<br>A: You can call 866 757 0677.&nbsp; This number is open Monday through Friday from 8AM to 7PM Eastern.<br><br>Q: If I am a registered donor and I receive a letter, does this mean that I am a victim of identity theft?<br>A: No. It is unlikely that someone has accessed your information or used it inappropriately. It does not mean that you are a victim of identity theft or that the information may be used to commit fraud. The Agency for Health Care Administration wanted to let you know about the incident so you are aware and may take steps as you see fit.<br><span style="font-style: italic;">[Evan] Again, poor logging and other detective controls lead to statements such as "It is unlikely that someone accessed...".</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Ugh!&nbsp; I am left with too many questions about this breach.&nbsp; On the surface, this breach doesn't look all that significant unless of course, you are a victim.&nbsp; When I read into it more, I realize that I have some serious concerns surrounding process, control, and detection mechanisms used at AHCA.&nbsp; With less detail, it is easier to imagine. <br><br><span style="font-weight: bold;">Past Breaches:</span><br><span style="font-weight: bold;">State of Florida:</span><br>January, 2008 - <a href="http://breachblog.com/2008/01/04/dcf.aspx">Five stolen Florida Department of Children and Families laptops</a> <br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/09/ahca.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 07:15:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/flaw">flaw</category>
      <category domain="http://securityratty.com/tag/configuration flaw">configuration flaw</category>
      <category domain="http://securityratty.com/tag/health care administration">health care administration</category>
      <category domain="http://securityratty.com/tag/database includes donors">database includes donors</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <source url="http://breachblog.com/2008/07/09/ahca.aspx">Florida's Agency for Health Care Administration reports a breach</source>
    </item>
    <item>
      <title><![CDATA[Employee fraud at Wells Fargo Home Mortgage affects some customers]]></title>
      <link>http://securityratty.com/article/769d77ddea6a7ce4dd58d70e453e805b</link>
      <guid>http://securityratty.com/article/769d77ddea6a7ce4dd58d70e453e805b</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/16/08

Organization
Wells Fargo &amp; Company

Contractor/Consultant/Branch
Wells Fargo Home Mortgage

Victims
Customers

Number Affected
Unknown

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wellsfargo.jpg" width="62" align="right" height="62"><font size="2"><b>Date Reported: </b><br>5/16/08<br><br><b>Organization: </b><br><a href="https://www.wellsfargo.com">Wells Fargo &amp; Company</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="https://www.wellsfargo.com/mortgage">Wells Fargo Home Mortgage</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, dates of birth, loan numbers, Personal Identification Numbers (PIN), current bank account numbers and last five digits of their Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"We have learned that a former Wells Fargo employee working in our reverse mortgage servicing department inappropriately used another customer's account information. We have taken appropriate action against this individual."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/WellsFargoBank.pdf%20">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Pursuant to the information compromise notification requirements of the State of New Hampshire, Wells Fargo hereby notifies you that we have give notice to approximately 24 residents of the state of New Hampshire of a potential compromise of their Social Security numbers and mortgage loan account numbers.<br><br>We have learned that a former Wells Fargo employee working in our reverse mortgage servicing department inappropriately used another customer's account information.<br><span style="font-style: italic;">[Evan] Employee fraud is one of the most difficult breaches to prevent (and sometimes to detect).&nbsp; Most controls are largely administrative in nature such as background checks, segregation of duties, job rotation, policy and procedure, etc.&nbsp; Sometimes even the best controls won't do much to prevent an attack from the enemy within.</span><br style="font-style: italic;"><br>We have taken appropriate action against this individual.<br><span style="font-style: italic;">[Evan] I wonder what this means.</span><br><br>We have no information indicating your information was compromised.<br><br>However, the former employee, in the course of their employment, had access to information that may have included your name, address, date of birth, loan number, Personal Identification Number (PIN), current bank account number and last five digits of your Social Security number.<br><span style="font-style: italic;">[Evan] The fact that only the last five digits of the Social Security numbers were accessible is a good indication that Wells Fargo identified the risk involved with a person in the former employee's position accessing confidential information.&nbsp; Limiting Social Security number exposure also limits the extent and impact of the breach.</span><br style="font-style: italic;"><br>We started mailing consumer notices on May 13, 2008.<br><br>Wells Fargo Home Mortgage takes information security very seriously and wants to assure you that we are taking precautionary measures to reduce the potential risk associated with this incident.<br><br>Wells Fargo Home Mortgage, to ensure everything is done to protect you, will be providing you with a new PIN to access the line of credit on your reverse mortgage loan.<br><span style="font-style: italic;">[Evan] Not just "to protect you".&nbsp; Remember that Wells Fargo is in business to make money and I am pretty sure that the things they do are to that end.</span><br><br>As a precaution, Wells Fargo has partnered with a company called Intersections, Inc. to provide you with a free one-year subscription to IDENTITY GUARD CREDITPROTECTX3.<br><span style="font-style: italic;">[Evan] Cool!&nbsp; "CREDITPROTECTX3" sounds super strong and effective!</span><br><br>Wells Fargo Home Mortgage values and appreciates the trust you have placed in us by allowing us to serve you.<br><br>We sincerely apologize for this situation.<br><br>If we can be of further assistance, please do not hesitate to call us at (800) 472-3209 between the hours of 8:00 am and 8:00 pm eastern time, Monday through Friday.<br><br><span style="font-weight: bold;">Commentary:</span><br>I think that breaches like this are more common than some people would like to admit.&nbsp; Banks have the one thing that everyone wants! <br><br><b>Past Breaches:</b><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/08/wellsfargo.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 08:58:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fargo">fargo</category>
      <category domain="http://securityratty.com/tag/fargo home mortgage">fargo home mortgage</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/fargo employee">fargo employee</category>
      <category domain="http://securityratty.com/tag/reverse mortgage loan">reverse mortgage loan</category>
      <category domain="http://securityratty.com/tag/reverse mortgage">reverse mortgage</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/evan cool">evan cool</category>
      <category domain="http://securityratty.com/tag/evan">evan</category>
      <source url="http://breachblog.com/2008/07/08/wellsfargo.aspx">Employee fraud at Wells Fargo Home Mortgage affects some customers</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Latest 802.11 Standard Boosts Wi-Fi Power in New Band]]></title>
      <link>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</link>
      <guid>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</guid>
      <description><![CDATA[The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances : Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.warpspeed.com/wordpress/?p=2406"><strong>The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances</strong></a>: Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from noise sources and other networks, while using very low power, and trying not to make a pest of itself. It's done very well. In the 2.4 GHz band and parts of 5 GHz, the maximum power from the radio is 1 watt (W), and the effective power (EIRP) is 4 W on an omnidirectional antenna. (You can push far more power if you narrow the antenna's beam. And parts of the 5 GHz band restrict radio power below 1 W. I wrote <a href="http://wifinetnews.com/archives/007336.html"><strong>a long rundown of 5 GHz issues</strong></a> back in Jan-2007.)</p>

<p>But there's this lovely new segment of lightly licensed spectrum in the U.S., the 3.65 GHz band. It's a non-exclusive licensed band available only in parts of the country that don't have pre-existing ground-to-satellite or radar uses that overlap. This omits most of the eastern seaboard and most major cities; Seattle is one exception.</p>

<p>The licensing mechanism allows any number of operators to obtain inexpensive licenses, and register the base stations they use by location. If interference arises among base stations, operators are required to work out the problems themselves. I wrote extensively about this band and its rules on 9-May-2008 in <a href="http://wifinetnews.com/archives/008313.html"><strong>profiling Azulstar</strong></a>, formerly a metro-scale Wi-Fi firm, but now a big proponent of WiMax in 3.65 GHz. I also <a href="http://wimaxnetnews.com/archives/2007/06/fcc_affirms_365.html"><strong>went over the rules</strong></a> for the band on 11-June-2007 when the FCC announced the arrangement. </p>

<p>Several firms offer base station and customer premises equipment for this band now, so close to the 3.5 GHz band more commonly exclusively licensed in Europe and elsewhere. WiMax equipment is available because the 3.65 GHz band can be used with WiMax without any modifications to that protocol, although limited to just 25 MHz of the 50 MHz that the FCC set aside.</p>

<p>Equipment that conforms to a more stringent set of rules about contention and other factors can use the whole 50 MHz, and that's where 802.11y comes in. It's an extension of Wi-Fi to cope with the specific needs--and to open Wi-Fi technology up to 20 W EIRP, a vastly higher power output. This could allow connections over 5 km, the group says.</p>

<p>The <a href="http://en.wikipedia.org/wiki/IEEE_802.11y"><strong>Wikipedia entry on 802.11y</strong></a>, clearly written by someone involved with the specification, notes that three specific additions are needed: a tweak to support the way in which the FCC wants contention among competing devices to work; a method for an access point to tell a station (a connecting radio) that it's about to switch its channel or its channel's bandwidth, and the station should do likewise; and a mechanism to handle a base station allowing or revoking permission to use the spectrum without uniquely identifying the user's system or broadcasting its precise GPS-based location.</p>

<p>The standard is near completion and initial approval. I don't have any knowledge about whether any mainstream Wi-Fi equipment makers or metro-scale equipment makers are looking into building 802.11y into their gear. </p>

<p>The fact is that this could be a great technology for the mostly sub-metropolitan markets that 3.65 GHz is available in, although it has the same pain as WiMax: all new gear on the towers and all new adapters for customers.</p>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 10:01:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/band">band</category>
      <category domain="http://securityratty.com/tag/power">power</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/ghz band">ghz band</category>
      <category domain="http://securityratty.com/tag/ghz">ghz</category>
      <category domain="http://securityratty.com/tag/equipment">equipment</category>
      <category domain="http://securityratty.com/tag/wimax equipment">wimax equipment</category>
      <category domain="http://securityratty.com/tag/metro-scale wi-fi firm">metro-scale wi-fi firm</category>
      <category domain="http://securityratty.com/tag/power output">power output</category>
      <source url="http://wifinetnews.com/archives/008379.html">Latest 802.11 Standard Boosts Wi-Fi Power in New Band</source>
    </item>
    <item>
      <title><![CDATA[Mozilla Firefox 3.0 Final Version Available For Download]]></title>
      <link>http://securityratty.com/article/7c033dce648e3b35dcc2cc708db79478</link>
      <guid>http://securityratty.com/article/7c033dce648e3b35dcc2cc708db79478</guid>
      <description><![CDATA[Mozilla Corp. launched a new Firefox version, 3.0, on June 17. This is a major update to the open-source browser that adds a new search tool, anti-hacking protection and revamped bookmarking. The...]]></description>
      <content:encoded><![CDATA[Mozilla Corp. launched a new Firefox version, 3.0, on June 17. This is a major update to the open-source browser that adds a new search tool, anti-hacking protection and revamped bookmarking. The first major revision of Firefox since late 2006, Firefox 3.0 was posted to Mozilla&#8217;s servers at 1 p.m. Eastern time.
Firefox 3.0 first entered [...]]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 02:54:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/firefox">firefox</category>
      <category domain="http://securityratty.com/tag/firefox version">firefox version</category>
      <category domain="http://securityratty.com/tag/major revision">major revision</category>
      <category domain="http://securityratty.com/tag/major">major</category>
      <category domain="http://securityratty.com/tag/eastern time">eastern time</category>
      <category domain="http://securityratty.com/tag/open-source browser">open-source browser</category>
      <category domain="http://securityratty.com/tag/mozillas servers">mozillas servers</category>
      <category domain="http://securityratty.com/tag/mozilla corp">mozilla corp</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <source url="http://cyberinsecure.com/mozilla-firefox-30-final-version-available-for-download/">Mozilla Firefox 3.0 Final Version Available For Download</source>
    </item>
    <item>
      <title><![CDATA[UTUIA laptops are missing after shipment]]></title>
      <link>http://securityratty.com/article/3cca53a16c51f77342f6ce79b4c1eee9</link>
      <guid>http://securityratty.com/article/3cca53a16c51f77342f6ce79b4c1eee9</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/9/08

Organization
United Transportation Union Insurance Association (&quot;UTUIA

Contractor/Consultant/Branch
Westin Hotels and Resorts
United Parcel...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/utuia.jpg" align="right" height="81" width="140"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/9/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.utuia.org/index.htm">United Transportation Union Insurance Association ("UTUIA")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.starwoodhotels.com/westin/index.html">Westin Hotels and Resorts</a> <br><a href="http://www.ups.com/content/us/en/index.jsx">United Parcel Service</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Policyholders<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names and social security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>Two laptop computers shipped via UPS to UTUIA offices are missing.&nbsp; One of the laptops may contain sensitive personal information belonging to UTUIA policyholders.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/united_trans_union.pdf">New Hampshire State Attorney General breach notification</a><br><br>Report Credit:<br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We are writing to inform you of a recent security incident involving UTUIA, headquartered in Ohio.<br><br>During shipment of UTUIA laptop computers to UTUIA offices, laptops have been reported missing.<br><span style="font-style: italic;">[Evan] The notification letter sent to victims mentions two laptops.</span><br><br>The laptops may have contained personal information, including names and social security numbers, about policyholders<br><br>UTUIA has reported the missing laptops to law enforcement authorities and is pursuing the return of these laptops.<br><br>United Transportation Union Insurance Association has filed police reports, is coordinating with the hotel involved (Westin San Francisco) and has notified UPS of the missing items.<br><span style="font-style: italic;">[Evan] Based on the information so far, it appears that UTUIA arranged for Westin to ship two laptops via UPS.&nbsp; One of the laptops contained sensitive personal information.&nbsp; There is no mention of encryption or any other protections in the breach notification, so we can only imagine.</span><br><br>Given the time that has passed since notification, we believe the likelihood of timely recovery is low and therefore are proceeding with notification.<br><span style="font-style: italic;">[Evan] How much time has passed since the laptops were lost/stolen?&nbsp; Neither the New Hampshire or victim notifications disclose this important piece of information.</span><br><br>Currently, there is no indication that the laptop was stolen for its content, but it is possible that there was unauthorized access to information<br><span style="font-style: italic;">[Evan] Do you think that a thief would announce his/her intentions for stealing the laptop?&nbsp; I don't think so.&nbsp; What indication an investigator look for to explain a thief's motives?</span><br><br>We regret this unfortunate situation, and although we have no evidence at this time that any personal information has been accessed or misused, we encourage you to take preventative measures.<br><span style="font-style: italic;">[Evan] What "preventative measures" did UTUIA use to protect personal information for which they were not the owners?&nbsp; Who knows?</span><br><br>We sincerely apologize for any inconvenience that this may cause you.<br><br>If you have additional questions, please call us toll-free at 866-753-3631 between 8:30 a.m. and 4:30 p.m. eastern time, or contact us by mail at 14600 Detroit Avenue, Cleveland, Ohio 44107.<br><br><span style="font-weight: bold;">Commentary:</span><br>In my opinion, there is not enough information in the breach notification sent to the New Hampshire Attorney General or victims.&nbsp; Customers deserve more information about what an organization plans to do in order to provide an adequate amount (owner's discretion) of security.&nbsp; Based on the information we've read in the breach notification, there is no basis for judgment, which is sad.<br><br>What exactly does UTUIA do to protect the confidential information belonging to policyholders?<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/16/utuia.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 16 Jun 2008 05:37:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/utuia">utuia</category>
      <category domain="http://securityratty.com/tag/protect personal information">protect personal information</category>
      <category domain="http://securityratty.com/tag/laptop computers">laptop computers</category>
      <category domain="http://securityratty.com/tag/utuia laptop computers">utuia laptop computers</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/utuia offices">utuia offices</category>
      <source url="http://breachblog.com/2008/06/16/utuia.aspx">UTUIA laptops are missing after shipment</source>
    </item>
  </channel>
</rss>
