Police track text message senders in Sydney riot investigation

The investigation of the recent racial riots in Sydney, Australia, are another reminder that text messages sent by cell phone are logged and are useful for police investigations: Police track text message senders - National - smh.com.au.

Australian Privacy Commissioner deals with backlog; complaints take a year to be investigated

Canadian privacy complainants have faced delays because of the backlog in the Office of the Privacy Commissioner. Notwithstanding that PIPEDA says the Commissioner's findings should be issued within twelve months, it has taken longer in many cases. The Australian Privacy Commissioner is facing similar problems, according to the annual report released recently. In some cases, it is taking twelve months to even begin an investigation and reports take an average of seventeen months. See: Delays raise privacy fears - National - smh.com.au.

Your security (and your company's reputation) rests in the hands of your employees

I've blogged on this topic before (Better develop a "culture of privacy", Edmonton cops investigated for misusing law enforcement databases and Sorry, but implementing privacy laws may upset some customers.), but it bears repeating again and again and again.

You can have the right privacy policies. You can harden your network and your systems to ward off hackers. All this effort will be lost if your employees are not sesitized to think about privacy and security all the time. Train them to think about how they hold business and customer information in trust ... and to trust their instincts if anything feels weird.

CNet is reporting on a presentation given by Kevin Mitnick who knows first hand how easily exploited employees can be.

Mitnick: Security depends on workers' habits CNET News.com:

"Famed ex-hacker Kevin Mitnick is warning against security strategies that focus on technology. Rather, teaching your staff to say no will help keep your network secure, he says.

...

Many companies invest heavily in technologies to protect their networks, but Mitnick was quick to point out that even the tightest technological barriers never stopped him. Rather, some carefully planned social engineering--or even a bit of dumpster diving in one's spare time--can often be far more effective at penetrating the weakest security link at most companies: their people.

"What you can find in the trash is simply amazing," Mitnick said. "People throw out notes, drafts of letters, printouts of source code, printouts of project documentation they're working on. In some cases, they even write down passwords and access information, or calendars that list every person that person has talked to or met with."

This information provides invaluable assistance to hackers keen to worming their way into a company by, say, impersonating an employee and calling the internal help desk, or dropping in and pretending to be a business associate. Because people hate to say no, even when they're suspicious of a well-presented stranger, Mitnick says, smooth talking has gotten many a hacker far closer to a target company's network than brute-force technological attacks.

...

The solution to such security vulnerabilities is easy to understand but often hard to implement: Develop clear security policies for issues such as treatment of strangers, handling of information and access to physical facilities by visitors. Teach employees to fall back on those policies when they're in suspicious circumstances rather than trying to ad-lib their response or give in to their natural inclination to accommodate the hacker's requests.

Even a simple request for contact details, so that a company employee might call back the person requesting assistance, can be enough to make many hackers turn tail and run.

"We can't expect our employees to be human lie detectors," Mitnick said. "One of the most difficult challenges in corporate cultures is getting people to modify their politeness norms.

"Social psychology has found that people should generally pay attention to their own discomfort. If something doesn't feel right, or it's nagging at their gut, they'd better check it out. They're not always going to remember a security policy, but what you want is to come up with some very simple protocols that will trigger employees to refer to security policy. The only people who are going to object to this are the bad guys."

David Braue reports for ZDNet Australia."

UC Researcher finds out how to uniquely identify a PC on the net

A University of California researcher has developed a technique to uniquely identify a PC anywhere on the internet, even if it is hidden behind a firewall or shares its IP address with other computers:

How to track a PC anywhere it connects to the Net: ZDNet Australia: News: Security:

"Anonymous Internet access is now a thing of the past. A doctoral student at the University of California has conclusively fingerprinted computer hardware remotely, allowing it to be tracked wherever it is on the Internet.

In a paper on his research, primary author and Ph.D. student Tadayoshi Kohno said: 'There are now a number of powerful techniques for remote operating system fingerprinting, that is, remotely determining the operating systems of devices on the Internet. We push this idea further and introduce the notion of remote physical device fingerprinting ... without the fingerprinted device's known cooperation.' "

Thanks to Privacy Digest for the pointer to this story.

BC Privacy Commissioner's report leads to questions in Australia

The recent report by the BC Privacy Commissioner on privacy and outsourcing to US-controlled companies has led to questions in Australia:

Australian IT - US law raises privacy worries :

"THE South Australian Government has promised to review the access of US outsourcer Electronic Data Systems to information on citizens in the wake of a Canadian government report finding a 'reasonable possibility' of unathorised disclosure by US outsourcers to US government agencies.

A spokesman for Administrative Services Minister Michael Wright, who oversees the EDS whole-of-government outsourcing contract, said the the Government was 'taking the issue seriously'.... "

As alluded to above, much Australian government data processing is done by EDS. A related story, from Yahoo News, includes a statement from EDS that there has been no disclosure of Austrialian personal information to US authorities under the USA PATRIOT Act:

EDS denies breaching Privacy Act

"... The company's managing director Chris Mitchell says EDS is a corporate citizen and it complies with the Privacy Act of Australia.

"The US Government would have to talk to the Australian Government about superseding the laws of the land, that's all I can say," he said.

Mr Mitchell says the data for the Federal Government's accounts are dealt with in Australia and some other clients' data is processed offshore, but only with their agreement...."

Alarm raised over Australian health network

The Australian privacy commissioner is concerned that HealthConnect, a federal health network, is lumbering toward implementation without adequate privacy protections:

Australian IT - Alarm raised over health network (Karen Dearne, FEBRUARY 23, 2005):

"'Given the magnitude of the project and the sensitive nature of health information, a robust privacy framework needs to be established as a priority,' the OFPC says in its submission on the roadmap HealthConnect Business Architecture.

'The architecture includes many references to privacy protocols or rules which will apply to HealthConnect, although their substance and standing is unclear.'

While the OFPC regulates the private health sector and handling of personal information by federal and ACT government agencies, the privacy of health information within the states is regulated at the state level. "

Findings from the Australian Privacy Commissioner

The Australian Regulatory Review has links to and some dicussion of recent findings from the Australian Privacy Commissioner:

Australian Regulatory Review: Privacy Case Notes:

"The Privacy Commissioner, Karen Curtis, has released case notes 8 to 18 regarding personal information handled by credit providers, insurance providers, employment agencies, a telecommunications service provider, an internet service provider and federal government agencies...."

Much of it sounds familiar.

Nursing home privacy whistleblowers vindicated in Australia

An Australian government inquiry has vindicated a number of whistleblowing employees of a Melbourne nursing home. Among the incidents reported is one related to the privacy of the residents: "In a gross breach of privacy, residents' personal records were used as scrap paper for grocery lists and chores to be done around the home."

New technologies for scanning IDs

For those bar and nightclub owners who are not content with reading the magnetic stripes of patrons' ID cards, a UK company has added to the ID-capturing arsenal with ClubScan. It's a all-in-one scanner, OCR driver and database management system to slice and dice customer information:

idscan

"idscan incorporates the cutting edge of Optical Card Recognition OCR technology. It uses advanced image processing and field identification capabilities to read and process the information on driver licenses, Idcards, passports and other forms of ID.

idscan application has an OCR system that is pre-trained to recognize and interpret a wide variety of font types on ID cards. Including Passports, Provisional UK, European, US, Australian, Middle East and Far East IDS & Driving Licenses.

idscan OCR technology begins reading the text information, the application uses its intelligent processing engine to correctly place the text data into appropriate text fields i.e. ID Number, Name, Address, Issue Date, Expiration Date and Date of Birth.

The combination of accurate OCR with advanced image processing yields a perfect system for scanning and filing driver licenses and ID cards and offers the only OCR system that delivers 99% accuracy. ..."

For those who want to share with other users, Sharescan adds "troublesome" former customers to a worldwide database accessible to other idscan customers. Oddly, there's no mention on the website of how this jibes with the UK Data Protection Act.

Via Engadget: The Clubscan ID scanner for nightclubs.

For a somewhat related blog entry, check out: The Canadian Privacy Law Blog: Calgary student challenges nightclub over scanning ID.

Researchers say Australian privacy laws hinder research

Like colleagues around the world, Australian medical researchers are attacking privacy laws saying they hinder research. Researchers are looking for more consistency among Australian states and for more circumstances where they can have access to health information without permission. See: The Australian: Privacy laws 'hinder medical research' [September 19, 2005],