Information Policy

Study: Too Many Users Reuse Passwords

You may have a remarkably strict password policy in place at your organization, requiring a long string of letters, numbers, and special characters. Unfortunately, those policies become far less effective if you use a similar or identical password for, say, logging in to Facebook or Amazon.com or any other Web site. If a malicious hacker is able to get his or her hands on a user's password credentials for one domain, said hacker has a good starting point for figuring out the user's password for other sites.

http://infoworld.com/t/data-security/study-finds-high-rate-password-reuse-am ong-users-188

CIS nations to jointly fight against extremism in the Web

Security services of the member countries of the Collective Security Treaty Organization – namely, Russia, Armenia, Belarus, Kazakhstan, Kirgizstan, Tajikistan and Uzbekistan – have held a joint operation to close extremist Web sites. Hundreds of sites were closed.

At an international conference in the Russian Parliament’s upper house, the Collective Security Treaty Organization’s Secretary General Nikolay Bordyuzha said: “An information war against terrorism and drug trafficking is no less important than other forms of fighting against these evils. From now, operations to close extremist Web sites will be constantly held.”

“This operation, which received the name of “PROXI”, was the first experience of fighting against criminals in the virtual space on a scale of the whole CIS,” Mr. Bordyuzha continued. “Thanks to our joint efforts, we’ve revealed about 2 thousand Web resources who spread information which may cause political damage to our states. They stirred national or religious hatred or supplied information for terrorist groupings. On the basis of the data that we’ve collected, about one thousand proceedings have been instituted.”

Today, extremist organizations all over the world widely use the Web as a means of propagandizing their delirious ideas. Some people use the Internet, one of the greatest achievements of civilization, in their insane attempts to destroy the civilization itself. One of the examples of this was the events of August 2008, when Russia had to face not only the aggressive policy of Saakashvili’s regime, but also a powerful onslaught of a war of words in the Web.

This means that we need smoothly working mechanisms to stand against this onslaught, Nikolay Bordyuzha believes:

“For some time past, practically all post-Soviet republics saw cases when certain political forces widely used Web resources to manipulate people’s moods - Moldova, Georgia, Ukraine, and, recently, Kirgizstan. Today, some people use the Web to stir nationalistic feelings – or, to calm down people whom they consider to bee too active. In fact, information can be a weapon now.”

“With the possibilities which the Web offers today, security of information is becoming shadowy,” the Chairman of the Parliament’s upper house Sergey Mironov said at the conference.

“The recent story with WikiLeaks is a proof of the fact that today top secret governmental information can become a property of any individual. Even if Mr. Assange meant nothing but good, I believe that such actions are impermissible. To prevent such cases, we need a clearly-outlined legal base.”

The Collective Security Treaty Organization is now creating a special center to fight against Web crimes, which will start working very soon. The center is being formed on the basis of the Moscow State University.

http://english.ruvr.ru/2010/12/21/37409484.html

Foreign media websites apparently blocked in China

The websites of several foreign media outlets appeared to be blocked in China on Thursday on the eve of the award ceremony in Oslo honouring the 2010 Nobel peace laureate, jailed dissident Liu Xiaobo. AFP attempts to access the websites of television networks CNN, the BBC and Norwegian public broadcaster NRK were unsuccessful, with the message "Internet Explorer cannot display the web page" appearing on the screen. China last Thursday stepped up its criticism of the Oslo-based Nobel committee that in October chose Liu - who was jailed in December 2009 for 11 years on subversion charges - as this year's honoree. When Liu was named the peace prize winner two months ago, initial reports were blacked out on CNN, BBC and French satellite channel TV5, while the state network China Central Television did not report on the prize.

http://www.ejc.net/media_news/foreign_media_websites_apparently_blocked_in_china/

Microsoft Gives Away Free Software In Piracy-Ridden Countries

Microsoft said it is providing free software licenses for Microsoft software on computers to non-profit organizations as well as independent media in 12 countries that are known to be problem regions for illegal reproduction of applications.

The company’s “unilateral software license” applies to Microsoft software that is “already installed” on a PC on users who are part of non-governmental organizations (NGOs) and small, independent media in Armenia, Azerbaijan, Belarus, China, Kazakhstan, Kyrgyzstan, Malaysia, Russia, Tajikistan, Turkmenistan, Uzbekistan, and Vietnam.

The program essentially legalizes pirated copies of Microsoft software until January 1, 2012 via a document that can be printed from the web. Microsoft did not say what will happen after that date, but noted that the USL is extended from the standard NGO donation program, which will enable those organizations to keep their software “up to date and secure.”

The qualification levels are relatively low. The government share has to be less than 10% and “must operate on a not-for-profit basis and have a mission to benefit the local community. Eligible organizations may also include small, independent media, or others that hold a local public communication license, are members of a local media association, or are recognized by an international media organization,” Microsoft said.

Those who qualify can also request additional software donations from Microsoft.

http://www.conceivablytech.com/4469/products/microsoft-gives-away-free-software-in-piracy-ridden-countries/

Germany: "The Internet Is Not a Lawless Place"

Germany on Wednesday unveiled plans to beef up Internet privacy after a public outcry over Google's Street View service. The new law would allow people to opt out from tracking services as well as ban services that combine data to create comprehensive profiles of individuals. German media on Thursday are critical of the plans, asking if they go far enough.

http://www.spiegel.de/international/germany/0,1518,732451,00.html

Russian man to face spamming charges in American court

A 23-year-old Russian man accused of running a worldwide spamming network, which Internet-security experts say on some days accounted for one of every three unwanted e-mails, is scheduled to appear in a Wisconsin courtroom to hear charges against him.

http://www.theaustralian.com.au/australian-it/russian-man-to-face-spamming-charges-in-american-court/story-e6frgakx-1225965122658

Internet blocking - key decisions to be made by 3 February 2011

The legislative process on Internet blocking is about to move from almost standstill to almost completed between now and the beginning of February. In the Council of Ministers, an informal agreement is planned for the Justice Council in December, while the MEP in charge in the Parliament will present her draft report on 10 January 2011 with an informal orientation vote just three weeks later.

Every civil society organisation that wants to stop web blocking and the damage that this will do for child protection must focus all available resources on the Civil Liberties Committee of the European Parliament between now and early February. Afterwards, it will be too late. The risk of damage to child protection is abundantly clear from the Working Document prepared by the MEP in charge of the dossier, Roberta Angelilli (Italy). She says: "We have to bear in mind that our priority is to eliminate these images for public access as quick as possible." The priority is not to identify the children, not to investigate the criminals, but to avoid public access via blocking, which does not even serve the purpose of stopping deliberate access.

Bizarrely, Ms Angelilli also suggests that "the providers would be promptly informed about their rights to appeal against the decision". This assumes that there would be no immediate investigation - having been accused of having a website containing images of gross violations of children, the suggestion is a polite notice to the alleged criminal that he may wish to complain.

In the Parliament, MEPs remain divided but the argument that blocking is a "complementary" measure, to be implemented with other measures (such as deletion and prosecution), rather than instead of them, is successful with many parliamentarians. The argument is working, despite the fact that there is no evidence of this being the case in countries that already have blocking.

In the Council, Germany and Romania are fighting hard for blocking to remain optional for Member States. However France and Italy (coincidentally, countries that also have blocking for gambling and intellectual property) are campaigning for obligatory blocking with what one negotiator described as "missionary fervour". Most countries are remaining silent on the issue, meaning that they are passively having blocking imposed on them by the larger countries. The only large country to remain silent is Poland, and this silence will be crucial for the success of mandatory blocking, if it is maintained.

In the Council, the current negotiating text reads as follows: "2. Where the removal of webpages containing or disseminating child pornography is not possible within a reasonable time, Member States shall take the necessary measures, including through non-legislative measures, to ensure that the blocking of access to webpages containing or disseminating child pornography is possible towards the Internet users in their territory. The blocking of access shall be subject to adequate safeguards, in particular to ensure that the blocking, taking into account technical characteristics, is limited to what is necessary, that users are informed of the reasons for the blocking and that content providers, as far as possible, are informed of the possibility of challenging it."

This text raises three interesting points. Firstly, blocking through non-legislative measures has already been described as illegal by the European Commission in the impact assessment it prepared to accompany the proposals. In that text, the Commission assessed extra-judicial blocking as follows: "More problematic may be the compliance with the requirement that the interference in this fundamental right must be "prescribed by law", which implies that a valid legal basis in domestic law must exist" (page 30) before coming to the conclusion that "such measures must indeed be subject to law, or they are illegal" (page 37). The illegality of this approach is quite clear from the European Convention on Human Rights, which states that "the exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary."

The second interesting point refers to the last lines of the draft text. It suggests that a legal obligation is necessary for Member States to take the step of contacting the alleged criminals, accused of publishing pictures of children being abused on the Internet, and politely informing them that their page has been blocked and giving them the opportunity to complain, if they so wish.

The final point is that Member States should do what they consider necessary, which means that, strictly speaking, this text places no obligations on anyone. Its only real purpose is to give Member States an excuse to introduce blocking, even via "self-regulatory" measures that are in breach of the European Convention on Human Rights and the Commission's own assessment of the legality of the measure.

The civil society in Poland is pushing hard to demand that the government have the courage to take a position. EDRi-member the Panoptykon Foundation, along with representatives of the Kidprotect Foundation, the Modern Poland Foundation, the Foundation for Free and Open Source Software and the Interactive Advertising Bureau Poland appealed to the Prime Minister to ensure that Polish representation to the European Council takes a critical stance on the Child Exploitation Directive.

In their appeal, the groups demanded proper action against the abuse, rather than the childish act of placing its hands before its eyes in the hope that the monsters would disappear. Illegal content must be removed and not hidden by the creation of a censorship infrastructure.

http://www.edri.org/edrigram/number8.23/internet-blocking-key-decisions-february-2011

China blocks access to WikiLeaks

China has blocked Internet access to WikiLeaks' release of more than 250,000 U.S. Department of State cables, with its Foreign Ministry saying that it does not want to see any disturbance in China-U.S. relations.

http://www.computerworld.com/s/article/9198578/China_blocks_access_to_WikiLeaks

Germany unveils plan to tighten Internet privacy

Germany's interior minister on Wednesday unveiled a draft law to tighten rules on Internet privacy, sparked by the uproar this summer over the Google Street View mapping service. The draft is a combination of self-regulation by Google and other companies, and new rules that would make it illegal to gather certain kinds of personal information. Web services that assemble personal profiles would only be allowed if the people being profiled gave their consent or a there was a compelling reason for making such information public. The new law, if passed, would amend the current Federal Privacy Act and create a central online repository for geo-spatial and geo-location information. Also on Wednesday, German tech trade group BITKOM submitted its proposal on industry self-regulation with the group's president, August-Wilhelm Scheer, formally presenting a codex on data protection to de Maiziere in Berlin. BITKOM represents more than 1,350 companies in Germany, including major players like Google, Microsoft, Nokia, Deutsche Telekom, Deutsche Post and others. Among its suggestions, BITKOM offered to set up a single website where German residents could access what geo-data is made available about them, and what rights they have to correct or request its deletion. Users could also submit similar requests by postal mail, or call a government-run hotline to get questions answered. But data protection commissioners harshly criticized the draft law, especially the self-regulation aspect. They said the rules did not go far enough, nor did they have teeth.

http://www.ejc.net/media_news/germany_unveils_plan_to_tighten_internet_privacy/

The Federal Trade Commission released A Preliminary FTC Staff Report on Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers. This much-anticipated document covers a myriad of issues, including the need for greater consumer education, industry efforts to incorporate “privacy by design” into online services and improving consumer notice and choice. Many IAB members are leaders in the area of consumer privacy, and as an industry we remain committed to furthering consumer trust across the entire interactive advertising ecosystem. The FTC has asked for comments to this report, and the IAB will work with its members to engage productively with the Commission in this process.

However, there is one recommendation made by the FTC staff that you are sure to hear much more about—the creation of a federally run Do Not Track mechanism. The IAB believes there are significant problems inherent in creating such a new government program. Though a Do Not Track list might resonate with the public because of its apparent resemblance to the National Do Not Call Registry, the two are similar in name only. Any notion that an online Do Not Track list could operate like the Do Not Call Registry is fundamentally flawed. Phone calls consist of one-to-one connections and are easily managed because each phone is identified by a consistent phone number. In contrast, the Internet is comprised of millions of interconnected websites, networks and computers—a literal ecosystem, all built upon the flow of different types of data. To create a Do Not Track program would require reengineering the Internet’s architecture.

Perhaps most important, consumers depend upon sharing of data within this architecture to customize news sites, optimize web services such as social networks, receive relevant content and advertising across the web, and much more. “Do Not Track” is a misnomer because you cannot turn off data sharing online and, if you could, consumers would encounter a severely diminished experience since they would lose out on the remarkable benefits provided by data sharing. Policy makers should not promise a “consumer protection program” they cannot deliver without disenfranchising the American public.

We are encouraged by the FTC’s recognition of our self-regulatory efforts and its acknowledgment that self regulation may be a viable option for achieving its own goals of consumer transparency and choice. However, we see several distinct problems with the preliminary recommendation:

1. Foremost, we believe the industry’s Self-Regulatory Program for Online Behavioral Advertising will provide the enhanced notice and simple, comprehensive opt-out mechanism the FTC has called for. The industry successfully developed this program without the need for government regulation.

2. The FTC seems to place great emphasis on consumer click-through rates as a measure for whether self-regulation is working. We believe consumers are best served by a system that makes them aware of online behavioral advertising (OBA) practices, provides real-time enhanced notice and empowers them to exercise an opt-out mechanism that is easy to use. Opt-out rates are not an accurate indicator of self-regulatory success, and the government should not be in the business of pushing consumers to opt out of OBA.

3. The FTC “seeks comment on whether a universal choice mechanism should include an option that enables consumers to control the types of advertising they want to receive and the types of data they are willing to have collected about them.” (page 68) If mandated by the government, this would be tantamount to a government-sponsored, and possibly managed, ad-blocking program—something inimical to the First Amendment. Flexibility in this area best serves consumers and industry.

http://www.iab.net/public_policy/1481209?o1408380=