<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: patent]]></title>
    <link>http://securityratty.com/tag/patent</link>
    <description></description>
    <pubDate>Mon, 30 Jun 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Enhanced Domain Protection Services Emerge]]></title>
      <link>http://securityratty.com/article/7acf5055cb56782b95c8c264468b8373</link>
      <guid>http://securityratty.com/article/7acf5055cb56782b95c8c264468b8373</guid>
      <description><![CDATA[Registrars are beginning to offer new services to protect against domain name loss. Are they worth it? Well, they're worth something, but maybe not all the money being charged. Yesterday, Domain Name...]]></description>
      <content:encoded><![CDATA[Registrars are beginning to offer new services to protect against domain name loss. Are they worth it? Well, they're worth something, but maybe not all the money being charged.

Yesterday, Domain Name Wire revealed that <a href="http://domainnamewire.com/2008/09/23/godaddy-files-patent-for-domain-name-hijack-protection/">GoDaddy has filed for a patent for "Domain Name Hijack Protection."</a> The basic idea of the service is that domain name transfer-out requests are automatically ignored. The customer gets a notice that the request was received and ignored. The user then has the option of turning off the service, and must supply photo ID in order to do it. Comments on the Domain Name Wire article say it's an intentionally cumbersome process, which certainly works out well for GoDaddy, but I'm not so sure I'd call this innovative.

This application may be related to <a href="https://www.godaddy.com/gdshop/protect/landing.asp?ci=9004">GoDaddy's Protected Registration service</a>, which similarly protects against casual transfers, a service they call Deadbolt Transfer Protection. In order to perform a transfer, more thorough verification procedures are required, probably involving genuine human beings.

GoDaddy also claims to protect the domain in case of billing problems, such as "credit card expiration, failed billing or outdated contact information." If your domain expires and cannot be renewed because the credit card expired or some other such reason the domain will be placed in "invalid, protected status" for up to one year. In other words, it will be taken off-line, but not made available for anyone else to register. If you've parked it you may not notice, but if you're using the domain you will, because it won't work anymore. At this point you can go back to GoDaddy and make things right. All this costs $24.99 a year, which is a lot of money compared to the base registration. You'd be much better off with a standard domain lock and just being responsible about your domains and reading the e-mail GoDaddy sends you.

And thanks to <a href="http://www.domainnamenews.com/registrars/moniker-launches-domainmaxlock/2452">DomainNameNews for reporting</a> that Moniker, a registrar aimed at higher-volume domain name owners, has launched <a href="http://www.moniker.com/maxlock/">their DomainMaxLock service</a>.

DomainMaxLock, like GoDaddy's Deadbolt, makes you provide more stringent identification for transfers. According to the company you must:
<UL>
<LI>Provide a government I.D. number for verification of your identity.
<LI>Set up custom security questions and answers, further safeguarding your domain assets.
<LI>Provide special verification instructions and artifacts to ensure that your unique business or ownership interests are protected.
<LI>When you request that your domains be unlocked, our security team works directly with you to verify all of the above off-line - further eliminating risks of doing business in an online world! </LI>
</UL>
It's essentially an admission of the failure of automated services with respect to security. The idea is we can trust humans in person, not software. The service costs $34.95 per domain per year for a limited time, but the cost will increase later to $59.99.

These verification services are similar in many ways to those performed by CAs (certificate authorities). Since GoDaddy is also one of those, it's likely they can get better utilization out of that staff by offering such services.
<p><a href="http://feedads.googleadservices.com/~a/FCZhqYUdUonhGhpMKWK6obfrCas/a"><img src="http://feedads.googleadservices.com/~a/FCZhqYUdUonhGhpMKWK6obfrCas/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/8Vacprz_ezY" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 04:23:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/domain">domain</category>
      <category domain="http://securityratty.com/tag/standard domain lock">standard domain lock</category>
      <category domain="http://securityratty.com/tag/higher-volume domain">higher-volume domain</category>
      <category domain="http://securityratty.com/tag/domain assets">domain assets</category>
      <category domain="http://securityratty.com/tag/domain expires">domain expires</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/domainmaxlock service">domainmaxlock service</category>
      <category domain="http://securityratty.com/tag/godaddy">godaddy</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/8Vacprz_ezY/enhanced_domain_protection_services_emerge.html">Enhanced Domain Protection Services Emerge</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9]]></title>
      <link>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</link>
      <guid>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</guid>
      <description><![CDATA[Australian tech office wins appeal: Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.zdnet.com.au/news/hardware/soa/CSIRO-victorious-in-Wi-Fi-appeal/0,130061702,339292134,00.htm?omnRef=1337"><strong>Australian tech office wins appeal:</strong></a> Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented technology used in all 802.11 implementations. The case, in the patent-holder-friendly US Eastern District Court of Texas--a venue that may be dethroned as a <em>forum coveniens</em> for patentholders' suits in new legislation--prevents Buffalo from importing or selling gear in the US with Wi-Fi technology embedded. In Japan, the patent office threw out CSIRO's patent. While Cisco paid CSIRO as the result of an acquisition of an Australian company a few years ago, most US-based technology giants are involved in resisting the patent's continued validation and enforcement. I've read the patent and some of the suits, and as a non-patent expert, it's clear CSIRO original invention didn't cover what's at stake. However, CSIRO was allowed in a subsequent filing to extend its patent to cover already-in-use technology in a way that seems odd to me, but happens in patents all the time. Many millions of dollars and many more years may be expended before a resolution happens. CSIRO apparently isn't asking for insane fees, although anything paid to them would be passed along to consumers. If companies settled, this might result in an increase of 1 to 5 percent on retail prices. It may ultimately effect WiMax, too, though no suits in that area have been filed.</p>

<p><a href="http://news.cnet.com/8301-10805_3-10046542-75.html"><strong>Finding Zune-Fi:</strong></a> Ina Fried of News.com wanders the polite streets of San Francisco in search of Zune connections over Wi-Fi. She finds a few, and has a good experience. One cafe owner sees the ease with which she can stream music and calls it cool. She can't connect at the long-running Google-sponsored free Wi-Fi at Union Square, however, which means the Wi-Fi likely has an accept button that must be pressed. Surely Microsoft could insert a little technology that would allow a browser-free acceptance of terms? Probably involves Yet Another Protocol: the Wi-Fi Terms Browser-Free Presentation Protocol (WTBFPP).</p>

<p><img src="http://wifinetnews.com//images/2008/kodakesp9.jpg" alt="kodakesp9.jpg" border="0" width="150" height="120" align="right" /><a href="http://www.kodak.com/eknec/PageQuerier.jhtml?pq-path=13572&pq-locale=en_US"><strong>Kodak adds interesting Wi-Fi enabled all-in-one:</strong></a> The new Kodak ESP 9 is a multi-function printer (fax, scan, print, copy) that connects to a network via Wi-Fi or Ethernet. The $300 device spits out 30 pages per minutes in color, 32 ppm in black only. Kodak claims that the model line to which the ESP belongs uses ink in a vastly more efficient manner than the "average of comparable consumer inkjet printers." </p>]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 05:53:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/csiro">csiro</category>
      <category domain="http://securityratty.com/tag/patent">patent</category>
      <category domain="http://securityratty.com/tag/cover">cover</category>
      <category domain="http://securityratty.com/tag/cover already-in-use technology">cover already-in-use technology</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/kodak">kodak</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wi-fi technology">wi-fi technology</category>
      <source url="http://wifinetnews.com/archives/008452.html">Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9</source>
    </item>
    <item>
      <title><![CDATA[The Real Migration Problem]]></title>
      <link>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</link>
      <guid>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</guid>
      <description><![CDATA[Preview of Tom Friedman's thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added

FP: And what about drilling? Republican presidential candidate Sen. John McCain, his running...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.foreignpolicy.com/story/cms.php?story_id=4463">Preview</a> of Tom Friedman&#39;s thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added):</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><span class="fp_red" style="color: #8c182d; font-weight: bold; "><strong>FP:&#160;</strong></span>And what about drilling? Republican presidential candidate Sen. John McCain, his running mate Gov. Sarah Palin, and President George W. Bush are implying that lifting environmental restrictions on drilling is the way to promote energy independence.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><strong>TF:&#160;</strong>Well, I think it’s patent nonsense. No one believes that somehow offshore, there’s enough oil in any near term and even the long term to provide us oil independence. It’s the wrong approach because in a world that’s hot, flat, and crowded, fossil fuels—and particularly crude oil—are going to be expensive and exhausting. Therefore the focus should be on the next great global industry: clean energy technology. <span style="font-weight: bold;">When I hear McCain pounding the table for “drill, drill, drill,” it reminds me of someone pounding the table for IBM Selectric typewriters on the eve of the IT revolution.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; ">I’m not against offshore drilling, by the way, because I believe the technology and the safety has improved far beyond where it was back in the 70s, 80s, and 90s, even. What I’m against is making it the centerpiece of our energy policy. If all McCain said was, “Let’s drill, but let’s also throw everything into innovating the next generation of clean-energy technologies,” I’d say, “You’ve got it exactly right, pal.”</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></p><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Its funny because as someone who has done a half dozen legacy migration projects (with mental and emotional scars to prove it), I was thinking the same thing. The entrenched mindset. &quot;If we just dig our trench deeper (in this case literally) then we will be ok.&quot;...at least until the person in question retires...</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">One of the legacy migration project I worked on, I was the third consultant that tried to get this company off of mainframe and onto distributed systems (which are no panacea but this company really did need to make the move). The core developers of the mainframe were actively hostile to change, as opposed to simply passive aggressive, which we expect. For example, if you asked about how a piece of functionality worked, say a report writer, the developer would not answer, stand up, walk out of the room, come back with a 800 page &quot;data model&quot;, slam it on the table and walk out of the room. Good times.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">A chief objection beyond fear of the unknown was the perceived lack of elegance in the distributed systems as opposed to the control from say JCL. Anyway, what progress I made was due to analogizing that we were leaving Greece which has a rich culture, history, philosophy and moving to Rome which maybe was not as elegant as Greece but still people like circuses, roads and acqueducts. So when, several times a day, a perceived go/ no go issue arose, I would gently remind &#160;the developers that &quot;we are now in Rome and things work differently here.&quot;</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Intransigently digging the trench deeper is not the way, instead we need to better understanding the energy &#160;problem in a larger context, and finding deployable technologies to help address it. If you think drill, drill, drill is the answer, then I think the answer for you is the same as someone who knows COBOL and flat refuses to learn modern languages even when that is required - a nice retirement house on a golf course somewhere.</span></div>]]></content:encoded>
      <pubDate>Tue, 09 Sep 2008 05:38:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/clean-energy technologies">clean-energy technologies</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/drill">drill</category>
      <category domain="http://securityratty.com/tag/energy policy">energy policy</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/promote energy independence">promote energy independence</category>
      <category domain="http://securityratty.com/tag/trench deeper">trench deeper</category>
      <category domain="http://securityratty.com/tag/mccain">mccain</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/the-real-migration-problem.html">The Real Migration Problem</source>
    </item>
    <item>
      <title><![CDATA[No Trademark for Cloud Computing]]></title>
      <link>http://securityratty.com/article/4b9f7e842fb8a79ceb2a5ea157dab13c</link>
      <guid>http://securityratty.com/article/4b9f7e842fb8a79ceb2a5ea157dab13c</guid>
      <description><![CDATA[Just a couple of weeks ago, it was reported that Dell was in the final stages of being granted a trademark on Cloud Computing shocking and amusing pretty much everyone except for possibly Dell...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="157" alt="clouds-jwn6" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/clouds-jwn6.jpg" width="240" align="left" border="0" /> Just a couple of weeks ago, it was reported that Dell was in the final stages of being granted a trademark on &#8220;Cloud Computing&#8221; &#8211; <a href="http://languagelog.ldc.upenn.edu/nll/?p=434#more-434" target="_blank">shocking and amusing</a> pretty much everyone except for possibly Dell employees. But apparently the US Patent and Trademark Office paid attention to the flurry of negative responses and has since <a href="http://samj.net/2008/08/dells-notice-of-allowance-for-cloud.html" target="_blank">cancelled their &#8220;Notice of Allowance&#8221;</a> for the trademark. </p>
<p>I&#8217;d like to give everyone the benefit of the doubt here; perhaps Dell was using it in a much narrower sense. Perhaps the term has really only been used more commonly since the time Dell first applied for the trademark back in March 2007 and now. BUT&#8230;</p>
<p>- Dell&#8217;s definition is quite broad and certainly not Dell-specific. <a href="http://www.eweek.com/c/a/IT-Infrastructure/Dell-Attempts-to-Trademark-Cloud-Computing/" target="_blank">&#8220;The design of computer hardware for use in datacenters and mega-scale computing environments for others; customization of computer hardware for use in data centers and mega-scale computing environments for others; design and development of networks for use in data centers and mega-scale computing environments for others.&#8221;</a> Strike One.</p>
<p>- And according to the Wall Street Journal&#8217;s research, &#8220;<a href="http://blogs.wsj.com/biztech/2008/08/06/dells-tech-jargon-trademark/" target="_blank">cloud computing&#8221; has been in regular use since 2001</a>. Strike Two.</p>
<p>So now the &#8220;case&#8221; has been returned to examination and hopefully the PTO will follow up on everyone else&#8217;s research on this and decide that yes, cloud computing is one of those broad, ubiquitous terms that should NOT be trademarked by a single company. </p>
]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 16:01:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trademark">trademark</category>
      <category domain="http://securityratty.com/tag/dell">dell</category>
      <category domain="http://securityratty.com/tag/time dell">time dell</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/dell-specific">dell-specific</category>
      <category domain="http://securityratty.com/tag/possibly dell employees">possibly dell employees</category>
      <category domain="http://securityratty.com/tag/trademark office">trademark office</category>
      <category domain="http://securityratty.com/tag/computer hardware">computer hardware</category>
      <category domain="http://securityratty.com/tag/data centers">data centers</category>
      <source url="http://blog.sciencelogic.com/no-trademark-for-cloud-computing/08/2008">No Trademark for Cloud Computing</source>
    </item>
    <item>
      <title><![CDATA[Sun offering support for OpenSSO]]></title>
      <link>http://securityratty.com/article/4e90e9c71d9a3efb89230e7c16e3db4d</link>
      <guid>http://securityratty.com/article/4e90e9c71d9a3efb89230e7c16e3db4d</guid>
      <description><![CDATA[Sun Wednesday said it would offer support to corporate users of OpenSSO open source identity technology and introduced a new version that also protects companies against patent infringement...]]></description>
      <content:encoded><![CDATA[Sun Wednesday said it would offer support to corporate users of OpenSSO open source identity technology and introduced a new version that also protects companies against patent infringement suits.]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/source identity technology">source identity technology</category>
      <category domain="http://securityratty.com/tag/patent infringement suits">patent infringement suits</category>
      <category domain="http://securityratty.com/tag/offer support">offer support</category>
      <category domain="http://securityratty.com/tag/opensso">opensso</category>
      <category domain="http://securityratty.com/tag/sun wednesday">sun wednesday</category>
      <category domain="http://securityratty.com/tag/protects companies">protects companies</category>
      <category domain="http://securityratty.com/tag/version">version</category>
      <category domain="http://securityratty.com/tag/users">users</category>
      <source url="http://www.networkworld.com/news/2008/072408-sun-opensso-support.html?fsrc=rss-security">Sun offering support for OpenSSO</source>
    </item>
    <item>
      <title><![CDATA[NAPA Shows How the Government is Using Web 2.0]]></title>
      <link>http://securityratty.com/article/c2382eef0b0cdb073ef226ac74ecee5b</link>
      <guid>http://securityratty.com/article/c2382eef0b0cdb073ef226ac74ecee5b</guid>
      <description><![CDATA[Back in April, we attended a session at the FOSE conference that highlighted Web 2.0 usage in the public sector . We also found through a survey of government workers that 65% of government IT workers...]]></description>
      <content:encoded><![CDATA[<p>Back in April, we attended a session at the <a href="http://blog.sciencelogic.com/fose-session-web-20-for-the-public-sector/04/2008" target="_blank">FOSE conference that highlighted Web 2.0 usage in the public sector</a>. We also found <a href="http://blog.sciencelogic.com/web-20-adoption-by-the-federal-government-shouldnt-be-a-surprise/06/2008" target="_blank">through a survey of government workers</a> that 65% of government IT workers surveyed said that Web 2.0 tools are important to their operations. The overall message was that all IT, government included, have too many projects they could be taking on for the amount of resources they have. For much of the IT topics we covered in the survey, importance was high but actual deployment was lower.
<p>Dan Munz, project manager of the <a href="http://www.collaborationproject.org/" target="_blank">Collaboration Project</a> commented on <a href="http://www.collaborationproject.org/display/home/Collaboration+Project+Blog" target="_blank">the unique work</a> that the National Academy of Public Administration (NAPA) is doing to bring together government leaders. The Collaboration Project seeks to innovate across government not just down the silos and create a safe place for leaders to have discussions around innovation.
<p><strong><em>ScienceLogic:</em></strong> What is the National Academy of Public Administration?
<p><strong><em>Dan Munz:</em></strong> The Academy is an independent, non-partisan, non-profit organization dedicated to tackling government&#8217;s most complex challenges. We were founded in 1967 by James Webb, the NASA administrator who took us to the moon – he saw that he could consult the National Academy of Sciences for expert technical advice, but had no counterpart in government for expert management advice. That&#8217;s been our mission ever since.
<p><strong><em>ScienceLogic:</em></strong> What is the Collaboration Project? How long has it been around?
<p><strong><em>Dan Munz:</em></strong> The Collaboration Project is the Academy&#8217;s response to two parallel trends we see in government. The first is the government’s need to transform the way it does business. There is a strong demand for change out there driven by a number of challenges that are forcing the government to rethink its mission and structure. Challenges include a public disconnected from government; a multi-sector workforce and increasing reliance on contractors; financial instability; and new types of security threats, just to name a few. More and more, the challenges facing government reach across the traditional boundaries of agency and mission. But government isn&#8217;t configured to work that way.
<p>The second trend is the unprecedented opportunity collaborative technology offers to drive transformational change in government. Tools like blogs, wikis, and mashups are changing the way leaders think about problems. They&#8217;re focusing not on what they can do just within their offices or agencies, but what voices they need to pull together across government, non-profits, the general citizenry, and other stakeholders to solve these problems. The Collaboration Project’s goal is to encourage this type of thinking and empower leaders committed to use collaborative technology to:
<ul>
<li>strengthen citizen civic engagement;</li>
<li>enhance government transparency;</li>
<li>improve service delivery and operational efficiency; and</li>
<li>facilitate coordination and innovation within and between agencies.</li>
</ul>
<p><strong><em>ScienceLogic:</em></strong> Why focus on Web 2.0 in the government?
<p><strong><em>Dan Munz:</em></strong> The question of how web 2.0 will impact federal IT departments is a critical one. Our view is that &#8220;the era of big systems&#8221; is basically over. Things like disk space, bandwidth, and computing power are basically shifting from being assets to being commodities.
<p>There&#8217;s also a shift in expectations. People both inside and outside government – especially Gen-X and Gen-Y – are incredibly frustrated by being able to use lightning-fast apps like Flickr, YouTube, and Facebook <i>that don&#8217;t even live on their hard drives</i> while the government and other large organizations still operate clunky PCs, space-limited e-mail accounts, and sluggish e-mail servers.
<p>So aside from the opportunity for transformative leadership, the idea of web 2.0 at a government level is very appealing in terms of getting the most out of the IT infrastructure we already have, rather than embarking on costly, large-scale projects in an era of diminishing budgets.
<p><strong><em>ScienceLogic:</em></strong> How do you build a sense of community at the Collaboration Project?
<p><strong><em>Dan Munz:</em></strong> Some community feel emerges naturally, from a sense that mass collaboration really is a tool for &#8220;doing government&#8221; in a whole new way.
<p>The more formal community building mechanisms we have include <a href="http://www.collaborationproject.org" target="_blank">our web page</a>, where we share insights, news, case studies, and other content – The virtual space serves as an anchor for people, whether they&#8217;re experts or beginners, to learn about what we do.
<p>Finally, we are conducting an ongoing series of in-person meetings, usually featuring a leader who has harnessed collaborative technology in what we think is a truly revolutionary new way.
<p><strong><em>ScienceLogic:</em></strong> How do you hear about cool new government Web 2.0 projects?
<p><strong><em>Dan Munz:</em></strong> That&#8217;s a key question, because part of our mission is to inspire action by finding leaders who have succeeded and highlight their accomplishments. We&#8217;ve done that with folks like Kip Hawley, TSA, Molly O&#8217;Neill, EPA, and Jim Walker, Alabama DHS.
<p>We also feel that the Academy&#8217;s position as a &#8220;safe space&#8221; for leaders means that we&#8217;re a place people can turn to when they hear about an emerging trend or project and want some help making sense of it.
<p><strong><em>ScienceLogic:</em></strong> What are the most innovative uses of Web 2.0 technology you&#8217;ve seen in the government?
<p><strong><em>Dan Munz:</em></strong> It&#8217;s important to distinguish between agencies that are simply adjusting to the reality of web 2.0, and those that are &#8220;using&#8221; it. Getting a YouTube account for your agency, or putting some photos on Flickr, is a great first step, but we want to inspire leaders to really transform their normal ways of doing business. At the moment a few that come to mind are the EPA Puget Sound Mashup, ODNI&#8217;s Intellipedia, TSA IdeaFactory, the PTO Peer-to-Patent Project, and Virtual Alabama, to name a few.
<p>The <a href="http://www.fcw.com/print/22_5/features/151791-1.html" target="_blank">TSA launched the IdeaFactory</a> in February 2008. TSA set up a collaboration platform with commenting, voting, etc. to form communities in a way to bring people to consensus and <a href="http://www.collaborationproject.org/pages/viewpage.action?pageId=5668923&amp;navigatingVersions=true" target="_blank">offer ways to improve the agency&#8217;s performance</a>.
<p><strong><em>ScienceLogic:</em></strong> Do you see a difference between state and local versus federal adoption of Web 2.0?
<p><strong><em>Dan Munz:</em></strong> That&#8217;s a hard generalization to make – at all levels you see leaders who recognize the potential in this technology to bring new voices into the governance process.
<p><strong><em>ScienceLogic:</em></strong> What are the obstacles to Web 2.0 adoption by government agencies?
<p><strong><em>Dan Munz:</em></strong> The three main challenges that we see are in the areas of technology, culture, and policy/governance.
<p>The technology issue is probably the simplest to solve – it&#8217;s important to choose a technology that fits the problem you&#8217;re trying to solve, but these technologies are usually inexpensive and almost never very complex.
<p>The question of culture is harder, particularly given the way that baby boomers, gen-xers, and millenials are beginning to interact in the workforce. How do you gain acceptance and buy-in among groups that have very different comfort levels with collaborative tools and environments?
<p>Finally, the most daunting challenge might be the questions of policy and governance, if only because those are the things that most commonly prevent leaders from even dipping a toe in the waters of collaboration. Most of the policies, regulations, and statutes governing the way government does business don&#8217;t anticipate things like wikis, blogs, or instant messaging. One of our most important missions is helping leaders who just want to get to action navigate these obstacles.
<p><strong><em>ScienceLogic:</em></strong> Is there any advice you can give to government employees getting started with Web 2.0? Or any places you would point them to for more info?
<p><strong><em>Dan Munz:</em></strong> It&#8217;s shameless plug time! I&#8217;d of course point them to our web page, <a href="http://collaborationproject.org/">collaborationproject.org</a>, where, among other things, we&#8217;ve collected a case library of over 40 instances of collaborative technology being used in the government and non-profit sectors. The library is growing every day and is a sort of &#8220;database of record&#8221; for what is and isn&#8217;t working in terms of collaborative government. I think that would be a great place to start for anyone looking to get started but not really knowing the way.
<p>In terms of advice, the best thing to say is that, once you&#8217;ve settled on a problem you want to solve and an audience you want to reach out to, <b>just do it</b>! We believe strongly that there are a lot of organizational and leadership issues that still need to be addressed regarding collaboration in government, but our biggest mantra is about getting leaders to action. The most successful projects we&#8217;ve seen are ones that try something daring and new, and discover the true power of what they&#8217;ve done as it catches on more and more widely.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=NAPA+Shows+How+the+Government+is+Using+Web+2.0&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fnapa-shows-how-the-government-is-using-web-20%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 16:45:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/web page">web page</category>
      <category domain="http://securityratty.com/tag/government web">government web</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/mass collaboration">mass collaboration</category>
      <category domain="http://securityratty.com/tag/collaboration project seeks">collaboration project seeks</category>
      <category domain="http://securityratty.com/tag/government employees">government employees</category>
      <category domain="http://securityratty.com/tag/enhance government transparency">enhance government transparency</category>
      <source url="http://blog.sciencelogic.com/napa-shows-how-the-government-is-using-web-20/07/2008">NAPA Shows How the Government is Using Web 2.0</source>
    </item>
    <item>
      <title><![CDATA[P2P-related breach affects high-profile clients from Wagner Resource Group]]></title>
      <link>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</link>
      <guid>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08

Organization
Wagner Resource Group

Contractor/Consultant/Branch
None

Victims
Clients

Most notably Supreme Court Justice Stephen G. Breyer,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wagner.jpg" width="200" align="right" height="120"><font size="2"><b>Date Reported: </b><br>7/9/08<br><br><b>Organization: </b><br><a href="http://www.wagnerrg.com/new/invest-taxfree/gate.asp">Wagner Resource Group</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Clients*<br><br><font size="1">*Most notably Supreme Court Justice Stephen G. Breyer, which has been well publicized.</font><br><br><span style="font-weight: bold;">Number Affected:</span><br>~2,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, dates of birth and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Washington Post today ran a story I wrote on a data breach of a local investment firm that exposed the names, birth dates and Social Security numbers of some of the Washington area's most powerful attorneys, including Supreme Court Justice Stephen Breyer."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://blog.washingtonpost.com/securityfix/">SecurityFix</a> <br><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/07/08/AR2008070802997.html">Washington Post</a> <br><a href="http://www.upi.com/Top_News/2008/07/09/Justices_data_breached_in_file-sharing/UPI-14191215609364/">United Press International</a> <br><a href="http://www.nbc4.com/news/16832357/detail.html">NBC Universal, Inc</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Brian Krebs, Washington Post<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Sometime late last year, an employee of a McLean investment firm decided to trade some music, or maybe a movie, with like-minded users of the online file-sharing network LimeWire while using a company computer<br><span style="font-style: italic;">[Evan] P2P file sharing and other client software use can pose a very significant risk in most companies.&nbsp; It is typically an easy risk to address however.&nbsp; A mixture of any one or more of the following controls can help to mitigate the risk; information security training and awareness, egress traffic monitoring and filtering, intrusion detection/prevention, and hardened workstations (i.e. removal of administrative access) to name a few.</span><br style="font-style: italic;"><br>In doing so, he inadvertently opened the private files of his firm, Wagner Resource Group, to the public.<br><span style="font-style: italic;">[Evan] This is a common oversight.&nbsp; LimeWire and other P2P file sharing applications are wonderful tools for doing what they are designed to do.&nbsp; Before allowing their use (or any other software), an organization must evaluate the risks in doing so.&nbsp; If you intend to use or allow the use of LimeWire in your organization, understand how the software works and how it is configured.&nbsp; During the install you will be prompted for the "Save Folder and Shared Folders".&nbsp; Be careful what you choose, and be careful about what information you put in these locations in the future.&nbsp; Most organizations that are aware of risks just choose not to allow P2P use.</span><br><br><img src="http://images.quickblogcast.com/95781-88451/limewire.jpg" width="576" border="0"><br><br>That exposed the names, dates of birth and Social Security numbers of about 2,000 of the firm's clients, including a number of high-powered lawyers and Supreme Court Justice Stephen G. Breyer.<br><span style="font-style: italic;">[Evan] The high-profile nature of this breach is what has grabbed headlines all last week.</span><br><br>Of the 2,000 records from Wagner Resource Group that were found online, 700 included Social Security numbers, names and birth dates, while other records included only one or two of those details. <br><br>The breach was not discovered for nearly six months.<br><span style="font-style: italic;">[Evan] This is another danger posed by information leaked through P2P.&nbsp; Once information has leaked, how does an organization detect that it has been leaked?&nbsp; There is no longer any control.</span><br style="font-style: italic;"><br>A reader of washingtonpost.com's Security Fix blog found the information while searching LimeWire in June.<br><span style="font-style: italic;">[Evan] I wonder why the reader did not notify the authorities and/or Wagner at the time of its discovery.&nbsp; Maybe he/she did.&nbsp; I don't know.</span><br style="font-style: italic;"><br>Robert Boback, chief executive of Tiversa, the company hired by Wagner to help contain the data breach, said such breaches are hardly rare.<br><br>About 40 to 60 percent of all data leaks take place outside of a company's secured network, usually as a result of employees or contractors installing file-sharing software on company computers.<br><span style="font-style: italic;">[Evan] Really?!&nbsp; I would have not guessed that the percentage would be so high.&nbsp; Interesting.</span><br><br>"We've seen a lot of instances where a company will be working on a product that's not even released yet, and the diagrams for that product are already out on the Net," Boback said.<br><span style="font-style: italic;">[Evan] Very good point.&nbsp; It isn't just personally identifiable information that is leaked, there are plenty of instances where intellectual property (IP) is exposed.&nbsp; I have read estimates that as much as 80% or organizational assets globally are intangible (information, knowledge, etc.).</span><br style="font-style: italic;"><br>"This case is unique because of the high profile of the targets. The individuals on this list are at a very high risk, almost imminent, of identity theft." <br><br>Tiversa officials found that more than a dozen LimeWire users in places as far away as Sri Lanka and Colombia downloaded the list of personal data from the Wagner network.<br><br>"To me, this was devastating," said Phylyp Wagner, founder of the investment firm. "I didn't even know what peer-to-peer was. I do now."<br><span style="font-style: italic;">[Evan] This is a big problem!&nbsp; Corporate leaders must be made aware of the risks surrounding the information for which they are ultimately responsible for.</span><br style="font-style: italic;"><br>Wagner said his company has contracted with FirstAdvantage of Poway, Calif., which last week sent out letters notifying affected clients of the breach and offering each six months of free credit-report monitoring.<br><br>He emphasized that the peer-to-peer disclosure never endangered his clients' financial records, which are stored by a separate company.<br><span style="font-style: italic;">[Evan] Maybe not their financial records, but it did affect some people's financial status (at least temporarily).</span><br><br>But that may be small consolation to several lawyers on the list who said they recently experienced unexplained financial activity.<br><br>"This may explain why two weeks ago I got a $9,000 cellphone bill from AT&amp;T," said Steven Agresta, a partner with the law firm Alston &amp; Bird.<br><br>Someone had opened a phone account using his date of birth and Social Security number, but with a different address.<br><br>this morning I heard from reader Christopher Lynt, a patent attorney from Virginia whose personal data was included in the file exposed via P2P.<br><br>He told me that last July, an identity thief used his SSN and birth date to have $1,000 wired to Mexico from Lynt's bank and credit accounts.<br><br><span style="font-weight: bold;">Commentary:</span><br>This certainly isn't the first time we have read about P2P file sharing network exposures.&nbsp; If your organization can find a way to use the technology without posing an unacceptable risk, then fine.&nbsp; If not, then don't allow the technology to be used.&nbsp; Seems pretty plain and simple.<br><br>There is much work to be done.&nbsp; At Wagner and elsewhere. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/14/wagner.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 13:08:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wagner">wagner</category>
      <category domain="http://securityratty.com/tag/p2p">p2p</category>
      <category domain="http://securityratty.com/tag/investment firm">investment firm</category>
      <category domain="http://securityratty.com/tag/evan p2p file">evan p2p file</category>
      <category domain="http://securityratty.com/tag/mclean investment firm">mclean investment firm</category>
      <category domain="http://securityratty.com/tag/p2p file">p2p file</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/wagner network">wagner network</category>
      <category domain="http://securityratty.com/tag/wagner resource">wagner resource</category>
      <source url="http://breachblog.com/2008/07/14/wagner.aspx">P2P-related breach affects high-profile clients from Wagner Resource Group</source>
    </item>
    <item>
      <title><![CDATA[Barracuda countersues Trend Micro in patent case]]></title>
      <link>http://securityratty.com/article/ba33d47f5361440e3cbc99f680c71148</link>
      <guid>http://securityratty.com/article/ba33d47f5361440e3cbc99f680c71148</guid>
      <description><![CDATA[The legal battle between Trend Micro and Barracuda enters a new stage, as Barracuda brings in three newly-purchased patents of its...]]></description>
      <content:encoded><![CDATA[The legal battle between Trend Micro and Barracuda enters a new stage, as Barracuda brings in three newly-purchased patents of its own.]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trend micro">trend micro</category>
      <category domain="http://securityratty.com/tag/barracuda brings">barracuda brings</category>
      <category domain="http://securityratty.com/tag/barracuda enters">barracuda enters</category>
      <category domain="http://securityratty.com/tag/legal battle">legal battle</category>
      <category domain="http://securityratty.com/tag/stage">stage</category>
      <category domain="http://securityratty.com/tag/patents">patents</category>
      <source url="http://www.networkworld.com/news/2008/070208-barracuda.html?fsrc=rss-security">Barracuda countersues Trend Micro in patent case</source>
    </item>
    <item>
      <title><![CDATA[Kill Switches and Remote Control]]></title>
      <link>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</link>
      <guid>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</guid>
      <description><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now...]]></description>
      <content:encoded><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now everyone else wants to get their hooks into your gear.

OnStar will soon include the <a href="http://www.informationweek.com/news/mobility/showArticle.jhtml?articleID=202400922">ability</a> for the police to shut off your engine remotely. Buses are getting the <a href="http://www.nypost.com/seven/06082008/news/regionalnews/busting_terror_114567.htm">same capability</a>, in case terrorists want to re-enact the movie <cite>Speed</cite>. The Pentagon wants a kill switch <a href="http://blog.wired.com/defense/2008/06/the-pentagons-n.html">installed</a> on airplanes, and is worried about potential enemies <a href="http://spectrum.ieee.org/may08/6171">installing</a> kill switches on their own equipment. 

Microsoft is doing some of the most creative thinking along these lines, with something it's calling "<a href="http://arstechnica.com/news.ars/post/20080611-microsoft-patent-brings-miss-manners-into-the-digital-age.html">Digital Manners Policies</a>." According to its <a href="http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220080125102%22.PGNR.&OS=DN/20080125102&RS=DN/20080125102">patent application</a>, DMP-enabled devices would accept broadcast "orders" limiting capabilities. Cellphones could be remotely set to vibrate mode in restaurants and concert halls, and be turned off on airplanes and in hospitals. Cameras could be prohibited from taking pictures in locker rooms and museums, and recording equipment could be disabled in theaters. Professors finally could prevent students from texting one another during class. 

The possibilities are endless, and very dangerous. Making this work involves building a nearly flawless hierarchical system of authority. That's a difficult security problem even in its simplest form. Distributing that system among a variety of different devices -- computers, phones, PDAs, cameras, recorders -- with different firmware and manufacturers, is even more difficult. Not to mention delegating different levels of authority to various agencies, enterprises, industries and individuals, and then enforcing the necessary safeguards.

Once we go down this path -- giving one device authority over other devices -- the security problems start piling up. Who has the authority to limit functionality of my devices, and how do they get that authority? What prevents them from abusing that power? Do I get the ability to override their limitations? In what circumstances, and how? Can they override my override?

How do we prevent this from being abused? Can a burglar, for example, enforce a "no photography" rule and prevent security cameras from working? Can the police enforce the same rule to avoid another Rodney King incident? Do the police get "superuser" devices that cannot be limited, and do they get "supercontroller" devices that can limit anything? How do we ensure that only they get them, and what do we do when the devices inevitably fall into the wrong hands?

It's comparatively easy to make this work in closed specialized systems -- OnStar, airplane avionics, military hardware -- but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems.

And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music to a computer other than your own. They want to enforce <em>their</em> legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible. 

"Digital Manners Policies" is a marketing term. Let's call this what it really is: Selective Device Jamming. It's not polite, it's dangerous. It won't make anyone more secure -- or more polite.

This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/06/securitymatters_0626">originally appeared</a> in Wired.com.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=JiKwGJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=JiKwGJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aXm5MJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aXm5MJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 02:48:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wireless devices">wireless devices</category>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/devices inevitably">devices inevitably</category>
      <category domain="http://securityratty.com/tag/digital manners policies">digital manners policies</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/prevent security cameras">prevent security cameras</category>
      <category domain="http://securityratty.com/tag/difficult security">difficult security</category>
      <category domain="http://securityratty.com/tag/cameras">cameras</category>
      <category domain="http://securityratty.com/tag/prevent students">prevent students</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/kill_switches_a.html">Kill Switches and Remote Control</source>
    </item>
    <item>
      <title><![CDATA[Report: Tech giants forming 'patent troll' alliance ]]></title>
      <link>http://securityratty.com/article/6697325419582177728038e7b7fbffbd</link>
      <guid>http://securityratty.com/article/6697325419582177728038e7b7fbffbd</guid>
      <description><![CDATA[Patent trolls beware: some of the tech industry's biggest names are banding together to run you out of...]]></description>
      <content:encoded><![CDATA[Patent trolls beware: some of the tech industry's biggest names are banding together to run you out of court.]]></content:encoded>
      <pubDate>Mon, 30 Jun 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/patent trolls beware">patent trolls beware</category>
      <category domain="http://securityratty.com/tag/tech industry">tech industry</category>
      <category domain="http://securityratty.com/tag/court">court</category>
      <category domain="http://securityratty.com/tag/names">names</category>
      <source url="http://www.networkworld.com/news/2008/070108-patent-troll-alliance.html?fsrc=rss-security">Report: Tech giants forming 'patent troll' alliance </source>
    </item>
  </channel>
</rss>
