"Knowledge is the currency of the future," says Sidney Pearl, Global Director of Enterprise Security Solution management for the Unisys Global Financial Services business. And according to the latest Unisys Security Index, Americans are getting much smarter - and more demanding - about the basic information security they expect from government and businesses. In an exclusive interview, Pearl discusses: Results of the latest Unisys Security Index; The security topics that mean the most to U.S. consumers; What these findings mean for government agencies and banking institutions. Pearl's Enterprise Security Solutions Management Group has worldwide responsibility for defining and managing the company's Fraud, Risk Management and Enterprise Security services offerings for the financial industry. Unisys provides Security Business Operations services and solutions to financial services clients in over 40 countries.

A South Korean court acquitted a blogger on Monday of spreading false information, in a case that triggered debate about freedom of speech in cyberspace and critics said was only launched because his economic doom postings angered authorities. Defendant Park Dae-sung, who went by the pseudonym "Minerva" after the Greek goddess of wisdom became a household name last year for his predictions of sharp falls in the won and the local stock market and the collapse of U.S. investment bank Lehman Brothers. "He's been found not guilty," a court official said by telephone. The court threw out charges that he purposely harmed market sentiment by posting false information on his blog. Prosecutors said a posting Park made in December led to volatility in the local currency and caused financial authorities to inject billions of dollars to stabilize the Korean won. "Even if there was recognition that it was false information, he cannot be seen as having acted on purpose to harm public interest considering the situation at the time including the special nature of the foreign exchange market," the court said. As the markets tumbled last year, the main financial regulator warned it would crack down on what it considered malicious rumors. Some economic analysts said they had come under pressure from authorities not to voice negative views on the economy.

More consumers are growing comfortable with online behavioral targeting, perhaps as a result of an increase in familiarity, but the majority remain uneasy with the practice. That's according to a new study conducted by TNS on behalf of the privacy group Truste. For the study, consumers were asked whether they agreed or disagreed with the statement: "I am comfortable with advertisers using my browsing history to serve me relevant ads, as long as that information cannot be tied to my name or any other personal information." Twenty-eight percent of respondents agreed, up from 24% who agreed when the same study was conducted last year. At the same time, 51% said they disagreed that they were comfortable with anonymous behavioral targeting. While that figure represents a slim majority, it's down from last year, when 57% of respondents said they disagreed. At the same time, more respondents than in the past now say they delete cookies. Almost half--48% of survey respondents--said they erase cookies at least weekly, up from 42% last year. It's not clear how much overlap there is between the respondents that regularly delete cookies and those who say they're uncomfortable with behavioral targeting. Colin O'Malley, vice president of strategic business at Truste, attributed the increase in the proportion of consumers who said they were comfortable with behavioral targeting to increased publicity over the issue. He said the recent attention to the issue in the mainstream media has helped to increase transparency. He added that the increased cookie erasures showed that consumers want to be able to manage their experience. "Cookie deletion is just one more indication that consumers are seeking tools to increase their level of control," he said.

A court has handed Blockbuster a preliminary defeat in a potential class-action lawsuit filed as a result of its participation in Facebook's ill-fated Beacon ad program, which notified members about their friends' e-commerce activity. U.S. District Court Judge Barbara Lynn in Dallas ruled that the case could proceed in court even though Blockbuster's contract with users calls for any disputes to be heard by an arbitrator rather than in court, and also says that users waive their right to file a class action lawsuit. Lynn determined that Blockbuster's contract with users was "illusory" because the agreement said that movie rental store could change the terms and conditions at any time. A Blockbuster spokesperson declined to comment on the case or state whether the company will appeal. The decision is a blow to Blockbuster because individual consumers would have had a difficult time bringing cases one-by-one against the company. But the decision paves the way for attorneys to argue that all consumers affected by Blockbuster's participation in Beacon should be able to proceed as a class. Internet law expert Venkat Balasubramani said Lynn's decision invalidating Blockbuster's user agreement was potentially far-reaching because many Web companies reserve the right to make changes to their terms of service. "It seems broad and could have impact on the terms of service used by a lot of different companies," he said.

The US Department of Justice has asked for yet another extension to the judicial oversight of Microsoft's antitrust compliance in order to give the company more time to update its technical documentation. The original judgment had already been extended once to late 2009, but now the DOJ wants it extended again for another 18 months. The sanctions on Microsoft, which were agreed to in 2002 and originally set to expire in November 2007, are aimed at preventing the company from retaliating against hardware vendors that ship computers with alternatives to Microsoft's software products. An additional set of sanctions mandating interoperability API licensing had already been extended for another two years. When it came time for the decree to be lifted, however, Judge Colleen Kollar-Kotelly decided that Microsoft failed to provide protocol specification documents to competitors as required by the agreement. Because of this, she extended the oversight until November of 2009. In a document filed with Judge Colleen Kollar-Kotelly on Thursday, the DOJ requested another extension to her oversight of Microsoft's antitrust settlement, apparently because it feels Microsoft still has a ways to go before meeting the requirements. At the same time, a joint status report from Microsoft and the plaintiffs states that all parties seem to think that things are almost ready. "It is clear to Plaintiffs that Microsoft has made substantial progress in improving the technical documentation over the last two years," reads the report. "While the entire project has taken longer than any of the parties anticipated, the project is nearly complete." The request marks a reversal of the DOJ's previous position that it took in 2007 when it decided not to ask for an extension of the settlement while the attorneys general of ten states (the so-called California and New York Groups) pushed for extensions. At that time, the DOJ stated that it didn't believe that the standard for such an extension had b

The FBI has used a secret form of spyware in a series of investigations designed to nab extortionists, database-deleting hackers, child molesters, and hitmen, according to documents obtained by CNET News. One suspect used Microsoft's Hotmail to send bomb and anthrax threats to an undercover government investigator; another demanded a payment of $10,000 a month to stop cutting cables; a third was an alleged European hitman who was soliciting for business from a Hushmail.com account. CNET News obtained the documents -- totaling hundreds of pages, although nearly all of them were heavily redacted -- this week through a Freedom of Information Act request to the FBI. The FBI spyware, called CIPAV, came to light in July 2007 through court documents that showed how the bureau used it to nab a teenager who was e-mailing bomb threats to a high school near Olympia, Wash. (CIPAV stands for Computer and Internet Protocol Address Verifier.) A June 2007 memo says that the FBI's Deployment Operations Personnel were instructed to "deploy a CIPAV to geophysically locate the subject issuing bomb threats to the Timberline High School, Lacy, Washington. The CIPAV will be deployed via a Uniform Resource Locator (URL) address posted to the subject's private chat room on MySpace.com."

Last week, the government took another step toward closing a legal loophole in federal privacy and security rules for emerging Health 2.0 information technology applications by issuing proposed rules aimed at covering an estimated 900 companies and organizations offering personal health records and electronic systems connected to them. The Federal Trade Commission was careful to point out its new interim proposed rule on federal breach notification requirements for the developers of electronic PHR systems did not apply to covered organizations or their business associates as defined by the Health Insurance Portability and Accountability Act of 1996, heretofore the key federal privacy and security regulation. The FTC, operating under new authority given it by the American Recovery and Reinvestment Act of 2009, noted that its new rule seeks to cover previously unregulated entities that are part of a Health 2.0 product mix. FTC staff estimates that about 200 PHR vendors, another 500 related entities and 200 third-party service providers will be subject to the new breach notification rule. The staffers estimate that the 900 affected companies and organizations, on average, will experience 11 breaches each per year at a total cost of about $1 million per group, per year. Costs include investigating the breach, notifying consumers and establishing toll-free numbers for explaining the breaches and providing additional information to consumers. Pam Dixon, founder and executive director of the World Privacy Forum, said that this isn't the first involvement of the FTC in healthcare-related regulation, noting the consumer protection agency joined with the Food and Drug Administration in a joint statement on the marketing of direct-to-consumer genetic tests. The FTC also has worked in the field of healthcare competition. She noted the compliance deadline with the FTC's "red flag rules" on provider organizations that provide consumer credit to patients for installment payment

There is no simple technology solution to protect children from bullying, pornography, sexual predation and other online threats, a new study says. The highly anticipated report -- results of a year-long study ordered by 49 state attorneys general -- found that "a combination of technologies, in concert with parental oversight, education, social services, law enforcement, and sound policies by social-network sites and service providers, may assist in addressing specific problems that minors face online," according to a draft of the report reviewed by The Wall Street Journal. The report also found that the risks that minors face on the Web -- notably bullying and harassment by peers -- aren't very different from those they face in the real world. The report is scheduled to be issued Wednesday by the Internet Safety Technical Task Force, led by Harvard University's Berkman Center for Internet and Society. Task-force members included representatives of several top Internet and security companies, including News Corp.'s MySpace, Google Inc., Time Warner Inc.'s AOL and Facebook Inc. (News Corp. also publishes the Journal.) The 278-page report is a boon for the Web companies, which have long argued that technology isn't the sole solution to the dangers kids face online. It is a disappointment for those in favor of stricter technological controls, such as age-verification and filtering tools.

For years, Attorneys General Roy Cooper of North Carolina and Richard Blumenthal of Connecticut have been leading a coalition of 49 states that were pushing MySpace to add technology to verify the age of its members. The attorneys general argue that age verification will help keep younger children off the site, and therefore prevent them from being contacted by sexual predators and other unsavory characters. Tomorrow, however, leading researchers in online child safety are expected to submit a report to the attorneys general stating that age verification technology is flawed and will not protect children from online dangers. Excerpts of separate interviews with Attorney Generals Roy Cooper of North Carolina and Richard Blumenthal of Connecticut, who led the charge for social networking safety standards.

Presentation from Peter Swire - Symposium on Enforcement, Compliance, and Remedies in the Information Society, Fordham Law School, New York, May, 2008.

Burger King, through their insanely creative advertising agency Crispin Porter + Bogusky (see their recent Burger King perfume launch), launches a Facebook application that encourages users to remove Facebook friends. Sacrifice ten of them and you got a free Whopper. 233,906 friends were removed by 82,771 people in less than a week. Facebook is overjoyed, right? What a great example to show the Madison Avenue agencies on how a big brand can get real engagement from users. This is the future of advertising. Or it could have been, if Facebook hadn't shut it down, citing privacy issues: We encourage creativity from developers and brands using Facebook Platform, but we also must ensure that applications follow users' expectations of privacy. This application facilitated activity that ran counter to user privacy by notifying people when a user removes a friend. We have reached out to the developer with suggested solutions. In the meantime, we are taking the necessary steps to assure the trust users have established on Facebook is maintained. Did anyone talk to the sales department before pulling the trigger on this? All that happened is the user being dissed got a message telling them, which helps the application spread virally. Without that feature the app is far less powerful. There is no real privacy issue here, just a policy decision by Facebook that people shouldn't be notified when you remove them as a friend. Facebook consistently tell users they can't do things in the name of privacy, despite the fact that those users know full well what they are up to. Unless investor and partner Microsoft makes them do it, of course.

A Troy woman learned Tuesday that she will spend 180 days in the Livingston County Jail for stealing the identity of a local woman who was dying. Judge Stanley J. Latreille also sentenced Vershawn Jones, who earlier pleaded guilty to identity theft, to four years of probation. Assistant Prosecutor Pamela Maas said the victim, who was not in court Tuesday, wanted to know how Jones, 38, got his wife's identification. His wife, Maas noted, was dying in a Hospice facility at the time. Jones, who said she operated a mortgage business, said she got it from one of four employees who brought her applications from people seeking mortgages. Those applications included personal information, such as Social Security numbers, she said. When pressed for names, Jones glanced at her attorney and shrugged. "I apologize to the victim and the victim's family," she said. "I've done the best I can running my own business." Maas initially requested that the state be allowed to withdraw from the plea deal that called for her office to recommend Jones serve no more than 90 days in the county jail after noting Jones had twice been sent to jail for failing to show for court hearings. While Jones apologized, Latreille was unmoved, telling the defendant "you're fortunate you're not going to prison."

Urging Privacy Protections with Health IT Privacy safeguards are needed if funds are to be provided for implementation of health IT systems in economic stimulus package. At today's news conference, the Coalition for Patient Privacy is releasing a letter sent to Congress advocating for the inclusion of privacy safeguards with any funding given to implement health IT systems in the proposed economic stimulus package. In the letter, the bipartisan coalition, representing over 30 organizations, individual experts and the Microsoft Corporation, welcomes the renewed commitment in Congress to protecting consumers over special interests, but makes clear that trust is essential to health IT adoption and participation, and only attainable with privacy protections. The coalition is calling on Congress to "A.C.T.", by providing: accountability for access to health records, control of personal information, and transparency to protect medical consumers from abuse. Consumer trust is essential to health IT adoption and participation, and only attainable with privacy safeguards. Through these three tenets, implementation of health IT is not only attainable, but would protect the right to privacy for consumers, employees, and providers.

Burger King's wildly popular Facebook application "Whopper Sacrifice," which rewards you with a free Whopper when you drop 10 friends, has been shut down. Social networking just got healthier. Last week, Burger King announced it was teaming up with social networking powerhouse Facebook for a special promotion: If you removed 10 people from your network of friends, the fast-food company would reward you with a coupon for a free Whopper. The story became an Internet sensation, but it's only now getting meatier. As it turns out, a notification feature on the "Whopper Sacrifice" application that lets your friends know they have been replaced by a shot at a free hamburger violates Facebook's privacy policy. "We encourage creativity from developers and companies using Facebook platform, but we also must ensure that applications follow users' expectations and privacy," the company said in a statement. "After extensive discussions with the developer, we've made some changes to the application's behavior to assure that users' expectations of privacy are maintained. The application remains active on Facebook."

As if banks didn't have enough on their plates with compliance and regulation on the federal front, come May 1, they will have to be mindful of strict new rules coming from the Commonwealth of Massachusetts around data security. The Massachusetts Data Security Regulations are perhaps like no other in terms of their depth and scope. During a teleconference, attorneys from the privacy and data security practice of the law firm Goodwin Procter (Boston) described this very detailed, all-encompassing set of rules designed to keep consumers' personal data safe. They go beyond the rules of other states and the federal government that simply require companies to notify their customers of theft of their personal information. "Personal information," for the purposes of the regulation, is described as someone's first and last name or first initial and last name, in combination with Social Security Number, driver's license number or financial account number. At its core, the regulation states that companies, including banks, that handle the personal data of a Massachusetts resident must show they have in place a comprehensive, written information security program with heightened security procedures around how this information is handled. The rules also extend to entities' service providers and the degree to which they too much show they comply with the Massachusetts rules of handling data on residents. Companies have until May 1 to amend their vendor contracts to reflect this and until Jan. 1, 2010 to certify their vendors comply. Furthermore, companies must comply with these rules even if they do not have a single office in the Bay State or if they are in an already heavily regulated industry, like financial services. As long as customers in businesses' databases reside in Massachusetts, those companies are affected by the rules. According to partner Deborah Birnbach, this is some of the most intrusive legislation as it relates to the operation of businesses. "It requires

Privacy and civil liberties advocates are urging lawmakers working on the forthcoming economic stimulus package to ensure that any language to spur adoption of electronic medical records includes meaningful security safeguards. The American Civil Liberties Union, Consumer Action, the National Association of Social Workers, Patient Privacy Rights and others sent letters to House Speaker Nancy Pelosi, Senate Majority Leader Harry Reid and President-elect Barack Obama Wednesday asking them to ensure individuals can control the use of their medical records and protect them from what they believe is a thriving industry of firms that share and sell medical data. "We all want to innovate and improve health care, but without privacy our system will crash as any system with a persistent and chronic virus will," Patient Privacy Rights executive director Ashley Katz said at a Capitol Hill briefing. Katz said her group has been pleased with progress that the House Energy and Commerce, and Ways and Means committees made last year.

The National Institute of Standards and Technology (NIST) this month released preliminary recommendations that federal agencies -- and their contractors -- should follow to protect the confidentially of personally identifiable information (PII). U.S. government agencies should take a number of precautions when dealing with personal information residing in their organizations, according to the NIST document. The recommendations are intended to be for U.S. federal government agencies, and companies with which they work, but NIST said that other verticals may also find value in it. The report states that organizations should store only PII necessary to conduct business, develop an incident response plan for the event of a breach and encourage coordination for data-loss incidents among CIOs, information security officers and legal counsel.

Identity theft concerns are focused on the security and necessity of the collection process. Collecting personal information just because you can is unsafe. Organizations can reduce privacy risks by not collecting unnecessary personal info. Once the data gets into the data life cycle pipeline, the cost of managing and destroying it escalates. The Federal Trade Commission estimates that as many as 9 million people have their identities stolen every year. According to the Privacy Rights Clearinghouse, more than 200 million instances of data breaches have occurred since the beginning of 2005, and they show no signs of letting up. In the first quarter of 2008 alone, more than 85 million incidents were reported. The causes of data breaches run the gamut: Hackers get unencrypted, transmitted data and data at rest; laptops are stolen or lost; storage Relevant Products/Services devices are lost by third-party shipping companies; flash drives or PDAs are left lying around; Social Security numbers are accidentally printed on envelopes; or data is found on discarded computers. This article examines the organizational risks to CPAs and their clients or corporate employers of improperly managed data throughout the data life cycle. It also discusses best data management practices and proper procedures for responding to a data breach. Data breaches, whatever the cause, are costly. According to a study by the Ponemon Institute, the average cost of a data breach in 2007 was $6.3 million. The average cost to an organization per record compromised is about $197, which is typically spent on phone calls for customer notification, providing free credit monitoring, discounts on membership fees, or discounts on merchandise to make up for the security Relevant Products/Services breach. Some organizations also experience an increase in customer turnover. The organization typically spends additional money in data protection Relevant Products/Services enhancements. Companies sanctioned by

The offshoring of business processes has become increasingly popular. Fueled by advancements in technology, the benefits of offshoring are primarily attributable to the savings from lower personnel costs at foreign locations. According to the Global Financial Services Offshoring Report 2007 by Deloitte & Touche U.SA LLP, over 75% of major financial institutions report offshoring a portion of their operations. Some economists estimate that up to one-third of total U.S. employment in services may ultimately be offshored (Steve Lohr, "At IBM, a Smarter Way to Outsource," The New York Times, July 5, 2007). Offshore entities often operate in developing countries such as India, China, Pakistan, the Philippines, and Vietnam. The offshoring of business processes generally takes two forms: outsourcing to an unaffiliated offshore entity (offshore outsourcing), or ownership and operation of an affiliated offshore entity (AOE). Many multinational companies have AOEs. For example, Accenture has more employees in India than in the United States; IBM is projected to have more than one-quarter of its workforce in India by 2010; and companies like General Electric, Eli Lilly, Google, and Microsoft are expanding their R&D centers in India and China (House Committee on Science and Technology, June 12, 2002). Offshoring and the Auditing Profession The potential benefits of offshoring have not been ignored by the accounting profession. In past years, several large public accounting firms began using AOEs to perform certain nonaudit procedures for their U.S.-based clients. For example, Ernst & Young uses AOE employees to prepare client tax returns (Vanessa Houlder, "E &Y Sends Compliance Work Offshore," Financial Times, July 11, 2007), and a number of accounting firms use AOEs to print documents for delivery to clients. The largest international public accounting firms have recendy begun testing the offshoring of certain auditing procedures on very large U.S. audit engagements to thei

I. INTRODUCTION The globalization revolution is undeniably well underway. Some of the primary leaders of the revolution are the off-shoring outsourcers of the world in search of readily available talent at prices below what is available in the traditional geographical outsourcing centers. Certainly, U.S. companies seeking information technology resources--as well as those looking for human resources to support the ever-growing customer care requirements of their business--are at the forefront of the movement. Some of those companies are seeking their own solutions, but many have turned to business process outsourcing companies for assistance. Business process outsourcing is, generally speaking, the contracting of a specific business task to a third party service provider. Processes that are best suited to be outsourced are those that a company requires but does not depend upon to maintain its position in the marketplace. There are two primary categories of business process outsourcing. One category is commonly referred to as "back office outsourcing" which includes internal business functions such as billing or purchasing. The other category is commonly referred to as "front office outsourcing" which includes customer-related services such as marketing, customer contact management, and technical support. The globalization of business in general has resulted in the need for companies to be able to provide support to their customers in many different languages. At the same time, developments in technology have provided the ability for business process outsourcers to provide a cost effective global delivery platform. The convergence of the need for a portfolio of services to be sourced globally with the ability of business process outsourcers to do so on a cost effective basis has driven the outsourcers to geographic locations previously ignored by most business sectors. By many estimates, there are currently off-shore outsourcing vendors in more than 175 different