EHIP

Lawmaker urges regulations for file-sharing

US House Oversight and Government Reform Committee Chairman Edolphus Towns said during a hearing on the safety of peer-to-peer software that he was astonished at privacy breaches involving LimeWire, operated by the Lime Group.

"In the last administration, the Federal Trade Commission took a see-no-evil, hear-no-evil approach to the file sharing software industry. I hope the new administration is revisiting that approach."

Towns said he plans to meet with the new FTC chairman to request that the agency investigate whether inadequate safeguards on file sharing software such as LimeWire constitute an unfair trade practice.

Robert Boback, the head of Tiversa Inc, a private online security and intelligence firm, criticized the LimeWire software, saying corporate and government documents, as well as child pornography, can be downloaded.

He said peer-to-peer software has made it dangerously easy for snoopers to unearth extremely private information -- easier than rifling through someone's trash.

Automated summary from: Reuters Technology

Counter-terrorism investigators find alleged identity theft ring

On a spring day last year, a Pakistani man came to Shamsha Laiwalla looking for help. He told her he had recently jumped off a cargo ship docked in the Port of Los Angeles and was now looking to buy a new identity.

For years, the 44-year-old Pakistan native has offered customers a startling menu of illegal services as the architect of an extensive fraud ring involving several DMV employees she regularly paid to produce licenses and other documents, according to Los Angeles police and federal officials.

The Pakistani man was, in fact, an undercover detective in the Los Angeles Police Department's counter-terrorism bureau, which is headed by Downing.

"We have no idea how many thousands of people might be out there with these documents," said LAPD Det. Mark Severino, who helped run the investigation. "If we're talking about counter-terrorism issues, that's a scary thought. How do you track a man with a valid license and the name Rios?"

Two other women, one of whom was found guilty of identity theft charges in federal court alongside Laiwalla, are accused of procuring forged birth certificates and Social Security cards with legitimate numbers for about $1,500.

Automated summary from: The Los Angeles Times

GAO report cites government weaknesses, data leakage

Weak security policies and practices in nearly all 24 major federal agencies in 2008 have resulted in exposing personally identifiable information of Americans, according to a new report from the Government Accountability Office (GAO).

An underlying reason for these weaknesses is that agencies have not fully implemented their information security programs," according to the GAO report, issued Monday.

The GAO conducts a periodic review of information security policies and procedures at federal agencies. Inspectors general review agency conformity to the Federal Information Security Management Act of 2002 (FISMA) and report their findings to Congress.

The number of security incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US-CERT) rose over 200% over the past 3 years, increasing from 5,503 incidents reported in fiscal year 2006 to 16,843 incidents in fiscal year 2008.

Nearly half of information security control weaknesses pertained to access controls, according to the GAO review of reported incidents. Many agencies are also granting too many rights or permissions to users. In one agency, "1,100 users had access to mainframe system management utilities although such access was not necessarily required to perform their jobs." The permission gave them the ability to alter hardware configurations supporting the production environment.

Automated summary from: Information Security Magazine

Ministry unveils eHealth privacy measures

British Columbians wanting to limit the amount of access health care providers have to their electronic health records can now apply for a disclosure directive from the Ministry of Health Services.

Since Friday, July 17, patients have been able to request a form from the ministry that when completed will allow them to block health care providers from accessing their lab results.

A patient-provided keyword will enable temporary access by medical professionals if the patient wants the information made available in certain situations.

Health care providers are also able to override the disclosure directive in emergencies.

The disclosure directive is a key part of the ministry’s response to privacy concerns related to electronic health records.

But privacy rights advocates have expressed serious concern that the disclosure directives and roles-based access cannot ensure the protection of sensitive health information.

A coalition called BC’s Big Opt Out continues to demand that every British Columbian be given the choice to participate in eHealth by giving or withholding their informed consent.

The group cautions that privacy measures can easily be revoked and the system remains susceptible to security breaches.

Automated summary from: The Hook

Facebook breaches Canadian privacy law: commissioner

Facebook shares its users' personal information with developers who create games and quizzes in a way that breaches Canadian privacy law, the Office of the Privacy Commissioner of Canada has found.

The office's main concern was that users could not always give "meaningful consent" to the use of their personal information due to a lack of transparency on the site.

The Office of the Privacy Commissioner's report found that Facebook continues to breach PIPEDA in four ways and it made recommendations to correct the problem.

• Facebook doesn't have enough safeguards to prevent 950,000 third-party developers around the world from getting unauthorized access to users' personal information, nor does it ensure users have given "meaningful consent" to allow their personal information to be disclosed to the developers.
• Facebook keeps information from accounts deactivated by users indefinitely.
• Facebook keeps the profiles of deceased users for "memorial purposes" but does not make this clear. 
• Facebook allows users to provide personal information about non-users without their consent. For example, it allows them to tag photos and videos of non-users with their names, and provide Facebook with their email addresses to invite them to join the site.

Denham and privacy commissioner Jennifer Stoddart emphasized, however, that they aren't telling people to stay away from social networking sites.

Denham added that users also need to take responsibility by reading privacy policies and using the information to make their own choices.

Automated summary from: CBC News

The Information Commissioner's Office has warned another five trusts to clean up their data practices

The Information Commissioner's Office (ICO) has repeated its calls for the NHS to sort out its data handling, issuing warnings to five trusts after breaches.

The five new incidents are classic data breaches - lost USB sticks, stolen laptops, documents left on public transport.

All of the trusts have promised the ICO they will shape up their data protection by locking offices, encrypting devices and training staff.

Sally-Anne Poole, head of enforcement and investigations at the ICO, said in a statement that the five cases should serve as a reminder to NHS bodies to keep patient data safe.

"Failure to do so could result in patient information, including sensitive medical records and treatment details falling into the wrong hands."

Automated summary from: ITPro

LexisNexis issues data breach warning after alleged mafia bust

Information broker LexisNexis has warned more than 13,000 consumers, saying that a Florida man who is facing charges in an alleged mafia racketeering conspiracy may have accessed some of the same sensitive consumer databases that were once used to track terrorists.

The office of the New Hampshire Attorney General posted a letter that LexisNexis sent out to consumers last month, warning that Klein may have used his access to LexisNexis' Seisint databases "in order to perpetrate certain crimes."

LexisNexis has had problems with credit card fraudsters using its database in the past, but Klein's alleged crimes are different.

In court filings, the DOJ says Klein would provide Bonanno family members with names, addresses and account numbers as part of a fake check-cashing operation.

Automated summary from: ComputerWorld UK

Computer virus copied thousands of Alberta health records

The personal health information of thousands of Albertans was skimmed from the Alberta Health Services Edmonton network in May as a computer virus infected the network.

Alberta Health Services has sent letters to the 11,582 people whose information may have been captured by the virus between May 14 and May 29.

The computer virus that infected computers in the AHS-Edmonton network, believed to have been introduced by an external computer, was new and previously unknown to the AHS anti-virus software vendors, Bill Trasford, senior vice-president and chief information officer for Alberta Health Services said Wednesday.

"The way the virus worked, it would capture what was on a computer screen and then transmit it out to an external website," Trasford said. "So lab results, diagnostic imaging reports, things like that," he said.

Automated summary from: CBC News

Man faces identity theft charges

A 29-year-old Alberta man has been charged in an alleged identity theft ring after police seized hundreds of credit cards, bank cards and various forms of identification.

The stolen information and property, belonging to more than 100 people, was taken mainly from vehicles and gym locker-rooms, as well as some homes and businesses, Edmonton police Det. David Butt said.

Officers also recovered a universal memory exchanger designed to transfer data--contact numbers, personal information and photos --from one cellphone to another.

The man was arrested on June 24 following a traffic stop. A search of the vehicle turned up a stack of credit cards, debit cards and personal and banking information stolen from Edmonton and other Alberta communities.

Investigators then learned of a storage locker containing a larger collection of items. They searched it the next day, finding cellphones, flash drives, gift cards, lottery tickets and banking documents, as well as more credit and debit cards.

Automated summary of: The Edmonton Journal

Canadians keep falling for Nigerian letter scam, experts say recession a factor

Fraud artists are finding it easier amid a battered economy to entrap marks with dubious offers once easily dismissed as scams, and are snaring a growing number of victims to the tune of millions of dollars a month, experts say.

Statistics provided by Phonebusters - the Canadian anti-fraud call centre run by the Royal Canadian Mounted Police, the Competition Bureau and Ontario Provincial Police - show Canadians are increasingly falling prey to scams of all types.

Vulnerable people sometimes lower their defences and make bad decisions as times get tough, while others on the borderline of lawful society turn to crime, Nielsen-Jones said.

Among those is the so-called Nigerian letter scam, which typically offers too-good-to-be true promises of untold millions from an African country in exchange for some simple help with a few bank transactions.

In the first six months of the year, Phonebusters has heard from more than 7,000 mass-marketing fraud victims, including 3,903 Canadians, with losses totalling almost $26.5 million.

Automated summary from: The Canadian Press