<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: strict]]></title>
    <link>http://securityratty.com/tag/strict</link>
    <description></description>
    <pubDate>Sun, 08 Jun 2008 14:28:48 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Interop NY: Cloud Language: The Taxonomy of On-Demand Computing]]></title>
      <link>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</link>
      <guid>http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8</guid>
      <description><![CDATA[This session on cloud computing was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS...]]></description>
      <content:encoded><![CDATA[<p>This <a href="http://www.interop.com/newyork/conference/all-by-day.php?tag=Cloud+Computing" target="_blank">session on cloud computing</a> was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS efforts. He also blogs at <a href="http://peterlaird.blogspot.com/" target="_blank">Laird On Demand</a>.</p>
<p><strong>Defining Cloud Computing</strong></p>
<p>Cloud computing is a very active community. The <a href="http://groups.google.com/group/cloud-computing" target="_blank">Google Group</a> gets 600 posts per month and many bloggers are covering the space. However, &#8220;cloud computing&#8221; is impossible to define in a way that satisfies everyone (or even most). Cloud computing is not alone in this controversy, consider the definition and meaning of &#8220;Web 2.0&#8243;, &#8220;mashups&#8221; or &#8220;RESTful architecture&#8221;. All of these terms are relatively recent. According to Google Trends, these terms became popular to the general public sometime between 2005 and 2007:</p>
<ul>
<li>Web 2.0 - often confused with RIA, AKA Social Computing, Long-Tail Apps, Crowdware (2005 by O&#8217;Reilly Media)</li>
<li>Mashup - made popular by Google Maps, AKA Composite/Situational Apps. (2005)</li>
<li>REST - Has a strict definition, but many don&#8217;t understand it and abuse the term. (2006 by R. Fielding)</li>
<li>Cloud computing - collides with many other terms, such as SaaS, Grid, Utility, PaaS, etc. (2007)</li>
</ul>
<p>The definition of cloud computing is in progress:</p>
<blockquote><p>There&#8217;s a Darwinian evolution of the exact definition of cloud computing running around. We&#8217;re about a country mile away from &#8220;knowing when I see it&#8221;, which is excellent progress. The cloud to everyone&#8217;s silver-lining has enough material to write a 3 volume desktop reference at this point. - Michael Cote, June 2008</p></blockquote>
<p><strong>Definition #1</strong> - &#8220;Cloud computing is the realisation of Internet (&#8221;Cloud&#8221;) based development and use of computer technology (&#8221;Computing&#8221;) delivered by an ecosystem of providers. - Sam Johnston, July 2008</p>
<p><strong>Definition #2</strong> - &#8220;Cloud computing = network computing. I love the idea of cloud computing, the next evolution of the most network intensive architecture possible, but one that if it works well, is transparent. It&#8217;s all about the transparency.&#8221; - Douglas Gourlay, Cisco, May 2008</p>
<p><strong>Definition #3</strong> - &#8220;There seems to be a group myopia around so-called &#8220;cloud computing&#8221; and its definitions. What we&#8217;re really talking about are &#8220;cloud services&#8221; of which, &#8220;computing&#8221; is only a subset&#8230;Cloud services are not SaaS. They are far more akin to web services&#8230;&#8221; - Randy Bias, neoTactics, May 2008</p>
<p><strong>(Anti-)Definition #4</strong> - &#8220;Note that I refer to cloud services, not to the could. I am not interested in defining cloud as a term, because I don&#8217;t think it&#8217;s very useful. For those of us in the distributed computing&#8217;s pace</p>
<p><strong>The Working Definition (Winner!):</strong></p>
<p>&#8220;&#8230;the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don&#8217;t know where the resources are, and for the most part, you don&#8217;t care. What&#8217;s really important is the capability to access your application anywhere, move it freely and easily, and inexpensively add resources for instant scalability.&#8221; - Mitchell Crandell, Rightscale, June 2008</p>
<p><strong>Taxonomies of the Cloud Space</strong></p>
<p>Taxonomies are useful to provide insight into a market. It classifies a multitude of players into a smaller bucket.</p>
<p><em>Andreessen&#8217;s Platforms - September 2007</em></p>
<p>Provided an early taxonomy model for emerging cloud platforms</p>
<p>Platform being a system that can be programmed</p>
<ul>
<li>Access API - platform that provides web service endpoints</li>
<li>Plug-In API - platform invokes your code, that you have deployed remotely</li>
<li>Runtime Environment - your code runs inside the platform&#8217;s process space.</li>
</ul>
<p><em>Mehta 11 Layer Stack, April 2008</em></p>
<ol>
<li>Facilities (space, power, cooling)</li>
<li>Network</li>
<li>Hardware (e.g. servers Amazon EC2 runs)</li>
<li>Hardware virtualization (e.g. Xen for EC2) - optional</li>
<li>O/S (e.g. Linux)</li>
<li>Systems Management (e.g., tools to manage EC2 instances)</li>
<li>Application Middleware (e.g., MySQL on EC2)</li>
<li>Application Code</li>
<li>Application APIs / Web Services</li>
<li>GUI for Application</li>
<li>GUI for Application Development / Customization</li>
</ol>
<p><em>Croll Cloud Stack, June 2008</em></p>
<p>7 layer stack within Turnkey app and Generic Platform.</p>
<p><em>Turnkey app</em></p>
<ul>
<li>SaaS</li>
<li>Extensible app</li>
<li>Generic IDE</li>
<li>Constrained APIs</li>
<li>App Cluster</li>
<li>Virtual Data Center</li>
<li>Virtual Servers</li>
</ul>
<p><em>Generic Platform</em></p>
<p>The bottom of Alistair&#8217;s stack includes &#8220;root access &#8220;style compute clouds.</p>
<p><em>Robert Anderson, July 2008</em></p>
<p>3 layer stack</p>
<ul>
<li>Software (SaaS)</li>
<li>Platform (PaaS)</li>
<li>Infrastructure (IaaS)</li>
</ul>
<p>This is the model taxonomy for this session.</p>
<p><strong>Related Concepts and Terms</strong></p>
<ul>
<li>Infrastructure as a Service (IaaS), Hardware as a Service (HaaS) are synonyms to cloud infrastructure.</li>
<li>Virtualization</li>
<li>Hosting</li>
<li>Autonomic computing</li>
<li>Distributed computing</li>
<li>Grid computing</li>
</ul>
<p>Cloud Applications</p>
<ul>
<li>SaaS</li>
<li>S+S (Software+Services)</li>
<li>Managed Service Provider (MSP)</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 14:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/cloud applications">cloud applications</category>
      <category domain="http://securityratty.com/tag/croll cloud stack">croll cloud stack</category>
      <category domain="http://securityratty.com/tag/cloud infrastructure">cloud infrastructure</category>
      <category domain="http://securityratty.com/tag/platforms process space">platforms process space</category>
      <category domain="http://securityratty.com/tag/space">space</category>
      <category domain="http://securityratty.com/tag/cloud space">cloud space</category>
      <category domain="http://securityratty.com/tag/cloud platforms">cloud platforms</category>
      <category domain="http://securityratty.com/tag/cloud services">cloud services</category>
      <source url="http://blog.sciencelogic.com/interop-ny-cloud-language-the-taxonomy-of-on-demand-computing/09/2008">Interop NY: Cloud Language: The Taxonomy of On-Demand Computing</source>
    </item>
    <item>
      <title><![CDATA[Indiana State University professor's laptop is stolen]]></title>
      <link>http://securityratty.com/article/ac01a165449e657f832374db2c405cad</link>
      <guid>http://securityratty.com/article/ac01a165449e657f832374db2c405cad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
Indiana State University

Contractor/Consultant/Branch
None

Victims
students who took economics classes from 1997 through the...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/indianastate.jpg" width="137" align="right" height="48"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://www.indstate.edu/home.htm">Indiana State University</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>"students who took economics classes from 1997 through the spring semester 2008"<br><br><span style="font-weight: bold;">Number Affected:</span><br>"more than 2,500"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, grades, e-mail addresses and student identification numbers"*<br><br><font size="1">*Until 2003, student identification numbers were the equivalent of each student’s Social Security number.</font><br><br><span style="font-weight: bold;">Breach Description:</span><br>"A password-protected laptop computer containing personal information for current and former Indiana State University students was stolen during the weekend, the university reported Tuesday."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www1.indstate.edu/laptopsecurity/">Indiana State University</a> <br><a href="http://www.wthitv.com/Global/story.asp?S=8684098&amp;nav=menu593_1">Associated Press via WTHI Channel 10 News</a> <br><a href="%20http://www.chicagotribune.com/news/chi-ap-in-isu-stolenlaptop,0,1255776.story">Associated Press via Chicago Tribune</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>Indiana State University<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A password-protected laptop computer containing personal information for current and former Indiana State University students was stolen during the weekend, the university reported Tuesday.<br><span style="font-style: italic;">[Evan] What do you suppose the purpose of the "password-protected" mention is?&nbsp; I hope it is not meant to reassure anyone that the information is safe.&nbsp; For those of you that do not know, password-protection is easily bypassed and in the opinion of many information security professionals (this one included), does NOT provide adequate protection for confidential information.</span><br><br>While there is no evidence to suggest that password security was breached, the university is taking the precaution of notifying all affected students for whom it has current contact information.<br><span style="font-style: italic;">[Evan] If someone were to breach the "password security", what evidence would the school see?&nbsp; None.&nbsp; There would be no evidence (except locally on the laptop) if the local password store had been compromised.&nbsp; The school no longer has possession of the laptop, so the school would have no evidence.</span><br><br>The laptop contained data for students who took economics classes from 1997 through the spring semester 2008, estimated at more than 2,500 individuals.<br><br>If you took an economics class during this time period, but did not receive a letter, please call the Registrar’s Office to verify that you were on the list, and to update your address so that we may send you a letter.<br><span style="font-style: italic;">[Evan] Contact information for the Registrar's Office, click </span><a style="font-style: italic;" href="http://www1.indstate.edu/registrar/">here</a><span style="font-style: italic;">.</span><br><br>The information includes names, grades, e-mail addresses and student identification numbers.<br><br>Beginning in 2003, use of social security numbers as student ID numbers was discontinued in favor of university-specific identification numbers.<br><span style="font-style: italic;">[Evan] A sound security decision by the university would have been to follow up with a project to identify and remove Social Security numbers already held as student IDs.&nbsp; Maybe it was, but the information on this laptop was missed.</span><br><br>The theft occurred Saturday while the professor was traveling in southern Indiana<br><br>the professor was traveling with his family and briefly left the computer unattended<br><span style="font-style: italic;">[Evan] A laptop can grow legs in a flash.&nbsp; A person doesn't need to leave a laptop unattended for very long for it to disappear.</span><br><br>The incident occurred on July 12, 2008 and was reported to university officials on July 14, 2008.<br><br>The incident was reported immediately to the appropriate law enforcement agency and early Monday to university officials.<br><br>The extent of the information contained on the computer was not determined until Monday night.<br><br>Faculty and staff are being reminded that university policy prohibits the storage of private, sensitive data on portable computers.<br><span style="font-style: italic;">[Evan] Excellent policy provision.&nbsp; Policy does little if it is not communicated, enforced, audited against, and improved.&nbsp; Where was the failure in the breach?&nbsp; Was the policy not communicated to this professor, and thus he/she was not aware?</span><br><br>In addition, laptops provided to faculty are equipped with several security measures including encryption and a bio-metric fingerprint reader to prevent access by anyone other than the assigned user.<br><span style="font-style: italic;">[Evan] An excellent standard (or procedure).</span><br><br>Approximately 500 ISU faculty members have laptop computers.<br><br>The university is reviewing its procedures to ensure compliance with existing policies, said Interim President C. Jack Maynard, the university’s provost and vice president for academic affairs<br><br><span style="font-weight: bold;">From the FAQs:</span><br><br>Q: What can someone do with a stolen SSN?<br>A: "With just a SSN there is little anyone can do in the way of setting up a false identity or securing credit. Generally an identity thief would need more information and documentation to set up false credit.<br><span style="font-style: italic;">[Evan] A SSN needs to be held in strict confidentiality in today's financial, employment, health, and other systems.&nbsp; It is often used for identification and authentication.&nbsp; Once an identity thief has a SSN, the owner of that SSN is now a prime target because the thief has the most confidential piece of information (ingredient) in the identity theft recipe.&nbsp; The rest of the information is typically easier to come by, i.e. name, address, employer, etc.&nbsp; It is true that an SSN alone is not enough information to commit identity theft, but it is an EXCELLENT start.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>We can assume that the school knows the risks involved in storing confidential information on a poorly protected laptop.&nbsp; Otherwise, they probably wouldn't have policy and procedure against it.&nbsp; The school's statements that are meant to minimize the risk, seemingly without fact, are disappointing. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/17/indianastate.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 05:29:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information includes names">information includes names</category>
      <category domain="http://securityratty.com/tag/university students">university students</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/evan contact information">evan contact information</category>
      <category domain="http://securityratty.com/tag/university policy prohibits">university policy prohibits</category>
      <source url="http://breachblog.com/2008/07/17/indianastate.aspx">Indiana State University professor's laptop is stolen</source>
    </item>
    <item>
      <title><![CDATA[CBAC & Medical Identity Theft]]></title>
      <link>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</link>
      <guid>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</guid>
      <description><![CDATA[Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: askelizabeth
The Sopranokovs
The...]]></description>
      <content:encoded><![CDATA[<p>Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: <a href="http://askelizabeth.typepad.com/weblog/2008/07/medical-identity-theft-the-new-frontier-for-organized-crime.html">askelizabeth</a>)

</p><blockquote><p>
	The Sopranokovs 
	</p></blockquote><blockquote><p>The Russian mob comes to town with a new scam—medical identity theft. 	
	</p></blockquote><blockquote><p>When FBI special agent Ted Price peered through the window of a dingy brick storefront on Southwest Morrison Street in March, it was what he didn’t see that caught his attention. 	</p></blockquote><blockquote><p>The business, called UnimedCorner, claimed to provide ailing seniors with orthotics—braces and other devices to correct foot, joint and back problems. 	
	</p></blockquote><blockquote><p>Price and other federal investigators were skeptical. 	
	</p></blockquote><blockquote><p>On Unimed’s showroom floor, Price saw wheelchairs, motorized scooters, a variety of canes and, on the walls, a selection of amateurish paintings and framed photographs. There was no evidence, however, of the kinds of equipment for which Unimed had billed Medicare nearly $2 million in the previous couple of months. 	
	</p></blockquote><blockquote><p>“I observed wheelchairs and canes through the window but did not see any orthotics in the store,” Price later wrote in a search-warrant affidavit. “It is a sign of fraud that the store is not stocking the items [for which] it is billing.” 	
	</p></blockquote><blockquote><p>By the time Price arrived on the scene, the company’s owner, a shadowy Russian immigrant named Alexandr Shcherbakov, was long gone. 	
	</p></blockquote><blockquote><p>Today, Shcherbakov’s store sits undisturbed. The message light on the phone blinks, dead potted plants droop and a stuffed toy monkey slumps in a glass display case. 	
	</p></blockquote><blockquote><p>And behind the cash register hangs a framed poster of television’s best-known mobsters, the Sopranos. 	
	</p></blockquote><blockquote><p>From interviews and information presented in federal affidavits, it is clear Shcherbakov moved to Oregon to commit a crime elegant and lucrative enough to make Tony Soprano envious: medical identity theft. 	
	</p></blockquote><blockquote><p>... 	
	</p></blockquote><blockquote><p>“Medical identity theft is the new frontier for organized crime,” says Alex Johnson, a former FBI agent who investigates fraud for Regence BlueShield. “Pretty much anybody can set up a mom-and-pop operation and start cranking out claims.”
	
	Someday, most Americans will need a cane, wheelchair, home hospital bed or another of the items healthcare professionals call “durable medical equipment,” or DME. 	
	</p></blockquote><blockquote><p>For those over 64 and without private insurance, there’s a good chance federally funded Medicare will pick up the tab for that equipment. Last year, according to federal statistics, Medicare spent $8.6 billion on DME. 	
	</p></blockquote><blockquote><p>Here’s the way the system is supposed to work: A doctor prescribes a device such as a wheelchair for a patient, who presents his prescription to a DME supplier. The supplier provides the equipment and bills Medicare, which typically pays 80 percent of the cost.
	
	Unlike pharmacists, who fill prescriptions under strict scrutiny of state and federal watchdogs, DME suppliers are lightly regulated.
	
	“DME is very vulnerable to fraud,” says Consuelo Woodhead, the chief healthcare fraud prosecutor for the U.S. Attorney’s Office in Los Angeles. “It doesn’t require any background in medicine, any kind of professional licensure or appreciable capital. </p></blockquote><blockquote><p>There are barriers of entry in other medical fields, but not in DME.”
	
	To operate, DME suppliers simply need a place of business, a business license and liability insurance. Unlike pharmacists, DME suppliers operate under an honor system: The feds count on them to supply the equipment they claim to provide to the beneficiaries who need it. 	
	</p></blockquote><blockquote><p>That honor system is not working. 	
	</p></blockquote><blockquote><p>The epicenter of DME fraud, according to the federal Department of Health and Human Services, is South Florida, where Medicare billing for DME quadrupled from 2002 to 2006 to $1.7 billion.
	
	Investigators found much of that increase was due to fraud. In 2006, federal inspectors revoked the licenses of 634 DME suppliers in South Florida, nearly half the DME dealers in the region. </p></blockquote><blockquote><p>Later the same year, raids in Southern California yielded similar results: The feds shut down 95 DME suppliers.
	
	Many of the DME suppliers shut down around Los Angeles were run by immigrants from the former Soviet Union. It’s probably no coincidence that when the feds raided Los Angeles DME suppliers, some Angelenos fled to cities where there was less scrutiny—such as Portland.</p></blockquote>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:09:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dme suppliers simply">dme suppliers simply</category>
      <category domain="http://securityratty.com/tag/dme suppliers">dme suppliers</category>
      <category domain="http://securityratty.com/tag/dme fraud">dme fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/dme">dme</category>
      <category domain="http://securityratty.com/tag/identity">identity</category>
      <category domain="http://securityratty.com/tag/medical identity theft">medical identity theft</category>
      <category domain="http://securityratty.com/tag/dme dealers">dme dealers</category>
      <category domain="http://securityratty.com/tag/dme supplier">dme supplier</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/cbac-medical-identity-theft.html">CBAC &amp; Medical Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Simple oversight at TNS Infratest exposes participant information]]></title>
      <link>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</link>
      <guid>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/4/08

Organization
Taylor Nelson Sofres plc (TNS

Contractor/Consultant/Branch
TNS Infratest

Victims
Survey participants

Number Affected
41,000
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tns.jpg" width="98" align="right" height="98"><font size="2"><b>Date Reported: </b><br>7/4/08<br><br><b>Organization: </b><br><a href="http://www.tnsglobal.com/">Taylor Nelson Sofres plc (TNS)</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.tns-infratest.com/">TNS Infratest</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Survey participants<br><br><span style="font-weight: bold;">Number Affected:</span><br>41,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"Name and address, date of birth, email address and phone numbers", "Some of the data included monthly income, education, bank account information, health insurance data, and which credit cards are used"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The scientific journal of the Chaos Computer Club (CCC), Die Datenschleuder, reports that market research firm TNS Infratest/Emnid has lost 41,000 private data records of their survey participants."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ccc.de/updates/2008/umfragetief?language=en">Chaos Computer Club e.V.</a> <br><a href="http://www.theinquirer.net/gb/inquirer/news/2008/07/07/hackers-claim-survey-outfit">The Inquirer</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Chaos Computer Club e.V.<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>TOP MARKET RESEARCH firm TNS Infratest/Emnid has 'lost' 41,000 private data records of its survey participants, the Chaos Computer Club (CCC) has revealed in its official organ Die Datenschleuder.<br><br>As the magazine reports [1], it was possible for participants to read master data records and consumer profiles without bypassing even basic security measures.<br><br>Access to the comprehensive survey results could be gained by simply changing the customer ID number in the browser's address bar.<br><span style="font-style: italic;">[Evan] This type of development mistake too common.&nbsp; The vulnerability is very easy to find by good pen testers and the bad guys.&nbsp; Actually, I am surprised that we don't hear about more of these types of breaches.</span><br><br>Besides name and address, the data records included date of birth, email address and phone number.<br><br>Many records also included very sensitive information: monthly income, education, bank account information, health insurance data, if and which credit cards are used, which electronic devices are used in the household, children's ages and yet more private data.<br><span style="font-style: italic;">[Evan] Clearly this is some very sensitive information, all provided by people completing surveys.</span><br><br>"TNS Infratest made a beginner's mistake in their software development. This is unprofessional, grossly negligent and above all deeply worrying," commented CCC spokesman Dirk Engling regarding the incident.<br><span style="font-style: italic;">[Evan] Mr. Engling is dead on.&nbsp; I couldn't have said it better myself.</span><br><br>"As this information is very sensitive, where abuse such as identity theft or its use in connection with burglary cannot be excluded, THS Infratest needs to inform the victims immediately," he continued<br><br>This case continues a disastrous, never-ending series of information leaks of data held by public and private sector organisations.<br><br>The need for more strict control of sensitive data collections is evidenced by the recent snooping affairs by German Telecom as well as the data leaks from the "Meldeämtern" (registration of address offices). <br><br>It is obvious here that data security only plays a minor role in companies.<br><span style="font-style: italic;">[Evan] Very sad, but very true.&nbsp; Too many organizations still take the wrong view of information security as a "cost center" instead of a business driver.&nbsp; Well designed and managed information security programs, the ones that are aligned with the business and not IT, can actually provide value to the business.</span><br><br>"Especially for companies surveying the most confidential data, the highest security standards have to apply," said Engling.<br><br>The press team of the Chaos Computer Club is available for questions at the following addresses: <br></font><ul><li><font size="2">presse@ccc.de (preferred)</font></li><li>0700-CHAOSFON (0700 - 24267366)<br></li></ul><font size="2"><br><span style="font-weight: bold;">Commentary:</span><br>TNS is a large company, a large company with resources to hire good management, programmers, and information security personnel.&nbsp; What is the excuse for making such a significant, yet simple oversight?&nbsp; There are a number of controls that could have reduced the risk of this occurring.<br><br>One a secondary note, but no less important in my opinion.&nbsp; It seems that people (in general) provide too much information willingly, without understanding what the risks could be.&nbsp; Personally, I rarely complete surveys that ask me for personally identifiable information (name, address, etc.).&nbsp; I suggest that you give some serious thought to providing any of your personal information.&nbsp; Ask yourself if you trust the organization collecting your information.&nbsp; If so, question what your trust is based on.&nbsp; Do NOT hesitate to ask questions and err on the side of caution. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br><script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/09/tns.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 19:37:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/master data records">master data records</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/sensitive">sensitive</category>
      <category domain="http://securityratty.com/tag/information leaks">information leaks</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bank account information">bank account information</category>
      <source url="http://breachblog.com/2008/07/09/tns.aspx">Simple oversight at TNS Infratest exposes participant information</source>
    </item>
    <item>
      <title><![CDATA[Changhai Ke of ILOG: The More Part of CEP over ESP is Far from Mature]]></title>
      <link>http://securityratty.com/article/4ccda505bb59db762d5daa487d5ea59e</link>
      <guid>http://securityratty.com/article/4ccda505bb59db762d5daa487d5ea59e</guid>
      <description><![CDATA[This post was originally a comment On CEP Maturity and the Gartner Hype Cycle by Changhai Ke of ILOG . Changhai Kes comment was so well written, I have repostedit as a blog entry
The More Part of CEP...]]></description>
      <content:encoded><![CDATA[<p>This post was originally a <a href="http://www.thecepblog.com/2008/06/01/on-cep-maturity-and-the-gartner-hype-cycle/#comment-498" target="_blank">comment</a> <a href="http://www.thecepblog.com/2008/06/01/on-cep-maturity-and-the-gartner-hype-cycle" target="_blank">On CEP Maturity and the Gartner Hype Cycle</a> by <a href="http://forums.ilog.com/brms/index.php?action=profile;u=16;sa=showPosts" target="_blank">Changhai Ke of ILOG</a>.  Changhai Ke&#8217;s comment was so well written, I have reposted it as a blog entry.</p>
<p>The “More” Part of CEP over ESP is Far from Mature </p>
<p>By Changhai Ke, <a href="http://www.ilog.com" target="_blank">ILOG</a></p>
<p>An EDA and CEP must be understood as 2 different areas. EDA is an architecture pattern for enterprise applications. The components are loosely coupled by the use of events. In its strict sense, this is more an architecture pattern than an algorithm.</p>
<p>CEP, on the other hand, targets at the event processing and pattern recognition level. For me, it’s the research for the right algorithm to use to recognize the situations. Pattern recognition, event correlation are all good characterizations for CEP. Back 15 years ago, the alarm correlation in the telecom area was done using production rules (it is still the case), and this perfectly falls into the CEP area.</p>
<p>In fact, EDA comes after CEP, but the CEP at that period was not explicitly called CEP. The nature of their respective study is not the same, one is at the architecture and middleware level, the other is at the algorithm side. As both are concerned by events, it seems that people more or less implicitly include CEP in EDA, mix the two and introduce confusion. Why not. But it’s important to understand that CEP (on its algorithm side) could mature on its way without being worried about the event transportation layer.</p>
<p>As a system, CEP needs input events for processing. If EDA is considered as the only way to bring and transport events to the CEP systems, then of course CEP won’t become successful without the prior success of EDA. But in my understanding, CEP targets some real-time or close to real-time applications, and the event transport layer in those applications are the most often ad-hoc and over-optimized. I fear that EDA has the same kind of performance goal.</p>
<p>Another distinction needs to be made. CEP is more general than ESP (event stream processing), characterized by an EPL for data aggregation with notifications. Even on the market most of the CEP vendors provide EPL languages, CEP has the vocation to cover more than that. The “more” part is not well defined, at least it should include the event correlation, and correlation is not just data aggregation.</p>
<p>The ESP part of CEP could be considered as quite mature. There are so many EPL languages, and tuning has been made on the runtime side. It seems also that some applications based on ESP have proved to work. But the “more” part of CEP over ESP is far from mature. It is often described that CEP could use several technologies, such as statistical models, Bayesian network, time series, rules, etc. I agree that there are a few systems using rules. But where are the others?</p>
<p>Sincerely,</p>
<p><a href="http://forums.ilog.com/brms/index.php?action=profile;u=16" target="_blank">Changhai Ke</a></p>
]]></content:encoded>
      <pubDate>Sun, 06 Jul 2008 07:58:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/implicitly include cep">implicitly include cep</category>
      <category domain="http://securityratty.com/tag/cep systems">cep systems</category>
      <category domain="http://securityratty.com/tag/cep targets">cep targets</category>
      <category domain="http://securityratty.com/tag/cep maturity">cep maturity</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/correlation">correlation</category>
      <category domain="http://securityratty.com/tag/event transport layer">event transport layer</category>
      <category domain="http://securityratty.com/tag/alarm correlation">alarm correlation</category>
      <source url="http://www.thecepblog.com/2008/07/06/changhai-ke-of-ilog-the-%e2%80%9cmore%e2%80%9d-part-of-cep-over-esp-is-far-from-mature/">Changhai Ke of ILOG: The More Part of CEP over ESP is Far from Mature</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Shake-up For Internet Proposed]]></title>
      <link>http://securityratty.com/article/c93395204ded0b339cd5e662e3182ed2</link>
      <guid>http://securityratty.com/article/c93395204ded0b339cd5e662e3182ed2</guid>
      <description><![CDATA[From the BBC
The net could see its biggest transformation in decades if plans to open up the address system are passed
The nets regulators will vote on Thursday to decide if the strict rules on...]]></description>
      <content:encoded><![CDATA[<p>From the BBC:</p>
<blockquote><p>The net could see its biggest transformation in decades if plans to open up the address system are passed.</p>
<p>The net&#8217;s regulators will vote on Thursday to decide if the strict rules on so-called top level domain names, such as .com or .uk, can be relaxed.</p>
<p>If approved, it could allow companies to turn their brands into domain names while individuals could also carve out their own corner of the net.</p>
<p>The move could also see the launch of .xxx, after years of wrangling. </p></blockquote>
<p>The part I find funny is the number of politicians that think having a .xxx domain will cordon off sexually oriented websites from the rest of the web.</p>
<blockquote><p>The move could yet be blocked as the independent arbitration panel can reject domains based on &#8220;morality or public order&#8221; grounds.</p></blockquote>
<p>Morality on the Internet. Hmmm, ok.</p>
<p><a href="http://news.bbc.co.uk/2/hi/technology/7468855.stm">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=vaH0NO"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=vaH0NO" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=JjnUjI"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=JjnUjI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=EOPxTi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=EOPxTi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=xNtv0i"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=xNtv0i" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=31hRji"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=31hRji" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=63ROmi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=63ROmi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/318799055" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 24 Jun 2008 06:45:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/xxx">xxx</category>
      <category domain="http://securityratty.com/tag/xxx domain">xxx domain</category>
      <category domain="http://securityratty.com/tag/independent arbitration panel">independent arbitration panel</category>
      <category domain="http://securityratty.com/tag/reject domains based">reject domains based</category>
      <category domain="http://securityratty.com/tag/move">move</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/morality">morality</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/318799055/">Shake-up For Internet Proposed</source>
    </item>
    <item>
      <title><![CDATA[.. and now - PIN stealing..]]></title>
      <link>http://securityratty.com/article/2e699cb88411c7ece62621d294d7f5fb</link>
      <guid>http://securityratty.com/article/2e699cb88411c7ece62621d294d7f5fb</guid>
      <description><![CDATA[Once the bad guys figured out how easy it was to sniff unencrypted ATM and card authorization traffic to steal track data, and after making a killing with stolen card numbers, they began setting their...]]></description>
      <content:encoded><![CDATA[Once the bad guys figured out how easy it was to sniff unencrypted ATM and card authorization traffic to steal track data, and after making a killing with stolen card numbers, they began setting their sights on bank PINs.  PIN numbers - thanks to ANSI's TG3 - are encrypted with a half decent algorithm (and they are looking to strengthen that even more now). Which means that sniffing the traffic will only give you an encrypted number - something which would require a decryption key. A number of security controls like requiring dual control and split knowledge for key components, strict physical security requirements and Tamper Resistant Security Modules help in securing the keys. Assuming one cannot gain access to the encryption keys, this leaves only two scenarios for an attacker to gain access to the unencrypted PINs:<br />1. Before the PIN is encrypted by the Tamper Resistant Security Module (an ATM in the case of bank customers). Most criminals have been using fake PIN PADs and a number of techniques like jamming cards etc steal PINs blissfully unaware that they are on camera most of the time. Nice video ?<a href="http://www.youtube.com/watch?v=9mi4kB15wMY"> here.</a><br /><br />2. After the PIN reaches the issuer and is decrypted. This is the scarier situation -as the attacker would have access to a database of unencrypted PIN numbers / PIN offsets coming in from all around the globe. PCI supposedly <a href="http://pcianswers.com/2007/08/31/issuer-pci-requirements/">requires </a> that issuers be compliant and not store unencrypted PANs or PINs - but no validation is required (unless they are a VisaNet processor). <br /><br />Well - Kevin Poulsen at Wired <a href="http://blog.wired.com/27bstroke6/2008/06/citibank-atm-se.html">wrote today</a> about how an alleged ATM crime spree has been blamed on a Citibank hack. Though Citibank has denied the hack as the cause of the fraudulent withdrawals - all signs seem to point towards it so far.<br />(This definitely is not new - While testing an issuer's security I'd stumbled upon ATM log entry files - complete with PAN, PIN, full name, address, zip code and atm location - back in the day when RFP just released<a href="http://www.wiretrip.net/rfp/"> whisker.</a> )<br /><br />This is probably just the beginning of a new wave. Issuers really need to pull up their socks and begin to treat cardmember data with the same respect that PCI Co is requiring merchants and processors to do. - and while I'm wishing horses - can ANSI or someone start working on some standards for requiring all track data to be encrypted in transit?]]></content:encoded>
      <pubDate>Thu, 19 Jun 2008 06:38:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/pin">pin</category>
      <category domain="http://securityratty.com/tag/pin reaches">pin reaches</category>
      <category domain="http://securityratty.com/tag/pin offsets">pin offsets</category>
      <category domain="http://securityratty.com/tag/fake pin pads">fake pin pads</category>
      <category domain="http://securityratty.com/tag/atm location">atm location</category>
      <category domain="http://securityratty.com/tag/atm">atm</category>
      <category domain="http://securityratty.com/tag/bank pins">bank pins</category>
      <category domain="http://securityratty.com/tag/atm crime spree">atm crime spree</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <source url="http://securitycoin.blogspot.com/2008/06/and-now-pin-stealing.html">.. and now - PIN stealing..</source>
    </item>
    <item>
      <title><![CDATA[Canadian farmer personal information on stolen CCGA laptop]]></title>
      <link>http://securityratty.com/article/59ad7c04243f6352dc04e5847a1515dd</link>
      <guid>http://securityratty.com/article/59ad7c04243f6352dc04e5847a1515dd</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/4/08

Organization
Government of Canada

Contractor/Consultant/Branch
Canadian Canola Growers Association (CCGA

Victims
Farmers

Number Affected...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ccga.jpg" align="right" height="82" width="168"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/4/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.gc.ca/home.html">Government of Canada</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ccga.ca/OrganizationHome.htm">Canadian Canola Growers Association (CCGA)</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Farmers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~32,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"social insurance numbers, bank account numbers and other data"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"OTTAWA, June 5 (UPI) -- Prairie farmers in Canada are upset the federal government waited two months to tell them a laptop computer containing their personal data was missing."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.winnipegfreepress.com/breakingnews/story/4182176p-4771903c.html">Winnipeg Free Press</a> <br><a href="http://www.cbc.ca/consumer/story/2008/06/05/canola-information.html">CBC News</a> <br><a href="http://www.upi.com/Top_News/2008/06/05/Personal_data_on_32000_farmers_missing/UPI-66311212671633/">United Press International</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Lindsay Wiebe, Winnipeg Free Press<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>About 32,000 Canadian farmers are on the alert after learning a laptop containing their financial information has been stolen.<br><br>The laptop was stolen when a programmer working for the Canadian Canola Growers Association took the machine off-site for routine maintenance.<br><span style="font-style: italic;">[Evan] No offense to programmers, but in my experience the ways they use information can be some of the most dangerous threats to information security.&nbsp; There is no reason for a programmer to EVER have access to confidential production information.&nbsp; Programmers should only be permitted to work with scrubbed information in a test and/or development environment.</span><br><br>CCGA general manager Rick White described the theft as a classic "smash and grab."<br><span style="font-style: italic;">[Evan] Also classic as in another organization that either does not know how or is unwilling to properly secure confidential information.</span><br><br>The laptop has the bank account numbers and social insurance numbers of farmers who applied for Agriculture Canada's advance payments program, which is administered by the CCGA on behalf of the federal government.<br><br>Although the theft happened March 30, Canadians weren't sent letters until last week informing them<br><br>The federal department has sent letters out to all farmers affected by the theft.<br><br>The letter said the laptop was stolen from an undisclosed, remote location in Manitoba.<br><br>"We treat this very seriously," White said. "This is an unfortunate incident, a very low-risk one."<br><span style="font-style: italic;">[Evan] Mr. White is probably not well versed in risk analysis.&nbsp; Or incident response for that matter.</span><br><br>the strict security measures being used on the laptop reduce the chances of information being misused, White said.<br><span style="font-style: italic;">[Evan] Like what?</span><br><br>"There was a very strong password protection on it, [and] there was a biometric fingerprint reader on it," he said. "That would prohibit anyone other than the user or the person with the password to access the data on the laptop."<br><span style="font-style: italic;">[Evan] These are "strict security measures"?&nbsp; My emphatic answer is NO!&nbsp; These "strict security measures" are easily bypassed.</span><br><br>but the data was not encrypted<br><span style="font-style: italic;">[Evan] The missing piece of the puzzle.&nbsp; Why go through all of the (self-proclaimed) "strict security measures" and not employ encryption.&nbsp; What you get with full-disk encryption is pre-boot authentication and this defeats the boot to CD attack.</span><br><br>Agriculture Canada spokesman Sean Malone said there were security features on the laptop, but a sophisticated hacker could likely bypass them.<br><span style="font-style: italic;">[Evan] No sophistication required.&nbsp; A novice could figure it out with Google, a CD, and 15 minutes.</span><br><br>So far, there have been no reports of identity theft among the farmers, the report said.<br><br>Pitblado LLP privacy lawyer Brian Bowman said the CCGA and agriculture department deserve credit for notifying people of the breach -- a move not required by Manitoba law.<br><span style="font-style: italic;">[Evan] Just because CCGA is not required by law, doesn't mean that they deserve any credit for notification.&nbsp; The information belongs to the victims not CCGA, and as owners of the information don't you think they should be informed of an incident that has the potential affect them personally?</span><br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"If they're devilish enough to steal a computer, maybe they're devilish enough to do something with the information," <br><br>"What frustrates me is that they've treated this like it's no skin off their back,"<br><br>"They've known this since then and they're only getting the letters out now?"<br><br>"I don't want to find out a mortgage has been taken out on our farm."<br><br><span style="font-weight: bold;">Commentary:</span><br>It is bad enough for an organization to lose confidential information on a poorly protected laptop, but what makes this more troubling is the apparent fact that they still view the practice that led to the breach as a low risk.&nbsp; Clueless and sad. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Government of Canada:<br>December, 2007 - <a href="http://breachblog.com/2007/12/05/passport.aspx">Passport Canada web site suffers serious breach</a> <br>November, 2007 - <a href="http://breachblog.com/2007/11/26/servicecanada.aspx">Service Canada stolen laptop affects more than 1,600</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/08/ccga.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 08 Jun 2008 15:32:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop affects">laptop affects</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/strict security measures">strict security measures</category>
      <category domain="http://securityratty.com/tag/ccga">ccga</category>
      <category domain="http://securityratty.com/tag/laptop computer">laptop computer</category>
      <source url="http://breachblog.com/2008/06/08/ccga.aspx">Canadian farmer personal information on stolen CCGA laptop</source>
    </item>
    <item>
      <title><![CDATA[AT&T management information on stolen laptop]]></title>
      <link>http://securityratty.com/article/2a7e7d1645c0c310fb2a37602fad248d</link>
      <guid>http://securityratty.com/article/2a7e7d1645c0c310fb2a37602fad248d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/4/08

Organization
AT&amp;T

Contractor/Consultant/Branch
None

Victims
AT&amp;T management personnel

Number Affected
Unknown

Types of Data
Compensation...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/att.jpg" align="right" height="67" width="128"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/4/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.att.com/gen/landing-pages?pid=3309">AT&amp;T</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>AT&amp;T management personnel<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Compensation information, including employee names, Social Security numbers, and salary and bonus information.<br><br><span style="font-weight: bold;">Breach Description:</span><br>"An undisclosed number of management-level workers at AT&amp;T have been notified that their personal information was stored unencrypted on a stolen laptop."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pogowasright.org/article.php?story=20080603133358351">PogoWasRight</a> <br><a href="http://www.scmagazineus.com/ATT-management-staff-data-on-stolen-laptop/article/110884/">SC Magazine</a> <br><a href="http://www.networkworld.com/community/node/28453">NetworkWorld</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>PogoWasRight<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>An undisclosed number of management-level workers at AT&amp;T have been notified that their personal information was stored unencrypted on a stolen laptop.<br><span style="font-style: italic;">[Evan] Don't you think that a well known (and respected) company like AT&amp;T would have had the forethought to encrypt laptops?</span><br><br>Employees were first alerted to the theft on the evening of May 22nd by email from Bill Blase, Senior Executive Vice President - Human Resources.<br><br>This is to alert you to the recent theft of an AT&amp;T employee's laptop computer that contained AT&amp;T management compensation information<br><br>The laptop was stolen May 15 from the car of an employee<br><br>The data on the computer was not encrypted -- a violation of company policy -- and included names, Social Security numbers and in some cases, salary and bonus information.<br><br>No customer or client data were on the stolen laptop.<br><br>the company would not disclose the number of affected individuals, but there is no reason to believe any of the data was being targeted when the machine was stolen.<br><br>AT&amp;T repeatedly declined to disclose the number of employees affected "as a matter of policy."<br><br>"Usually these are property crimes in which the drive is wiped clean and resold for profit,"<br><span style="font-style: italic;">[Evan] This used to be the case, but do you think the same still holds true today?&nbsp; If a thief is going to go through the trouble of wiping the drive, it seems plausible that he/she may also attempt to access/review the information contained on it.&nbsp; Hardware value = ~$1000, Information value = ~$10, $20, $50+ per record.&nbsp; Do the math and it soon becomes apparent that a thief can profit much more by selling the information.&nbsp; I presume that some thieves know this.</span><br><br>The employee who was in possession of the laptop when it was stolen has been disciplined.<br><span style="font-style: italic;">[Evan] Was it the employee's responsibility to encrypt the information, or was it his/her responsibility to not store confidential information on it?&nbsp; If the employee was aware of his/her responsibilities, then I can understand the disciplinary action.&nbsp; If not, then AT&amp;T has much bigger problems.</span><br><br>"There are a number of rules governing the handling of encrypted material and the mobile devices handling that material that employees must follow," Sharp said. "It is up to the employee to ensure that any sensitive material is encrypted."<br><span style="font-style: italic;">[Evan] Really?&nbsp; It is "up to the employee" to ensure that sensitive material is encrypted?&nbsp; Most of the users I work with wouldn't know the first thing about how to encrypt information.&nbsp; This is why we usually implement policies, standards and procedures to encrypt the entire contents of hard drives as part of the standard laptop build.&nbsp; Encryption is then semi-transparent and we don't need to worry about an incident such as this.&nbsp; Take information security out of the hands of employees if feasible.</span><br><br>AT&amp;T used the breach as a reminder that employees must follow policies.<br><span style="font-style: italic;">[Evan] Hopefully this isn't the only time employees are reminded to follow policies.</span><br><br>We deeply regret this incident. <br><br>You will soon hear about additional steps we're taking to reinforce our policies to safeguard sensitive personal information and ensure strict compliance in order to avoid incidents like this in the future.<br><br>The telecom also says that it is "in the process of encrypting devices," but that may be small comfort to those whose data were on the stolen laptop.<br><span style="font-style: italic;">[Evan] Sheesh, hundreds if not thousands of breaches involving lost and/or stolen laptops affecting millions of people and now AT&amp;T is "in the process of encrypting devices"?&nbsp; To AT&amp;T's credit, they do employ thousands of mobile devices which take time to encrypt and it's better late than never.&nbsp; Explain this to the people affected.</span><br><br>AT&amp;T is offering free credit monitoring to those affected<br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"I'm very disappointed in my company,"<br><br>"Eight days passed before we were notified ... and it took up to another 10 days to be informed about requesting a fraud alert and to be given instructions for signing up for credit watch."<br><br>"It is pathetic that the largest telecom company in the world -- with more than 100 million customers -- doesn't encrypt basic personal information,"<br><br>"I receive company internal e-mails reminding me to contact our legislators about relieving the company of the burdens of regulation," he says. "What happened here shows the company isn't ready to have those burdens lifted."<br><br><span style="font-weight: bold;">Commentary:</span><br>Excellent work at <a href="http://www.pogowasright.org">PogoWasRight.org</a>.&nbsp; Their report contains copies of the actual AT&amp;T correspondence.&nbsp; Obviously, AT&amp;T should have known better.<br><br>The Breach Blog was notified via a comment from the wife of an affected employee on May 28th, but we did not have enough information to report.&nbsp; The comment was not approved by me either because the commenter used her real name (out of protection for her and her husband).<br><br><img src="http://images.quickblogcast.com/95781-88451/attcomment.jpg" border="0" width="700"><br><br><span style="font-weight: bold;">Past Breaches:</span><br>August, 2007 - <a href="http://breachblog.com/2007/08/31/att-stolen-laptop-unknown-number-of-former-employees-affected.aspx">AT&amp;T Stolen Laptop, Unknown Number of Former Employees Affected</a> <br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/08/att.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 08 Jun 2008 14:28:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/att employee">att employee</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/att">att</category>
      <category domain="http://securityratty.com/tag/store confidential information">store confidential information</category>
      <category domain="http://securityratty.com/tag/actual att correspondence">actual att correspondence</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <source url="http://breachblog.com/2008/06/08/att.aspx">AT&amp;T management information on stolen laptop</source>
    </item>
  </channel>
</rss>
