corps & govts: violating privacy with legal ease

google this: the price of violating privacy
from national post: Google Inc. violated Canadian privacy law by collecting personal information from unsecured wireless networks across the country for its Street View service, Canada’s Privacy Commissioner said Tuesday.

“Our investigation shows that Google did capture personal information - and, in some cases, highly sensitive personal information such as complete emails,” said Jennifer Stoddart, Privacy Commissioner of Canada, in a statement. “This incident was a serious violation of Canadians’ privacy rights,” she said.

Noting that thousands of Canadians were likely affected, Ms. Stoddart said personal information collected by Google’s iconic Street View cars included complete emails, email addresses, user names and passwords, names and residential telephone numbers and addresses. Some particularly sensitive information was also inadvertently captured, such as a list of people suffering from certain medical conditions complete with their full names and contact information...

Ms. Stoddart has given the world’s largest search engine a deadline of Feb. 1 to delete all offending Canadian data. She said her office will allow Google to keep any data relevant to ongoing legal proceedings as long as the data are secured and access is restricted. The company, which has already secured and restricted access to the Canadian payload data, is currently facing a number of lawsuits in the United States related to its Street View data-collection methods.

judge clears captcha-breaking case for criminal trial

eu may propose criminal sanctions, fines for data privacy cases
from bloomberg: European Union regulators may propose expanded criminal penalties to enforce data protection rules that limit what companies and governments can do with personal information. People should also have the right to have their details deleted and to remove lists of friends, photos or medical records, according to a European Commission document obtained by Bloomberg. The proposals may also make it easier for data protection authorities and consumer groups to file lawsuits over privacy breaches.

Google Inc. and Facebook Inc. are among several Internet companies that have come under European scrutiny for possible privacy breaches. Data-protection officials have criticized Facebook, the largest social-networking site, for putting users’ personal information and privacy at risk with recent policy changes. It’s “essential to have effective provisions on remedies and sanctions” including “criminal sanctions in case of serious data protection violations,” the paper from the EU’s executive agency says.

Privacy violations can be punished with jail time in Italy, where a court in February sentenced three Google officials to six-month terms, which were suspended. They were held responsible after a group of Turin school students filmed themselves bullying an autistic classmate and uploaded a clip to Google Video in 2006.

military asks media to omit leaked documents - as pentagon braces for release of 400,000 iraq files on wikileaks

secret-spilling sources at-risk following cryptome breach

cryptome says: wired complicit in federal crimes by hacker
from threat level: Secret-spilling site Cryptome was hacked over the weekend, possibly exposing the identities of whistleblowers and other confidential sources, according to a hacker who contacted Wired.com and claimed responsibility for the breach.

The hacker said two intruders from the group Kryogeniks breached the long-running site, where they gained access to a repository of secret files and correspondence. Among them, the hacker claimed, were the records of self-proclaimed WikiLeaks insiders who have been the source of several unconfirmed tips supposedly detailing internal WikiLeaks matters.

Wired.com could not confirm the identity of the hacker, who asked to be identified as “Ruxpin” or “Xyrix.” To verify his claims, the hacker showed Wired.com screenshots of Cryptome founder John Young’s Earthlink account inbox and Cryptome’s directory. The latter showed two WikiLeaks file paths. The hacker also provided a list of about 30 names and e-mail addresses of sources who communicated with Cryptome and the contents of one e-mail exchange between Young and a Wired.com contributor from 2008. The Wired.com contributor and Young have authenticated the e-mail.

related: hacker infiltration ends dc online voting tests

9/30 defcon: total domination & digital infringement

obama's internet wiretap move:
just one small facet of total domination project*
video: obama working on plan to wiretap skype, facebook, blackberrys & more*
wiretapped phones, now internet?*
100k+ germans ask google to blur their homes*
feds' requests for google data rise 20%*
net censorship takes center stage in 'online infringement' bill*
the leaked list & the digital economy act*
unpublished iraq war logs trigger internal wikikeaks revolt*
cia accused of using pirated software for drone assassination attacks*
fmr stasi cryptographers now develop technology for nato*

crack the code in cybercom's logo

"be sure to drink your ovaltine fight the net"
from danger room: The U.S. military’s new Cyber Command is headquartered at Ft. Meade, Maryland, one of the military’s most secretive and secure facilities. Its mission is largely opaque, even inside the armed forces. But the there’s another mystery surrounding the emerging unit. It’s embedded in the Cyber Command logo.

On the logo’s inner gold ring is a code: 9ec4c12949a4f3147
4f299058ce2b22a

“It is not just random numbers and does ‘decode’ to something specific,” a Cyber Command source tells Danger Room. “I believe it is specifically detailed in the official heraldry for the unit symbol... While there a few different proposals during the design phase, in the end the choice was obvious and something necessary for every military unit,” the source adds. “The mission.”

With that hint in hand, go crack this code open. E-mail us your best guess, or leave it in the comments below. Our Cyber Command source will confirm the right answer. And the first person to get it gets his/her choice of a Danger Room T-shirt or a ticket to the International Spy Museum.

update: code cracked! cybercom logo's mystery solved
from danger room: Okay, maybe it wasn’t that much of a mystery. In fact, it took a little more than three hours your Danger Room reader jemelehill to figure out the odd string of letters and numbers in the logo of the U.S. military’s new Cyber Command. Turns out, it’s the new unit’s mission statement, translated into 32 digits with the md5 cryptographic hash:

USCYBERCOM plans, coordinates, integrates, synchronizes, and conducts activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full-spectrum military cyberspace operations in order to enable actions in all domains, ensure freedom of action in cyberspace for the U.S. and its allies, and deny the same to adversaries.

Eventually, other commenters figured it out (especially after jemelehill’s solution made it to all the databases of cracked hashes). But that didn’t stop folks from offering their own, shall we say, creative guesses, in order to win one of two coveted prizes: a Danger Room t-shirt or a ticket to the International Spy Museum.

* “If you can read this, send your resume to jobs@nsa.gov.”
* “I’m sorry, Dave. I’m afraid I can’t do that.”
* “If the intelligence community is a family, think of us as the uncle no one talks about.”
* “Darmok and Jalad at Tanagra”
* “In God We Trust All Others We Monitor”
* “Why do people keep posting the wrong answers when someone solved it like 20 comments ago?”

Yahoo News, the Associated Press, Agence Presse France, Slashdot, El Reg, and the websites of the Washington Post and the L.A. Times all joined in the fun. The hubub even provoked this reponse from an official Defense Department blog:

I cracked the code, but you can keep my t-shirt.

google admits harvesting wi-fi data with street view cars

from v3.co.uk: Google has admitted that it has been recording data transmissions on Wi-Fi networks using its Street View cars.

Alan Eustace, senior vice president of engineering and research at Google, explained in a blog post that, while Google routinely collects wireless information such as network names, it has also been collecting payload data from open Wi-Fi points for the past four years.

"So how did this happen? Quite simply, it was a mistake. In 2006 an engineer working on an experimental Wi-Fi project wrote a piece of code that sampled all categories of publicly broadcast Wi-Fi data," he said. "A year later, when our mobile team started a project to collect basic Wi-Fi network data like SSID information and MAC addresses using Street View cars, they included that code in their software, although the project leaders did not want, and had no intention of using, payload data."

Eustace said that Google has shut down the Street View fleet until the company is sure that the software has been removed, and will bring in an independent third party to verify that the code has been expunged and fully deleted.

However, privacy watchdogs and consumer groups have pounced on the news as yet another example of Google's demonstrating a lack of concern for privacy.

"Google's computer engineers run amok, push the envelope and gather whatever data they can until their fingers are caught in the cookie jar," said John Simpson, consumer advocate with the Consumer Watchdog group. "Then a Google executive apologises, mouthing bafflegab about how privacy matters to the company."

Simpson added that Google's plan to have an unnamed third party study what went wrong, and to check that the improperly gathered private data has been eliminated, is inadequate. "That's like getting to pick the referees in a championship football game," he said.

related/updates:
google data collection eyed by congress, class action lawsuit*
google to offer encrypted search next week*