There's a great deal of classified information in federal government databases that never should become public. Some of this information, involving the military or the intelligence world, must be made available to contractors by necessity, and that data should be closely guarded and kept confidential. But an alarming new article that we report on this week illustrates this is not always the case, and that information can inadvertently seep out from a classified venue and make it into the public's hands. It turns out that secret information about a U.S. missile defense system was found on the hard drive of a computer discarded by a major contractor, and sold on eBay. The discarded computer, reported the Guardian newspaper in Great Britain, contained documents from defense contractor Lockheed Martin that included detailed test launch procedures, photos and personal data of employees. The hard drive was turned over to the FBI, but one has to wonder how this could have happened and why sufficient controls were not put in place. Apparently, this is not an isolated incident.

It's hardly a bed of roses these days for IT companies and their managers. There are plenty of things nagging at high-tech vendors, too, according to the annual RiskFactor Report for Technology Businesses published by the financial consultancy, BDO Seidman. The information was gleaned from fiscal year 2008 10-K SEC filings of the 100 largest publicly traded U.S. tech companies. Strong competition and consolidation risk factors top the list of IT managers' concerns. Failure to develop new products or services is also a big headache. Other items making the worry list: * International operations. * Management of current and future M&As. * And, for the first time: Natural disasters, war, conflicts and terrorist attacks. So how should a top manager deal with all this uncertainty? Play some tennis, go for a run, gobble a few Tums and then forge ahead with the best ideas you have.

GovLoop (http://govloop.com), an online community created for and by government employees, announced today it has signed up its 10,000th member less than a year after launching. Dubbed by some as a "Facebook for Feds," GovLoop brings together government employees from the U.S. and other nations to discuss ideas, share best practices and create a community dedicated to the betterment of government. A revolution is happening in government as the result of a new generation of government employees, the rise of Web 2.0 technologies, and the Obama administration's focus on transparency, participation, and collaboration. This revolution is often called "Government 2.0" and GovLoop is at the center of this movement. The social network was developed by Steve Ressler, a 28-year old federal employee from Tampa, Fla. who is also a co-founder of Young Government Leaders (http://youngovernmentleaders.org). Fed up with the silos that existed across government agencies, including artificial barriers between levels of government, rank and age, Ressler believed there had to be a better way to share information, so he launched GovLoop.com in June 2008.

As USB devices have evolved into useful storage media, they've also turned into a security nightmare for agencies. The usage of USB devices should be encouraged and embraced to improve productivity, but they also must be managed to minimize the risks inherent with these tools. This paper discusses how USB devices have evolved and looks in-depth at the productivity benefits as well as the potential risks these devices can introduce if not managed properly. This paper also offers recommendations on how to balance the productivity versus risk challenge and highlights how government agencies can effectively manage the usage of USB devices and prevent data loss and malware introduction.

The head of Calgary's Drop-In Centre says he is astounded by the controversy surrounding the shelter's use of a handprint-based security system, with the latest salvo coming from the province's privacy commissioner on Friday. "People . . . have no idea what we're going through here,"said the centre's executive director Dermot Baldwin, adding he now has three staff off work because of beatings. "We're going to (take) the measures necessary to make this place safe, secure, a good place to come . . . but in order to do that, I've got to keep the bad guys out." The comments came after Alberta's privacy commissioner said he's concerned about a new security system the Drop-In Centre is testing, which includes the scanning of clients' handprints to confirm their identification. Frank Work said Friday the home-less shelter's system of scanning and collecting handprints will likely lead to the creation of a database that will store that information.

Hackers, possibly from Asia, have stolen about a decade's worth of personal information on current and former UC-Berkeley students, the university announced Friday. The breaches involved records dating to 1999 at the school's health center that included Social Security numbers, health insurance information, immunization history and the names of treating physicians. No other treatment-related records were stolen, the university said, although self-reported medical histories of students who studied abroad were hacked. The school on Friday sent e-mails and letters to 160,000 people, including about 3,400 Mills College students who used or were eligible for University of California-Berkeley medical services. About 97,000 people are most at risk because their names and Social Security numbers could be connected by the hackers, said Steve Lustig, the university's associate vice chancellor for health and human services. "What's been taken is bits of data that the thief might put together into an identity," he said. The university traced the hackers back to Asia, possibly China, but the exact origin could not be pinpointed. UC and FBI investigators are probing the breaches, which apparently occurred over several months. An FBI spokesman said the agency was informed of the hacking immediately, but declined to provide more information. The thefts were discovered about a month ago, but system administrators did Advertisement not realize the breadth of the attack until April 21. The hackers disguised their work as routine operations and then left taunting messages for UC-Berkeley employees, said Shelton Waggener, the university's associate vice chancellor for information technology. The thieves accessed the information through the university Web site, he said. "You should think of it as a public building," Waggener said. "They got into the building properly, but then they broke into secure areas." Administrators at Mills College, which contracts with UC-Berkeley for

Concerned that Google knows too much about you? The company provides many ways to protect your privacy online -- you just need to find them. Here are six good ones. 1. Know your privacy rights: Use the Google Privacy Center. This site includes all of Google's privacy policies, as well as privacy best practices for each of its products and services. Although the "legalese" of privacy policies can be difficult to understand, Google's Privacy Channel offers a library of short YouTube videos with practical tips on protecting your data when using Google products and services. Try the "Google Search Privacy" and "Google Privacy Tips" series. 2. Protect your content on the services you use. Some content that Google stores for you, such as photos uploaded in Picasa Web Albums, are public by default. You can protect your privacy when you upload photos by choosing the appropriate checkbox. Choices include "unlisted" (accessible only if you have the Web link, and not indexed by Web search engines) or private (viewable only by named users who must sign in). Another example: You can take a Google Chat "off the record" if you don't want the instant messaging transcript stored. In contrast, Google Latitude, which tracks your whereabouts by way of GPS-enabled cell phones, does not share your location data by default. You must authorize others to see it. Latitude stores your last known location, but not your history. 3. Turn off the suggestion feature in the Chrome browser. By default, Chrome retains a history of Web sites you've visited -- and the full text of those pages -- so it can try to guess which Web address you want as you type in the "Omnibox." You can turn the feature off by going to "Under the Hood" under Options and unchecking the "Use a suggestion service" box. You can also select other privacy options, including surfing in Chrome's "incognito" mode. 4. Turn off Web History. You may have turned on the Web History option, also called Personalized Search, when yo

When the director of IT at a Boston-based, midsize pharmaceutical firm was first approached to participate in a data leakage audit, he was thrilled. He figured the audit would uncover a few weak spots in the company's data leak defenses and he would then be able to leverage the audit results into funding for additional security resources. "Data leakage is an area that doesn't get a lot of focus until something bad happens. Your biggest hope is that when you raise concerns about data vulnerability, someone will see the value in allowing you to move forward to protect it," the IT director says. But he got way more than he bargained for. The 15-day audit identified 11,000 potential leaks, and revealed gaping holes in the IT team's security practices. (Read a related story on the most common violations encountered.) The audit, conducted by Networks Unlimited in Hudson, Mass., examined outbound e-mail, FTP and Web communications. The targets were leaks of general financial information, corporate plans and strategies, employee and other personal identifiable information, intellectual property and proprietary processes. Networks Unlimited placed one tap between the corporate LAN and the firewall and a second tap between the external e-mail gateway and the firewall. Networks Unlimited used WebSense software on two servers to monitor unencrypted traffic. Then it analyzed the traffic with respect to company policy. Specifically, Networks Unlimited looked for violations of the pharmaceutical firm's internal confidentiality policy, corporate information security policy, Massachusetts Privacy Laws (which go into effect in 2010), Health Insurance Portability and Accountability Act (HIPAA), and Security and Exchange Commission and Sarbanes-Oxley regulations. Auditor Jason Spinosa, senior engineer at Networks Unlimited, says that while he selected the criteria for this audit, he usually recommends that companies take time to determine their policy settings based on their risk

Consumer Watchdog has sent the U.S. Justice Department a Google document presenting the best corporate arguments for why Google should not be viewed as monopolistic, along with a duplicate of the presentation marked up with comments from an expert countering the claims. The nonprofit consumer group received both documents from an anonymous industry insider. In the presentation, Google seeks to deflate increasing criticism that it is too big and powerful by spin meant to minimize the notion its search and advertising businesses are virtual monopolies. Commentary surrounding the presentation in the second document delivered to Consumer Watchdog presents information countering Google's contentions in what is described as a "Charm Offensive." "As the Justice Department examines the Google book deal and other Google enterprises it deserves to see the play book Google has prepared to deflect scrutiny and insider commentary on how many Google myths lack a basis in reality," said Consumer Watchdog President Jamie Court. "Google's charm and spin should not be allowed to deter anti-trust regulators from seeing the real problems with Google's dominance and setting appropriate limits to protect users."

For months somebody (I don't know who) has been running a Facebook profile that bears my name, my personal information and several photos of me. An old high school friend had connected with the faker, instead of me. Several of the people with whom fake Matt is friends also appeared to be fakes, including a copycat of Vertex Pharmaceuticals ( VRTX - news - people ) founder and chief executive Joshua Boger. (Boger has a real Facebook profile but isn't friends with me. He declined to comment on the fakesters.) I couldn't see this Fake Matt's profile myself, even by searching for my name.

Twitter posts may seem different from e-mail, but legally they aren't, so more companies are including them in their e-discovery policies, reports InformationWeek's Bob Evans. The subject is more than a little confusing, Evans finds, but one thing is clear: If you do have a policy on Twitter posts, it had better be enforced.

Are you an advertiser looking to target mothers online with children under 12 who are concerned about obesity to promote a healthy snack food? Or people that don't support drilling in the Arctic National Wildlife Refuge but support offshore drilling generally? If so, Resonate Networks -- a new ad network geared to nonprofit, political and corporate advertisers -- promises to serve up just the right audience based on highly targeted, if anonymous, profile data focused on political views and attitudes. "It's really drilling down to people's beliefs and where they stand on issues," said Bryan Gernert, CEO of Alexandria, Va.-based Resonate, a non-partisan company launched by former Republican and Democratic political strategists including Harold Ickes, Bill Clinton's former deputy chief of staff and one of Resonate's investors. Unlike traditional ad networks that target advertising based on a site content or audience demographics, Resonate combines survey information, online and offline databases and proprietary algorithms to match Web users' political leanings and levels of activism with sites they tend to visit most often. "You can identify Web sites that have a preponderance of people who support certain issues," that go beyond obvious issue-oriented or political sites, said Gernert. He added that Resonate is already working with 500 of about 2,500 sites that correlate strongly with particular issues or audiences with high levels of engagement or influence.

A TV investigation has revealed that secondhand BlackBerries on Nigerian markets are priced according to the data held on them, not the age or the model of a phone. Jon Godfrey, director of Sims LifeCycle Services, who is advising on a TV investigation into the trade due to screen later this year, said that BlackBerries sell for between $25 to $65 on Lagos markets. Details of the trade come from an agent in Nigeria unaffiliated to Sims' technology recycling business. Godfrey explained that the smart phones offered for sale come from the US, continental Europe and the UK. "It's unclear as yet whether the phones are either sold, thrown away, lost or stolen," Godfrey explained. Other type of smartphone are also of potential interest to data thieves, but it is the trade in BlackBerries that seems to be the most active. Data retrieved from smartphones is itraded by crooks in Nigeria. BlackBerries include technology to remotely wipe devices and come with built-in encryption. But this encryption is often left switched off because it is considered an inconvenience.

A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit. The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive. Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales. A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system's manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers. Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk. Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals. In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details. A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included. Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest. Yet anothe

The FBI and Virginia State Police are searching for hackers who demanded that the state pay them a $10 million ransom by Thursday for the return of millions of personal pharmaceutical records they say they stole from the state's prescription drug database. The hackers claim to have accessed 8 million patient records and 35 million prescriptions collected by the Prescription Monitoring Program. "This was an intentional criminal act against the commonwealth by somebody who was trying to harm others," Gov. Timothy M. Kaine (D) said. "There are breaches that happen by accident or glitches that you try to work out. It's difficult to foil every criminal that may want to do something against you." Although the hackers had threatened to sell the data if they did not receive payment by Thursday, the deadline passed with no immediate sign that they followed through. ad_icon State officials say it is unclear whether the hackers were able to view the patient records, as they have claimed. If the theft is real, it would be the most serious cybercrime the state has faced in recent history.

New rules will protect consumers, harmonize regulation, and enshrine net neutrality. But a late amendment left the legislation in limbo The European Parliament has voted through a massive tranche of reforms for the European telecommunications sector, including a significant net-neutrality amendment. The 'Telecoms Package' of laws was voted into force on Wednesday with a large majority, and must now be ratified by the Council of Telecoms Ministers. The vote marks the first time that internet access has been recognised in European law as a fundamental right on a par with freedom of expression. The legislation also compels European telecoms and internet service providers (ISPs) to notify their customers of any personal data breaches, the first time they have been required to do so.

A security breach at credit card processor and payroll services administrator Heartland Payment Systems Inc. has proven costly, driving the company to a first-quarter loss. The nation's sixth-largest payment processor reported a loss of $2.5 million, or 6 cents a share, compared with a profit of $9 million, or 23 cents a share, the year before. The results included expenses and accruals of $12.6 million, or 20 cents a share, resulting from a security breach in which criminals secretly installed spying software on its computer network.

There is pervasive fear of identity theft. Victims spend an extraordinary amount of time and money recovering from it. The government is doing something about it, but businesses may not be pleased to hear that the government's latest action is another unfunded mandate. New rules concerning identity theft prevention at financial companies go into effect on Friday May 1, 2009, but for most organizations, complying with the FTC's Red Flags Rule could be as simple as writing down rules and procedures already in place and having them certified by the Board. The rules are about procedures, not about data security, said Tiffany George, attorney for the division of privacy and identity protection at the FTC. She spoke on Tuesday at the FTC's workshop for businesses held on the campus of Fordham University in New York City. "The Red Flags Rule covers what to do when, despite our best efforts, thieves steal data," she said. As new regulations go, the FTC's Red Flags Rule will be less painful than many other recently enacted rules. For example, while Sarbanes-Oxley is considered a burden to many public companies, requiring several full-time staff, the Red Flags Rule can likely be handled by legal or compliance staff already in place.

A former IT analyst at the Federal Reserve Bank of New York and his brother were arrested Friday on charges that they took out loans using stolen information, including sensitive information belonging to federal employees at the bank. Prosecutors allege that Curtis Wiltshire, 34, took out student loans totalling US$73,000 using the stolen information. His brother, Kenneth Wiltshire, 40, is charged with using the identities of two federal employees to try and obtain a loan for a 2006 Sea Ray 340 Sundancer speedboat. The charges (pdf) come two months after federal investigators found two 2006 student loan applications on a thumb drive attached to the work computer of Curtis Wiltshire, who had worked at the Reserve Bank for nearly eight years as an information and technical analyst. According to court documents, that investigation was unrelated to the fraud charges. Wiltshire was dismissed soon after the drive was found on around Feb. 15, prosecutors said. The charges were filed in the federal court in Manhattan. The two men could not be reached for comment Friday and the names of their lawyers were not included in the court documents. Curtis Wiltshire had "access to computer files containing information about employees of the [federal bank], including their names, dates of birth, Social Security numbers, and photographs," U.S. Federal Bureau of Investigation Special Agent Cordel James said in an affidavit filed in the case. Curtis Wiltshire was charged with bank fraud and identity theft and faces more than 30 years in prison if convicted. His brother was charged with mail fraud and identity theft and faces a maximum of 22 years in prison.

We've all heard the argument before: "Why should you worry about the government looking into your personal records if you have nothing to hide?" Daniel J. Solove, an associate professor of law at The George Washington University Law School, analyzes that argument in a recently published paper titled "I've Got Nothing to Hide and Other Misunderstandings of Privacy." Solove argues that "the question assumes faulty assumptions about privacy and its value." Those who make the "nothing to hide" argument fail to understand the chilling effect that surveillance has on public discourse, the fact that small bits of private data (which an individual may not object to being uncovered) when put together form a larger and more intimate profile (which an individual may object to), and the mistake of having one's profile mistakenly associated with a group that is labeled as threatening. Here's an excerpt from the paper, which was published in the latest issue of the San Diego Law Review: [T]he problem with the "nothing to hide" argument is that it focuses on just one or two particular kinds of privacy problems - the disclosure of personal information or surveillance - and not others. It assumes a particular view about what privacy entails, and it sets the terms for debate in a manner that is often unproductive. It is important to distinguish here between two ways of justifying a program such as the NSA surveillance and data mining program. First is to not recognize a problem. This is how the "nothing to hide" argument works. It denies even the existence of a problem. The second manner of justifying such a program is to acknowledge the problems but contend that the benefits of the NSA program outweigh the privacy harms. The first justification influences the second, for the low value given to privacy is based upon a narrow view of the problem. The key misunderstanding is that the "nothing to hide" argument views privacy in a particular way - as a