CIPP Information Privacy & Security News

Stunned applicants filling out immigration forms are now being warned their personal information can be shared with the RCMP, national security and intelligence agents, and even foreign cops. The immigrants, many who arrive here from brutal regimes, are being told that they must sign a consent form or their requests will not be dealt with by federal immigration officials. One form, which was obtained by Sun Media, said the data can be shared with the Canada Border Services Agency, RCMP, Canadian Security Intelligence Service and foreign police. TARGET FRIENDS The information can be used to target friends or family members of those who say negative things about their homelands, said Jamal Kaker, of the Afghan Association of Ontario. "This will impact a lot of immigrants in many communities," he said yesterday. "This is scary because the information will get back to Afghanistan in no time." Toronto lawyer Guidy Mamann said it can be deadly for immigrants who give information that may be negative to their governments and are then refused by Canada. "The rights of these immigrants are being trampled," Mamann said. "All this was done under the radar without an announcement." He said foreign police -- some working for the worst regimes -- will be able to find out where their nationals who fled to Canada live and allegations they have leveled against their homelands. "All this information will now be shared," Mamann said. "The lives of immigrants and some Canadian citizens will become an open book." SIGN FORMS He said Canadian citizens are affected if they sign forms to sponsor a spouse or loved ones. "It's another nail in the coffin for civil rights in Canada," Mamann said. "Negative information against governments will now be open for sharing." Toronto lawyer Mendel Green called the changes troubling. "This is a serious breach of our privacy laws," he said. "It appears to be an excess of authority. Big Brother wants to watch our visitors." Federal immig

Bruce Schneier is the chief security technology officer at BT and a celebrated writer and speaker on privacy, cryptography and security issues. Welcome to the future, where everything about you is saved. A future where your actions are recorded, your movements are tracked, and your conversations are no longer ephemeral. A future brought to you not by some 1984-like dystopia, but by the natural tendencies of computers to produce data. Data is the pollution of the information age. It's a natural byproduct of every computer-mediated interaction. It stays around forever, unless it's disposed of. It is valuable when reused, but it must be done carefully. Otherwise, its after effects are toxic. And just as 100 years ago people ignored pollution in our rush to build the Industrial Age, today we're ignoring data in our rush to build the Information Age. Increasingly, you leave a trail of digital footprints throughout your day. Once you walked into a bookstore and bought a book with cash. Now you visit Amazon, and all of your browsing and purchases are recorded. You used to buy a train ticket with coins; now your electronic fare card is tied to your bank account. Your store affinity cards give you discounts; merchants use the data on them to reveal detailed purchasing patterns.

A group of federal agencies and private organizations, including the National Security Agency and the Department of Homeland Security, has released a set of guidelines defining the top 20 things organizations should do to prevent cyberattacks. The Consensus Audit Guidelines (CAG) describe the 20 key actions, referred to as security controls, that organizations should take to defend their computer systems. The controls are expected to become baseline best practices for computer security, following further public- and private-sector review. CAG is being led by John Gilligan, formerly the CIO for both the U.S. Air Force and the U.S. Department of Energy, and a member of the Obama transition team dealing with IT in the Department of Defense and various intelligence agencies. "We are in a war, a cyberwar," Gilligan said on a media conference call. "And the federal government is one of many large organizations that are being targeted. Our ability at present to detect and defend against these attacks is really quite weak in many cases." Borrowing an analogy he attributed to an unnamed federal CIO, Gilligan said, "We're bleeding badly and we really need triage and we need to focus on things that will keep this patient alive." The CAG initiative represents part of a larger effort, backed by the Center for Strategic and International Studies (CSIS) in Washington, D.C., to implement recommendations from the CSIS Commission report on Cybersecurity for the 44th Presidency.

Securing our Nation against cyber attacks has become one of the Nation's highest priorities. To achieve this objective, networks, systems, and the operations teams that support them must vigorously defend against external attacks. Furthermore, for those external attacks that are successful, defenses must be capable of thwarting, detecting, and responding to follow-on attacks on internal networks as attackers spread inside a compromised network. A central tenet of the US Comprehensive National Cybersecurity Initiative (CNCI) is that 'offense must inform defense'. In other words, knowledge of actual attacks that have compromised systems provides the essential foundation on which to construct effective defenses. The US Senate Homeland Security and Government Affairs Committee moved to make this same tenet central to the Federal Information Security Management Act in drafting FISMA 2008.

Social media is on the rise, and so are the privacy and security risks. Is it time to dial back on the whole Web 2.0 'friend' thing? The social media honeymoon is officially over. While it may not yet be time to fly to Reno for a quickie divorce, you might want to start thinking about sleeping in separate bedrooms for a while. Example du jour: Over the weekend, a rogue application spread across Facebook, warning users about bogus errors in their profiles. Clicking on the "Error Check System" app causes it to send false warnings to your entire FB posse, per the unofficial AllFacebook blog. There doesn't seem to be any payload associated with that app besides driving traffic, but the potential for abuse is obvious. But a bigger problem on social nets is an old familiar one: spam. So far, spam only accounts for about 5 to 25 percent of all e-mail passed on social networks, versus 90 percent of regular e-mail, says Adam O'Donnell, director of emerging tech for Cloudmark, which filters spam for some large social nets (but won't identify which ones). As more people start tweeting about what their cats ate for lunch and share their Facebook profiles with near-total strangers, though, that number will only grow. The type of spam on social networks is different too, says O'Donnell. Think fewer fake Viagra come-ons, more social engineering scams. In other words, the junk you get on social networks is more likely to be aimed at stealing your credentials or your identity -- and thus much more dangerous than garden-variety spam.

The fuss over Facebook's attempt to modify the contract with its millions of users has died down for the moment, and I haven't noticed any of my friends closing their account or even significantly changing their behaviour in protest despite the widespread coverage. The problem started in early February when Facebook updated the section on its site which establishes the legal agreement with its users. Like most people who use it I didn't notice the change, and even though Facebook clearly knows who I am and how to contact me I didn't get a message or see a notification in my news feed about it. This is pretty common practice on the web, where long legal contracts are agreed with a click of a mouse and sites update them at will because they contain a clause saying that you accept the changes if you carry on using the site. Term paper Unlike laws passed by Parliament, which have to be properly promulgated to those affected, contracts can evidently be changed without any proper notice.

Oh, the double-edged sword of Twitter. It's not nice when it makes PR people and reporters look like asses, as Jennifer Leggio will post tomorrow. But it's a whole new can o' beans when it affects political power. And yup, Twitter did in fact (or not - see below) alter the balance of power in Virginia (the state capital of which is Richmond, Va., for what it's worth) this week, as Talking Points Memo blogs: Yesterday the Virginia GOP came very close to taking control of the state Senate, nearly luring a Democratic Senator to switch parties and put them at a 20-20 tie, which would have been broken by the Republican Lt. Governor. Then Jeff Frederick, a state legislator and the party chairman, ruined it all by Twittering this: Big news coming out of Senate: Apparently one dem is either switching or leaving the dem caucus. Negotiations for power sharing underway. The Dems then read the message, quickly mobilized to talk the renegade out of it, and stopped the GOP coup before it could happen. Here's Frederick's exciting presence on Twitter, featuring such nail-biting updates as: * Had great meeting; dinner @ Bookbinders; now at Lucky Strike/Cap Results party. Tired * Meeting w/ Senator about a bill he wants me to support. And then this intriguing post: Meeting w/ HseMajLdr abt my senate post earlier.He gave me info, which came f/ a Senator who said it was public. That will be a fun meeting. At any rate Frederick pointed to a blog post from conservative Roanoke County, which says the whole Twitter story is b.s., that the Dems already knew about the rogue House member before Frederick ever Tweeted. Even so, the strange power of Twitter is now well-established.

A number of software errors are present in the Global Election Management System (GEMS) voting system (version 1.18.19), put out by the company Premier Election Solutions, Inc. A Deck Zero error led to 179 tallied ballots inadvertently being deleted from initial results in the November 4, 2008 election in California - which was subsequently corrected, according to California Secretary of State, Debra Bowen. As a result, the state may withdraw approval for the use of this system.

Financial fraud last year caused 7.5 percent of all adults in the United States to lose money, largely because of data breaches. That's the finding of a survey conducted by Stamford, Conn. research firm Gartner. The survey polled 5,000 U.S. adults and also found that when compared with average consumers, nearly twice as many people who lost money to fraud changed their shopping, payment, and e-commerce behavior. In particular, victims of electronic checking and/or savings account transfer fraud were nearly five times more likely to change banks because of security concerns. "Fraud victims are also more cautious about which brick-and-mortar stores they shop at and how they pay for goods when they get there, demonstrating more awareness of the risk of data breaches," said Avivah Litan, vice president and distinguished analyst at Gartner, in a news release. High-tech crimes, such as data breaches (which typically involve hacking into enterprise systems) and phishing attacks against consumers, are the most prevalent causes of payment card fraud. Gartner found that financial losses were highest with new-account, credit card and brokerage fraud, with average losses per incident totaling $1,097, $929 and $900, respectively. However, victims of brokerage, credit card and debit/ATM card fraud find it easiest to recover their losses, receiving an average of 100 percent, 86 percent, and 77 percent of the funds stolen, respectively.

The Internet Advertising Bureau U.K. has today launched a good practice principles guide for firms that collect and use data for online advertising. The goal is to promote self-regulation of the practice and quell privacy concerns surrounding it. Companies that support the principles include Google, Microsoft Advertising, Platform-A, Yahoo, Specific Media, Audience Science, NebuAd, and Phorm, all of which have been involved in the formation of the principles as members of the IAB's behavioral advertising task force. To complement the guide, the IAB has also launched a consumer-facing site, youronlinechoices.co.uk, designed to educate consumers on how and why their data is being used, and to provide information on how they can opt out of the process if they wish.

Locaccino is the only location-sharing system that gives you precision control over who can see your location. While most location-based systems only allow you to list which of your contacts should or shouldn't be able to see your location, our privacy settings allow you to create rules as simple or complex as you want them to be! Our technology allows you to easily define the times when you want to share your locations. Locaccino lets you create groups for your friends to simplify your location preferences. With Locaccino, allowing your co-workers to see your location from 8AM - 5PM is a snap. Locaccino also allows you to specify where you can be located. Using a Google maps interface, you can define regions where you do and don't want other people to be able to find you. Locaccino Location Sensing Our software will sense your location without even requiring GPS! By leveraging the wifi network of Skyhook Wireless, a nearby location will be found for you. The Locaccino software you'll download will do all the work. We Protect Your Privacy We are the only location-based system with privacy researchers actively working to make sure that your data is kept safe. Our Privacy Policy explains in detail exactly how we store and process all of your data. We want you to know that your location information is saved anonymously and we will never sell any of your personal data.

I was at an advertising conference last week. Some folks are concerned that privacy advocates will press the government to regulate the most common of tracking technologies: behavioral targeting. That's the system that drops a cookie onto our computers to record many of our wanderings through the Web in hopes of targeting us with relevant ads. I had just written The Next Net, about how we'll be tracked on the mobile Internet. And I was thinking that if behavior targeting worries people, the data cascading from our phone use will terrify them. But there are also plenty of reasons to worry about regulation. First, there's a divide in our society between people extremely worried about erosion of privacy and others who appear, with their Web postings, videos and Tweets, to celebrate it. Which group wins? They both can. Take a look at this new friend-finding location-based application for Facebook, Locaccino. It comes out of Carnegie Mellon. The idea is that people can fine-tune their privacy profiles, deciding who can see where exactly they are, and who gets a blurrier vision, or none at all. The point is that millions of people are clearly eager to exchange all sorts of data. It's a way for them to learn, make friends, find things, and have fun. What's more, it supports a vibrant and innovative software market in a gloom-infested tech industry. Some of the innovation will go toward protecting privacy. Because privacy is something that both sides of this debate want and need, even if they don't agree on what it is. Regulations? The most important privacy regs, in my view, should mandate clear communications on how customer data will be used, and will limit tracking to those who have chosen to participate.

Infection of the adware called "VideoPlay," which has been spreading through malicious posts and comments on Digg and YouTube, increased 400 percent from January to February, according to Panda Security. Attackers have been posting comments on news stories and videos posted to the social networking sites Digg.com and YouTube.com, claiming users will be able to see videos of celebrities - some of which claim to be pornographic - by clicking a link that is provided, Sean-Paul Correll, threat researcher and security evangelist for Panda Security, told SCMagazineUS.com in an email Tuesday. But, when a user follows the link, they will be re-directed to a page where they will be prompted to download a codec to view the video. The download is the VideoPlay adware - a worm that aims to steal email login credentials and other information stored in a user's browser and then further propagate itself through removable drives.

Animated explanation about privacy choices - from AOL

A leading technology advisor to President Obama said in a research note for his investment firm today that privacy and net neutrality will be among the biggest telecommunications issues facing the Federal Communications Commission and the administration going forward. Analyst Blair Levin, who was the co-lead of Obama's technology and innovation team along with nominated FCC Chair Julius Genachowski, wrote in a Stifel Nicolaus research note that the economic crisis and change of administration will shift the focus of telecom policy away from traditional phone companies to "Internet/edge" players. Indeed, Google and other Web video and voice companies like Skype have been increasingly active in recent years at the FCC, pushing particularly for net neutrality rules that would prevent carriers from blocking or charging more for certain content that travels over the Web. Levin said in a note that net neutrality will emerge again as an issue in the new administration for wireless networks. On the other hand, there won't likely be a push for new net neutrality rules for cable, DSL, and fiber network carriers at the FCC. "(There is a) consensus emerging that disputes about whether a wireline network management tool is 'reasonable' (or is actually blocking or degrading traffic) to be resolved on a case-by-case basis," Levin wrote in the note with analysts Rebecca Arbogast and David Kaut. It would be a tough climb to impose rules that force wireless carriers to open their networks. Apple and AT&T successfully argued to lawmakers and regulators to keep their exclusive iPhone contract. Skype's petition to the FCC to force carriers to allow any handset or software to operate on any network was shot down by former FCC Chairman Kevin Martin. He said the biggest "sleeper" issue will be privacy. With a major overhaul of healthcare records to the Web, the rise in behavioral advertising and cloud computing, where information is stored in computers strung across many geographies

Wal-Mart Stores is striding into the market for electronic health records, seeking to bring the technology into the mainstream for physicians in small offices, where most of America's doctors practice medicine. Wal-Mart's move comes as the Obama administration is trying to jump-start the adoption of digital medical records with $19 billion of incentives in the economic stimulus package. The company plans to team its Sam's Club division with Dell for computers and eClinicalWorks, a fast-growing private company, for software. Wal-Mart says its package deal of hardware, software, installation, maintenance and training will make the technology more accessible and affordable, undercutting rival health information technology suppliers by as much as half. "We're a high-volume, low-cost company," said Marcus Osborne, senior director for health care business development at Wal-Mart. "And I would argue that mentality is sorely lacking in the health care industry." The Sam's Club offering, to be made available this spring, will be under $25,000 for the first physician in a practice, and about $10,000 for each additional doctor. After the installation and training, continuing annual costs for maintenance and support will be $4,000 to $6,500 a year, the company estimates. Wal-Mart says it had explored the opportunity in health information technology long before the presidential election. About 200,000 health care providers, mostly doctors, are among Sam Club's 47 million members. And the company's research showed the technology was becoming less costly and interest was rising among small physician practices, according to Todd Matherly, vice president for health and wellness at Sam's Club. The financial incentives in the administration plan - more than $40,000 per physician over a few years, to install and use electronic health records - could accelerate adoption. When used properly, most health experts agree, digital records can curb costs and i

A top lawyer for P&G called upon industry execs to work harder than ever to defend self-regulation of the ad business at a gathering of top advertisers today. Speaking about the tough economic environment and increased government involvement in business affairs, Deborah Platt Majoras, VP-general counsel at P&G, said the ad business has to tout that it has been responsible and doesn't need additional oversight. The current business environment -- one in which market failures have prompted government bailouts and heightened government oversight -- is leading to a more skeptical outlook from policymakers about self-regulation. ' "The road ahead is not going to be easy, but we are not helpless," said Ms. Majoras, who, prior to joining P&G served as chairman of the Federal Trade Commission from 2004 to 2008. "The industry has been far more responsible than we get credit for. It's time that we backed up rhetoric with facts," she said.

As if you needed another sign that times are tough, here's a fairly reliable measure: The number of cases handled by the advertising industry's best-kept secret -- self-regulation -- are on the rise. Last year the National Advertising Division of the Council of Better Business Bureaus handled 214 cases, up 22% from 2007. And in 2008 ad challenges, in which one advertiser challenges a competitor's claim, rose 31% to 81 cases. Why the increased activity? It's a deadly fight for share of market out there, and in down times advertisers tend to revert to hard-hitting comparative advertising. NAD's purpose is to substantiate these kinds of attack ads, and it can do it faster and cheaper than litigation can. The Federal Trade Commission seems to like the idea of letting advertisers settle their own disputes. When the National Advertising Review Council, the body that sets the policies and procedures for the NAD to enforce, started 38 years ago, then-FTC Chairman Bob Pitofsky wasn't an early convert. "If the truth be known," he said 10 years ago, "there was some skepticism about how the whole thing would work. The FTC had been burned time and time again by unkept promises of self-regulation by other industries. But this group has proved the skeptics wrong. Today, advertising has the best self-regulatory system of any industry in the country." The outgoing chairman of the FTC, William Kovacic, is also a fan. But the current crop of FTC commissioners don't seem as convinced, although they seem somewhat willing to give self-regulation a chance. In issuing guidelines for online behavioral advertising, FTC Commissioner Jon Leibowitz said the industry needs to do a better job of "meaningful, rigorous self-regulation, or it will certainly invite legislation by Congress and a more regulatory approach by our commission."A joint industry task force quickly seized on that statement as an endorsement for self-regulation, and said it supported FTC's goal of a "comprehensive and eff

Last week, President Barack Obama convened a health-care summit in Washington to identify programs that would improve quality and restrain burgeoning costs. He stated that all his policies would be based on rigorous scientific evidence of benefit. The flagship proposal presented by the president at this gathering was the national adoption of electronic medical records -- a computer-based system that would contain every patient's clinical history, laboratory results, and treatments. This, he said, would save some $80 billion a year, safeguard against medical errors, reduce malpractice lawsuits, and greatly facilitate both preventive care and ongoing therapy of the chronically ill. Following his announcement, we spoke with fellow physicians at the Harvard teaching hospitals, where electronic medical records have been in use for years. All of us were dumbfounded, wondering how such dramatic claims of cost-saving and quality improvement could be true. The basis for the president's proposal is a theoretical study published in 2005 by the RAND Corporation, funded by companies including Hewlett-Packard and Xerox that stand to financially benefit from such an electronic system. And, as the RAND policy analysts readily admit in their report, there was no compelling evidence at the time to support their theoretical claims. Moreover, in the four years since the report, considerable data have been obtained that undermine their claims. The RAND study and the Obama proposal it spawned appear to be an elegant exercise in wishful thinking. To be sure, there are real benefits from electronic medical records. Physicians and nurses can readily access all the information on their patients from a single site. Particularly helpful are alerts in the system that warn of potential dangers in the prescribing of a certain drug for a patient on other therapies that could result in toxicity. But do these benefits translate into $80 billion annually in cost-savings? The cost-savings from avoi

Every time you get online, your privacy comes under attack. Whether it's an overbearing End User License Agreement, contact forms, or just website cookies, there are literally millions of ways that you can let your private information slip away online. One of the best ways to fight invasions of your privacy is to get informed and learn how to prevent it. Read on to find advice, organizations, and other resources that can help you keep your privacy safe online. Guides & Articles These resources have specific advice and information for protecting your online privacy. 1. EFF's Top 12 Ways to Protect Your Online Privacy: Read this guide from the Electronic Frontier Foundation to learn how you can protect private information online. 2. Frequently Asked Questions about Online Privacy: Get answers to questions about online privacy and safety from this resource. 3. Is Your PC Watching You? Find Out!: This article from CNN will help you figure out if your privacy is being violated through your PC. 4. Nameless in Cyberspace: Anonymity on the Internet: Find out why the right to anonymity online is so important to have by reading this article. 5. Consumer Privacy Guide: The Consumer Privacy Guide offers a variety of resources and information for protecting your privacy online. 6. This Email Will Self-Destruct: Learn about email security measures that you can take to protect your privacy. 7. Anti-Spam Resources: Visit this guide to learn how to stop receiving junk email. 8. All About Internet Privacy and Security: Read this guide to learn about security terms and Internet privacy settings. 9. Online Privacy: The Complete Guide to Protect You: WebUpon's guide discusses steps you can take to protect your online privacy. 10. Social Networking and Safety Online: Read this guide to learn how to practice common sense on social networking sites. 11. Internet privacy: Wikipedia's entry on Internet privacy offers a broad view at staying private o