<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: refuse]]></title>
    <link>http://securityratty.com/tag/refuse</link>
    <description></description>
    <pubDate>Mon, 23 Jun 2008 04:11:34 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[How safe is "safe"?]]></title>
      <link>http://securityratty.com/article/f08902ea89d9e6e152a51fbff57e5f87</link>
      <guid>http://securityratty.com/article/f08902ea89d9e6e152a51fbff57e5f87</guid>
      <description><![CDATA[Everybody talks about how safe it is in Dubai. Yet the murder of Lebanese pop singer, Suzanne Tamim would indicate otherwise

The unfortunate singer appears to have been the victm of a well...]]></description>
      <content:encoded><![CDATA[Everybody talks about how safe it is in Dubai.  Yet the <a href="http://www.ameinfo.com/167726.html">murder of Lebanese pop singer, Suzanne Tamim</a> would indicate otherwise.   <br /><span id="fullpost"><br />The unfortunate singer appears to have been the victm of a well orchestrated murder plot.  It is believed that her killer, alleged to be a former Policeman, was paid $2 million to kill her. If the local rumours are true, then she would have had an idea that the person behind it was capable of such an act.<br /><br />One wonders why people who are in the public eye sometimes do not consider their personal safety.  No doubt, denial has much to do with it.  Some probably refuse to believe that they are that "important" to require personal protection, while others have difficuly believing that anyone would want to harm them.<br /><br />I would hazzard a guess that the latter is what happened to John Lennon.  Lennon was the epitome of peace and love, yet a crazed lunatic saw fit to shoot him in the back for no reason other than he knew it would bring him fame.<br /><br />Sometimes it is detrimental to overthink things.  Just because we have noble thoughts, does not mean that the rest of the world thinks in a similar manner.  We literally need to always watch our backs.    <br /></span><div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 06 Sep 2008 23:56:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/john lennon">john lennon</category>
      <category domain="http://securityratty.com/tag/lebanese pop singer">lebanese pop singer</category>
      <category domain="http://securityratty.com/tag/lennon">lennon</category>
      <category domain="http://securityratty.com/tag/require personal protection">require personal protection</category>
      <category domain="http://securityratty.com/tag/murder plot">murder plot</category>
      <category domain="http://securityratty.com/tag/murder">murder</category>
      <category domain="http://securityratty.com/tag/singer appears">singer appears</category>
      <category domain="http://securityratty.com/tag/safe">safe</category>
      <category domain="http://securityratty.com/tag/personal safety">personal safety</category>
      <source url="http://www.thebulletproofblog.com/2008/09/how-safe-is-safe.html">How safe is "safe"?</source>
    </item>
    <item>
      <title><![CDATA[The Stigma Enigma, Revisited]]></title>
      <link>http://securityratty.com/article/c238be0f778cce325c4423b05b36b9e3</link>
      <guid>http://securityratty.com/article/c238be0f778cce325c4423b05b36b9e3</guid>
      <description><![CDATA[Recently my pal Bill Pytlovany (of WinPatrol fame) wrote an article on his blog asking &quot;What's Wrong With Toolbars

I wrote something along similar lines way back in 2005 , and it's vaguely depressing...]]></description>
      <content:encoded><![CDATA[
        Recently my pal Bill Pytlovany (of WinPatrol fame) wrote an <a href="http://billpstudios.blogspot.com/2008/08/what-wrong-with-toolbars.html">article</a> on his blog asking "What's Wrong With Toolbars"?<br /><br />I wrote something along similar lines <a href="http://www.revenews.com/chrisboyd/the-stigma-enigma/">way back in 2005</a>, and it's vaguely depressing to see how little has apparently changed. I'm not going to quote myself, but rather compare and contrast Bills experiences (and those of his commentators) with the person who posted a comment to my entry, which I quote below in full:<br /><br /><div class="comment-content">
                                                <p><i>"Unfortunately,
the few 'honest' toolbars have indeed taken the wrath of users as a
result of the spyware, parasite, adware and other creepy applications
of an otherwise good technology.</i></p>
<p><i>What's interesting is that, as far as my own toolbar system goes,
I've had offers from clients all over the world to develop different
kinds of toolbars -- and without fail -- it is the US-based companies
that seem most willing to cross the line and request applications that
I simply refuse to develop.</i></p>
<p><i>We're talking about features like:</i></p>
<p><i>- Forced Install<br />
- Hidden Install<br />
- Report all URLs back<br />
- Report all searches back<br />
- Forcibly and hidden set home page<br />
- Forcibly and hidden set default search engine<br />
- Forcibly generate un-blockable pop-ups<br />
- Install and run hidden executables<br />
- Bypass all security and anti-virus tools<br />
- The list goes on...</i></p>
<p><i>What's sad is that I'm able to generate the most powerful and
incredibly useful toolbars imaginable. Ones that can save countless
hours of time and effort. Ones that can be customized on a per-user
basis to make the Internet and use of ones's own computer a pleasure.</i></p>
<p><i>However, there will always be people around who's sole motivation is the almighty dollar -- and who will do ANYTHING to get it.</i></p>
<p><i>These people don't care about you, your wants, your needs, your
security or safety -- as long as they can line their pockets with your
money, or by taking advantage of actions you perform (even one lousy
click!).</i></p>
<p><i>They'll infect your machine, using whatever means necessary, and they won't stop -- EVER."</i><br /><br />The "industry" has certainly cleaned up since then, but the insistence on wanting to cram a toolbar on every PC, ever, remains. I must admit to being kind of disturbed that none of these companies seemingly want to take "No" for an answer - instead of leaving alone, they keep coming back every month or so. Of course, given the potential for mass moneymaking that's on offer I can't say I'm entirely surprised...<br /></p>
                    </div><br /> 
        
    ]]></content:encoded>
      <pubDate>Wed, 27 Aug 2008 10:58:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/toolbars imaginable">toolbars imaginable</category>
      <category domain="http://securityratty.com/tag/toolbars">toolbars</category>
      <category domain="http://securityratty.com/tag/forcibly">forcibly</category>
      <category domain="http://securityratty.com/tag/install">install</category>
      <category domain="http://securityratty.com/tag/toolbar">toolbar</category>
      <category domain="http://securityratty.com/tag/applications">applications</category>
      <category domain="http://securityratty.com/tag/contrast bills experiences">contrast bills experiences</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/toolbar system">toolbar system</category>
      <source url="http://blog.spywareguide.com/2008/08/the-stigma-enigma-revisited.html">The Stigma Enigma, Revisited</source>
    </item>
    <item>
      <title><![CDATA[Open Letter to Verizon Wireless]]></title>
      <link>http://securityratty.com/article/33861048df9fa12f13bd8d46690d0a5b</link>
      <guid>http://securityratty.com/article/33861048df9fa12f13bd8d46690d0a5b</guid>
      <description><![CDATA[After receiving no support from agents at the Verizon Wireless store or by agents on the phone, I decided to write them and make it an open letter. Its no secret that Verizon has a great network, but...]]></description>
      <content:encoded><![CDATA[<P><FONT size=2><FONT face=Verdana>After receiving no support from agents at the Verizon Wireless store or by agents on the phone, I decided to write them and make it an open letter.<SPAN>&nbsp; </SPAN>It&#8217;s no secret that Verizon has a great network, but it&#8217;s also no secret that their phone selection stinks.<SPAN>&nbsp; </SPAN>I don&#8217;t want to leave them and am hoping that whatever little bad press I can cause will encourage them to resolve the issue.<SPAN>&nbsp; </SPAN>If not, I&#8217;m tapping out.<SPAN>&nbsp; </SPAN>For 3 years I have hated my phone and loved their network.<SPAN>&nbsp; </SPAN>I&#8217;m ready to feel mediocre about both.<SPAN>&nbsp; </SPAN>Here it goes: </FONT></FONT>
<P><FONT size=2><FONT face=Verdana>I am currently without a phone and would appreciate a speedy reply. </FONT></FONT>
<P><FONT size=2><FONT face=Verdana>I have been a Verizon Wireless customer for over 5 years and my monthly bill easily averages over $200 during that time frame.<SPAN>&nbsp; </SPAN>While I love your network, I have been completely unsatisfied by your selection of phones.<SPAN>&nbsp; </SPAN>It is a stretch to say that my last phone worked&#8212;it had a feature called a battery that allowed me to switch from the car charger to my office charger without dying.<SPAN>&nbsp; </SPAN>And I waited&#8212;under duress&#8212;until I was allowed to purchase a new phone with the discount. </FONT></FONT>
<P><FONT size=2><FONT face=Verdana>My current phone has a wonderful battery life, but this is the 4th time the charger has snapped off in the phone.<SPAN>&nbsp; </SPAN>The phone is fine, but I keep paying $30 for new chargers.<SPAN>&nbsp; </SPAN>I refuse to purchase another or wait until February when I will be eligible for a new phone.<SPAN>&nbsp; </SPAN>You sold a phone with a design flaw, and I&#8217;m not even asking for a refund or a free phone.<SPAN>&nbsp; </SPAN>Just allow me to take a chance on a new one at the 2 year contract renewal rate.<SPAN>&nbsp; </SPAN></FONT></FONT>
<P><FONT size=2><FONT face=Verdana><SPAN></SPAN></FONT></FONT><FONT size=2><FONT face=Verdana>If not, I will gladly pay the early termination fee and leave Verizon.<SPAN>&nbsp; </SPAN>On general principle, I will spend more money canceling my account with you than I would likely receive as a discount on a new phone.<SPAN>&nbsp; </SPAN>As a customer, I consider it unacceptable that you sell inferior phones and leave me with no recourse. </FONT></FONT>
<P><FONT size=2><FONT face=Verdana>The first time I waited haplessly to become eligible for a new phone.<SPAN>&nbsp; </SPAN>I will not suffer a second time.<SPAN>&nbsp; </SPAN>If you don&#8217;t like the fact that you will end up losing money by allowing me to purchase a new phone early, I suggest you take it up your vendors who supply you with awful products.<SPAN>&nbsp; </SPAN>I can promise you that we will both lose more money if you don&#8217;t. </FONT></FONT>
<P><FONT size=2><FONT face=Verdana>Sincerely, </FONT></FONT>
<P><FONT face=Verdana size=2>Eric Marvets</FONT></P><img src ="http://marvets.com/blog/aggbug/12205.aspx" width = "1" height = "1" />]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 11:43:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/phone workedit">phone workedit</category>
      <category domain="http://securityratty.com/tag/free phone">free phone</category>
      <category domain="http://securityratty.com/tag/current phone">current phone</category>
      <category domain="http://securityratty.com/tag/verizon">verizon</category>
      <category domain="http://securityratty.com/tag/phone selection stinks">phone selection stinks</category>
      <category domain="http://securityratty.com/tag/verizon wireless store">verizon wireless store</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/verizon wireless customer">verizon wireless customer</category>
      <source url="http://marvets.com/blog/archive/2008/08/25/12205.aspx">Open Letter to Verizon Wireless</source>
    </item>
    <item>
      <title><![CDATA[Flying Without ID]]></title>
      <link>http://securityratty.com/article/d16b3a7064ab7b40c5d6679ed3569bbd</link>
      <guid>http://securityratty.com/article/d16b3a7064ab7b40c5d6679ed3569bbd</guid>
      <description><![CDATA[Seems like the procedure has changed : Mr. Peters nodded, and then looked down at the sheet which I had filled out and signed. Im going to have to make some calls to verify your identity
I nodded
He...]]></description>
      <content:encoded><![CDATA[<p>Seems like the <a href="http://philosecurity.org/2008/08/10/flying-without-a-wallet">procedure has changed</a>:</p>

<blockquote>Mr. Peters nodded, and then looked down at the sheet which I had filled out and signed. “I’m going to have to make some calls to verify your identity.”

<p>I nodded.</p>

<p>He pulled out a cell phone. I had assumed that we would be going to some separate screening room, but that wasn’t the case. He stood facing the silver table, and I leaned back against it. So this was the dreaded interview. People walked past us with bags and luggage.</p>

<p>"Hello," he said. "Security." Long pause. It sounded like he was transferred. He said a number that I think had the same number of digits as a phone number. Then he said a shorter number. "No, she doesn’t." He wrote something in small letters on the form. Then he spelled my name over the phone. "D-A-V-I-D-O-F-F. That’s Indigo Delta… yes."</p>

<p>He looked at me. "What’s the name of a street that you lived on prior to your current address?"</p>

<p>"Inman."</p>

<p>"Inman," he repeated. There was a pause. "Where did you live in 2004?"</p>

<p>"Hmm…" I said. "New Mexico? I think? Maybe Massachusetts."</p>

<p>He conferred with the person on the phone. "That’s fine." He hung up.</p>

<p>"All right," he said. "You’re going to go through full security screening." He wrote "SSSS" in red marker on my printed boarding pass. He handed my form to one of the officers at the podium, and then gestured to the first screening line. "Right here."</blockquote></p>

<p>This only works if you've lost your ID, not if you <a href="http://www.schneier.com/blog/archives/2008/06/new_tsa_id_requ.html">refuse to show it</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=pCc1wK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=pCc1wK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=q8PrAK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=q8PrAK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 08:33:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cell phone">cell phone</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/red marker">red marker</category>
      <category domain="http://securityratty.com/tag/form">form</category>
      <category domain="http://securityratty.com/tag/pause">pause</category>
      <category domain="http://securityratty.com/tag/indigo delta">indigo delta</category>
      <category domain="http://securityratty.com/tag/current address">current address</category>
      <category domain="http://securityratty.com/tag/silver table">silver table</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/flying_without_1.html">Flying Without ID</source>
    </item>
    <item>
      <title><![CDATA[Laptop containing personal information is stolen from U.S. Foodservice]]></title>
      <link>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</link>
      <guid>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/13/08

Organization
U.S. Foodservice, Inc

Contractor/Consultant/Branch
None

Victims
Present and former employees, &quot;and in a few instances, their...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usfoodservice.jpg" width="146" align="right" height="71"><font size="2"><b>Date Reported: </b><br>6/13/08<br><br><b>Organization: </b><br><a href="http://www.usfoodservice.com/usf/html/index1.html">U.S. Foodservice, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Present and former employees, "and in a few instances, their dependents and applicants for jobs at USF"<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, social security numbers, home addresses, and/or dates of birth"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/us_foodservice.pdf">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information.<br><span style="font-style: italic;">[Evan] We now add U.S. Foodservice to the ever-growing list of organizations that refuse to encrypt laptops, yet allow confidential information to be stored on them.</span><br><br>Local authorities were immediately notified and we conducted an internal investigation.<br><br>the laptop contained certain old data files<br><span style="font-style: italic;">[Evan] I wonder how old these data files were.&nbsp; I also wonder if these files were supposed to have been removed and/or destroyed, but were missed.</span><br><br>In the course of our investigation, we determined that the laptop computer contained the names, social security numbers, home addresses, and/or dates of birth of some present and former USF employees, and in a few instances, their dependents and applicants for jobs at USF.<br><br>We are sending a notification letter to individuals impacted by this incident.<br><br>We expect to begin mailing the notification letters on June 13, 2008.<br><br>we have no indication that any of the information is being misused<br><span style="font-style: italic;">[Evan] A breach notification is almost not a real breach notification without this mention.</span><br><br>Please note that several years ago, the Company stopped using social security numbers to identify employees for internal reporting or other purposes.<br><span style="font-style: italic;">[Evan] A good move by the Company.&nbsp; USF is still required to collect Social Security numbers however.</span><br><br>Pursuant to USF policies, the laptop was protected by a unique user ID and password, but the individual files containing personal information were not encrypted or password protected.<br><span style="font-style: italic;">[Evan] I am interested in reading the USF policies.&nbsp; Do the policies only require a user ID and password to protect (or access) confidential information?&nbsp; Probably not sufficient.</span><br><br>U.S. Foodservice takes the security of your personal information seriously and apologizes for any inconvenience or worry this incident may cause you.<br><br>As a precautionary measure, we are making several services available at the Company's expense, free of charge to you, to assist you in protecting your identity.<br><span style="font-style: italic;">[Evan] A true "precautionary measure" might have been restricting confidential information storage on laptops (and other mobile media) or encryption.</span><br><br>Although at this point we have no indication that your information has been compromised<br><span style="font-style: italic;">[Evan] My definition of "compromised" obviously differs.&nbsp; In my opinion, if the confidentiality, integrity or availability of information cannot be reasonable assured, then the information IS compromised.&nbsp; If you believe that password-protection provides reasonable assurance, then you and I disagree.</span><br><br>Call the Toll Free Help Line at 1-866-584-9681 to get answer [sic] to your questions.<br></font><ul><li><font size="2">Staffed by a team of professionals</font></li><li>Monday through Friday from 6:00 a.m. to 6:00 p.m. (Pacific Daylight Time)</li><li>Saturday and Sunday from 8:00 a.m. to 5:00 p.m. (Pacific Daylight Time)<br></li></ul><font size="2"><br>Please know that while we have information security policies in place, we are reviewing those practices and procedures to see what changes need to be made.<br><span style="font-style: italic;">[Evan] Its good the USF has information security policies in place, but it doesn't mean that they are effective or that they are well enforced.&nbsp; A poorly enforced policy isn't worth the paper its written on.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>U.S. Foodservice is also offering one year of free credit monitoring and identity theft insurance.&nbsp; This would be fine minus the fact that a Social Security number has an effective lifespan that far exceeds one year.<br><br>If only there were other controls available to protect information stored on a laptop.&nbsp; Wait, we do!<br>&nbsp;<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/05/usfoodservice.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 19:35:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/protect information">protect information</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <category domain="http://securityratty.com/tag/usf">usf</category>
      <category domain="http://securityratty.com/tag/usf policies">usf policies</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://breachblog.com/2008/07/07/usfoodservice.aspx">Laptop containing personal information is stolen from U.S. Foodservice</source>
    </item>
    <item>
      <title><![CDATA[Kill Switches and Remote Control]]></title>
      <link>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</link>
      <guid>http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a</guid>
      <description><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now...]]></description>
      <content:encoded><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now everyone else wants to get their hooks into your gear.

OnStar will soon include the <a href="http://www.informationweek.com/news/mobility/showArticle.jhtml?articleID=202400922">ability</a> for the police to shut off your engine remotely. Buses are getting the <a href="http://www.nypost.com/seven/06082008/news/regionalnews/busting_terror_114567.htm">same capability</a>, in case terrorists want to re-enact the movie <cite>Speed</cite>. The Pentagon wants a kill switch <a href="http://blog.wired.com/defense/2008/06/the-pentagons-n.html">installed</a> on airplanes, and is worried about potential enemies <a href="http://spectrum.ieee.org/may08/6171">installing</a> kill switches on their own equipment. 

Microsoft is doing some of the most creative thinking along these lines, with something it's calling "<a href="http://arstechnica.com/news.ars/post/20080611-microsoft-patent-brings-miss-manners-into-the-digital-age.html">Digital Manners Policies</a>." According to its <a href="http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220080125102%22.PGNR.&OS=DN/20080125102&RS=DN/20080125102">patent application</a>, DMP-enabled devices would accept broadcast "orders" limiting capabilities. Cellphones could be remotely set to vibrate mode in restaurants and concert halls, and be turned off on airplanes and in hospitals. Cameras could be prohibited from taking pictures in locker rooms and museums, and recording equipment could be disabled in theaters. Professors finally could prevent students from texting one another during class. 

The possibilities are endless, and very dangerous. Making this work involves building a nearly flawless hierarchical system of authority. That's a difficult security problem even in its simplest form. Distributing that system among a variety of different devices -- computers, phones, PDAs, cameras, recorders -- with different firmware and manufacturers, is even more difficult. Not to mention delegating different levels of authority to various agencies, enterprises, industries and individuals, and then enforcing the necessary safeguards.

Once we go down this path -- giving one device authority over other devices -- the security problems start piling up. Who has the authority to limit functionality of my devices, and how do they get that authority? What prevents them from abusing that power? Do I get the ability to override their limitations? In what circumstances, and how? Can they override my override?

How do we prevent this from being abused? Can a burglar, for example, enforce a "no photography" rule and prevent security cameras from working? Can the police enforce the same rule to avoid another Rodney King incident? Do the police get "superuser" devices that cannot be limited, and do they get "supercontroller" devices that can limit anything? How do we ensure that only they get them, and what do we do when the devices inevitably fall into the wrong hands?

It's comparatively easy to make this work in closed specialized systems -- OnStar, airplane avionics, military hardware -- but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems.

And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music to a computer other than your own. They want to enforce <em>their</em> legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible. 

"Digital Manners Policies" is a marketing term. Let's call this what it really is: Selective Device Jamming. It's not polite, it's dangerous. It won't make anyone more secure -- or more polite.

This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/06/securitymatters_0626">originally appeared</a> in Wired.com.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=JiKwGJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=JiKwGJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aXm5MJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aXm5MJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 02:48:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wireless devices">wireless devices</category>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/devices inevitably">devices inevitably</category>
      <category domain="http://securityratty.com/tag/digital manners policies">digital manners policies</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/prevent security cameras">prevent security cameras</category>
      <category domain="http://securityratty.com/tag/difficult security">difficult security</category>
      <category domain="http://securityratty.com/tag/cameras">cameras</category>
      <category domain="http://securityratty.com/tag/prevent students">prevent students</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/kill_switches_a.html">Kill Switches and Remote Control</source>
    </item>
    <item>
      <title><![CDATA[The Grammar of Complex and Intelligent Events]]></title>
      <link>http://securityratty.com/article/8c957ac14117013317b31426e120f60c</link>
      <guid>http://securityratty.com/article/8c957ac14117013317b31426e120f60c</guid>
      <description><![CDATA[Folks defining CEP, and now this newtermIEP ,have been very passionate over the past few years that Complex Event Processing means the Processing of Complex Events not the Complex Processing of...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p>Folks defining CEP, and now this <a href="http://epthinking.blogspot.com/2008/06/on-embedded-intelligence-within-event.html" target="_self">new term IEP</a>, have been very passionate over the past few years that &#8220;<strong>Complex Event Processing</strong>&#8221; means the <strong>Processing</strong> of &#8220;<strong>Complex Events</strong>&#8221; not the &#8220;<strong>Complex Processing</strong>&#8221; of <strong>Events</strong>.   </p>
<p><a href="http://en.wikipedia.org/wiki/Grammar" target="_self">Grammatically</a> speaking, it follows that <strong>Complex</strong> is an <a href="http://en.wikipedia.org/wiki/Adjective" target="_self">adjective</a> describing a noun, <strong>Event; </strong>and <strong>Processing </strong>is a verb. </p>
<p>Complex events are defined by the same community as composite events, or events that are composed of two or more &#8220;contributing&#8221; events.</p>
<p>To be consistent, I think we should follow the same logic and grammar in the discussion of &#8220;Intelligent Event Processing&#8221;. </p>
<p>It follows that <strong>Intelligent</strong> should be an adjective describing a noun, <strong>Event; </strong>and <strong>Processing </strong>is a verb.  It also follows that &#8220;Intelligent Event Processing&#8221; means the Processing of &#8220;Intelligent Events&#8221; not the &#8220;Intelligent Processing&#8221; of Events.   </p>
<p>This is precisely the problem that folks are creating a new CEP term, &#8220;Intelligent Event Processing&#8221; to described processing capabilitities that are missing from the current suite of self-described CEP software products.   What people really mean to describe is the <strong>Intelligent Processing</strong> of <strong>Complex Events.   </strong>However, based on the same grammer used in defining CEP, they have created the <strong>Processing</strong> of <strong>Intelligent Events</strong>.</p>
<p>The use of inconsistent grammar and logic is not good for the CEP community, in my opinion.   Just because the current generation of self-described CEP vendors do not rise to the capability required by the vast majority of business event applications, we should not create new terms just to make marketing folks happy.</p>
<p>I think I am in a good position to speak about this, because some of my best friends work for software companies selling self-described CEP software and they have seemingly lost patience  because I refuse to support to illogical positioning and repositioning of the CEP market.</p>
<p>Why is the grammar between the terms &#8220;Complex Event Processing&#8221; and &#8220;Intelligent Event Processing&#8221; inconsistent?.   Folks can only spin and reposition CEP so much before all the spin, hype, and repositioning begins to catch up with the community.   </p>
<p>Dr. David Luckham&#8217;s original papers and single book on CEP was clear enough about CEP; and CEP covers the entire space that Opher Etzion would like to reposition as IEP.    The Grammar of Complex and Intelligent Events are, at best, misleading and inconsistent.</p>
<p>I think the main problem is that what Opher has been describing is the <strong><em>Intelligent Processing of Complex Events</em></strong> - however, to say this would affirm what I have been evangelizing for over two years.</p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/264/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/264/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/264/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/264/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/264/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/264/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/264/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/264/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/264/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/264/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/264/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/264/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=264&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Sun, 29 Jun 2008 00:56:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/intelligent">intelligent</category>
      <category domain="http://securityratty.com/tag/terms">terms</category>
      <category domain="http://securityratty.com/tag/terms complex event">terms complex event</category>
      <category domain="http://securityratty.com/tag/intelligent events">intelligent events</category>
      <category domain="http://securityratty.com/tag/events">events</category>
      <category domain="http://securityratty.com/tag/intelligent event">intelligent event</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/cep covers">cep covers</category>
      <source url="http://thecepblog.com/2008/06/28/the-grammar-of-complex-and-intelligent-events/">The Grammar of Complex and Intelligent Events</source>
    </item>
    <item>
      <title><![CDATA[The Grammar of Complex and Intelligent Events]]></title>
      <link>http://securityratty.com/article/662f152fed9484e77935799d6e25e415</link>
      <guid>http://securityratty.com/article/662f152fed9484e77935799d6e25e415</guid>
      <description><![CDATA[Folks defining CEP, and now this newtermIEP ,have been very passionate over the past few years that Complex Event Processing means the Processing of Complex Events not the Complex Processing of...]]></description>
      <content:encoded><![CDATA[<p>Folks defining CEP, and now this <a href="http://epthinking.blogspot.com/2008/06/on-embedded-intelligence-within-event.html" target="_self">new term IEP</a>, have been very passionate over the past few years that &#8220;<strong>Complex Event Processing</strong>&#8221; means the <strong>Processing</strong> of &#8220;<strong>Complex Events</strong>&#8221; not the &#8220;<strong>Complex Processing</strong>&#8221; of <strong>Events</strong>.   </p>
<p><a href="http://en.wikipedia.org/wiki/Grammar" target="_self">Grammatically</a> speaking, it follows that <strong>Complex</strong> is an <a href="http://en.wikipedia.org/wiki/Adjective" target="_self">adjective</a> describing a noun, <strong>Event; </strong>and <strong>Processing </strong>is a verb. </p>
<p>Complex events are defined by the same community as composite events, or events that are composed of two or more &#8220;contributing&#8221; events.</p>
<p>To be consistent, I think we should follow the same logic and grammar in the discussion of &#8220;Intelligent Event Processing&#8221;. </p>
<p>It follows that <strong>Intelligent</strong> should be an adjective describing a noun, <strong>Event; </strong>and <strong>Processing </strong>is a verb.  It also follows that &#8220;Intelligent Event Processing&#8221; means the Processing of &#8220;Intelligent Events&#8221; not the &#8220;Intelligent Processing&#8221; of Events.   </p>
<p>This is precisely the problem that folks are creating a new CEP term, &#8220;Intelligent Event Processing&#8221; to describe processing capabilitities that are missing from the current suite of self-described CEP software products.   What people really mean to describe is the <strong>Intelligent Processing</strong> of <strong>Complex Events.   </strong>However, based on the same grammer used in defining CEP, they have created the <strong>Processing</strong> of <strong>Intelligent Events</strong>.</p>
<p>The use of inconsistent grammar and logic is not good for the CEP community, in my opinion.   Just because the current generation of self-described CEP vendors do not rise to the capability required by the vast majority of business event applications, we should not create new terms just to make marketing folks happy.</p>
<p>I think I am in a good position to speak about this, because some of my best friends work for software companies selling self-described CEP software and they have seemingly lost patience  because I refuse to support inconsistent illogical positioning and repositioning of the CEP market.</p>
<p>Why is the grammar between the terms &#8220;Complex Event Processing&#8221; and &#8220;Intelligent Event Processing&#8221; inconsistent?.   Folks can only spin and reposition CEP so much before all the spin, hype, and repositioning begins to catch up with the community.   </p>
<p>Dr. David Luckham&#8217;s original papers and single book on CEP was clear enough about CEP; and CEP covers the entire space that Opher Etzion would like to reposition as IEP.    The Grammar of Complex and Intelligent Events are, at best, misleading and inconsistent.</p>
<p>I think the main problem is that what Opher has been describing is the <strong><em>Intelligent Processing of Complex Events</em></strong> - however, to say this would affirm what I have been evangelizing for over two years.</p>
]]></content:encoded>
      <pubDate>Sun, 29 Jun 2008 00:56:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/intelligent">intelligent</category>
      <category domain="http://securityratty.com/tag/terms">terms</category>
      <category domain="http://securityratty.com/tag/terms complex event">terms complex event</category>
      <category domain="http://securityratty.com/tag/intelligent events">intelligent events</category>
      <category domain="http://securityratty.com/tag/events">events</category>
      <category domain="http://securityratty.com/tag/intelligent event">intelligent event</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/cep covers">cep covers</category>
      <source url="http://www.thecepblog.com/2008/06/28/the-grammar-of-complex-and-intelligent-events/">The Grammar of Complex and Intelligent Events</source>
    </item>
    <item>
      <title><![CDATA[Security Matters: I've Seen the Future, and It Has a Kill Switch]]></title>
      <link>http://securityratty.com/article/b9aa8529e116abf92778a4755495e63d</link>
      <guid>http://securityratty.com/article/b9aa8529e116abf92778a4755495e63d</guid>
      <description><![CDATA[It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now...]]></description>
      <content:encoded><![CDATA[<p>It used to be that just the entertainment industries wanted to control your computers -- and televisions and iPods and everything else -- to ensure that you didn't violate any copyright rules. But now everyone else wants to get their hooks into your gear.
</p><p>
OnStar will soon include the <a href="http://www.informationweek.com/news/mobility/showArticle.jhtml?articleID=202400922">ability</a> for the police to shut off your engine remotely. Buses are getting the <a href="http://www.nypost.com/seven/06082008/news/regionalnews/busting_terror_114567.htm">same capability</a>, in case terrorists want to re-enact the movie <cite>Speed</cite>. The Pentagon wants a kill switch <a href="http://blog.wired.com/defense/2008/06/the-pentagons-n.html">installed</a> on airplanes, and is worried about potential enemies <a href="http://spectrum.ieee.org/may08/6171">installing</a> kill switches on their own equipment. 
</p><p>
Microsoft is doing some of the most creative thinking along these lines, with something it's calling "<a href="http://arstechnica.com/news.ars/post/20080611-microsoft-patent-brings-miss-manners-into-the-digital-age.html">Digital Manners Policies</a>." According to its <a href="http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220080125102%22.PGNR.&OS=DN/20080125102&RS=DN/20080125102">patent application</a>, DMP-enabled devices would accept broadcast "orders" limiting capabilities. Cellphones could be remotely set to vibrate mode in restaurants and concert halls, and be turned off on airplanes and in hospitals. Cameras could be prohibited from taking pictures in locker rooms and museums, and recording equipment could be disabled in theaters. Professors finally could prevent students from texting one another during class. 
</p><p>
The possibilities are endless, and very dangerous. Making this work involves building a nearly flawless hierarchical system of authority. That's a difficult security problem even in its simplest form. Distributing that system among a variety of different devices -- computers, phones, PDAs, cameras, recorders -- with different firmware and manufacturers, is even more difficult. Not to mention delegating different levels of authority to various agencies, enterprises, industries and individuals, and then enforcing the necessary safeguards.
</p><p>
Once we go down this path -- giving one device authority over other devices -- the security problems start piling up. Who has the authority to limit functionality of my devices, and how do they get that authority? What prevents them from abusing that power? Do I get the ability to override their limitations? In what circumstances, and how? Can they override my override?
</p><p>
How do we prevent this from being abused? Can a burglar, for example, enforce a "no photography" rule and prevent security cameras from working? Can the police enforce the same rule to avoid another Rodney King incident? Do the police get "superuser" devices that cannot be limited, and do they get "supercontroller" devices that can limit anything? How do we ensure that only they get them, and what do we do when the devices inevitably fall into the wrong hands?
</p><p>
It's comparatively easy to make this work in closed specialized systems -- OnStar, airplane avionics, military hardware -- but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems.
</p><p>
And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music a computer other than your own. They want to enforce <em>their</em> legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible. 
</p><p>
"Digital Manners Policies" is a marketing term. Let's call this what it really is: Selective Device Jamming. It's not polite, it's dangerous. It won't make anyone more secure -- or more polite.
</p>
<p>
---
</p>
<p><em>Bruce Schneier is chief security technology officer of BT, and author of</em> Beyond Fear: Thinking Sensibly About Security in an Uncertain World<em>.</em>
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=2e7004605a2cfdb2dff6647568035341" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=2e7004605a2cfdb2dff6647568035341" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=TdV5GI"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=TdV5GI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=hCKWyi"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=hCKWyi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=P6GE7i"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=P6GE7i" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=YY5ZlI"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=YY5ZlI" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=rAla0I"><img src="http://feeds.wired.com/~f/wired/politics/security?i=rAla0I" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKXIgi"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKXIgi" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=IE7M8i"><img src="http://feeds.wired.com/~f/wired/politics/security?i=IE7M8i" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=swX5hI"><img src="http://feeds.wired.com/~f/wired/politics/security?i=swX5hI" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/320220918" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/320220920" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 26 Jun 2008 00:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/wireless devices">wireless devices</category>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/prevent">prevent</category>
      <category domain="http://securityratty.com/tag/prevent security cameras">prevent security cameras</category>
      <category domain="http://securityratty.com/tag/difficult security">difficult security</category>
      <category domain="http://securityratty.com/tag/cameras">cameras</category>
      <category domain="http://securityratty.com/tag/prevent students">prevent students</category>
      <category domain="http://securityratty.com/tag/difficult">difficult</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/320220920/securitymatters_0626">Security Matters: I've Seen the Future, and It Has a Kill Switch</source>
    </item>
    <item>
      <title><![CDATA[Some of the other noteworthy breaches last week, 6/16/08 - 6/22/08]]></title>
      <link>http://securityratty.com/article/807b1e3ccc47c175a72b57ee98773462</link>
      <guid>http://securityratty.com/article/807b1e3ccc47c175a72b57ee98773462</guid>
      <description><![CDATA[Technorati Tag: Security Breach

The Breach Blog

Just SOME of the other noteworthy breaches from the past week (6/16/08 - 6/22/08

Citibank Hack Blamed for Alleged ATM Crime Spree
By Kevin Poulsen,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tbblogo.jpg" width="192" align="right" height="96"><font size="2"><font size="3"><span style="font-weight: bold;">The Breach Blog</span></font><br><br>Just <span style="font-weight: bold;">SOME </span>of the other noteworthy breaches from the past week (6/16/08 - 6/22/08)<br><br><font style="font-weight: bold;" size="3"><a href="%20http://blog.wired.com/27bstroke6/2008/06/citibank-atm-se.html">Citibank Hack Blamed for Alleged ATM Crime Spree</a></font><br>By Kevin Poulsen, Wired.com, 6/18/08<br><br></font><div style="margin-left: 40px;"><font size="2">A computer intrusion into a Citibank server that processes ATM withdrawals led to two Brooklyn men making hundreds of fraudulent withdrawals from New York City cash machines in February, pocketing at least $750,000 in cash, according to federal prosecutors. </font><br><br><font size="2">The ATM crime spree is apparently the first to be publicly linked to the breach of a major U.S. bank's systems, experts say. </font><br></div><font size="2"><br><font style="font-weight: bold;" size="3"><a href="http://www.networkworld.com/news/2008/061808-security-firm-finds-server-with.html">Security firm finds server with health-care data</a></font><br>By Jeremy Kirk, NetworkWorld, 6/18/08<br><br></font><div style="margin-left: 40px;"><font size="2">Security researchers with <a href="http://www.finjan.com/">Finjan Software</a> are seeing a growing thirst from cybercriminals for data other than credit-card numbers, with the latest findings including servers containing passwords leading to heath-care records and airline systems data. </font><br><br><font size="2">The problem is two-fold: sensitive data is being stolen after PCs are infected with malicious software, and then that data sent to unprotected remote servers, said Yuval Ben-Itzhak, chief technology officer for Finjan. The content of those servers is then indexed by search engines, leaving it open to anyone who uses the right query terms. </font><br></div><font size="2"><br><font size="3"><a style="font-weight: bold;" href="http://www.wsbt.com/news/local/20465589.html">Bank scam spreads as institutions look for possible source of breach</a></font><br>By Leanne Tokars, WSBT Channel 22 News, 6/18/08<br><br></font><div style="margin-left: 40px;"><font size="2">SOUTH BEND - An international bank scam is spreading, and there is some idea how that information may have gotten out.</font><br><br><font size="2">Hundreds of people and dozens of banks and credit unions across our area are trying to recover from a major security breach.</font><br><br><font style="font-style: italic;" size="2">[Evan] This story is related to the "<a href="http://breachblog.com/2008/06/05/1stsource.aspx">1st Source Bank reissues all debit cards in response to breach</a>" posting on 5/30/08.&nbsp; Another supporting story;<a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&amp;taxonomyId=17&amp;articleId=9101158&amp;intsrc=hm_topic"> Fraudulent ATM transactions overseas could be tied to Indiana bank breach</a></font><span style="font-style: italic;">&nbsp; This is a winding storyline.</span><br></div><font size="2"><br><font size="3"><a style="font-weight: bold;" href="http://www.topnews.in/parents-livid-over-database-putting-student-profiles-pictures-online-247747">Parents livid over database putting student profiles, pictures online</a></font><br>By Mohit Joshi, Top News, 6/16/08<br><br></font><div style="margin-left: 40px;"><font size="2">Melbourne, June 16: With the State government planning to post the profile of every state school student on its intranet database, called OneSchool, parents in Australia are livid over the fact that it will make their kids vulnerable to paedophiles.</font><br><br><font size="2">OneSchool, will provide each and every detail of the state's 480,000 public school students enrolled from Prep to Year 12, for which, the photographs, personal details, career aspirations, off-campus activities and student performance records are already being collected from all 1251 state schools.</font><br><br><font style="font-style: italic;" size="2">[Evan] I think I’d be livid too.&nbsp; Are parents given the opportunity to opt out, without penalty or lost opportunities?</font><span style="font-style: italic;">&nbsp; "According to Education Minister Rod Welford, if the parents refuse to
give their consent to their child being profiled, they could also be
denied access to public education."</span></div><font size="2"><br><font size="3"><a style="font-weight: bold;" href="http://news.bbc.co.uk/2/hi/uk_news/politics/7459579.stm">Blears PC loss - officials blamed </a></font><br>BBC News, 6/17/08<br><br></font><div style="margin-left: 40px;"><font size="2">Information on a computer stolen from Communities Secretary Hazel Blears' office had been sent in breach of data security rules, it has emerged. </font><br><br><font size="2">The Communities and Local Government department admitted its officials had "not fully" complied with guidance on handling sensitive data. </font><br><br><font size="2">Its top civil servant Peter Housden said "no damage had been done" as the documents were not secret.</font><br><br><font size="2">The computer contained a combination of constituency and government information relating to defence and extremism.</font><br><br><font style="font-style: italic;" size="2">[Evan] It is disappointing to read about breaches where the government does not follow its own laws and regulations.&nbsp; Mr. Housden claims that the files were "not secret".&nbsp; They certainly weren’t public, were they?</font><br></div><font size="2"><br><font style="font-weight: bold;" size="3"><a href="http://www.dailymail.co.uk/news/article-1027457/Personal-details-20-000-patients-stolen-hospital-new-security-blunder.html">Personal details of thousands of patients stolen from hospital in new security blunder</a></font><br>By James Tozer, The Daily Mail, 6/18/08<br><br></font><div style="margin-left: 40px;"><font size="2">Laptops holding tens of thousands of patients' records have been stolen from a hospital and a GP's home, it emerged yesterday. </font><br><br><font size="2">In the latest lost personal data scandal, the information was stored on the machines in contravention of NHS guidelines. </font><br><br><font size="2">It was revealed that details of 20,000 patients were on six laptops stolen earlier this month from filing cabinets at St George's Hospital, in Tooting, South West London. </font><br><br><font style="font-style: italic;" size="2">[Evan]&nbsp; This is six stolen laptops in one month, and the four breaches in one year?!&nbsp; The exposed information in this breach was "names, postcodes, hospital numbers and dates of birth".&nbsp; Check out the excuse for storing confidential information on these poorly secured laptops; "Normally such information is stored on the hospital's central network, but because of technical problems it was being stored temporarily on the laptops."</font><br></div><font size="2"><br><br><b>To Readers:</b>&nbsp; I am testing this weekly "Other noteworthy breaches" post.&nbsp; I am using this first one to gauge interest and decide if it is something we should continue.&nbsp; Please feel free to comment.<br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/23/062308.aspx%E2%80%9D%20type=" text="" javascript="" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 23 Jun 2008 04:11:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/major security breach">major security breach</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/airline systems data">airline systems data</category>
      <category domain="http://securityratty.com/tag/breaches">breaches</category>
      <category domain="http://securityratty.com/tag/noteworthy breaches">noteworthy breaches</category>
      <category domain="http://securityratty.com/tag/indiana bank breach">indiana bank breach</category>
      <category domain="http://securityratty.com/tag/sensitive data">sensitive data</category>
      <source url="http://breachblog.com/2008/06/23/062308.aspx">Some of the other noteworthy breaches last week, 6/16/08 - 6/22/08</source>
    </item>
  </channel>
</rss>
