<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: pizza]]></title>
    <link>http://securityratty.com/tag/pizza</link>
    <description></description>
    <pubDate>Tue, 18 Dec 2007 16:12:25 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[America's CTO]]></title>
      <link>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</link>
      <guid>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</guid>
      <description><![CDATA[I hope this message gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as...]]></description>
      <content:encoded><![CDATA[<p>I hope <a href="http://bits.blogs.nytimes.com/2008/11/05/john-doerrs-advice-for-barack-obama-hire-bill-joy/">this message</a> gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as a good a track record in technology on one hand.</p><br /><div>Also, I could not agree more with John Doerr on these points:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The next question from the president-elect was what single policy issue he could focus on that would most help entrepreneurs.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“The most important thing he’s got to do is kick-start a huge amount of research and innovation in energy,” said Mr. Doerr, who backed Google and Amazon.com and has invested heavily in clean energy technology for the last few years.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The nation now invests less than $1 billion a year in renewable energy versus $32 billion a year in health care, Mr. Doerr said. “I think we’ve just scratched the surface in terms of clean ways to use energy, to produce energy. It’s the challenge of our generation.”</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">How to do that? Double the number of engineers who graduate from American universities each year to 60,000, Mr. Doerr said. Bring more women into the field, and encourage foreigners who study engineering here to stay here.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“What we do is bring foreign nationals to the world’s greatest universities. We train them, invest in them and make them go home,” he said. “What kind of national strategy is that? So I would staple a green card to the diploma.”</span></p></blockquote><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></p><div><span style="color: #333333; font-family: georgia; font-size: 10px; "><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 0px; font-size: 1.4em; line-height: 1.5em; "><span id="more-1803"></span></p></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">While it is amazing that it took until 2009 for the US to have a CTO as a cabinet level position, it is very cool to think about all the things that could happen going forward. As Neal Stephenson said the US is only world class at three things - 1. Movies, 2. High speed pizza delivery and 3. Software development.</span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">If you read your </span><a href="http://edgeperspectives.typepad.com/edge_perspectives/">John Hagel</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"> and </span><a href="http://www.johnseelybrown.com/">JSB</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">, then you know that innovation is the only sustainable edge. Luckily its hard wired into our system, but it will be helpful to have a seat at the table for certain things. &#0160;</span></div>]]></content:encoded>
      <pubDate>Sat, 08 Nov 2008 13:08:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/produce energy">produce energy</category>
      <category domain="http://securityratty.com/tag/renewable energy versus">renewable energy versus</category>
      <category domain="http://securityratty.com/tag/cto">cto</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/clean">clean</category>
      <category domain="http://securityratty.com/tag/doerr">doerr</category>
      <category domain="http://securityratty.com/tag/john doerr">john doerr</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/americas-cto.html">America's CTO</source>
    </item>
    <item>
      <title><![CDATA[Creepy Customer Profiling via Facial Recognition]]></title>
      <link>http://securityratty.com/article/dfdb490391ea01b54e8449583b7ebb5b</link>
      <guid>http://securityratty.com/article/dfdb490391ea01b54e8449583b7ebb5b</guid>
      <description><![CDATA[Usually, shopping off-line is usually more ad-free than shopping online. But this is changing, with ads coming in strange places like video screens at Gas Stations, Albertsons, and so on. Googles been...]]></description>
      <content:encoded><![CDATA[<p>Usually, shopping off-line is usually more ad-free than shopping online. But this is changing, with ads coming in strange places like video screens at Gas Stations, Albertson&#8217;s, and so on. Google&#8217;s been using content targeted at users for some time, and now this is coming to offline ads too. Some unlikely retailers like Dunkin Donuts are installing facial recognition systems that change the ads shown, depending whether the viewer is male or female, and in what age range.</p>
<div id="main">
<div id="content">
<div class="post post-permalink">
<div class="entry">
<blockquote><p>The <em>Wall Street Journal</em> says that Dunkin&#8217; Donuts is experimenting with video screens that use facial recognition technology to figure out your age and gender. The screens then display ads targeted specifically to you.</p>
<p>Creepy!</p>
<p>Dunkin&#8217; Donuts is also tailoring the cash register ads to your specific purchase. If you buy a breakfast sandwich, you can expect an ad prompting you to return &#8220;for a coffee break in the afternoon&#8221; to &#8220;try an oven-toasted pizza.&#8221; The system is already in place at two Buffalo, NY locations.</p></blockquote>
<p>Read the<a rel="nofollow" target="_blank" href="http://consumerist.com/5040049/facial-recognition-technology-%252B-video-screens--creepy-dunkin-donuts-ads"> full article here</a>.</div>
</div>
</div>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 05:41:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ads">ads</category>
      <category domain="http://securityratty.com/tag/cash register ads">cash register ads</category>
      <category domain="http://securityratty.com/tag/display ads">display ads</category>
      <category domain="http://securityratty.com/tag/dunkin donuts">dunkin donuts</category>
      <category domain="http://securityratty.com/tag/screens">screens</category>
      <category domain="http://securityratty.com/tag/video screens">video screens</category>
      <category domain="http://securityratty.com/tag/ads shown">ads shown</category>
      <category domain="http://securityratty.com/tag/age range">age range</category>
      <category domain="http://securityratty.com/tag/wall street journal">wall street journal</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/372009137/">Creepy Customer Profiling via Facial Recognition</source>
    </item>
    <item>
      <title><![CDATA[Insurance claims and policy information in the dumpster]]></title>
      <link>http://securityratty.com/article/ae2a94a41f5bdb5795784e6c6f9639b9</link>
      <guid>http://securityratty.com/article/ae2a94a41f5bdb5795784e6c6f9639b9</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/13/08

Organization
Texas Insurance Claims Services

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
hundreds of files

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/shredded.jpg" width="133" align="right" height="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/13/08<br><br><span style="font-weight: bold;">Organization: </span><br>Texas Insurance Claims Services<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"hundreds of files"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Insurance claims and policy paperwork including "names, social security numbers and policy numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>Files containing sensitive confidential information were discovered in a dumpster in Richardson, Texas.&nbsp; The files are believed to have been thrown out by the owner of a company called Texas Insurance Claims Services.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wfaa.com/sharedcontent/dws/news/localnews/tv/stories/wfaa080613_lj_lopez.2c3f840a.html">WFAA Channel 8 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Rebecca Lopez, WFAA-TV<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>on Friday, hundreds of files with people's names, social security numbers and policy numbers were found in a Richardson dumpster<br><br>The files contain a lot of private information.<br><br>The people who filled out the forms probably never expected them to end up where anyone could simply walk away with them.<br><span style="font-style: italic;">[Evan] There we go with expectations again.&nbsp; See my comments in the "</span><a style="font-style: italic;" href="http://breachblog.com/2008/06/18/dominos.aspx">Tucson area Domino's Pizza customer information exposed</a><span style="font-style: italic;">" breach.</span><br><br>You expect when you give your private information to an insurance company, it will stay that way.<br><br>Mike McCarty was driving by a dumpster near his work in Richardson. He saw a man taking pictures of trash inside, so he stopped.<br><span style="font-style: italic;">[Evan] Taking pictures?</span><br><br>"[The man] said he was looking for empty boxes because he was going to move but he found a bunch of these files."<br><span style="font-style: italic;">[Evan] But why was the man taking pictures?&nbsp; The story isn't clear on this point, so I wonder.</span><br><br>There were files with people's names, addresses, social security numbers and even pictures of their homes and cars. <br><br>The files were dumped here by a company called Texas Insurance Claims Services which processes people's claims.<br><br>We asked the owner why he threw them away. He wouldn't go on camera but said he was only required to keep the files five years and could then toss them.<br><span style="font-style: italic;">[Evan] Oh, well then.&nbsp; Sounds like a good enough explanation to me... NOT!&nbsp; Where is the corporate and social responsibility?</span><br><br>The company says it sometimes uses commercial shredding services but decided not to do so this time.<br><span style="font-style: italic;">[Evan] Let me see if I understand this correctly.&nbsp; The company obviously knows the importance of shredding confidential papers in general, otherwise they wouldn't "sometimes use commercial shredding services".&nbsp; What the @#$^ explains why the company chose not to use the shredding services in this instance?</span><br><br>Authorities say it's not unusual for criminals to dumpster dive to look for ways to get personnel information that they can use to illegally run up huge bills.<br><span style="font-style: italic;">[Evan] This is very true.&nbsp; There are even people who organize and belong to dumpster diving clubs, not to imply that THESE people are "criminals", but only to point out that people DO dumpster dive.</span><br><br>The dumpster was full of files. Most of them were taken away by garbage collectors. We are shredding the few we took for our story.<br><span style="font-style: italic;">[Evan] The files were taken away by garbage collectors?&nbsp; I wonder how much confidential information a person could find at the dump (landfill)?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>It may just be the context of the owner's remarks, or it may just be me, but the owner seems to be oblivious to the risk of throwing confidential customer information out with the garbage. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/18/tics.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 08:41:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/dumpster">dumpster</category>
      <category domain="http://securityratty.com/tag/sensitive confidential information">sensitive confidential information</category>
      <category domain="http://securityratty.com/tag/personnel information">personnel information</category>
      <category domain="http://securityratty.com/tag/confidential customer information">confidential customer information</category>
      <category domain="http://securityratty.com/tag/dumpster dive">dumpster dive</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <source url="http://breachblog.com/2008/06/18/tics.aspx">Insurance claims and policy information in the dumpster</source>
    </item>
    <item>
      <title><![CDATA[Tucson area Domino's Pizza customer information exposed]]></title>
      <link>http://securityratty.com/article/8a47859f1eed2fddfeb4d9a0979c73fb</link>
      <guid>http://securityratty.com/article/8a47859f1eed2fddfeb4d9a0979c73fb</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/18/08

Organization
Domino's Pizza

Contractor/Consultant/Branch
Unnamed former owner of 24 Tucson area locations

Victims
Customers

Number Affected...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/dominos.jpg" align="right" height="176" width="175"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/18/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.dominos.com/home/index.jsp">Domino's Pizza</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unnamed former owner of 24 Tucson area locations&nbsp;&nbsp;&nbsp;&nbsp; <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names and credit card numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>Hundreds of credit card receipts dating back as many as five years were found "blowing in the wind" after a former owner of 24 Domino's Pizza stores in the Tucson, Arizona area was found to have been discarding boxes of old records near her home.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.kvoa.com/Global/story.asp?S=8516485&amp;nav=HMO6HMaY">KVOA Channel 4 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Tom McNamara, KVOA Channel 4 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Investigators found credit card numbers blowing in the wind for anyone to see.<br><br>These piles and papers strewn across the alley contain hundreds of old receipts from Domino's Pizza stores.<br><br>When we got a call about this, we went down to University Avenue and Euclid and saw these receipts were three, four, and even five years old.<br><span style="font-style: italic;">[Evan] Is there any business reason to keep credit card receipts for this period of time?&nbsp; I suppose a case could be made that these should be kept for up to seven years for </span><a style="font-style: italic;" href="http://www.irs.gov/businesses/small/article/0,,id=98513,00.html">tax purposes</a><span style="font-style: italic;">.</span><br><br>We contacted the former owner of 24 Domino's Pizza stores in Tucson.<br><span style="font-style: italic;">[Evan] This could have been a very risky breach in terms of overall potential impact considering the number of affected persons.&nbsp; 24 stores, x number of credit card transactions per year, and 5 years could add up to a pretty significant number.</span><br><br>She won't talk with us on-camera, but told us she'd been discarding boxes of old records near her home and somehow all those receipts got loose.<br><span style="font-style: italic;">[Evan] Incidents like this tear me up.&nbsp; I very much doubt that this lady had any malicious intention behind her actions, but nonetheless her actions could have caused considerable inconvenience (and possible loss) to a number of individuals.&nbsp; I presume that she just didn't know any better.</span><br><br>We found Scott Brumage's name and credit card number on one of those receipts in the alley.<br><br>Tom McNamara asks him, "See that? Recognize that name? Recognize the number?" Scotts nods, "Uh huh."<br><br>Tom asks, "Well how'd you feel when we called you out of the blue and told you what we'd found? What went through your mind?"<br><br>"It was just kind of surreal at first because I like to think I can trust using my card [because of] the convenience and everything of course."<br><br>Scott was startled to see his name and card numbers on our screen.<br><br>He says he's ordered a lot of pizzas over the years and expects privacy and protection when he pays for his pepperoni pie.<br><span style="font-style: italic;">[Evan] Is this an unreasonable expectation?&nbsp; Maybe it is an unreasonable expectation, given the current environment and considering the bigger picture (merchants, processors, banks, "the system", etc.).&nbsp; I don't think that it is an unreasonable requirement, but requirements, expectations and practices are not in alignment.</span><br><br>Scotts tells us, "I don't know. [I'm] just dumbfounded, other than they need to figure a better way of disposing."<br><span style="font-style: italic;">[Evan] It is dumbfounding, isn't it.&nbsp; I often wonder what people are thinking when they do some of the things they do.</span><br><br>The Investigators contacted the Federal Trade Commission in Washington and they say thieves could potentially use discarded credit card numbers even if the card has expired. The numbers on the card in many cases are still the same.<br><br>They say there could be enough information on the receipt to help a thief reveal more information about you, such as your social security number.<br><br>It's small comfort for Scott. He says, "I'm hoping this is a one time only [situation]. They might have just lost a loyal customer."<br><span style="font-style: italic;">[Evan] The impact to the victim is usually pretty clear and easy to quantify.&nbsp; The impact to the business (or organization) is not usually as easy to measure.&nbsp; In a competitive business like pizza sales, companies need to identify and communicate differentiators like ingredient quality, service, taste, price, location, etc.&nbsp; Maybe if customers viewed information security practices as an important differentiator, businesses would put more time and effort into securing information.&nbsp; Pipe dream?</span><br><br>In this case, the Investigators contacted Tucson Police and several officers came to collect the records we found and have them destroyed.<br><br><span style="font-weight: bold;">Commentary:</span><br>This breach reminds me of a <a href="http://breachblog.com/2008/06/11/cotton.aspx#comment-1124161">recent discussion</a> I had online with Benjamin Wright in the comments section of the "<a href="http://breachblog.com/2008/06/11/cotton.aspx">Cotton Traders confirms that their website was compromised</a>" breach.&nbsp; He makes a very good argument regarding accountability in credit card breaches.&nbsp; My responses to him are included. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/18/dominos.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 06:43:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card transactions">credit card transactions</category>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/credit card receipts">credit card receipts</category>
      <category domain="http://securityratty.com/tag/credit card breaches">credit card breaches</category>
      <category domain="http://securityratty.com/tag/card">card</category>
      <category domain="http://securityratty.com/tag/pizza">pizza</category>
      <category domain="http://securityratty.com/tag/receipts">receipts</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/tucson">tucson</category>
      <source url="http://breachblog.com/2008/06/18/dominos.aspx">Tucson area Domino's Pizza customer information exposed</source>
    </item>
    <item>
      <title><![CDATA[Creating and Entrapping Terrorists]]></title>
      <link>http://securityratty.com/article/2f39bf4f70e8c93e2a43b2bf16f48157</link>
      <guid>http://securityratty.com/article/2f39bf4f70e8c93e2a43b2bf16f48157</guid>
      <description><![CDATA[When I wrote this essay -- &quot;Portrait of the Modern Terrorist as an Idiot&quot; -- I thought a lot about the government inventing terrorist plotters and entrapping them, to make the world seem scarier....]]></description>
      <content:encoded><![CDATA[<p>When I wrote this essay -- <a href=http://www.schneier.com/essay-174.html>"Portrait of the Modern Terrorist as an Idiot"</a> -- I thought a lot about the government inventing terrorist plotters and entrapping them, to make the world seem scarier.  Since then, it's been on my list of topics to write about someday.</p>

<p><i>Rolling Stone</i> has <a href="http://www.rollingstone.com/politics/story/18137343/the_fear_factory">this excellent article</a> on the topic, about the Joint Terrorism Task Forces in the U.S.:</p>

<blockquote>But a closer inspection of the cases brought by JTTFs reveals that most of the prosecutions had one thing in common: The defendants posed little if any demonstrable threat to anyone or anything. According to a study by the Center on Law and Security at the New York University School of Law, only ten percent of the 619 "terrorist" cases brought by the federal government have resulted in convictions on "terrorism-related" charges -- a category so broad as to be meaningless. In the past year, none of the convictions involved jihadist terror plots targeting America. "The government releases selective figures," says Karen Greenberg, director of the center. "They have never even defined 'terrorism.' They keep us in the dark over statistics."

<p>Indeed, Shareef is only one of many cases where the JTTFs have employed dubious means to reach even more dubious ends. In Buffalo, the FBI spent eighteen months tracking the "Lackawanna Six" -- a half-dozen men from the city's large Muslim population who had been recruited by an Al Qaeda operative in early 2001 to undergo training in Afghanistan. Only two lasted the six-week course; the rest pretended to be hurt or left early. Despite extensive surveillance, the FBI found no evidence that the men ever discussed, let alone planned, an attack -- but that didn't stop federal agents from arresting the suspects with great fanfare and accusing them of operating an "Al Qaeda-trained terrorist cell on American soil." Fearing they would be designated as "enemy combatants" and disappeared into the legal void created by the Patriot Act, all six pleaded guilty to aiding Al Qaeda and were sentenced to at least seven years in prison.</p>

<p>In other cases, the use of informants has led the government to flirt with outright entrapment. In Brooklyn, a Guyanese immigrant and former cargo handler named Russell Defreitas was arrested last spring for plotting to blow up fuel tanks at JFK International Airport. In fact, before he encountered the might of the JTTF, Defreitas was a vagrant who sold incense on the streets of Queens and spent his spare time checking pay phones for quarters. He had no hope of instigating a terrorist plot of the magnitude of the alleged attack on JFK -- until he received the help of a federal informant known only as "Source," a convicted drug dealer who was cooperating with federal agents to get his sentence reduced. Backed by the JTTF, Defreitas suddenly obtained the means to travel to the Caribbean, conduct Google Earth searches of JFK's grounds and build a complex, multifaceted, international terror conspiracy -- albeit one that was impossible to actually pull off. After Defreitas was arrested, U.S. Attorney Roslynn Mauskopf called it "one of the most chilling plots imaginable."</p>

<p>Using informants to gin up terrorist conspiracies is a radical departure from the way the FBI has traditionally used cooperating sources against organized crime or drug dealers, where a pattern of crime is well established before the investigation begins. Now, in new-age terror cases, the JTTFs simply want to establish that suspects are predisposed to be terrorists -- even if they are completely unable or ill-equipped to act on that predisposition. High-tech video and audio evidence, coupled with anti-terror hysteria, has made it effectively impossible for suspects to use the legal defense of entrapment. The result in many cases has been guilty pleas -- and no scrutiny of government conduct.</p>

<p>In most cases, because no trial is ever held, few details emerge beyond the spare and slanted descriptions in the indictments. When facts do come to light during a trial, they cast doubt on the seriousness of the underlying case. The "Albany Pizza" case provides a stark example. Known as a "sting case," the investigation began in June 2003 when U.S. soldiers raided an "enemy camp" in Iraq and seized a notebook containing the name of an imam in Albany -- one Yassin Aref. To snare Aref, the JTTF dispatched a Pakistani immigrant named Shahed "Malik" Hussain, who was facing years in prison for a driver's-license scam. Instead of approaching Aref directly, federal agents sent Malik to befriend Mohammed Hossain, a Bangladeshi immigrant who went to the same mosque as Aref. Hossain, an American citizen who ran a place called Little Italy Pizzeria in Albany, had no connections whatsoever to terrorism or any form of radical Islam. After the attacks on 9/11, he had been quoted in the local paper saying, "I am proud to be an American." But enticed by Malik, Hossain soon found himself caught up in a government-concocted terror plot. Posing as an arms dealer, Malik told Hossain that a surface-to-air missile was needed for an attack on a Pakistani diplomat in New York. He offered Hossain $5,000 in cash to help him launder $50,000 -- a deal Hossain claims he never properly grasped. According to Muslim tradition, a witness is needed for significant financial transactions. Thus, the JTTF reached out for Hossain's imam and the true target of the sting -- Aref.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=P9Pt7lF"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=P9Pt7lF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=iq7QmOF"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=iq7QmOF" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 05 Mar 2008 03:25:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/terrorist">terrorist</category>
      <category domain="http://securityratty.com/tag/modern terrorist">modern terrorist</category>
      <category domain="http://securityratty.com/tag/hossain">hossain</category>
      <category domain="http://securityratty.com/tag/terrorist conspiracies">terrorist conspiracies</category>
      <category domain="http://securityratty.com/tag/deal hossain claims">deal hossain claims</category>
      <category domain="http://securityratty.com/tag/yassin aref">yassin aref</category>
      <category domain="http://securityratty.com/tag/aref">aref</category>
      <category domain="http://securityratty.com/tag/terrorist plot">terrorist plot</category>
      <category domain="http://securityratty.com/tag/stop federal agents">stop federal agents</category>
      <source url="http://www.schneier.com/blog/archives/2008/03/creating_and_en.html">Creating and Entrapping Terrorists</source>
    </item>
    <item>
      <title><![CDATA[Union Mortgage loan applicant information found in dumpster]]></title>
      <link>http://securityratty.com/article/e521113877509ae97abc821cd675e5d7</link>
      <guid>http://securityratty.com/article/e521113877509ae97abc821cd675e5d7</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/22/08, updated on 2/28/08

Organization
Union Mortgage Services of Cleveland, Inc

Contractor/Consultant/Branch
None

Victims
Loan applicants

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/mortgage.jpg" align="right" height="184" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/22/08, updated on 2/28/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.unionmortgageservices.com/">Union Mortgage Services of Cleveland, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Loan applicants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*"hundreds of people" including "Thousands of pages of sensitive documents"</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>Information that is typically found in loan applications, including bank statements, credit reports, and tax returns.<br><br><span style="font-weight: bold;">Breach Description:</span><br>Thousands of pages of sensitive loan application information were discovered in a dumpster behind a pizza shop in Cleveland, Ohio.&nbsp; The documents were allegedly discarded by employees of Union Mortgage Services of Cleveland, Inc., which has closed down after failing to pay taxes or failure to file tax returns.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wkyc.com/news/news_article.aspx?storyid=83808">WKYC-TV News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WKYC-TV News, by way of Attrition.org<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Thousands of pages of sensitive documents were thrown out in a dumpster located behind a pizza shop at East 105th and Superior in Cleveland.<br><br>Confidential files were found on hundreds of people who applied for loans with a company called Union Mortgage, whose last known addresses were in Beachwood and Parma.<br><span style="font-style: italic;">[Evan] Union Mortgage Services addresses are/were; 23611 Chagrin Blvd Suite 275 </span><span style="font-style: italic;">Beachwood, OH 44122 and 1440 Snow Road Suite 118 Parma, OH 44134</span><br><br>Investigator Tom Meyer learned the company closed its doors recently after either failing to pay taxes or file its tax returns<br><span style="font-style: italic;">[Evan] Sounds shady for a mortgage company that people trust much of their financial lives with.</span><br><br>Channel 3 News retrieved as many documents as possible and returned them to their rightful owners.<br><br>Ken Knabe, a lawyer from Lakewood, was shocked that we had his bank accounts, credit reports, tax returns and other personal information including his social security number. "That's appalling. This is private information in a dumpster,"<br><br>Channel 3 News returned files of information on Kim and Edwin Soeder of Mentor, including their retirement accounts. "It makes you wonder how bad your credit rating becomes if people get this in their hands," said Mrs. Soeder.<br><br>Ohio Attorney General, Marc Dann, has sued another mortgage company, Randall Mortgage Services, Inc., for allegedly abandoning customers' loan and financial information. Dann says he would take action against Union Mortgage if customers came forward and filed complaints with his office.<br><br><img src="http://images.quickblogcast.com/95781-88451/marcdann.jpg" border="0" width="124"><br><br><span style="font-style: italic;">[Evan] Attorney General Marc Dann's site has some good information for consumers.&nbsp; To file a complaint, visit <a href="http://www.ag.state.oh.us/citizen/consumer/complaints.asp">http://www.ag.state.oh.us/citizen/consumer/complaints.asp</a></span><br><br>Dann said businesses that collect personal information are responsible for protecting it just like they would protect their own information.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is similar to the <a href="http://breachblog.com/2008/02/21/firstmagnus.aspx">First Magnus breach</a> reported earlier this month.&nbsp; Similarities include two financially troubled (or bankrupt) loan companies that figured their obligation to protect confidential personal information ceased when they closed the doors.&nbsp; The obligation to protect information entrusted to you only ceases when you transfer custodianship (i.e. return it to the owner, destruction, etc.)<br><br>I assume that we will only continue to see more of these types of breaches as more loan companies continue to suffer from today's credit crunch.&nbsp; When I researched Union Mortgage Services for this posting, I had a general sense of uneasiness.&nbsp; The lack of discovered background information and other legitimate references about the company might have made me question whether or not I would have done business with them in the first place.&nbsp; Hindsight is 20/20 they say. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/02/29/unionmortgage.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 29 Feb 2008 11:14:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collect personal information">collect personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/union mortgage">union mortgage</category>
      <category domain="http://securityratty.com/tag/loan">loan</category>
      <category domain="http://securityratty.com/tag/loan companies continue">loan companies continue</category>
      <category domain="http://securityratty.com/tag/loan companies">loan companies</category>
      <category domain="http://securityratty.com/tag/union mortgage services">union mortgage services</category>
      <category domain="http://securityratty.com/tag/background information">background information</category>
      <source url="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage loan applicant information found in dumpster</source>
    </item>
    <item>
      <title><![CDATA[Boston/Cambridge InfoSecurity Events]]></title>
      <link>http://securityratty.com/article/206a3c974bd327175dda2e8f0055e3f7</link>
      <guid>http://securityratty.com/article/206a3c974bd327175dda2e8f0055e3f7</guid>
      <description><![CDATA[Software Security Weaknesses - Avoiding and Testing
Bob Martin is giving a talk tonight at the Boston Software Process Improvement Network (SPIN) meeting on Software Security Weaknesses - Avoiding and...]]></description>
      <content:encoded><![CDATA[<h3>Software Security Weaknesses - Avoiding and Testing</h3>
<p>Bob Martin is giving a talk tonight at the <a href="http://www.boston-spin.org/">Boston Software Process Improvement Network</a> (SPIN) meeting on &#8220;Software Security Weaknesses - Avoiding and Testing&#8221;.  The meeting is at MITRE in Bedford in the basement conference center of M-Building (the one next to the parking garage).  Pizza and discussions at 6pm, talk at 7:10pm.</p>
<p>Its open to anyone.</p>
<h3>BeanSec</h3>
<p><a href="http://rationalsecurity.typepad.com/blog/beansec/index.html">BeanSec</a>, an informal gathering of security professionals, is held the 3rd Wednesday of every month in Cambridge. It will be held tomorrow night from 6pm-9pm at the <a href="http://www.middlesexlounge.com/">Middlesex Lounge</a>, 315 Mass. Ave, Cambridge, MA. Note that this is a change of venue from the Enormous Room.<font size="-1"> </font></p>
<h3>Source: Boston 2008</h3>
<p><a href="http://www.sourceboston.com/">Source: Boston</a> is a new security conference taking place in Cambridge on March 12-14th. This lines up pretty well with St. Patrick&#8217;s Day weekend which will be a fun time to be in Boston.  Mike Murray has a <a href="http://www.episteme.ca/index.php?/archives/294-A-Cool-New-Conference.html">great writeup about it</a> on his blog.</p>
]]></content:encoded>
      <pubDate>Tue, 18 Dec 2007 16:12:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software security weaknesses">software security weaknesses</category>
      <category domain="http://securityratty.com/tag/boston">boston</category>
      <category domain="http://securityratty.com/tag/cambridge">cambridge</category>
      <category domain="http://securityratty.com/tag/held">held</category>
      <category domain="http://securityratty.com/tag/held tomorrow night">held tomorrow night</category>
      <category domain="http://securityratty.com/tag/patricks day weekend">patricks day weekend</category>
      <category domain="http://securityratty.com/tag/basement conference center">basement conference center</category>
      <category domain="http://securityratty.com/tag/talk tonight">talk tonight</category>
      <category domain="http://securityratty.com/tag/talk">talk</category>
      <source url="http://www.veracode.com/blog/?p=72">Boston/Cambridge InfoSecurity Events</source>
    </item>
  </channel>
</rss>
