The 2014 Privies - Dubious Achievements in Privacy Law

Recognizing Stupid Privacy Laws 
by Stewart Baker, Former government official now practicing law

It’s time to recognize just how stupid privacy law is getting. And what better way than by acknowledging the most dubious achievements of the year in privacy law? (more)

My favorite - Judge Uncovers Wiretap Plot with 425 Million Co-Conspirators
(Scroll down to Category 3 - "Dumbest Privacy Cases of the Year")

Slack Wiretapping Sentence Imposed for Slack Attack on Slack

WV - A former West Virginia sheriff convicted of hacking his now ex-wife's work computer was sentenced to probation Thursday after she made an emotional plea for leniency.

Former Clay County Sheriff Miles Slack exchanged a long hug with Lisa Slack, his friends, and relatives after U.S. District Judge John T. Copenhaver sentenced him to one to two years' probation and fined him $1,000 for wiretapping...

Federal prosecutors say Slack secretly installed a keystroke logger on a computer in the county magistrate court in April where his wife worked. They were married at the time. Slack admitted he intended to monitor her activity.

Slack could have been sentenced to up to five years in prison. (more)

Mobile Devices Will Pose The Biggest Risk In 2014, Survey Says

IT professionals are troubled by the risk of data leakage associated with employee smartphones and are focusing on bolstering endpoint security, according to a new study.

Mobile devices will pose the biggest threat in 2014, according to a survey of 676 IT and IT security professionals conducted recently by the Ponemon Institute. About three-quarters of those surveyed cited the risk posed by mobile devices as their biggest concern, up from just 9 percent in 2010.

Meanwhile, targeted attacks, designed with custom malware that can maintain a lengthy presence on corporate systems, is close behind as a troubling trend, the survey found. About 40 percent of those surveyed said their firm was the victim of a targeted attack in the past year, according to the survey, which was commissioned by vulnerability management vendor Lumension Security. (more)

Riga International Airport Officials - "We bought what?!?!"

Latvia - Management officials of Riga International airport were not aware of the fact that they had used budget money to buy a device that had allegedly allowed the airport’s security listen in on employees’ telephone conversations.

Security Police has launched an investigation about this possible crime.

After learning of the possible wiretapping into employees’ telephone conversations, the Board of the airport dismissed the head of its Security Department Raimonds Lazdins and two other employees. Equipment meant for wiretapping was found in the airport. (more)

NSA Lawsuit Ruling

Washington – A federal district judge ruled on Monday that the National Security Agency program that is systematically keeping records of all Americans’ phone calls most likely violates the Constitution, describing its technology as “almost Orwellian” and suggesting that James Madison would be “aghast” to learn that the government was encroaching on liberty in such a way.

The judge, Richard J. Leon of Federal District Court for the District of Columbia, ordered the government to stop collecting data on the personal calls of the two plaintiffs in the case and to destroy the records of their calling history. But Judge Leon, appointed to the bench in 2002 by President George W. Bush, stayed his injunction “in light of the significant national security interests at stake in this case and the novelty of the constitutional issues,” allowing the government time to appeal it, which he said could take at least six months.

“I cannot imagine a more ‘indiscriminate’ and ‘arbitrary’ invasion than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval,” Judge Leon wrote in a 68-page ruling. “Surely, such a program infringes on ‘that degree of privacy’ that the founders enshrined in the Fourth Amendment,” which prohibits unreasonable searches and seizures. (more)

A Flashlight that Follows Your Path... in addition to lighting it.

The Android flashlight app, Brightest Flashlight!

GoldenShores Technologies, LLC, is using the onboard GPS to make money on a free app by selling the anonymized user data it collects. And, the amount is not trivial; over one million people have downloaded the flashlight app.

The reason this information finally surfaced was because the Federal Trade Commission (FTC) became involved, eventually issuing an official complaint against Goldenshores Technologies (PDF)... (more)

Camera Vendor Admits to Police Headquarters Bugging Mistake

Listening devices in Edison police headquarters secretly recorded officers, attorneys, civilians...
 

NJ - Private conversations, including legally protected attorney-client discussions, have been secretly recorded inside Edison police headquarters, prompting calls for state and federal investigations and stoking new tensions in a department long wracked by internal strife.

The conversations were picked up by dozens of audio-enabled surveillance cameras installed throughout the building in January.

At the time, Police Chief Thomas Bryan assured Edison’s mayor and business administrator, along with wary union officials, that microphones on the cameras would be disabled to guard against an invasion of privacy, the officials said. Officers learned otherwise last weekend... (more)

NSA News Flash

* Judge: NSA Phone Spying 'Almost Certainly' Unconstitutional 
* Ruling Deals a Blow to NSA Records-Collection Methods 
* Lengthy Federal Court Process Still Ahead for NSA Spying 
(MORE TO COME)

Opinion - IT Should Ban Google Glass Before It's Too Late

IT Should Ban Google Glass Before It's Too Late

Google's soon-to-be-publicly-available wearable technology exposes your company to problems ranging from illegal wiretapping and surveillance to a wild spectrum of inappropriate uses.  

Columnist Rob Enderle writes that you should do yourself a favor and ban Google Glass before it is even available to your employees. (more)

Coach with The Bush School Accused of Spycam'ing Female Students

WA - A Seattle private school has put a coach and substitute teacher on administrative leave after he was arrested and charged with voyeurism.

Jason Paur, a 43-year-old teacher with The Bush School, was arrested in British Columbia Tuesday while on a school sponsored ski team trip.

Pauer is accused of putting a video camera in a room where female students were staying. Police have also charged him with possessing child porn and breaking and entering. (more)

Fargo - A homespun spycam story.

ND - Police from two separate cities are investigating KVLY-KXJB reporter Mellaney Moore after the station aired her hidden camera story about local school security.

Jerry Lundegaard, town car salesman, upon hearing the news.

According to Moore’s story, she entered three schools, one in West Fargo, one in Fargo and one in Moorhead, MN, to test school security. “She had a hidden camera and was not stopped by any school official.”

The Forum of Fargo-Moorhead reports police in Moorhead, MN, and West Fargo are now looking into whether she should face charges. “The concern we had was that they were specifically doing something that wasn’t lawful,” Moorhead police Lt. Tory Jacobson told The Forum. (more)

Business Espionage - "Corn ain't just chicken feed, Bubb"

Two Chinese agricultural scientists face charges after they were caught trying to smuggle a variety of seeds — stolen from a biopharmaceutical plant in Kansas — into China, Reuters reports.

After a tour of agricultural facilities and universities in the Midwest and Arkansas, the two Chinese nationals were caught with the seeds as they boarded a plane for home, the report says. 

(In a separate, but parallel espionage case, "Investigators found ears of corn stashed in an Illinois self-storage unit, dozens of bags of corn kernels stuffed under the seat of a car, and hundreds of pictures of corn fields and production facilities.")

Don’t be fooled because they’re “just” seeds. The unidentified victim of the theft had invested about $75 million in patented technology to create the seeds, the report says. (more)

...thus bringing back traditional spycraft.

Governments around the world may be compelled to wall off their Internet systems as nations and companies move to protect sensitive data amid increasing cybercrime and espionage, Kaspersky Lab Chief Executive Officer Eugene Kaspersky said.

Cybercrime is increasing and secret documents released by former U.S. National Security Agency contractor Edward Snowden have heightened technology company concern about espionage. Some governments and corporations may even scrap information-technology systems in some cases, moving critical data back to paper, Kaspersky said. (more)

Interpretation

• Hacking is easier than traditional spycraft.  
• Computerization = low-hanging fruit for the business espionage and criminal crowds. 
• Throwing security budgets to the IT folks is not effective enough. 
• Solution... keep your secrets off the web, and out of the computers. 
• Anticipate... Traditional spycraft (bugging, tapping, intrusions, moles, etc.)
• Arm yourself... Put a counterespionage consultant on your team.

The Road to Farewellville

A police department in Battle Creek, Michigan is being sued by one former officer and two currently employed cops who say their superiors secretly installed a surveillance camera in the woman’s locker at a local precinct...

According to the claim, Inspector Maria Alonso of the department’s Internal Affairs Division was told in late 2012 that there had been instances of theft occurring in the women’s’ locker room of the Battle Creek Police Department. Upon approval of her superiors, Alonso installed a surveillance camera in the room sometime the following January and used evidence obtained by it to allegedly implicate a plaintiff in the case of robbing co-workers by rifling through their lockers.

Plaintiff Laurie Gillespie was shown the video shortly after and, according to the complaint, was depicted in the clip “going through at least two open lockers” while in uniform... She was ultimately terminated less than two months later. (more)

Data Security and Breach Notification Act of 2013 & Information Security Tips

American IT departments' decisions could inadvertently put organizations at risk of an information security breach if they don't have sufficient protocols for the disposal of old electronic devices...
Despite the many public wake-up calls, most American organizations continue to be complacent about securing their electronic media and hard drives...

Congress is hoping to hold businesses accountable for the protection of confidential information with the introduction of the Data Security and Breach Notification Act of 2013, which will require organizations that acquire, maintain, store or utilize personal information to protect and secure this data. (q.v.)

Mitigation tips:

• Think prevention, not reaction.
• Put portable policies in place for employees with a laptop, tablet or smartphone to minimize the risk of a security compromise while traveling;
• Protect electronic data. Ensure that obsolete electronic records are protected as well. (Remember, all that data was somewhere else before it became electronic data. Protect that too.)
• Create a culture of security. Train all employees on information security best practices... Explain why it's important, and conduct regular security audits (including TSCM) of your office to assess security performance. (more)