Perilocity

Loopholes Closed by FTC in CAN-SPAM Act Rules

The U.S. FTC has updated its regulations regarding the CAN-SPAM Act (PDF) to require:

(1) an e-mail recipient cannot be required to pay a fee, provide information other than his or her e-mail address and opt-out preferences, or take any steps other than sending a reply e-mail message or visiting a single Internet Web page to opt out of receiving future e-mail from a sender;

(2) the definition of “sender” was modified to make it easier to determine which of multiple parties advertising in a single e-mail message is responsible for complying with the Act’s opt-out requirements;

(3) a “sender” of commercial e-mail can include an accurately-registered post office box or private mailbox established under United States Postal Service regulations to satisfy the Act’s requirement that a commercial e-mail display a “valid physical postal address”; and

(4) a definition of the term “person” was added to clarify that CAN-SPAM’s obligations are not limited to natural persons.

— FTC Approves New Rule Provision Under The CAN-SPAM Act, Press Release, FTC, May 12, 2008

These changes appear to tighten up what is required of marketers; they have to say who they are and they can't weasel out by claiming a corporation is not a person.

However, it's not clear to me why it's opt-out that's required; why not opt-in? I never trust a spammer to process an opt-out; I assume they're just collecting more addresses. Plus the spammer still has ten days to process opt-out requests.

-jsq

Band Uses CCTV to make Music Video

This is clever:

Unable to afford a proper camera crew and equipment, The Get Out Clause, an unsigned band from the city, decided to make use of the cameras seen all over British streets.

With an estimated 13 million CCTV cameras in Britain, suitable locations were not hard to come by.

They set up their equipment, drum kit and all, in eighty locations around Manchester – including on a bus – and proceeded to play to the cameras.

— The Get Out Clause, Manchester stars of CCTV. By Tom Chivers, Telegraph.co.uk, Last Updated: 6:54PM BST 08/05/2008

Then they requested copies of the coverage from the various companies and law enforcement organizations owning the cameras through the British Data Protection Act, and got enough to use. They even managed closeups.

So maybe there is a use for CCTV, even though it's failed at crime prevention. It's a huge arts subsidy program!

-jsq

Class Action Coming for Identity Theft?

It wouldn't be a moment too soon:

I painfully predicted a few years back that phishing and related identity theft would result in class action suits. I lost my bet as it didn't happen fast enough, but a significant step has been taken (reported by Lynn) with the publication of a book that apparently blames the banks and the software manufacturers for identity theft.

— Signs of Liability: 'Zero Day Threat' blames IT and Security industry, Ian Grigg, Financial Cryptography, April 14, 2008

The book review iang quotes gets it about online crime not being amateur anymore: it's organized. And it gets it about perhaps a more important point:

Censorship as Security: GoDaddy Delists Cop Rating Web Site

This is security?

A new web service that lets users rate and comment on the uniformed police officers in their community is scrambling to restore service Tuesday, after hosting company GoDaddy unceremonious pulled-the-plug on the site in the wake of outrage from criticism-leery cops.

— GoDaddy Silences Police-Watchdog Site RateMyCop.com, By Kevin Poulsen, ThreatLevel, March 11, 2008 | 8:42:42 PM

Heaven forbid we should have public oversight of public servants.

This is customer service?

Privacy in Germany: Courts Support It

Interesting that Germany has more respect for privacy than the U.S. does:

Government surveillance of personal computers would violate the individual right to privacy, Germany's highest court found Wednesday, in a ruling that German investigators say will restrict their ability to pursue terrorists.

The Karlsruhe-based Federal Constitutional Court said in a precedent-setting decision that data stored or exchanged on a personal computer is effectively covered under principles of the constitution that enshrine the right to personal privacy.

"Collecting such data directly encroaches on a citizen's rights, given that fear of being observed ... can prevent unselfconscious personal communication," presiding judge Hans-Juergen Papier said in his ruling.

— Court Shoots Down Computer Surveillance, By MELISSA EDDY, Associated Press Writer, 27 Feb 2008

Although apparently Germany also has lazy cops who think spying on individuals is their birthright, just like in the U.S. Not regular police, mind you, but

...secret services' ability to use virus-like software to monitor suspected terrorists' online activity.

The court rightly said suspicion is not enough:

"Given the gravity of the intrusion, the secret infiltration of an IT system in such a way that use of the system and its data can be searched can only be constitutionally allowed if clear evidence of a concrete threat to a prominent object of legal protection exists," Papier said.

And a judge has to approve it.

Now that's risk management.

-jsq

Canadian Breach Reporting

Michael Geist's top tech law issue for Canada for 2008 is:

Security Breach Reporting Rules Are Introduced. Scarcely a week went by last year without a report of a security breach that placed the personal data of thousands of Canadians at risk. Last spring, a House of Commons committee acknowledged that the country needs mandatory security breach disclosure legislation that would require organizations to advise Canadians when they have been victimized by a breach.  A public consultation on the issue concludes next week and new regulations will be introduced before the summer.

— Eight Tech Law Issues To Watch in 2008, Michael Geist, Tuesday January 08, 2008

That would be a good thing.

-jsq

Bot Roast II: FBI Cracks Down on Bot Herders

FBI indicts, and in some cases gets guilty pleas or sentences, eight people they say were involved in botnet-related activities:

Secure Computing's prinicipal research scientist Dmitri Alperovitch was quite happy about the news.

"We welcome this news and applaud the FBI's efforts and law enforcement worldwide in attempting to cleanup the cesspool of malware and criminality that the botmasters have promoted," Alperovitch said in a press release. "Since botnets are at the root of nearly all cybercrime activities that we see on the Internet today, the significant deterrence value that arrests and prosecutions such as these provide cannot be underestimated."

— FBI Cracks Down (Again) on Zombie Computer Armies, By Ryan Singel, Threat Level, November 29, 2007 | 4:54:32 PM

Indeed, good news.

Now where are the metrics to show how much effect this actually had on number of botnets, number of bots, criminal activities mounted from bots, etc.? Baseline, ongoing changes, dashboard, drilldown?

-jsq

PS: Interestingly, every blog or press writeup I've seen about this misuses the word "hacker" to apply to these crackers, yet the actual FBI announcement never makes that mistake: it says cyber crime.

Antitrust and Microsoft: Still on the Table?

More time to determine whether Microsoft has a monopoly?

Microsoft, state prosecutors, and the U.S. Department of Justice on Tuesday said a federal judge needs more time to weigh whether Redmond should be subjected to a lengthier period of antitrust policing.

In a joint filing with U.S. District Judge Colleen Kollar-Kotelly, who has been overseeing Microsoft's antitrust compliance, they asked for a soon-to-expire oversight period to be temporarily extended until at latest January 31, 2008. That way, the judge will have more time to weigh the merits of last-minute pleas from a number of state prosecutors to add another five years to the oversight regime.

Right now, most of Microsoft's 2002 consent decree with the Bush administration is set to expire November 12. One small portion, related to a communications protocol licensing program that has encountered numerous delays since its inception, has already been extended through November 2009.

— U.S.-Microsoft antitrust deal to get temporary extension, by Anne Broache, C|Net News.com News blog, October 30, 2007 2:24 PM PDT

The story says the judge and Microsoft are expected to agree to the extension. Not surprisingly, there's an objection from a different quarter:

The Justice Department has already said it doesn't believe there's any need to extend the oversight period and that the agreement with Redmond has been working as designed.

It's state prosecutors from 10 states who are driving this extension.

These days we don't have Teddy Roosevelt to bust trusts, nor even William Howard Taft, whose Department of Justice started 80 antitrust lawsuits. Maybe the states can do it.

-jsq

Fingerprint False Positives

Not all that glitters is gold:

"Fingerprints, before DNA, were always considered the gold standard of forensic science, and it's turning out that there's a lot more tin in that field than gold," he said. "The public needs to understand that. This judge is declaring, not to mix my metaphors, that the emperor has no clothes."

— Judge bars use of partial prints in murder trial, By Jennifer McMenamin, Sun Reporter, October 23, 2007

The judge did this because of the partial fingerprint false positive linking an Oregon lawyer to the Madrid bombings. Apparently that was only one of twenty false matches in that case. So the judge in this homicide case has ruled that partial fingerprint matches can't be used as evidence.

At a pretrial hearing in May, prosecutors argued that fingerprint evidence has been accepted by the courts and relied upon for nearly 100 years. Defense attorneys countered that there is no similar history of subjecting the evidence to scientific review.

"The state is correct that fingerprint evidence has been used in criminal cases for almost a century," Souder, the judge, wrote in her decision. "While that fact is worthy of consideration, it does not prove reliability. For many centuries, perhaps for millennia, humans thought that the earth was flat."

So if a hundred year old "gold" standard of evidence turns out to be tin, what about all the wide-scan wiretap dragnet evidence that certain governments seem intent on compiling these days?

-jsq

PS: Seen on Bruce Schneier's blog.

eCrime Papers Posted

The APWG eCrime Researchers Summit has released its papers by linking them to its agenda. Lots of interesting stuff there about phishing and website takedown, capture and recapture, password reuse, behavorial reaction, etc.

There were also sessions on getting technology solutions adopted and user education, but those appeared to be panels, and don't have papers posted.

-jsq