(Image used under: Creative Commons 2.0 [SRC][Mod])

TJX, the company that is known for having the largest data breach in history (so far), has not implemented better security and might have gotten worse. The employee that blew the whistle on them has been caught and fired for it.

TJX now has a firm that scours the internet to find bad things posted about them, which is how they found the message and fired him for it. Too bad they don't appear to have hired anyone to beef up operational security or to convince people to use strong passwords.

Hey! That probably means they'll find THIS page. Sweet.

If that's the case, then here's my message to them: Stop storing all that personal data about us against our will and you won't have to pay for more security. You can't lose what you don't have, duh!

(Image used under: Creative Commons 2.0 [SRC])

This should be interesting. If China didn't take some serious precautions when implementing RFID for their tickets, we should be hearing any day now about people who remotely cloned someone else's ticket and got into the game denying access to the others.

Or, since passport information is stored on the ticket as well, someone with a scanner can find anyone from a given country should they wish to target someone based on their nationality. Let's see what happens.

(Image is used under the Pixabay license)

It's amazing and I promise it's no joke, but both congress AND Bush did something right by drafting, passing, and then signing into law the Genetic Information Nondiscrimination Act.

Some provisions of the law include:

- Prohibiting group health insurance plans and issuers offering coverage on the group or individual market from basing eligibility determinations or adjusting premiums or contributions on the basis of an individual's genetic information. Insurance companies cannot request, require or purchase the results of genetic tests, and they are prohibited from disclosing personal genetic information. - Prohibiting issuers of Medigap policies from adjusting pricing or conditioning eligibility on the basis of genetic information. They cannot request, require or purchase the results of genetic tests, or disclose genetic information. - Prohibiting employers from firing, refusing to hire, or otherwise discriminating with respect to compensation, terms, conditions or privileges of employment. Employers may not request, require or purchase genetic information, and they are also prohibited from disclosing personal genetic information. Similar provisions apply to employment agencies and labor organizations.

(Image used under: Creative Commons 2.0 [SRC])

Today there was a talk about Cyberbullying that revealed some really fascinating information. Elizabeth Englander from MARC (the Massachusetts Aggression Reduction Center) game a very spirited talk with some good statistics from her group's studies.

• Grappling is the name for either staging a fight or ambushing someone and recording it to upload to Youtube later. There has been at least one suicide as a result of these attacks where a girl was attacked, stripped, and violated with the entire episode uploaded to Youtube.
• When asked what the motivation was for being a cyberbully, kids (ranging from middleschool to college) listed mostly either "because it was fun" or "because I was angry". The most interesting thing about this statistic is that it broke down almost perfectly along gender lines. Can you guess which is which? Boys did it for fun and girls because they were angry.
• There's at least one school district where the teachers have threatened to strike unless they are allowed to collect cellphones at the door. This comes out of situations like the one where the students provoked their teacher on purpose and recorded his angy reaction for upload to Youtube.

Another very interesting thing that Elizabeth said due to a question about the effectiveness of Public Service Announcements about cyberbullying was that, in her state at least, they held a contest for teens to create public service announcements that would get the message out to people of their own age. That's brilliant! As the commenter in the audience said, the "This is your brain on drugs" and "I learned it by watching you" PSAs from our youth were really more of a joke than anything. Teens are probably best equipped to create something that their peers will pay attention to.

You can find out more about MARC at their website.

We all like our laptops

(Image is in the Public Domain)

Today before the first panel at the conference, I heard a presenter who had to be in his 70's or close to it say, "I feel so naked without my laptop".

And that has been today's CFP conference highlight 🙂

(Image is in the Public Domain)

I was given the opportunity to give a five minute talk on any topic of my choice relating to computers, freedom, or privacy preceding the conference dinner on Wednesday. Narrowing down all the things I would want to say was difficult at first, but of course had to be nothing other than credit freezes.

It drives me nuts that there's still so few people that know about this very important tool and I made sure that at least my fellow computer, freedom, and privacy advocates and peers would know. It turns out that there were many who hadn't heard of it before. After my talk, I had many people come to ask me about more details or to tell me that they spread the word to their friends and family. One even invited me to come speak at his church at a large event he's hosting in the fall!

It's a good start.

(Image used under: Fair Use doctrine)

I have been challenging the value of Lifelock for a while based on the fact that they claim to prevent ID theft, but can't. It looks like several other people have come to that conclusion and are busy suing him for as much of his millions that they can get.

The problem is that even with CNN, Wired, and Yahoo finally getting around to spreading the word, Lifelock is still going very strong.

Even though I've been chasing lifelock postings around on the net and posting comments letting people know the truth, I don't think my efforts are going to amount to much in the long-run. That's why I've decided to challenge Todd Davis directly. He's obviously a showy type that feels comfortable challenging others so now it's time to turn the tables. I've looked into Lifelock's features and found them useful, but far from worth the money spent. But with only one feature addition, that could all change. So let's get to it:

So there you have it. What are the odds that he'll actually respond? We shall see…

(Image is in the Public Domain)

I ended up sitting next to Peter Pietra, the head of the privacy department at the TSA. This gave me an interesting opportunity to talk about issues of privacy when dealing with their agency and the first thing I asked was about the pornographic backscatter x-ray devices.

He was clearly frustrated (and I don't blame him) as I'm sure this is a topic that assaults him regularly. The issue is that backscatter CAN see through your clothes, but the TSA orders the devices preconfigured at a level that prevents them from seeing pictures such as these one on the Internet. They are also unable to modify the configuration. In fact what they actually see, as shown on their site, is smeared blob that highlights objects, but not skin.

The issue that I have here is that if the TSA's claims of how they use the technology are true, then what the hell was all the hype about?

Images will be deleted immediately once viewed and will never be stored, transmitted or printed (the passenger imaging units have zero storage capability) Metallic and non-metallic objects are displayed, including all items that a passenger may be carrying on his/her person

Also, according to the website, you can always choose to have a pat-down instead.

I asked Peter about this because it seems to me most people aren't going to know to go to the website and read about Backscatter before being faced with it at an airport, but he said that the sample picture on the web is printed right on the machine and people are supposed to be shown the picture and told of the option for pat down prior to being scanned.

Final Thoughts

I notice that the picture on the TSA site is from behind so probably doesn't fairly show how much frontal detail they would see so for full disclosure, they should show a frontal picture. However, I can understand why someone wouldn't want to show what amounts to nudity on these machines for propriety reasons and don't necessarily consider that evasive.

What more can you ask for than clear disclosure and a reasonable choice? Granted the technology can be used for worse things, but the devices is about as small and conspicuous as a casket so you'll never be scanned without your knowledge. If they are configured correctly, store nothing, and you can opt for a pat down, then perhaps some have been too harsh on both the technology and the agency.

Speaking of, EPIC's article that led me to write about backscatter in the first place unfairly show the capabilities of backscatter ignoring the actual use of the technology by the TSA. I'm sure there's someone from EPIC around the conference somewhere and I'll be sure to ask them about it.

What TSA Sees

What EPIC Shows

(Image used under: Fair Use doctrine)

Today at the Computers, Freedom and Privacy Conference, we opened with statements from representatives from the Obama and McCain campaigns (Clinton declined to attend).

Obama

• Greater accountability in government
• Keeping government information and operations open and transparent
• Citizen participation in decision making
• The appointment of a government Chief Technology Officer to oversee these types of issues

McCain

• Promoting American innovation
• Taxing the rich is a popular idea, but it's the pursuit of riches that drives innovation
• The system should reward the behaviors that we want to reward
• We need to develop a skilled workforce
• We should very lightly regulate the market and let it take care of itself until such point as they fail
• Market regulation should focus on anti-competitive behavior

Open Questions

Next were questions asked by the moderators of the panel:

Q: "What do you see as the role of government in providing access to our basic communications infrastructure (the Internet)"

(McCain) Chuck – Can't understand his answer. Very politicalese. I'm fairly certain that he didn't answer the question, but it's hard to tell.

(Obama) Dan – Rather than focus on the infrastructure, it's important to protect the openness of the Internet. Even if we were to stay on dial-up or were years behind other countries on bringing broadband to our people, that's really secondary to protecting the nature of the Internet. He also noted that McCain's view of a self-regulating market will maintain open Internet (and I agree).

Q: "NSA Wiretapping – what would their position be on liability of carriers. What changes to Fisa"

(McCain) Chuck – "Immunity is a tough question because there's competing values. We're not talking about granting indulgences…" Again, hard to follow. Many words come out, but not much is said. The only thing he said of substance in his several minute non-answer to the question was "There needs to be hearings to find out what actually happened and what harm was actually done" which is to say that he will "look into it".

(Obama) Daniel – Obama's history and future view is to strengthen judicial review of administrative subpeonas, National Security Letters and the gag orders that accompany them. When surveillance is used, there must be real, meaningful oversight. Obama voted AGAINST retroactive immunity. McCain did not vote against them (which Dan feels is tacit approval).

Obama realizes that advanced surveillance and data mining can be important tools for national security, and they should be available, but with appropriate oversight. It's important to guard against mission creep! Woo! Someone gets it!

Q: "American companies are assisting China in censoring it's citizens. What would a given candiate do about that?"

(Obama) Dan – No official position, but if Dan had to offer advice to the campain, it would be that the lesson of the efforts in the US in the mid-90's to persuade countries to adopt an open Internet should be continued. We should open a dialogue and encourage and persuade countries to realize the benefits while using our influence to lead them towards more openness.

(McCain) Chuck – No explicit policy either. But the values that the campaign holds that would apply is to go slowly and carefully. It's always wrong to believe that you can legislate the behavior of people in other countries. Show the repressive regimes the benefits that openness provides, we will lead by example.

Open Questions

Q: "Email use by President – Will your candidate use e-mail. Does McCain know how? Will they avoid requirements to save e-mails by using other services outside of the Whitehouse?"

(McCain) Chuck – McCain does know how to use e-mail. As for avoiding requirements, you can tell from the tenor of his career that any perceived impropriety is anathema. Very little is more important for himself and country than acting honorably and keeping himself clean.

(Obama) Dan – There's a real commitment in Obama tech policy to keep government open and keep the flow of information open. Hiding e-mail wouldn't meet his commitment to open government.

Q: "Bush doesn't want to use e-mail because it becomes public record, but both of these candidates have records of believing in open government. But what will they do to keep government open?"

(McCain) Chuck – Answered by listing the example of require reporting of all data about sex offenders. He seems to have misunderstood that open government is about reporting what the GOVERNMENT is doing, not citizens.

(Obama) Dan – Bush administration has gone way overboard in classifying information. Obama called for national declassification center.

Q: "Clinton administration mandate cell companies to track users for 911. Companies are tracking all the time when powered. No legal limitations for what use can be made. Should this be protected by judicial oversight?"

(Obama) Dan – No position on that, but clear position of looking at tech capabilities that are not being addressed from a privacy perspective.

(McCain) Chuck – First ask, is there a problem and does the law already deal with it? If there was a possibility of current harm or future harm, then perhaps regulation would be appropriate, but otherwise, just trust but verify.

Q: "Net Nuetrality – How far would either of you go to live up to the view that the Internet is a tool for Democracy?"

(Obama) Dan – Obama wants to maintain openness of the Internet. Before we fight what the Internet may become, we should ask if we want to go where it's going. Do we like what it's evolving too. Either way, currently the regulatory agencies lack the power to get involved.

(McCain) Chuck – Understand Internet is important. But adverse to regulation, must have real evidence of harm. Don't want to stifle innovation.

Q: "Where do you think the burden lies for protecting information. American's must show harm? Or burden on Government that there's a justification for accessing my private information"

(McCain) Chuck – Companies always have known more about us than the government. We shouldn't have solutions seeking problems, but the opposite. Show the problem before acting.

(Obama) Dan – Increase FTC enforcement authority and budget. Too much burden on individuals to negotiate their privacy rights with whoever they deal with. Though our privacy laws are more modest than others, we've seen progress in our regulation. It's not up to normal people to protect their personal security. That's unreasonable. We don't have the time, energy, or (sometimes) capability.

Q: [my question] "Does your candidate realize the problem of Congress creating laws that over-rule stronger state laws that protect our privacy and freedom and would they have the balls to veto such a law?"

(McCain) Chuck – Clearly recognizes the importance of federalism. Always the rub whether what you have is well intentioned preemption or something else. Not the campaign's policy to over-turn what approaches of 3 centuries of preemption law. In other words, leave it to congress to make the determination of what is an appropriate level of preemption.

(Obama) Dan – No general position on preemption, but it's a right thing to keep an eye on. In other areas the benefit of some mount of federalism, but preemptive will come up. Depends on context.

Summary

McCain is a fool that believes the market can regulate itself.