IT Projects: Expert Witness, CIO, In-House Counsel & Litigation Forum

Google falls from list of most trusted companies for privacy

Wonder what affect the changes being made by Yahoo to remove data after 90 days will have on this list next year?  One would assume that others will follow Yahoo's actions.  Interesting --- Yahoo as leader and innovator----hmmmm.              Marlene

Previously appeared December 16, 2008
Author: Preston Gralla
http://blogs.computerworld.com/google_falls_from_list_of_most_trusted_companies_for_privacy

Privacy groups have long worried about Google's privacy policies --- and now it appears that consumers have followed suit. Google has dropped off the list of the most trusted companies when it comes to privacy protection. The Ponemon Institute and TRUSTe surveyed 6,486 consumers about which companies they felt were most trustworthy and protected their private information. They recently published the list of the top 20.

Last year, Google clocked in at number 10. Today, it's not even on the list. The Electronic Privacy Information Center (EPIC) has long worried about the massive amounts of data that Google has about people, and how that data might be used. EPIC, for example, testified that Google should not have been allowed to purchase the advertising firm DoubleClick because of privacy concerns.

Microsoft isn't on the list, either. In a story in the San Francisco Chronicle about the survey, a spokesperson for the Ponemon Institute said "Google (and Microsoft) suffer from big company syndrome. People figure that if you're big and collecting data, there must be an issue."

That doesn't really explain Google's dropping off the list, though. After all, the company that took the number one spot is American Express, for the second year in a row. American Express isn't exactly a mom-and-pop operation. eBay (number 2), IBM (number 3), and Amazon (number 4), aren't corner-store sized either.

The issue is that Google, by its very nature, collects more information about people than any other company, and people are uneasy about the way that information might be used. Google has a long way to go to clean up its privacy policies.

Other high-tech companies on the list include Hewlett-Packard (number 6), Apple (number 8), WebMD (number 13), Yahoo (number 14), Facebook (number 15), AOL (number 16), and Dell and eLoan (tied for number 20)

Yahoo to scrub personal data after three months

Wonder if this move was a result of the recent executive changes?  Would be interesting to know whose idea this was. The new policy is to begin implementation next month, and  will gradually include all of the company's services by mid-2010, according to a Dec 18th follow-up article by Jessica Guynn of the LA Times.                              Marlene

The move could pressure rivals Google and Microsoft to do the same

Previously appeared December 17, 2008
By Jeremy Kirk

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyId=11&articleId=9123700&intsrc=hm_topic

December 17, 2008 (IDG News Service)   Yahoo Inc said Wednesday it will anonymize most of the data it collects about people's Web searches after three months, a move that could put further pressure on competitors Google Inc. and Microsoft Corp.to do the same because of privacy concerns. Yahoo, which previously kept the data for 13 months, will now retain it for the least amount of time compared to its rivals.

Google said in September that it would anonymize data after nine months, down from 18 months. Microsoft keeps data for 18 months, although it said earlier this month it would reduce the period to six months if its rivals did the same.

A European Union group has recommended that search engines discard data after six months. The recommendation has been endorsed by data protection officials from the 27 countries in the European Union. Countries could eventually choose to enforce the recommendation, which will be discussed further next year.

Privacy campaigners have expressed concerns that Web users could potentially be identified on the basis of search terms and other data. An IP address can identify a person's ISP as well as their approximate geographic location. It also has been shown that a person can be identified on the basis of search terms they've entered.

How do new private browsing capabilities affect forensics?

Would love to hear from you forensic experts out there on what you think about this article.

Marlene

Previously appeared on November 12, 2008

http://blogs.techrepublic.com.com/security/?p=654&tag=nl.e019

Author:Tom Olzak

Chrome has it. IE8 and Firefox 3.1 have it. So what does it mean to forensics investigators? I’m talking about private browsing–the ability to visit sites, conduct research, or participate in illegal/unethical activities without leaving tell-tale signs behind.

Recent interest in this capability, sparked by privacy enhancements touted by Mozilla, Google, and Microsoft, prompted me to take a closer look at what this might mean to my forensics investigations. As usual, the impact on reconstructing questionable behavior depends on the browser used and the skills of both the problem employee and the investigator.

The need for private browsing

Some common reasons given for private browsing include:

• Researching a medical condition

• Shopping from a home PC for a surprise gift or vacation

• Planning a surprise birthday party

However, most family members aren’t going to know how to get around methods already provided by browsers—deleting cookies, cache content, and other session information written to disk. So these are rather weak arguments for stronger browsing privacy.

Spam Volume Drops When ISPs Terminate McColo

What a great job of research and follow through by Brian Krebs in getting this accomplished.  And congrats to Hurricane Electric for doing the right thing.                       Marlene

Previously appeared on Nov 12, 2008

Posted By Thomas Claburn, InformationWeek

http://www.informationweek.com/story/showArticle.jhtml?articleID=212002194

Security experts suggest there's a connection to the average of 11.9 spam messages per second in the last 24 hours compared to the 30.1 messages per second last month. If you notice a bit less spam in your inbox this week, thank Brian Krebs, who covers security for The Washington Post.

After four months of gathering information from various security companies about the malicious traffic coming out of McColo Corp., a San Jose, Calif.-based Web hosting company, Krebs took his findings up the data chain and presented them to the company's ISPs, Global Crossing and Hurricane Electric. Global Crossing declined to comment on Kreb's findings; Hurricane Electric cut off McColo's Internet service. "We looked into it a bit, saw the size and scope of the problem you were reporting and said 'Holy cow! Within the hour we had terminated all of our connections to them," Benny Ng, director of marketing for Hurricane Electric, told Krebs.

State Department, VA disclose two new data breaches

Database security is non-existent, stolen computers, breach of information files of high-profile citizens, personal details of veterans inadvertently included with public information on federal Web site that allows the public to search for details of government contracts and spending... and on and on it goes.  Who is watching the supposed "Watchdogs”?     Anybody have any good suggestions to pass on to help close up all the gaps and leaks?                     Marlene

Originally appeared in Computerworld on 2008-11-03 posted by Jaikumar Vijayan

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=IT+in+Government&articleId=9118959&taxonomyId=69&pageNumber=1

One affects passport applicants, the other, VA patients

November 3, 2008 (Computerworld) Two federal agencies that have already drawn attention this year for data security breaches are back in the spotlight again -- for the same reason.

One of them is the U.S. Dept. of State,  which last week disclosed that it had notified close to 400 individuals that the data they had submitted with their passport applications had been stolen in a database intrusion.

And last Saturday, the U.S. Department of Veteran's Affairs (VA) said that one of its medical centers in Oregon had accidentally posted personal data on about 1,600 patients on its public Web site.

The breach at the State Department occurred in March at around the same time the agency disclosed that some of its contractors had illegally snooped on passport records  belonging to Sen. Barack Obama (D-Ill.), Sen. John McCain (R-Ariz.) and other high-profile citizens, according to a spokeswoman.

That disclosure triggered a review of the security controls protecting the State Department's Passport Information Electronic Records System (PIERS), which contains records on 192 million passports for 127 million people. An Inspector General's report was released in July and identified "many control weaknesses" -- including a general lack of policies, procedures and training for protecting passport data at the State Department. The report noted that there were about 20,500 users with active PIERS accounts as of May, with about 12,200 of them being employees or contractors at the department.

According to a State Department spokeswoman, 383 records were illegally accessed by a State Department employee. That worker has since been terminated, the spokeswoman said. All of those who were affected by the incident have been notified by the department and have been offered one year's worth of free credit monitoring. The notifications were sent out in two batches, with the first set going out on July 10 and the second on Oct. 6.