Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…
Philadelphia Airport without power—went out courtesy of too much rain. Can't get to the planes. The computers are down. Everything's out.
Following up on previous RISKS items: "Two jurors have each been jailed for two months for contempt of court after one posted Facebook comments and the other researched the case on the web. ..." <http://www.bbc.co.uk/news/uk-23495785>. George D M Ross MSc PhD CEng MBCS CITP, University of Edinburgh, School of Informatics, 10 Crichton Street, Edinburgh, Scotland, EH8 9AB
Summary: NZ's new "Electronic Operating Model" for courts is late and
over budget; staff appear to have been mismanaged; and the government
has already closed some courts in anticipation of benefits from a
system that may not operate until next year.
Justice Minister Judith Collins announced in 2011 that the NZ Government was
"amending criminal procedure to bring [the justice system] up to date with
[the] 21st century... Within the District Sourts, around 60% of criminal
procedures will be new or changed. Where old law required paper records,
the Act allows use of technology to exchange information ..." The
"Electronic Operating Model" was to be introduced "later in 2013", replacing
the current paper-based court record. It was then estimated that charges
would be processed up to 70% faster and that the Ministry of Justice and
Police would be saved "around 93,000 hours a year". —Extracted from
http://my.lawsociety.org.nz/news/electronic-operating-model-outlined
I'm not sure when work started, but the "2010/11 estimates examination;
responses to the additional questions: Vote Courts" document, which is
missing from its home but still in Google's cache, suggests that it was
already in the 2010 budget, as part of a "Criminal Procedure Simplification
programme" that appears to have included paperwork streamlining as well as
computerisation. This would be the Criminal Procedure Act 2011, described
as the "biggest reform of criminal procedure in 50 years", and "enabled an
electronic operating model:.
The same document says
- the first phase will involve the electronic filing, management, and
disposal of an estimated 270,000 charges/year from the Police; this would
take about 2 years with the first charges processed by mid-2012.
- costs were expected to be NZD 11.2 million capital and NZD 7.8 million
operating expenses between 2010/11 and 2013/14.
- benefits were expected to equal costs for the first phase.
- the first phase was to "start establishing the platform for a wholly
electronic criminal summary operating model", but was not yet to _be_
that model.
-- Extracted from
http://webcache.googleusercontent.com/search?q=cache:hoquQTJVMaIJ:www.parliament.nz/NR/rdonlyres/5264E59A-204D-400B-A71D-450064F8CD4C/148485/49SCJE_EVI_00DBSCH_EST_9923_1_A56701_MinisterofCou.pdf+%22Electronic+Operating+Model%22+New+Zealand+Justice&cd=5&hl=en&ct=clnk&gl=nz&client=safari
If I'm reading the "Briefing for the Incoming Minister" correctly, that was
in the context of a total Vote Courts budget of NZD 438 million,
Quoting that document:
The court system is one of the few examples of a significant national
service delivery model that still relies predominantly on paper. Given
the technology available, a paper-based court record is resource
intensive, cumbersome and inefficient. The system is also open to error
from manual transcription into other administration systems, and at risk
of loss, damage or misuse.
The EOM project addresses these issues by reducing, simplifying, and
automating a number of steps in handling and processing of the court
record. This will improve and better control access to official court
records regardless of location, and reduce the risk of misuse or loss of
information. Having a single authoritative record will also increase
the quality of information available to justice agencies.
http://www.justice.govt.nz/publications/global-publications/b/briefings-to-incoming-ministers-2011/documents/VOTE%20COURTS%202011%20BIM%20FOR%20RELEASE.pdf
The concern to reduce error is praiseworthy.
Phase 1 was supposed to begin operation in March this year.
However,
From 1 July 2013, implementation of the justice sector's Electronic
Operating Model will begin with the electronic filing of Police charges.
We asked why the implementation of the electronic filing of judicial
decisions has been delayed until 2014. We heard that an audit of the
Ministry of Justice project found the programming to be more complicated
than expected. Some processes have already been tested, but real-time
live trials of the system will also be conducted before the progressive
implementation at courts next year. The technology will reduce the time
involved in handling documents and make them more easily accessible. We
will follow the implementation of the Electronic Operating Model
closely. —Extracted from http://www.parliament.nz/resource/0001682426
The system is now being described as costing "$30 million".
From an article printed on page 6 of the Friday July 26 issue of *The Otago
Daily Times*, reprinted from *The New Zealand Herald*:
- The project was flagged at risk and getting worse in November 2012
- "the project was reporting that these technical matters would be
sorted out"
- Staff "were compelled to work evenings and weekends"
- under "three extraordinarily high work streams"
- resulting in "key resignations amid prolonged work periods",
also described as "a wave of resignations"
- During all this high pressure, "staff were moved to a
different floor of the national headquarters, which had seating
for only 45 of the 48 staff, and more were hired".
Sounds to me like some manager at the Ministry of Justice (possibly
Crazy Eddie from the Mote) had never read 1 Kings 12.
The thing is that on the 3rd of October last year,
it was announced that
31 jobs would be lost at 13 courts
4 courts would be closed
9 would have their hours slashed
2 of those 9 would be reconsidered for closure in 2013
and "two tiers of management [would] have to reapply".
a net reduction of 68 staff
-- extracted from
http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10838100
The changes duly took place this year, in anticipation of the
benefits of the new system...
I wonder if any of the decision-makers had heard of "counting your
chickens before they're hatched"?
David McCandless of the "Information is Beautiful" website has produced a nice graphic illustrating the relative sizes of famous data losses http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/. Nicholas Chart, Senior Technical Consultant (Epos Infrastructure), Paradigm, Dukes Court, Duke Street, Woking, Surrey, GU21 5BH, +44 (0)1483 758146
Evgeny Morozov, Frankfurter Allgemeine Zeitung, 24 July 2013. A lengthy take on surveillance, online culture and Silicon Valley, with interesting links to examples of the current 'smart' bubble, like 'smart forks', 'smart toothbrushes', 'smart umbrellas', and 'smart shoes' (patented by Apple!). http://www.faz.net/aktuell/feuilleton/debatten/ueberwachung/information-consumerism-the-price-of-hypocrisy-12292374.html
Lisa O'Carroll, *The Guardian*, 26 Jul 2013 High court imposes injunction on Flavio Garcia, who has cracked security system of cars including Porsches and Bentleys http://www.guardian.co.uk/technology/2013/jul/26/scientist-banned-revealing-codes-cars
Robert X. Cringely, InfoWorld, 19 Jul 2013 Data leak proves yet again that DC politicos are even less tech savvy than your grandma (no offense to grandmas) http://www.infoworld.com/t/cringely/what-else-can-congress-bungle-their-passwords-starters-223078
I did an experiment on my Windows 7 machine yesterday. I right-clicked on the wireless connection in my system tray to Open Network and Sharing Center. I then clicked on Access type: Internet Connections: Wireless Network Connection in order to get the Wireless Connection Status panel to display (it's much easier to do this in Windows XP). This Wireless Connection Status panel displays the number of bytes sent & received on the wireless connection since the last time it was reset. (This wireless connection is the only connection this particular computer has with the outside world.) I then turned off every background task on this machine that I could find that didn't seem relevant to simply running my local Windows machine. I then left the machine alone for several hours. Even though the machine is doing *nothing* (no browser, no e-mail, no file server, no music serving, etc.), there is still some residual amount of network traffic that runs to megabytes over several hours. Interestingly, there was almost 3x the traffic being *sent* as being *received*. I then tried the same experiment with my Windows XP machine. Simply right-click on the wireless icon in the system tray and click on 'status'. The result: much less traffic—essentially zero. Perhaps someone on this list has an explanation for this phenomenon.
FYI—What could possibly go wrong here? Christopher Zara, *IB Times*, 26 Jul 2013 Is Your Cable Box Spying On You? Behavior-Detecting Devices From Verizon, Microsoft And Others Worry Privacy Advocates http://www.ibtimes.com/your-cable-box-spying-you-behavior-detecting-devices-verizon-microsoft-others-worry-privacy-1361587 Pay-TV providers like Verizon and tech giants like Microsoft are developing devices that can monitor our behaviors as we watch TV and play games. Reuters “Watching the watchers'' is taking on a whole new meaning. News that Google Inc. may be developing a television set-top box with a motion sensor and video camera has rekindled the debate over technology that can record so-called ambient action. Should a TV-mounted box have the ability to track our movements, record our voices and monitor our behaviors? Should cable providers and tech companies be allowed to collect such information without our consent? Lawmakers and privacy advocates are asking such questions as companies continue to experiment with data collection that will extend beyond our gadgets and into our living rooms and bedrooms. On Thursday, the Wall Street Journal reported that Google privately showed off a prototype device at the Consumer Electronics Show in Las Vegas last January. The company is one of many tech players looking to compete with pay-TV providers, who themselves have been exploring new ways to capture information about viewers' behavior. In November, Verizon Communications Inc. filed a patent application for a set-top box that delivers advertisements based on users' behaviors. For instance, two people cuddling on sofa watching TV might see a commercial for a romantic Disney cruise, while an arguing couple might see a pitch for couples' therapy. The device would use a combination of motion and audio sensors to collect information about what viewers are doing as they watch TV. Creeped out yet? You're not alone. News of Verizon's plans brought countless headlines about the potential for Orwellian cable boxes and digital video recorders, spying on us during our most intimate moments. And legislators have been quick to respond. Last month, two U.S. congressmen, a Democrat and a Republican, introduced a bill that would require such devices to be opt-in, meaning consumers would have to grant explicit consent before companies could collect data on ambient action. The bill—dubbed the We Are Watching You Act of 2013—would also require that devices flash on-screen warnings whenever they are recording such information. Reps. Michael E. Capuano, D-Mass., and Walter Jones, R-N.C., who sponsored the bill, called such technology an “invasion of privacy.'' In a statement, Jones even acknowledged the data collected through such devices could be potentially abused by the government itself. “When the government has an unfortunate history of secretly collecting private citizens' information from technology providers, we must ensure that safeguards are in place to protect Americans' rights,'' he said. The extent to which Google's set-top box would collect ambient information is unclear. In its report, the Journal cited only “people briefed on the device,'' and a Google representative has not yet responded to a request for more information. However, the company has reportedly been experimenting with such technology for several years. As Gizmodo reported in 2007, Google filed for a patent for an interactive TV that would include an image-capture device capable of measuring “how many viewers are watching or listening to a broadcast.'' And Google and Verizon are by no means lone players. In November, the Microsoft Corp. (NASDAQ:MSFT) also filed a patent application for a system that would use its Kinect camera to monitor users' behavior. Kinect will come attached to Microsoft's forthcoming Xbox One game consoles. Its always-on sensors can read body behavior, track eye movements and listen for commands. It even knows how many people are in the room. As Polygon reported, the device has raised numerous concerns among privacy advocates, particularly in light of Microsoft's reported compliance with the National Security Agency's PRISM program. If it makes you feel any better, Microsoft has vowed to “aggressively challenge'' any government attempt to spy on its customers using Kinect sensors. “Absent a new law, we don't believe the government has the legal authority to compel us or any other company that makes products with cameras and microphones to start collecting voice and video data,'' a company representative told the Verge this month. If that doesn't allay your fears, you can visit Microsoft's Xbox One privacy page.
Feds Indict 5 in Largest Hacking, Data Theft Ring in U.S. History http://abcnews.go.com/US/feds-indict-largest-hacking-data-theft-ring-us/story?id=19772118
http://www.reuters.com/article/2013/07/26/us-usa-hackers-creditcards-arrests-idUSBRE96P02Z20130726
Jeremy Kirk, InfoWorld, 25 Jul 2013 Apple created a status page showing its progress in rebuilding its systems following last week's intrusion http://images.infoworld.com/d/application-development/apples-developer-site-overhaul-continues-following-breach-223429
If you have a rooted Android device, I recommend against rushing to install Android 4.3 for now. It appears that 4.3's new protection model may require re-rooting devices in various situations (and require a new, rather kludgy workaround, for now at least), and unless you have some reason to push through 4.3 quickly (which is a relatively minor update in most other respects) I would suggest holding off until best practice procedures have been developed and promulgated. If you don't root your devices, you won't care about this, and you can jump to 4.3 immediately and happily. http://j.mp/1789QjV (This message on Google+ via NNSquad)
NASDAQ's Sloppy, Phishing-like password reset message after being hacked?
http://j.mp/14k5Niq (This message on Google+ via NNSquad)
[name withheld]
NASDAQ wrote the other week that they were hacked badly. They closed the
site for some days. Now I got this email:
Dear Community Members:
We are pleased to inform you that your "My NASDAQ" account is again online
and available. We invite you back to enjoy all the features you have come
to rely upon, including your portfolio tracker, stock ratings and social
features. To regain access to your account, please set a new password by
going to http://community.nasdaq.com/reset-password.aspx, entering your
email address, and clicking on the "Reset Password" button. You will be
sent a verification email which contains a link. You can then use that
link to reset your password.
Thank you for your patience. You are a valued member of our audience and
your security is paramount to us.
Sincerely, Bruce Hashim, www.nasdaq.com
The trouble I see is, the URL given is in an HTML mail, and it doesn't
actually go to what is being displayed. Rather, it goes to (numbers munged):
http://www.mmsend10.com/link.cfm?r=[xxxxxxxx]&sid=[xxxxxx]&m=[xxxxx]&u=NASDAQ_OI
S&j=[xxxxxx]&s=http://community.nasdaq.com/reset-password.aspx
Now, I'm not saying it's not legit, mind; I don't know. But mmsend10.com is
owned as follows:
Registered through: GoDaddy.com, LLC (http://www.godaddy.com)
Domain Name: MMSEND10.COM
Created on: 04-Jan-08
Expires on: 04-Jan-15
Last Updated on: 02-Jan-13
Registrant:
Real Magnet LLC
4853 Cordell Ave
PH-11
Bethesda, Maryland 20814
United States
Administrative Contact:
Pines, Tom domain-admin@realmagnet.com
Real Magnet LLC
4853 Cordell Ave
PH-11
Bethesda, Maryland 20814
United States
+1.3016524025
Technical Contact:
Pines, Tom domain-admin@realmagnet.com
Real Magnet LLC
4853 Cordell Ave
PH-11
Bethesda, Maryland 20814
United States
+1.3016524025
Domain servers in listed order:
NS1V.DATAPIPE.NET
NS2V.DATAPIPE.NET
[That does not exactly foster trust on my first take. LW]
Please report problems with the web pages to the maintainer