Monday, August 7, 2006

Slashdot | Reuters Admits, Pulls Doctored Photos fragmentate points to a post on PopPhoto which says "Reuters pulled a photograph of burning buildings in Beirut yesterday after a post on the Little Green Footballs blog outed it as digitally manipulated. The photo, filed on Saturday by freelance photographer Adnan Hajj, ran with the caption "Smoke billows from burning buildings destroyed during an overnight Israeli air raid on Beirut's suburbs." --- Fragmentate adds "Another image from the same photographer was found to have been doctored. Whether you're a CNN fan, or a FoxNEWS fan, you have to wonder how much of what we see is fake, or exaggerated." 9:23:59 PM  PermaLink   / trackback []

Slashdot | AOL Releases Search Logs of 657,427 Users An anonymous reader writes "AOL has released the search logs of over 650,000 users for research purposes. This looks like it may become a public relations disaster for AOL, as well as a privacy nightmare for the users involved as Michael Arrington of TechCrunch notes: "AOL has released very private data about its users without their permission. While the AOL username has been changed to a random ID number, the ability to analyze all searches by a single user will often lead people to easily determine who the user is, and what they are up to. The data includes personal names, addresses, social security numbers and everything else someone might type into a search box." This is also being covered on The Paradigm Shift and Oh My News." fantomas adds " Looks like they've just taken it down but it's still available on The Pirate Bay; not sure why but some of the academic researchers are going crazy musing the ethical aspects of letting the world know who's searching for how to kill their wives ..." --- Update: 08/07 21:32 GMT by T : amromousa writes "AOL is now apologizing for the release ..., calling it a "screw-up," which they're upset and angry about." 9:18:50 PM  PermaLink   / trackback []

State and Federal Governents Clash on NSA Snooping. State and Federal Governents Clash on NSA Snooping. An anonymous reader writes "In what could set the stage for an indirect decision over the NSA domestic surveillance program, The Justice Department has threatened the state of Maine with a lawsuit should the state's Public Utilities Commission investigate complaints from Maine customers that Verizon, by cooperating with the NSA without their customers' consent, violated privacy laws. Maine's PUC is expected to make its decision today. (More from the article below.) [Slashdot: Your Rights Online] 9:14:29 PM  PermaLink   / trackback []

Covert surveillance allowed in China law Pro-Beijing lawmakers in Hong Kong have approved legislation granting authority to police to conduct covert surveillance. Such surveillance includes wiretapping phones, bugging offices and residences and monitoring e-mail, The New York Times reported. The bill passed on a vote of 32-0 in the 60-member Legislative Council. The Democratic party and other opponents of the bill had reportedly tried to introduce close to 200 amendments in four days of debates, many of them citing the issue of personal privacy. However, all were defeated or ruled out, the Times said. 9:01:48 PM  PermaLink   / trackback []

Privacy Predicament. Privacy Predicament. Protecting the private information of customers has become a high-stakes affair for most companies. [Computerworld Privacy News] 8:58:36 PM  PermaLink   / trackback []

Maryland police arrest pair in theft of VA laptop. Maryland police arrest pair in theft of VA laptop. Maryland police have arrested two 19-year-old men and charged them with the theft of a laptop containing data on 26.5 million military veterans and active-duty personnel in May. A third person, a juvenile, also faces charges in the case. [Computerworld Privacy News] 8:54:39 PM  PermaLink   / trackback []

New Data Thefts at Department of Veterans Affairs. New Data Thefts at Department of Veterans Affairs. Computer may have contained names, addresses, SSN's, DOB's, dates of military service, and medical information [GT: Security and Privacy] 8:51:31 PM  PermaLink   / trackback []

EFF - AOL's Data Valdez Violates Users' Privacy. AOL's Data Valdez Violates Users' Privacy. As reported by TechCrunch and now the major media, AOL intentionally released three months of search queries by 650,000 AOL users. Though AOL has removed the data from its site and rightly apologized, the grave damage is already done. The data is available all over the Net, and AOL may have violated its own privacy policy as well as existing federal law. Congress should heed the lessons of this Data Valdez and enhance protections for your privacy. Particularly considering the uproar over the Department of Justice's demands for just this kind of information from Google only months ago, AOL's actions demonstrate a shocking disregard for user privacy. Search terms can expose the most intimate details of a person's life and, in doing so, cause great harm. Consider just a few hypothetical situations. Would you want your employer or credit company knowing that you searched for "how to file for bankruptcy"? Would you want anyone to know you searched for "HIV positive clinic," "breast cancer health services," or another illness-related query? What about "rape victim" or "depression" plus "counseling"? What about searches that reference your political or religious affiliation, or your sexual orientation? Though the data was associated with random ID numbers, that information could still be connected back to an individual given enough clues. Consider, for instance, what vanity searches for one's own name or MySpace profile could reveal. This incident highlights the dangers of allowing search companies to store this kind of personal data. We're still investigating, but it appears this disclosure may violate the Electronic Communications Privacy Act (ECPA), which strictly regulates disclosure of your Internet communications, along with AOL's own privacy policy. Regardless, Congress should take note of this latest Data Valdez by creating stronger, crystal clear legal protections for user information and by limiting data retention. [EFF: Deep Links] 8:19:46 PM  PermaLink   / trackback []

C0D3 CR4CK3D: Means and Methods to Compromise Common Hash Algorithms. C0D3 CR4CK3D: Means and Methods to Compromise Common Hash Algorithms. In this paper, Kevin Redmon discusses the means and methods that cryptanalysts use to compromise several hash algorithms. He also discusses ways to decrease the opportunity for a compromise of a hash or its source data. By Kevin C. Redmon. [Infosec Writers Latest Security Papers] 7:57:17 PM  PermaLink   / trackback []

AOL Search Data Reportedly Released. AOL Search Data Reportedly Released. The apparent release of searches made by hundreds of thousands of users is raising privacy concerns. [PC World: Latest Technology News] 7:53:16 PM  PermaLink   / trackback []

AOL search data reportedly released. AOL search data reportedly released. America Online improperly made public details about Internet searches performed by hundreds of thousands of its subscribers, a move a company spokesman called a "mistake" that should never have happened. [Computerworld Data Mining News] 7:51:30 PM  PermaLink   / trackback []

Bigger, dafter, creepier - Gordon Brown's ID scheme rescue plan. Bigger, dafter, creepier - Gordon Brown's ID scheme rescue plan. Get the shops to pay for it, and catch villains for us... Analysis 'Sources' close to Chancellor Gordon Brown are floating plans to finish off ID cards entirely in the UK - although that isn't quite how they're putting it. Instead, the advance men for the Prime Minister in waiting are offering a nightmare pitch that harnesses the private sector to implement a total surveillance system while raking in revenue for the Government. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 7:49:37 PM  PermaLink   / trackback []

Senate ratifies Cybercrime treaty. Senate ratifies Cybercrime treaty. 'Symbolic gesture' The US Senate ratified the Convention on Cybercrime on Thursday, the first international treaty on computer-related crime and the gathering of electronic evidence. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 7:47:41 PM  PermaLink   / trackback []

AOL publishes database of users' intentions. AOL publishes database of users' intentions. Your search history, right here AOL Labs prompted a weekend of hyperventilation in the 'blogosphere' by publishing the search queries from 650,000 users. This mini-scandal may yet prove valuable, however, as it reveals an intriguing psychological study of the boundaries of what is considered acceptable privacy. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 7:45:46 PM  PermaLink   / trackback []

AOL 's $658 Million Privacy Breach? AOL 's $658 Million Privacy Breach? In a possible massive violation of federal privacy law, America Online released the logs of nearly 20 million web searches documenting three months of activity by 650,000 AOL users on Sunday ten days ago in an effort to share data with the search research community. Electronic Frontier Foundation attorney Kevin Bankston considers the publication of the pseudonymized search logs to be a violation of the Electronic Communications Privacy Act, arguing that the search terms are content under federal law and that the law doesn't distinguish between identifiable and non-identifiable communications. That law carries a minimum statutory damages of $1000 per person, which, if Bankston is right, would put AOL on the hook for $658 million minimum, even if it didn't violate its own privacy policy. "I think this is a massive violation of federal law and shows a shocking disregard for AOL users' privacy," Bankston said. Though AOL user id numbers were replaced with a randomized user number, some search histories could be personally revealing enough to be traced back to users. Each line in the file contains the anonymized user id, the search terms, the date, the time and the site the person clicked on. It was then possible to see all the user queries from a single account over a three month period. Queries in the logs range from the mundane "amy grant" to the possibly incriminating "buy ecstasy" or "free lolita pics" that could grab the attention of the police. "This is also an incredible boon to law enforcement, who can, if it chooses use this as a basis for subpoenas," Bankston said. "But we would argue that this is content and that if this is less than 180 days old it would require a search warrant. This sort of data trove is exactly what Google fought the Justice Department in court over last year. Google largely won that case, and turned over only a small amount of data to the government. Other companies, including AOL, did not fight their subpoenas and turned over larger amounts of search data. Some search histories seem to tell not very pretty stories. One starts with "how to talk sexy to your man" followed one day later by "cancer man love compatibility" and six days later by the queries "controlling ex spouses", "and "men who are emotionally abused" and "porn.com." Nine days later, someone typed in "borderline personality disorder" multiple times and then days later there were many queries about "men that are abused by wives." The queries seem to be coming from somewhere in Toledo, Ohio. Months later someone searched for "ohio correctional institute strkyer ohio," then for airline tickets to Detroit Wayne airport and then finally on the words "win him back." And more simply, people often "ego search" to see what information is about them on the web and then search for friends or family. And then sometime later they might search for something more private -- like for porn or health information or cheap prescription drugs. At least one 14 year old MySpace user from Indiana is identifiable -- and further searches readable, as is a woman who typed her dating profile url into the search box. Bankston sees the publication of the logs as a violation of a macro-privacy interest of society. "It's revealing some things about our society that many of us would prefer remain private," Bankston said. AOL quickly pulled down the AOL Research page on Sunday night and several hours later removed the data site from the web, though the file was quickly mirrored and is now available on peer-to-peer sites. AOL did not return a call for comment by post time, but did give News.com a written statement. So, once again, follow the advice of Adam Shostack: if there is something you want to search on or a site you want to visit which you wouldn't want to have emblazoned on your T-shirt, take some steps to anonymize your web usage. For some tips on how to do so, check out this Wired News How To Foil Search Engine Snoops story from last fall. Update: Changed post title and updated figure from $6.5 million to $658 million once I did the math right. [27B Stroke 6] 7:42:55 PM  PermaLink   / trackback []

AOL: Destroy the Originals? AOL: Destroy the Originals? It's only going to be a matter of days until some intrepid FBI agent trolls through the search records AOL posted online and starts dropping subpoenas on AOL to hand over user names associated with searches for morphine and lolita porn and possibly worse. If AOL really wants to protect its users and not get served with hundreds of subpoenas, they should be destroying the original logs right now. That way there's no way to identify the subscribers when the feds come a'calling. I'm pretty certain this would be legal, but I am so not a lawyer. I'm sure AOL's lawyers could figure this out. It might not get them off the hook for a $658 million fine if a judge finds the company violated a federal privacy law, but it might help. UPDATE: It may be against the law to destroy the logs if AOL is expecting a subpoena. That could be construed as destruction of evidence. But then again, in the fifteen minutes between posting the item and adding this update, I still did not get a law degree. My mother remains mostly quietly disappointed. Photo: hive [27B Stroke 6] 7:39:23 PM  PermaLink   / trackback []

AOL Proudly Releases Massive Amounts of Private Data. AOL Proudly Releases Massive Amounts of Private Data. [I've pasted this in its entirety from TechCrunch - unbelievable] AOL must have missed the uproar over the DOJ's demand for 'anonymized' search data last year that caused all sorts of pain for Microsoft and Google. That's the only way to explain their release of data that includes 20 million web queries from 650,000 AOL users. The data includes all searches from those users for a three month period this year, as well as whether they clicked on a result, what that result was and where it appeared on the result page. It's a 439 MB compressed download, expanded to just over 2 gigs. The data is available here [UPDATE:they've removed the file] and the output is in ten text files, tab delineated. The utter stupidity of this is staggering. AOL has released very private data about its users without their permission. While the AOL username has been changed to a random ID number, the abilitiy to analyze all searches by a single user will often lead people to easily determine who the user is, and what they are up to. The data includes personal names, addresses, social security numbers and everything else someone might type into a search box. The most serious problem is the fact that many people often search on their own name, or those of their friends and family, to see what information is available about them on the net. Combine these ego searches with porn queries and you have a serious embarrassment. Combine them with 'buy ecstasy' and you have evidence of a crime. Combine it with an address, social security number, etc., and you have an identity theft waiting to happen. The possibilities are endless. Marketers are going nuts over the possibilities, users are calling for a boycott of AOL, and others are just enraged: User 491577 searches for 'florida cna pca lakeland tampa', 'emt school training florida', 'low calorie meals', 'infant seat', and 'fisher price roller blades'. Among user 39509's hundreds of searches are: 'ford 352'Ae,, 'oklahoma disciplined pastors', 'oklahoma disciplined doctors', 'home loans', and some other personally identifying and illegal stuff I'm going to leave out of here. Among user 545605's searches are 'shore hills park mays landing nj', 'frank william sindoni md', 'ceramic ashtrays', 'transfer money to china', and 'capital gains on sale of house'. Compared to some of the data, these examples are on the safe side. I'm leaving out the worst of it - searches for names of specific people, addresses, telephone numbers, illegal drugs, and more. There is no question that law enforcement, employers, or friends could figure out who some of these people are. There is some really scary stuff in this data. I am assuming that AOL will take this page and the data down soon, but as of the time of this post it has been downloaded 809 times already. People I've spoken with are already building a web interface to the data. If you are an AOL customer, I feel sorry for you. Note that Microsoft has proposed releasing similar data to researchers, although with an important difference - the data is not associated with a user. Excite released data very similar to what AOL has done here, with user associations, in 1999. [More coverage here: siliconbeat, digg, reddit, zoli's blog] [michaelzimmer.org] 7:34:13 PM  PermaLink   / trackback []

AOL Data Includes Social Security Numbers. AOL Data Includes Social Security Numbers. Have you ever searched for your social security number to see if it happened to be posted online somewhere? Have you searched for it along with your name? Many do, and it has apparently been confirmed that the massive database of search history AOL released does include searches with users' social security numbers. From the Interesting People mailing list: A search for an SSN shaped regex on the full AOL search data returns a 191 results including repeat searches. Many of these have full names, and at least a dozen include either an addresses, drivers license number, date of birth or some combination of the three in the same query. There's no telling how much more information an aggregation of other queries by those same user ID would yield. I don't know what AOL was thinking[sigma] [michaelzimmer.org] 7:28:17 PM  PermaLink   / trackback []

AOL's Apology Misses the Mark. AOL's Apology Misses the Mark. AOL has issued an apology for releasing the logs of nearly 20 million web searches documenting three months of activity by 650,000 AOL users: "This was a screw-up, and we're angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant," AOL, a unit of Time Warner, said in a statement. "Although there was no personally identifiable data linked to these accounts, we're absolutely not defending this. It was a mistake, and we apologize. We've launched an internal investigation into what happened, and we are taking steps to ensure that this type of thing never happens again." While AOL did replace users' account names with an ID number, the data can still be personally-identifiable. Further, by linking multiple searches from the same ID number, interesting (and very personal) patterns emerge. From 27B Stroke 6: Some search histories seem to tell not very pretty stories. One starts with "how to talk sexy to your man" followed one day later by "cancer man love compatibility" and six days later by the queries "controlling ex spouses", "and "men who are emotionally abused" and "porn.com." Nine days later, someone typed in "borderline personality disorder" multiple times and then days later there were many queries about "men that are abused by wives." The queries seem to be coming from somewhere in Toledo, Ohio. Months later someone searched for "ohio correctional institute strkyer ohio," then for airline tickets to Detroit Wayne airport and then finally on the words "win him back." And more simply, people often "ego search" to see what information is about them on the web and then search for friends or family. And then sometime later they might search for something more private [~] like for porn or health information or cheap prescription drugs. At least one 14 year old MySpace user from Indiana is identifiable [~] and further searches readable, as is a woman who typed her dating profile url into the search box. [michaelzimmer.org] 7:21:19 PM  PermaLink   / trackback []