PRIVACY — THE HEADLINES
2001/11/27
FBI spy software to crack encryption wall
2001/11/07
Europe goes after the cookie
2001/10/24
Beyond Carnivore: FBI eyes packet taps
2001/10/22
XP/IE pry on users
2001/10/16
US meet offshore privacy laws
PRIVACY — THE LINKS
There are 1 links to external Web sites for this category.
The file was last modified on: Thursday; 2001/05/03, 11.37 MEST
Submit a link:
PRIVACY — THE NEWS
2001/11/27
14:05 +0100
[Privacy] The FBI is developing software capable of inserting a computer virus onto a suspect's machine and obtaining encryption keys, a source familiar with the project told MSNBC.com. The software, known as "Magic Lantern," enables agents to read data that had been scrambled, a tactic often employed by criminals to hide information and evade law enforcement. The best snooping technology that the FBI currently uses, the controversial software called Carnivore, has been useless against suspects clever enough to encrypt their files.
Magic Lantern installs so-called "keylogging" software on a suspect's machine that is capable of capturing keystrokes typed on a computer. By tracking exactly what a suspect types, critical encryption key information can be gathered, and then transmitted back to the FBI, according to the source, who requested anonymity.
The virus can be sent to the suspect via e-mail—perhaps sent for the FBI by a trusted friend or relative. The FBI can also use common vulnerabilities to break into a suspect's computer and insert Magic Lantern, the source said. Magic Lantern is one of a series of enhancements currently being developed for the FBI's Carnivore project, the source said, under the umbrella project name of Cyber Knight.
The FBI released a series of unclassified documents relating to Carnivore last year in response to a Freedom of Information Act request request filed by EPIC. The documentation was heavily redacted—most information was blacked out. They included a document describing the "Enhanced Carnivore Project Plan," which was almost completely redacted. According to the anonymous source, redacted portions of that memo mention Cyber Knight, which he described as a database that sorts and matches data gathered using various Carnivore-like methods from e-mail, chat rooms, instant messages and Internet phone calls. It also matches the files with the necessary encryption keys.
AP and Washington Post had reported, that antivirus software company McAfee Corp. contacted the FBI to ensure its software wouldn't inadvertently detect the bureau's snooping software and alert a criminal suspect. McAfee's mother company, Network Associates, has strictly declined this statement, saying, "FBI activities are not our concern. We design software to detect malicious code, no matter who places it in a system," so the spokesman of NAI Germany, Alexander Wegner.
:: [dre].
Comments (0)
2001/11/07
14:20 +0100
[Privacy] The "cookie," a simplistic identification tag that most Internet users unknowingly carry when surfing the Web, runs the risk of being outlawed under a proposed privacy directive from the European Commission, says a Reuters report at wired news com. The legislation has triggered concern in Europe's Internet advertising community. The Interactive Advertising Bureau UK (IAB) said British companies could lose 300 million Euro ($270 million) if the directive is ratified.
"Cookies have been branded as spyware tools, or some kind of subversive software," Danny Meadows-Klue, chairman of the IAB, told Reuters. "But it's what we use everyday." The IAB has marshaled support from its members across Europe to launch a lobbying effort it calls "Save our Cookies." Meadows-Klue said the abolition of the cookie—an early Internet technology designed for the first Web browsers—could have an adverse impact on e-commerce and online advertising sales, the primary revenue sources for all Internet businesses.
The legislation winding through the EU Parliament claims the cookie is a threat to consumers' personal privacy as it collects data on their comings and goings without asking for their consent. Website operators typically monitor bulk cookie data to determine which areas of its site are most popular with visitors. News sites, for instance, could use the data to determine where to position a story on a Web page based on where visitors have clicked in the past. The data is also reviewed in this way to decide where to purchase banner ads to draw likely visitors to your site.
But the sticky point about cookies is that they often store data without a user's explicit approval. The Commission has been debating whether individuals should have the last word—lawmakers call this the "opt in" method—on what bits of personal information are collected on them while online. // c.f. SecuritySpace
:: [dre].
Comments (0)
2001/10/24
20:51 +0100
[Privacy] Expect the FBI to expand its Internet wiretapping program, says a source familiar with the plan, according to an Interactive Week article.
Stewart Baker, a partner with law firm Steptoe & Johnson, is a former general counsel to the NSA. He says the FBI has spent the last two years developing a new surveillance architecture that would concentrate Internet traffic in several key locations where all packets, not just e-mail, could be wiretapped. It is now planning to begin implementing this architecture using the powers it has under existing wiretapping laws. The FBI has acknowledged a program called Carnivore, which sniffs e-mail messages, but the new program is more extensive, Baker says.
"The FBI has been gradually developing a set of guidelines, standards—call it what you will—a list of what law enforcement wants from packet data communications systems," Baker said. "And they are in the process of unveiling that over the next few months to ISPs and router manufacturers and the like."
ISPs, Web hosters, vendors and other firms handling critical Internet infrastructure should expect the FBI trying to schedule meetings to deliver the details of their offering, and show the document containing the technical specifications, Baker said. He indicated that details of what this new surveillance architecture should look like are not clear. It is also possible the FBI has retained some well-known data infrastructure consulting firms to develop its new technology.
Whatever the new initiative ends up looking like, the ISP community could be more likely to co-operate, shaken up by 9/11, said industry executives. But no one has heard of the FBI going beyond Carnivore at this point. "The FBI are trying to get Carnivore with a lot more ISPs," said Patrick Sweeney, president and chief executive of ServerVault, a Web hosting firm specializing in secure hosting. // c.f. intern
:: [dre].
Comments (0)
2001/10/22
22:37 +0100
[Privacy] Companies using Microsoft Office XP and Internet Explorer 5 have been warned that documents containing personal information could be sent to Microsoft along with debugging information in the event of a program crash. The feature that reports errors sends crash and debugging information back to Microsoft to help the company detect and fix bugs in its software. But the US Department of Energy's Computer Incident Advisory Capability office (CIAC) has released a security bulletin reporting that the debugging information includes an image of the current contents of the PC's memory, which may include all or part of the document being viewed or edited.
"If a sensitive document is resident in the memory dump, this could be sent to Microsoft," said Graham Cluley, senior technology consultant at antivirus firm Sophos. "This is not a serious problem but an interesting foible." The CIAC bulletin states that the error reporting function is configured to "automatically" send debugging information to Microsoft and says the relevant dialog box does not make it obvious that the contents of the document being edited may be sent along with information about the program crash.
But Microsoft says the reporting function asks for permission before any information is forwarded, while additionally offering the option of turning the feature off from all company desktops. "We make it clear to customers that when a problem occurs, their Digital Product ID and Internet Protocol (IP) address will be sent to us," said Neil Laver, Windows marketing manager. "The report could also contain customer-specific information, which could be used to identify a person's identity, but will not be used." Laver said Microsoft also limits the number of people who have access to the bug reports.
Cluley thinks it's unlikely that many companies will be sending bug reports over the Internet but warned that "whenever any kind of communication takes place on the Internet, there is always the opportunity for people to intercept it." // c.f. CyberCrime-Alerts, intern
:: [dre].
Comments (0)
2001/10/16
12:14 +0100
[Privacy] Information technology (IT) managers have long known that privacy rules can have a direct impact on database design and customer relationship systems, IDG.net reports.
Now, they're also learning that international privacy requirements can affect IT in ways that you wouldn't expect. Take the case of a US company that conducts remote periodic scans of PCs at its European offices from its headquarters to ensure its systems are operating with an accurate inventory of licensed software. It also conducts remote virus scans.
But before these scans can be conducted, European rules state that the employee who works on the PC must be notified that the system is about to be scanned. The rules were intended to give employees notice if a company decided to review data files or a browser's cache files, but they also affect routine system maintenance.
US corporations are struggling to comply with the EU's privacy rules as well as an emerging set of stringent data-sharing requirements in Canada. E.g., Procter & Gamble in Cincinnati, Ohio, solved the problem of global privacy compliance by adopting a set of customer privacy rules that can meet Europe's standards—standards that are considered the most demanding because of provisions giving customers access to data about them and allowing them to choose how that data is used. Canada has adopted a set of privacy rules similar to the European rules.
"If you're not giving [consumers] control, why should they have any confidence in giving information to you?" says Procter & Gamble's privacy manager at the Privacy 2001 conference sponsored by the Ohio Supercomputer Center's Technology Policy Group in Columbus. // c.f. intern
:: [dre].
Comments (0)
|