It did not take much investigating to follow the data trail to Thelma Arnold, a 62-year-old widow who lives in Lilburn, Ga., frequently researches her friends' medical ailments and loves her three dogs. "Those are my searches," she said, after a reporter read part of the list to her.

The detailed records of searches conducted by Ms. Arnold and 657,000 other Americans, copies of which continue to circulate online, underscore how much people unintentionally reveal about themselves when they use search engines -- and how risky it can be for companies like AOL, Google and Yahoo to compile such data.

I sense a class-action lawsuit coming on. Is there a case to be made here? Could Ms. Arnold recover damages from AOL Time Warner?

A Face Is Exposed for AOL Searcher No. 4417749

The Army is considering a proposal to allow a private developer to build a military-themed park that would include Cobra Gunship rides and bars including a "1st Division Lounge."

"You can command the latest M-1 tank, feel the rush of a paratrooper freefall, fly a Cobra Gunship or defend your B-17 as a waist gunner," according to the proposal, which was obtained by The Washington Post.

County officials have no authority over the Army's decision because the site is federal property. County Supervisor T. Dana Kauffman said he thought the entertainment concept died last year and said he had no interest in turning a military museum into "Disney on Rolling Road."

Sounds like a blast.

CNN.com - C'mon kids, let's go to Army World! - Aug 8, 2006

A few hours after a Franco-American draft for a UN Security Council resolution was released, pro-Hezbollah lobbies and allies launched a campaign to hijack the response of Lebanon to the United Nations. As noted by seasoned observers the campaign started at the top with an alert release by News Agency Reuters written by Lin Noueihed. The article, put out early Sunday has reached the four corners of the Globe and its title has framed the position of the Lebanese people in a "no" to the UN expected resolution. Amazingly enough, Lin Noueihid titles her release "Lebanon rejects draft UN resolution." But when you read the release you realize that the "representative" of all of Lebanon in the eyes of the Reuters reporter is no one other than pro-Syrian, Hezbollah ally, Nabih Berri, the leader of Shiite Movement Amal.

Noueihid wrote that "Lebanon rejects a draft U.N. Security Council resolution to end 26 days of fighting because it would allow Israeli forces to remain on Lebanese soil, Parliament Speaker Nabih Berri said on Sunday." Basing her entire report on one of the most powerful supporters of the Syrian occupation and who heads a militia allied to Hezbollah, Noueihid gives Berri the full power of the credibility of Reuters. This title will find itself printed from Yahoo to the last local newsletter in the Fidji islands. Evidently, local editors around the world trust Reuters as they trust the Red Cross, and will conclude that indeed "Lebanon" has rejected a UN resolution, while in reality, it is Tehran-Damascus-Hezbollah axis that rejected it, and unfortunately a Reuters writer framed it otherwise.

Hezbolla is on top of their information warfare game...

Counterterrorism Blog: REUTERS' HIJACKING LEBANON'S ANSWER TO THE UN?

This comment was posted on TechCrunch by an AOL spokesman.

All –

This was a screw up, and we’re angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant.

Although there was no personally-identifiable data linked to these accounts, we’re absolutely not defending this. It was a mistake, and we apologize. We’ve launched an internal investigation into what happened, and we are taking steps to ensure that this type of thing never happens again.

Here was what was mistakenly released:

* Search data for roughly 658,000 anonymized users over a three month period from March to May.

* There was no personally identifiable data provided by AOL with those records, but search queries themselves can sometimes include such information.

* According to comScore Media Metrix, the AOL search network had 42.7 million unique visitors in May, so the total data set covered roughly 1.5% of May search users.

* Roughly 20 million search records over that period, so the data included roughly 1/3 of one percent of the total searches conducted through the AOL network over that period.

* The searches included as part of this data only included U.S. searches conducted within the AOL client software.

We apologize again for the release.

Andrew Weinstein
AOL Spokesman

For the record, this was the license included with the release:

This collection is distributed for NON-COMMERCIAL RESEARCH USE ONLY.

Any application of this collection for commercial purposes is STRICTLY PROHIBITED.

Techcrunch | AOL: “This was a screw up”

Unbelievable. AOL released a file containing the search engine queries of over 500,000 users during a three month period. It's being mirrored all over.

Here is a screenshot of the download page before it was taken down, complete with a spelling error.. "ananomized"

Update: I've imported the data into an SQL database so I can do some data mining. It's about 3.5G worth of SQL, so the process of building indexes and performing any useful queries is really slow going. Sometime in the next 24 hours, I should be posting up some statistics. I have to think about it some more first... From what I've gathered so far, there is no liability in doing so.

AOL fucked up. This data is in the hands of many, many, many people. That being the case, I want to see how the data frames the issues we all have with this kind of data being available to law enforcement, marketers, and others.. Anyone who has any ideas about what questions we should be asking, reply to this with your thoughts.

Since the hot button issue most directly connected with this is child porn, I've been doing some research focusing on that. The Justice Department wanted Google and other search engines to hand over exactly this information so they could build a profile of what people are searching for when they search for child porn. I've been attempting to do the same thing. Thus far, I've gotten a pretty expansive table of users (over 300) that have been blatantly searching for child porn. I've done a fair amount of work eliminating false positives, such as people searching for information about how to protect their kids, researching court cases, or looking up information about specific offenses. I've tried to limit the list to people blatantly repeatedly searching for illegal pictures of pre-teens and whatnot. I'm working on constructing a list of "what people who search for kiddie porn search for."

I also have some indexes building that will allow me to mine general statistical data on what the top queries are and stuff like that. Since I'm working with a laptop that only has a gig of ram and not too speediest of a hard drive, it's going to take awhile. I expect my machine to be churning for the next few hours.

Update: I don't have powerful enough hardware to mine this. I'm waiting on more resources to become available later tonight.

Link to AOL data release

The war between Israel and Hizbullah has revealed profound disagreement in the Arab world concerning the legitimacy of Hizbullah's activities against Israel. Two major camps have emerged. The first camp, led by Saudi Arabia, opposed Hizbullah's activities and called them "uncalculated adventures," not "resistance," and said that in order for a group to be considered a resistance organization it must meet certain criteria that Hizbullah does not meet. The second camp, headed by Syria, has supported Hizbullah and has considered it a true resistance organization that is conducting "glorious national resistance" that brings honor to the Arabs. They contend that resistance is always legitimate, and that its legitimacy is not dependent on any particular conditions.(1)

In a speech at the emergency summit of Arab foreign ministers in Cairo, on July 15, 2006, Lebanese Foreign Minister Fawzi Salloukh observed that there was a shift in Arab perceptions: "There has been a development in the concepts and criteria employed in the international arena. [These concepts] are crystallizing in a manner that is contrary to the Arab interest. [According to these criteria,] resistance is terrorism, but [Israel is seen as employing] self-defense, which gives it a free hand to destroy and kill without any limitation."(2)

The following are excerpts from statements by Saudi and Syrian officials and media, as well as the Egyptian press.

Debate in the Arab Countries – Is Hizbullah a 'Resistance' Organization or Not?

For three months, mysterious telephone numbers have been appearing on the Craigslist classified ad site which, when called, play recordings which sound much like shortwave numbers stations used by certain governments to communicate with intelligence agents in the field who are unreachable by other means. Now the secret behind these phone numbers stations has been revealed.

The numbers stations, placed on Voice over Internet Protocol (VoIP) telephone numbers, were created by several people who attended the Los Angeles 2600 meeting in May of this year, apparently just for the hell of it.

The stations, which used one-time pads for encryption, “were an experiment to try to estimate the size, power, and organizational capacity of the online cryptographic community,” according to a statement on the group’s web site.

The mystery of the numbers stations has been solved..

Phone numbers stations mystery revealed at DEFCON - Homeland Stupidity

The war between Israel and Hezbollah in Lebanon has exposed deep rifts between Iran and Syria on the one hand and the conservative and America-friendly regimes in Saudi Arabia, Jordan and Egypt on the other. This was dramatically underlined by Saudi Arabia’s unusually tough stance against Hezbollah at the outset of the conflict

It is well-known that amongst the West’s allies in the region, it is only the Saudis who can openly criticize American policy without risking their ties to Washington. Therefore, the fact they chose to unequivocally chastise Hezbollah (knowing full well what effect this will have on pro-Hezbollah public opinion in the Arab world) speaks volumes about growing Saudi desperation.

The Saudi stance against Hezbollah has less to do with fears of Iran’s growing geopolitical weight, than a demoralised reaction to the failure of its foreign policy in Lebanon. However, by choosing to side with Washington and Tel Aviv, the House of Saud risks deepening the dynamics that generate divisions and dissent in the Kingdom.

Already its controversial stance against Hezbollah has divided opinion in the Kingdom. The most important dissenter is Sheikh Salman al-Auda, a former Salafi hardliner, who has come out in support of Hezbollah. More broadly, there is significant grassroots support for Hezbollah, which is seen (as it is seen in other Arab countries) as the only effective tool against Israeli hegemony.

In the final analysis, the Lebanon war has not only imperilled 15 years of Saudi investments, but once again exposed the limitations of the Kingdom’s foreign policy. More ominously for the al-Saud, it has sharply divided opinion in the country and further discredited the official Wahabi Ulema. This is bound to undermine the regime’s security and create new forms of challenges and dissent long after the fighting stops in Lebanon.

I'd like to hear more about the effects of the current conflict on the internals of Saudi Arabia. I'd also like to hear some high level analysis on the political situation in Jordan, if any.

This next week is the time to start filling in question marks presented within the region. If America turns on the TV, and just hears vacant punditry all week, I'm going to be disappointed. Large chunks of the layout are still in question. If we hit the point of reiteration come monday, the US media has failed to bring the big picture in view, beyond pointing the obvious finger at Iran.

When pondering the current situation.. I have trouble envisioning September absent of a radically different layout in the Middle East.

At the very least, we have entered the post-nation-state era... Too many hyphens? New world order? I don't think that's what anyone was thinking...

No World Order? Two letters off, not bad.. And all the conspiracy theorists thought there would be some one-world-government thing going on. Common.. We can't even build a peacekeeping force.. Or a peace for it to keep!

SaudiDebate.com - Saudis mull losses in Lebanon as bid for influence is shattered

Last year, Cisco Systems sued a security researcher and organizers of the Black Hat event after a presentation on switch and router security. This year, Cisco is quietly investigating a possible flaw that was mentioned during a talk on VoIP.

In a presentation Wednesday at Black Hat in Las Vegas, Hendrik Scholz of Germany's Freenet Cityline briefly mentioned a flaw in Cisco software, Black Hat organizers said. This flaw had apparently not been patched. Scholz and Black Hat are now keeping quiet on the issue to give Cisco time to investigate and respond.

"We are looking into it," said John Noh, a Cisco spokesman. "We have to look at the validity of it. We take these things very seriously. And if we need to inform our customers, we will."

It is unclear exactly what Cisco application the alleged flaw is in, but it appears to be related to voice over Internet Protocol applications since Scholz's talk was on "SIP Stack Fingerprinting and Stack Difference Attacks." Most of Cisco's current products don't yet offer extensive SIP, or Session Initiation Protocol, support.

This year, Cisco is playing nice. The company is one of the main Black Hat sponsors and Chief Security Officer John Stewart is in attendance. Cisco on Wednesday also threw a party for Black Hat attendees at Pure, the night club at Caesars Palace. One of the attendees spotted at the party: Michael Lynn.

Looks like Cisco learned a lesson after all.

A Cisco zero-day at Black Hat? | News.blog | CNET News.com

Dan Kaminsky will share details of this technique, which will eventually be rolled into a free software tool, today at the Black Hat USA security conference in Las Vegas. The software can tell whether computers are treating some types of TCP/IP traffic better than others -- dropping data that is being used in voice-over-IP (VoIP) calls or treating encrypted data as second-class, for example.

Kaminsky calls his technique "TCP-based active probing for faults." He says that the software he's developing will be similar to the Traceroute Internet utility that is used to track what path Internet traffic takes as it hops between two machines on different ends of the network.

But unlike Traceroute, Kaminsky's software will be able to make traffic appear as if it is coming from a particular carrier or is being used for a certain type of application, like VoIP. It will also be able to identify where the traffic is being dropped and could ultimately be used to finger service providers that are treating some network traffic as second-class.

The security researcher said he is curious to see what people do with his software. "People are going to start looking [at networks] and who knows what they are going to find," he said.

Black Hat: Researcher creates Net neutrality test