Outgoing CPO of the Department of Homeland Security Hugo Teufel discusses his team's accomplishments and the challenges ahead for his successor. If you had a chance to pose any question to the person in charge of protecting Americans' privacy as the U.S. Department of Homeland Security executes its mission, what would you say? I had that chance this month when Hugo Teufel, departing chief privacy officer at the DHS, delivered an address, entitled "Reflections on My Time as DHS CPO of the War on Terror," to the Twin Cities Privacy Retreat. After the address, I cornered Teufel for some follow-up questions. Those and his answers follow.

Nearly one week after news emerged of the big data breach at Princeton, N.J.-based merchant acquirer Heartland Payment Systems Inc., it remains unclear how much damage actually happened and who did it. One report suggests Heartland's breach-related legal liabilities could approach $98 million, an estimate a Heartland spokesperson dismisses as speculative. The spokesperson tells Digital Transactions News on Monday that the so-called "sniffer" program secretly planted on one of Heartland's payment-processing platforms was not being used when investigators found it about two weeks ago. "It was inactive," the spokesperson says. "I want to be specific to say it was inactive," he adds, clarifying that the hackers hadn't deliberately disabled or deactivated it. Robert Carr, Heartland's chief executive, meanwhile, issued a statement calling for better industry cooperation and new operational procedures to prevent future data compromises, including industrywide, end-to-end encryption to fully protect cardholder data. Heartland uses encryption, but industry procedures leave data unencrypted during one brief point of the authorization process-a weakness that hackers have learned to exploit. Carr also said Heartland is working on its own system of end-to-end encryption.

We all like to think our privacy is absolute. But if your job involves working across borders, you'll want to talk about privacy as a matter of degree rather than as an uncompromising right. Why? Not only do you want to be seen as someone who can get things done globally, but you also may personally want to be part of advancing social objectives that are arguably as important as privacy. Have you ever had to re-architect your global rollout of PeopleSoft or Lawson because of European Union privacy concerns? Or adjust how your company offers technical support to medical products sold in Europe? Have you ever been part of acquiring a failing European company where the privacy of employee data was a final sticking point? If you've seen projects with obvious social benefit get held up by seemingly minor data-related questions, then you might have been running up against this notion of "nothing trumps privacy." It's a popular idea. The half-billion people of Europe do view privacy as a human right. And they're not the only ones. As one of the first acts of the UN, Eleanor Roosevelt and the U.S. delegation in 1948 lobbied for the global adoption of the Universal Declaration of Human Rights(UNDHR), whose Article 12 states, "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation." With Europe and the UN using absolute-sounding language to describe a right to privacy, it's no wonder we have all of these delayed and downsized corporate projects. People are legitimately concerned about our sometimes reckless march into the Information Age, and they want to put some brakes on it. But does privacy trump all foes? I can think of at least six other equally important social objectives that regularly put limits on privacy: 1. Personal health. We all want to stay healthy - even when we lose the ability to communicate and give consent. Emergency-room personnel need access t

Data breaches are running at record levels, according to the San Diego-based Identity Theft Resource Center, a non-profit that tracks cybercrime. ITRC says it recorded 342 data breaches from Jan. 1 through June 24, up 69% from the same period in 2007. But, like the origins and perpetrators of so many individual data breaches, mystery also lies behind the aggregated numbers. "I'm not sure that this says breaches are increasing," ITRC founder Linda Foley tells Digital Transactions News. "What we know is the reporting of breaches is increasing." A handful of states now require some disclosure of data breaches to authorities, Alaska being the most recent. And some companies that have been hacked are starting to report breaches voluntarily, Foley says. While data breaches can compromise all manner of personal and business records, they often involve credit and debit card data and bank-account information. ITRC lists five major categories of breached entities, with the so-called banking/credit/financial sector accounting for 10% of 2008's breaches. Businesses, which include physical and Internet retailers, insurance companies and other private enterprises, accounted for 36.8%. Schools accounted for 21.3%; government and military facilities, 17%; and health-care facilities, 14.9%. IRTC also categorizes breaches by how they happened, such as through hackings-break-ins into computers and related systems, insider thefts, data lost in physical transit, and by other methods. The number of 2008 hackings through late June in the banking/credit/financial category was 10-double the five for all of 2007. The estimated number of records compromised as a result was 227,864. In 2007, the reported number of compromised records at financial institutions through hackings was 83,500. But Foley says not to put too much stock in the records numbers because so many breached organizations don't know or fail to report the number of compromised records when they report a bre

Fireman's Fund Insurance Co. this week unveiled what it says is the first coverage available to small and medium-sized businesses for losses from payment card data breaches. News of the policy came on the same day that a non-profit research organization reported that data breaches increased 47% last year. The idea behind the coverage, according to Brian Gerritsen, product director at Novato, Calif.-based Fireman's, is to give peace of mind to business owners who are diligent about complying with the Payment Card Industry data-security standard, or PCI, the card networks' uniform protection rules that all card acceptors are supposed to meet. "That's what we're really trying to insure against-business owners trying to do everything in their power to protect their customers' cardholder data, but still find themselves in a data-breach situation and out of compliance with the PCI standards or other security standards that may apply to them," he tells Digital Transactions News. To get the coverage, however, a merchant must clear a number of hurdles. An applicant must already have property or liability coverage from Fireman's as well as the company's general data-breach policy first offered in 2006. The new payment card coverage is an add-on to that earlier product. Coverage is available to retailers and most other card-accepting merchants, but not schools and hospitals, says Gerritsen. The insurer excluded the former because of their high rate of data breaches and the latter because they hold extremely sensitive medical and personal data. If breached, a covered merchant could recoup about $160,000 in resulting expenses. That includes up to $50,000 for a PCI-specific forensic investigation, system scans and software, and hardware upgrades to get card security up to snuff. The policy also provides up to $100,000, with a 5% deductible, for PCI fines-"contractual penalties" in industry lingo-and related costs such as chargebacks and issuersâ€

Online ad industry will probably continue to be a hot-button if FTC Commissioner Jon Leibowitz is named chairman. The Federal Trade Commission may strengthen its focus on online advertising and privacy if, as is expected, current FTC Commissioner Jon Leibowitz is named chairman of the agency. "He would certainly keep privacy and online advertising as a focus of the FTC, so I think [his potential appointment] does matter," said Mike Zaneis, VP of public policy at the Internet Advertising Bureau. Reports indicate Leibowitz will be named as head of the commission, replacing William Kovacic. Kovacic replaced former Chairman Deborah Platt Majoras in March 2008, when she left to join the private sector as VP and general counsel of Procter & Gamble. "A kind of privacy switch is going to go on at the FTC [once the new chairman is named] and they're going to engage in this issue in a much more serious way," said Center for Digital Democracy Executive Director Jeff Chester. "Under a Leibowitz regime we would get the kind of serious industry analysis that so far has been lacking from the Bush era approach." "Leibowitz has been a leader on privacy issues," said Zaneis, who expects a Leibowitz-run FTC to continue along the agency's current path of pushing for industry self-regulation, rather than creating new regulations for online advertisers. As a commissioner, Leibowitz, a Democrat, has not ruled out FTC regulation of things like behavioral targeting. During a two-day FTC forum held in Washington, D.C. in 2007, Leibowitz noted, "The marketplace alone may not be able to solve all problems inherent in behavioral marketing." He revealed his sense of humor, adding, "If we see problems...the commission won't hesitate to bring cases, or even break thumbs."

DAVOS, Switzerland (Reuters) - Two years ago anyone uttering the words "state" and "regulation" in the same sentence would have been sneered at in high-powered banking circles gathered by the ski slopes of Davos. Now, more than 18 months into the biggest financial upheaval in the last eighty years, those bank executives that still have jobs are preparing to swallow large doses of regulatory medicine to help cure a crisis they are accused of causing. With bank lending still frozen, the world sliding into recession and more than 300,000 financial jobs already gone, policymakers are replacing bankers in the driving seat at this year's World Economic Forum (WEF) to discuss short- and long-term solutions to the sector's woes. "Two years ago nobody could see the problems and the risks," said Marc Weil, head of EMEA Financial Services at consultancy firm Oliver Wyman, which is publishing a report on the state of the global financial services industry this week. "It is clear now that the financial services industry is like no others and anyone that poses systemic risks needs tighter regulation."

Government Computer News presents Pat Howard, chief information security officer of the Nuclear Regulatory Commission, and Ari Schwartz, vice president and chief operating officer of the Center for Democracy and Technology, in an eSeminar recoreded at 2 p.m. Wednesday, Nov. 19, where they discuss personally identifiable information in the government. Federal IT officials must continually balance competing demands to share information while also complying with various mandates to protect the privacy of PII within federal information systems and programs. During the presentation, Mr. Howard discusses: * How IT and program managers are adapting to these challenges; * The latest laws and guidance on PII; * Measures taken by the NRC to strengthen PII protections; and * New demands concerning privacy in the federal marketplace. A question-and-answer session follows the presentation. GCN Editor in Chief Wyatt Kash moderates.

In court papers filed Wednesday, former federal prosecutor Richard Convertino called reporter David Ashenfelter's invocation of the Fifth Amendment, in an attempt to keep from having to reveal his confidential sources, both "speculative" and "unreasonable." Convertino urged the federal district court in Michigan to sanction Ashenfelter and to require him to present further evidence as to why he should not be held in contempt for his refusal at a December deposition to reveal the confidential sources. For the past two years, Convertino has been seeking Ashenfelter's testimony in hopes of boosting his Privacy Act lawsuit against the Department of Justice. Convertino claims DOJ violated the law by leaking to the press details of an investigation into Convertino's conduct during a terrorism trial. At a deposition in December, after Judge Robert Cleland in the Eastern District of Michigan ruled twice that Ashenfelter is not protected by a First Amendment reporter's privilege, the reporter invoked the Fifth Amendment right against self-incrimination.

In April 2008, the blogosphere was abuzz with news that someone was auctioning then-candidate Barack Obama's half-eaten breakfast on eBay, along with silverware purported to contain his DNA. This episode led some to speculate that the DNA of one or both of the presidential candidates would be surreptitiously analysed and their genetic information broadcast before the election for all to examine. Although this scenario did not take place during this election cycle, it is well within the realm of technological possibility. Every day, we shed millions of cells during ordinary activities - licking envelopes, blowing our nose, combing hair. These cells may seem to be mere human detritus, but our biological trash could be a gold mine for information prospectors looking for clues to our health or ancestry. And as an investigation in the latest issue of New Scientist magazine found, there already is a vibrant industry offering covert DNA tests to confirm infidelity and parentage. We have reached this point through technological advances in laboratory genetic analysis, dramatically reduced costs for the analysis and an almost complete absence of rules governing the legal status of "abandoned DNA."

Bank of America will pay Connecticut $350,000 as part of a settlement for a data breach by Countrywide Financial Corp., which the bank acquired last year, state officials said Thursday. The bank will also provide at least $25,000 to reimburse Connecticut residents forced to pay for freezing and unfreezing their credit reports because of the breach, Attorney General Richard Blumenthal said. The major credit bureaus, Experian, Equifax and TransUnion, charge about $10 to freeze and unfreeze credit reports. Affected consumers will receive about $60 for credit freezes and unfreezes for all three credit bureaus, Blumenthal said. Nearly 30,000 state residents were affected by the nationwide breach, which came to light last August after the FBI arrested a former Countrywide employee on charges of selling personal information, including Social Security numbers, for as many as 2 million loan applicants. To be reimbursed, consumers must send proof of payment for their credit freezes and unfreezes to Blumenthal's office, 110 Sherman St., Hartford, CT 06105, attn: Countrywide Credit Freeze.

Don't expect a letter from Monster or Heartland Payment Systems letting you know they've lost your data. The breaches at Monster.com and Heartland Payment Systems are raising questions about the efficacy of data-loss disclosure laws enacted in at least 45 states. Back in 2007 we wrote about how the financial services industry lobbied hard to block proposed federal rules requiring organizations to notify individuals whose data they lose, and to permit consumers to freeze their credit histories. States such as California and Massachusetts have passed laws giving consumers these rights. But the Monster and Heartland capers have brought weaknesses in the legislation to center stage. I asked Lisa Sotto, head of privacy and information management at law firm Hunton & Williams, about this: Q: Heartland and Monster told me they intend to comply with all state laws. That said, they have not announced plans to notify individual victims. Is that OK? A: In the state breach notification laws, it is permissible to delay notification if a law enforcement agency determines that notification would impede a criminal investigation. If such a delay is requested by law enforcement, notification must be made after the law enforcement agency determines that notice would not compromise the investigation. I do not know if these companies received a delay request from a law enforcement agency. Q: Monster says it chose not to email individual victims because the bad guys could then replicate that message and use it as a phishing template. That makes sense. But is that allowed by state consumer protection laws? A: There are now 45-plus state laws and they are not uniform. Typically, notice is provided via first class mail, but there are provisions in the state laws allowing for electronic notice as well. Q: The only official notices from Heartland and Monster so far has been one-page disclosures posted on a web site. Does that cover them? A: There are provisions in the state laws al

Still think that today's computer viruses and other malware come from some maladjusted teen out to vandalize your PC to make a name for himself? Think again. The persistent myth is a holdover from days long gone, and it's important to dispel it if you want to know what you're up against-and how to protect yourself. The splashy worms and malicious viruses that clogged entire networks and indiscriminately wiped hard drives are essentially gone. Today, it's all about cash-and lots of it. If there's a way to use evil software to make money, whether it means taking over a PC to send pharmacy-advertising spam, or stealing financial logins and credit card info, or even hacking game accounts, it's out there in some form. There's even a thriving online black market that sells everything from software kits to roll-your-own malware to spam services using infected PCs to reams and reams of credit card data stolen by keylogger malware. It's most important to get rid of this myth in order to get rid of the idea that you can usually tell whether you're infected by obvious signs like big pop-ups or suddenly missing files. Malware writers today work to keep infections as quiet as possible for as long as possible so that they can continue to make money. But it's also important to keep in mind that today's online crooks have become very creative in figuring out how to make money with their malware. Stolen Webmail accounts have been used to send messages to the account's contact list asking for money transfers. Popular online games such as World of Warcraft are a huge target, with thieves raiding hacked accounts to sell the items or in-game currency for real money. So don't assume that there's no risk using an untrusted PC as long as you don't log onto your bank.

With all the attention Google StreetView's clash with a baby deer evoked, it can be easy to overlook the tool's crime-fighting good side. Not too long ago, StreetView was instrumental in returning a kidnapped Massachusetts girl safely to her home, and just recently, it helped a Swiss police team detect a 1.2-acre marijuana field and nab the gang responsible. As with all things Google, you have to take the bad with the good. And the good can be pretty good, as reported in the Worcester Telegram. When 9-year-old Natalie Maltais was kidnapped by her grandmother and taken to a motel in rural Virginia, Athol police were able to track her down using her cellphone and Google StreetView. The cellphone's GPS data focused on a 300-foot area in Natural Bridge, Va. Using StreetView, the Worcester cops plugged in the coordinates of the area, navigated around a bit and saw a nearby motel that looked promising. When they sent Virginia police to the site, they found the grandmother along with the girl, and returned her safely to her legal guardians. A happy ending. Similarly, the AP yesterday reported that Swiss police used Google Earth to discover the pot field and make several arrests. While working the case, the police used Google Earth to zero in on a suspect's residence, only to stumble upon the field. Although it had been camouflaged by corn planted all along its perimeter, the weed field couldn't hide from Google's Earth's piercing satellite gaze. The find led to the arrest of 16 suspects who have allegedly sold up to 7 tons of hashish and marijuana, with an annual turnover of 3 million to 10 million francs (or $2.5 million to $8.64 million) per year. So yes, while Google can be insensitive at times, especially when it comes to images uploaded by StreetView, it's also a proven force for good in the world. In other words, a tool is only as good (or bad) as the person using it. Google doesn't kill Bambis, people do.

(PDF) Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where the public's trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, they also pose enormous risks that make it easier for individuals and groups with malicious intent to intrude into inadequately protected systems and use such access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks.

Feds would spend $20 billion on health IT if Senate and House agree in coming weeks. The House-passed version of the economic stimulus bill includes about $20 billion in spending for health IT. The bill, known as H.R. 1 or the American Recovery and Reinvestment Act of 2009, would make Medicare and Medicaid providers and hospitals eligible for incentive payments for using certified e-health records technology. It also supports health information exchanges, standards development and conformance testing, a chief privacy officer for health IT and other aspects of health IT. The portion of the bill called the Health Information Technology for Economic and Clinical Health Act -- the Hitech Act, for short -- and health IT spending provisions passed largely unchanged from the bills introduced earlier this month. The Senate is expected to take up a similar bill in the first week of February. The Senate bill now calls for $23 billion in health IT spending. Once it is passed, a House-Senate conference will need to resolve differences between the bills. Congressional leaders aim to send President Barack Obama the bill by mid-February.

Salesmen and parents know the technique well. It's called the takeaway, and as far as Keith Mularski is concerned, it's the reason he kept his job as administrator of online fraud site DarkMarket. DarkMarket was what's known as a "carder" site. Like an eBay for criminals, it was where identity thieves could buy and sell stolen credit card numbers, online identities and the tools to make fake credit cards. In late 2006, Mularski, who had risen through the ranks using the name Master Splynter, had just been made administrator of the site. Mularski not only had control over the technical data available there, but he had the power to make or break up-and-coming identity thieves by granting them access to the site. And not everybody was happy with the arrangement. A hacker named Iceman -- authorities say he was actually San Francisco resident Max Butler -- who ran a competing Web site, was saying that Mularski wasn't the Polish spammer he claimed to be. According to Iceman, Master Splynter was really an agent for the U.S. Federal Bureau of Investigation. Iceman had some evidence to back up his claim but couldn't prove anything conclusively. At the time, every other administrator on the site was being accused of being a federal agent, and Iceman had credibility problems of his own. He had just hacked DarkMarket and three other carder forums in an aggressive play at seizing control of the entire black market for stolen credit card information. ....In the end they would regret that decision. Iceman was right

Exactly one week after the Heartland Payment Systems (HPY) breach was first announced to the public, the first lawsuit has been filed against the payments processor. The class action lawsuit filed Tuesday by Chimicles & Tilellis LLP of Haverford, PA in the U.S. District Court for the District of New Jersey on behalf of Woodbury, MN resident Alicia Cooper, asserts that Heartland "made unreasonably belated and inaccurate statements concerning the breach." The complaint says Heartland does not appear to be offering any credit monitoring services or other relief to consumers affected by the breach. Chimicles & Tilellis' complaint also says in addition to the questionable timing of the announcement of its breach, (Read Heartland Class Action suit PDF) "there are materially misleading statements and omissions in Heartland's public description of the breach and its consequences." Heartland announced the breach in a press release on the same morning of President Barack Obama's inauguration. The law firm says it is suing on behalf of consumers whose sensitive financial information was compromised in the data breach at Heartland. The complaint raises a claim pursuant to the New Jersey Consumer Fraud Act, and asserts causes of action for negligence, breach of implied contract, breach of contracts to which Plaintiffs and Class members were intended third party beneficiaries, breach of fiduciary duty, and negligence. The payments processor did not disclose how many credit card account numbers were compromised as a result of the breach. Heartland is the fifth largest payment processor in the country and handles 100 million transactions per month for more than 250,000 small retailers, gas stations, restaurants and other small and midsized companies. The suit also states that Heartland only became aware of the breach after it was notified of patterns of fraudulent credit card activity by VISA and MasterCard. "Analysts have stated that the fact that Heartland did not detect th

A quick rant from me to you, dear readers. Yesterday I received an unsolicited email from a woman who was pitching me a service - one totally irrelevant to my life. In her signature, in which she included what she considers her credentials, she had the statement, "More than 2,000 followers on Twitter." I gasped, somewhat in horror. I laughed, full of humor. Twitter is fun and a great networking tool and business opportunities can stem from Twitter. I won't reiterate all of the ways because there are tons of existing resources. Yet as big as Twitter has become it's still not massively adopted. Using such a tagline in your credentials does one of two things: 1) makes schooled Twitter users laugh and 2) makes those unfamiliar with Twitter roll their eyes. For instance, HubSpot, a really cool inbound marketing firm, runs Twitter Grader, a way that Twitter users grade the reach of their feeds and profiles based on HubSpot's super secret algorithms. It's a fun tool - but it only measures folks against about a million or so other users (I think that's because it can only grade you against other folks who have graded themselves). It's also not the end all, be all of measuring Twitter influence.

A former Fannie Mae IT contractor has been indicted for planting a virus that would have nuked the mortgage agency's computers, caused millions of dollars in damages and even shut down operations. How'd this happen? The contractor was terminated, but his server privileges were not. Rajendrasinh Makwana was indicted on Tuesday in the U.S. District Court for Maryland (press report, complaint and indictment PDFs). From early 2006 to Oct. 24, Makwana was a contractor for Fannie Mae. According to the indictment, Makwana allegedly targeted Fannie Mae's network after he was terminated. The goal was to "cause damage to Fannie Mae's computer network by entering malicious code that was intended to execute on January 31, 2009." And given Fannie Mae-along with Freddie Mac-was nationalized in an effort to stabilize the mortgate market Makwana could caused a good bit of havoc. Makwana worked at Fannie Mae's data center in Urbana, MD as a Unix engineer as a contractor with a firm called OmniTech. He had root access to all Fannie Mae servers. The tale of Makwana malware bomb plot is a warning shot to all security teams and IT departments. Given the level of layoffs we've seen lately the ranks of disgruntled former employees is likely to grow. Is there any company NOT lopping off a big chunk of its workforce? And some of these workers may even have Makwana's access privileges and knowledge of the corporate network.