Department of Homeland Security (DHS) Secretary Janet Napolitano today announced the launch of a virtual job fair at www.dhs.gov/cyberjobfair to recruit cybersecurity experts—capitalizing on DHS’ recently acquired authority to recruit and hire up to 1,000 cybersecurity professionals across the Department over the next three years.

Through the virtual job fair, DHS is looking for applicants with experience in cyber risk and strategic analysis; malware/vulnerability analysis; incident response; exercise facilitation and management; vulnerability detection and assessment; intelligence analysis; and cyber-related infrastructure interdependency analysis.

DHS: Secretary Napolitano Announces Virtual Job Fair to Expand Cyber Workforce

The Obama administration is trying to ease Canadians' concerns that by crossing the U.S. border they risk their right to privacy and the abandonment of their information to Big Brother databases.

"I know there's this myth that the United States is one big database. There absolutely is the myth - and that is not the case," Mary Ellen Callahan, the chief privacy officer for the U.S. Department of Homeland Security, said in an interview during a recent visit to Ottawa.

Nah, its a bunch of big databases, but its ok, they're all interconnected.

However, Canadians were reminded that U.S. border searches can be intrusive last week when, only hours after Ms. Callahan spoke in Ottawa, Toronto science fiction writer Peter Watts was stopped as he tried to leave the U.S. He later complained he was assaulted and arrested when he tried to ask border officers why they were searching his car.

Apparently it was a rather serious altercation - Watts has been charged with assault.

Mr. Watts got his possessions back Saturday, except for a computer and flash drive, which he will get back later - and Chief Smith insisted that while border officers can look through such equipment for evidence of crimes, they didn't copy the information. "We're not allowed to keep the information off of anybody's personal computer or flash drive," he said. "We can look at it, but we can't maintain it."

Mr. Watts said in an interview yesterday that what happened to him was more akin to police brutality than Big Brother information gathering. "But I have to admit there is this crawly feeling - they now have access to all my financial data, and more importantly, all my e-mails."

According to DHS, the US only performed an in depth search of 40 laptops between October 1, 2008 and May 5, 2009. So, about 80 laptops a year. Out of millions of travelers, this science fiction author's laptop was selected to be one of the 80 that are given an in depth search? Why? Because there is no standard of suspicion required for seizure of laptops at the border, DHS doesn't need to have a reason.

This is a perfect example of why we must change the law to require reasonable suspicion for in depth laptop searches. People don't like being searched. People who are randomly selected at the border for search are occasionally going to be indignant about it. Generally speaking, getting in a argument with a police officer is a stupid thing to do, but people do it. Its human nature. Its also human nature for authority figures to get aggressive with people who question them.

It may be the case that CBP has a reason to be suspicious of Peter Watts. Something he said or did or maybe even the nature... [ Read More (0.2k in body) ]

Search of Peter Watts demonstrates why more rules are needed for border searches.

flynn23 wrote:
The problem is not whether people can opt out or not. At some point, opting out will make you a second class citizen, or even a criminal in some places, because having data about you will be required to make certain transactions or participate in basic services.

I should be clear - what I was discussing at WWW2007 wasn't about providing people with a way to opt out of services - it was about providing a way for people to opt out of data collection while still using the services...

Basically - these services need to collect data in order to do business. This causes some social problems, leading people to collectively push for log/data destruction (at least in the EU). What can these services do?

They can empower their users to see what is stored about them and control it themselves. This can work for two reasons:

1. These services don't need to know everything about me in order to do what they do. They can get by on some information. If I have the ability to control what they are storing, I can remove anything sensitive and let them have the rest of the information.

2. People who complain about the privacy impact can be shunted at the dashboard, where they can opt out of some or all the data collection while still using the service - its an answer that will satisfy a significant number of critics.

Basically, its a middle ground position that allows the services to operate and people to use them without the same privacy impacts and without a broad scaling back of the information the services have access to.

So far, in the US, the political will to reign in data collection by these services has been too weak to make this option attractive, but its possible, neh likely, that Canada and the EU will get there first as their privacy regulations are far more sophisticated then our own.

In fact, what Google has done with Dashboard is not nearly this sophisticated. A huge let down after reading the press coverage.

RE: Fuck You Eric Schmidt

My post about Google Dashboard quoted this news report:

Dashboard let me review my Web searches going back to 2006. Long-forgotten queries about airline tickets, books and magazine articles, a new clarinet for my daughter - they’re all still there.

When I posted this I hadn't logged in yet - and in fact Dashboard doesn't do that. Your search history comes from Google History which has been around for a while, but only works if you search while logged in. When you access Google History Google goads you to download a toolbar so they can watch your web surfing all the time, and not just when you are accessing one of their sites.

Are you better off not having a Google Account - and thus not having a Google History?

Either way, they know, they have the data, but if you tie your searches to your account, they know even more, but in exchange you get to know something too.

Why do I feel like I'm dealing with a drug dealer?

(Worse, if you remove things from "Google History" they don't actually get removed from Google's logs - only from the history service.)

Google Dashboard isn't as cool as I thought.

Acidus wrote:

Google CEO Eric Schmidt: "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place,"

... ...

This was an enormously stupid and hypocritical thing for him to have said, particularly in light of the CNET incident, and it will be requoted and requoted for years to come.

However, its worth noting that Google recently created a Dashboard that allows users to control what information is collected about them. A snippet from this news report:

Dashboard let me review my Web searches going back to 2006. Long-forgotten queries about airline tickets, books and magazine articles, a new clarinet for my daughter - they’re all still there.

I recommended this when I spoke on the subject of privacy at WWW2007. But its really an extension of Greg Conti's research, in which he developed tools that allow users to see what information Google is collecting. Conti is quoted in that news article.

It doesn't really solve the problem - the privacy problem is a collective problem and this is an individual solution. Its more a negotiating position if you will. You insist that you need all this information in order to operate these services - can you at least empower me to see what you've collected and to opt out? On a certain level it provides Google with a way of shunting uncomfortable questions about privacy by allowing concerned people to opt out as it applies to them personally. However, we will face the broader social implications of the privacy problems posed by these systems regardless of whether or not we individually opt out.

Nevertheless, I'm glad that Google did this. Its an important step. It could help raise people's awareness.

More on the subject here.

RE: Fuck You Eric Schmidt

Bsecure is a net nanny filter provider. They proudly boast on their website that they are endorsed by the American Family Association, as well as Joe Gibbs and the National Rifle Association.

Bsecure has placed MemeStreams on a number of their filter lists. The description of some of these lists, as applied to MemeStreams, is simply defamatory. There is no other reasonable description. Here are the filter lists.

The first one is not a big deal.

Web Logs

Websites which feature commentary and articles written a long or journal format, generally called blogs. These blogs can be from personal or non-commercial sources.

The next one gets a little fuzzy.

Hacking

Websites which promote unlawful or questionable tools to gain access to software or hardware, communications equipment, or passwords. This category includes sites that discuss password generation, compiled binaries, hacking tools, or software piracy.

We talk about hacking and security here frequently. I think the people here usually stop short of "promoting... unlawful tools to gain access..." but TI seems to have gotten confused about that...

The next category cuts even closer to the line:

Unsavory/Dubious:

Websites which contain material of a questionable legal or ethical nature. This category includes sites that promote or distribute products, information, or devices whose use may be deemed unethical or illegal.

In order to read that paragraph in such a way that you could fairly apply it to this site you'd have to parse it like a piece of legislation. Clearly its unfair when considered in totality.

Here is where the line gets crossed.

Malicious Code/Spyware/Viruses

Websites which may promote destructive or harmful computer code, or software intended to monitor user behavior without the user's knowledge and consent. This category applies to instruction, message board, or download sites that offer this material.

MemeStreams has never distributed Malicious Code, Spyware, or Viruses. But they don't stop there. The accusations keep coming:

Criminal Skills:

Websites which promote illegal or criminal activity such as credit card theft, illegal surveillance, and murder.

Credit card theft, illegal surveillance, and murder!?@? What the fuck are these people talking about?

Bsecure claims that sometimes they make "mistakes" when categorizing websites. Perhaps these are "mistakes?" I don't think so. It turns out that lots of prominent security sites such as seclists.org and NT Bug Traq are placed in the exact same categories (promoting murder and the like). However, Security Focus, a website which distributes every known exploit for every known computer security vulnerability, has a clean bill of health and two thumbs up from Bsecure.

Why is Memestreams a "criminal site" and Security Focus is not? Well, there is one obvious difference between us. The later is owned by a public company with a 14 billion dollar market capitalization, so they are in a better position than we are to file defamation suits. Could that have some baring on their categorization?

I dunno. But one thing is for sure, although I generally support the right to bare arms, I can't support a political group who endorsed somebody who claims that my website promotes credit card theft, illegal surveillance, and murder. I can't wait for the next fool who asks me what I think of the NRA!

The last Mortgage Bankers Association report estimates that the total number of loans in some sort of delinquency, default, or foreclosure status to be about 8.2 million, or 14.41% of all loans. If the true number of Imminently at-risk loans is somewhere between 13 and 15 million, the default and foreclosure crisis is about 60% over.

Millions More At-Risk of Default Than Most Think | The Big Picture

I like these. I almost bought the Hancock tower when I visited it last week but I decided to save my money in hopes that they'd have the CN Tower for sale on the web. Unfortunately they don't, but maybe soon?

Lego Sky Scrapers

The consumer electronics business, once the playground of large companies, has seen scrappy entrepreneurs charge in. But while the bar to becoming a hardware entrepreneur is lower than ever, it’s still not a gimme.

For Hardware Entrepreneurs, Getting From Idea to Reality Isn’t Easy | Gadget Lab | Wired.com

Shortly after Threat Level reported this week that Yahoo had blocked the FOIA release of its law enforcement and intelligence price list, someone provided a copy of the company’s spying guide to the whistleblower site Cryptome.

The 17-page guide describes Yahoo’s data retention policies and the surveillance capabilities it can provide law enforcement, with a pricing list for these services. Cryptome also published lawful data-interception guides for Cox Communications, SBC, Cingular, Nextel, GTE and other telecoms and service providers.

But of all those companies, it appears to be Yahoo’s lawyers alone who have issued a DMCA takedown notice to Cryptome demanding the document be removed. Yahoo claims that publication of the document is a copyright violation, and gave Cryptome owner John Young a Thursday deadline for removing the document. So far, Young has refused.

Young:

I cannot find at the Copyright Office a grant of copyright for the Yahoo spying document hosted on Cryptome. To assure readers Yahoo’s copyright claim is valid and not another hoary bluff without substantiation so common under DMCA bombast please send a copy of the copyright grant for publication on Cryptome.

Until Yahoo provides proof of copyright, the document will remain available to the public for it provides information that is in the public interest about Yahoo’s contradictory privacy policy and should remain a topic of public debate on ISP unacknowledged spying complicity with officials for lucrative fees.

From the thread:

Yahoo claims that a copyright notice is not necessary for works created after March 1 1989. If that is true, then Yahoo is in violation of the copyrights of its users by selling their works created after March 1, 1989 without their knowledge or consent. Opps! They out smarted themselves. I think Yahoo is in for a big can of whoop ass!

Yahoo Issues Takedown Notice for Spying Price List | Threat Level | Wired.com