Should E-Mail and Letters Have Equal Legal Protection? – NYTimes.com

The question boils down to this: Should personal information that people store online, like e-mail messages, photos and location updates, be treated the same as telephone calls or paper documents stored in a person’s home?

Right now, they often aren’t, in part because the Electronic Communications Privacy Act, which governs surveillance of what people do online, was written in 1986 — well before Twitter direct messages, Facebook status updates or Foursquare check-ins.

And Web users generally do not understand when and how law enforcement can get access to their information, said Ryan Calo, director of the consumer privacy project at Stanford Law School’s Center for Internet and Society.

“People have no idea that with a relatively small amount of process, people can get all this information that they’ve been storing for more than 180 days,” Mr. Calo said. “If they were to go and look at a privacy policy, it would say, ‘We comply with lawful requests for your information,’ but you don’t know what that means.”

In March, a group of Internet companies and advocacy groups like Google, Amazon.com and the Center for Democracy andTechnology started a group called Digital Due Process to try to update the 1986 law.

via Should E-Mail and Letters Have Equal Legal Protection? – NYTimes.com.

Google to tighten privacy policies after Wi-Fi fiasco – Computerworld

Under fire for months over its capture of people’s Wi-Fi traffic data, Google has announced several steps aimed at preventing similar missteps in the future.

At the same time, Google is acknowledging that its inadvertent Wi-Fi snooping collected not only data fragments but entire e-mail messages, website addresses and passwords.

Google has been in hot water with privacy advocates, government agencies and concerned individuals since its disclosure in May that, since 2007, its Street View cars, in addition to taking photos for its Maps product, had also collected Wi-Fi transmission data from unencrypted networks.

Government agencies and legislators in the U.S. and abroad are investigating the issue, and a number of users have filed privacy-breach lawsuits against the company.

Google had intended the Street View cars to only grab and store open Wi-Fi networks’ names (SSIDs) and their unique router numbers (MAC addresses) for use in Google location-based services.

Due to a software glitch, the Google cars intercepted and stored Web traffic data, which initially the company had said was highly fragmented, but that it now is admitting includes the full text of e-mail messages and passwords.

via Google to tighten privacy policies after Wi-Fi fiasco – Computerworld.

Adobe hits Reader users with 23-patch ‘whammy’ – Computerworld

Adobe patched 23 security vulnerabilities in its Reader PDF viewer on Tuesday, most of them critical, including one that has been exploited by hackers for at least a month or possibly much longer.

Tuesday’s patch job set a record for 2010, and came close to last year’s biggest update, a 29-fix collection Adobe shipped in October 2009.

In September, Adobe promised to speed up the delivery of today’s patches, which were originally meant to ship next week, because attackers were already leveraging a bug in Reader’s and Acrobat’s font parsing.

“Adobe is hitting customers with a double whammy today,” Andrew Storms, director of security operations at nCircle Security, said via e-mail. “Adobe products continue to be at the top of the target list for malware writers.”

“They patched a zero-day flaw in Flash in late September, and today they are releasing their quarterly Acrobat update ahead of schedule because of another zero-day,” Storms said.

Tuesday’s Reader and Acrobat updates also included a patch released more than two weeks ago for Flash, Adobe’s media player. Both Reader and Acrobat include code to run Flash embedded in PDF documents.

Of the 23 bugs Adobe patched, the most notable was the one revealed Sept. 7 by Mila Parkour, an independent security researcher who reported the attack after discovering rigged PDFs attached to e-mail messages.

via Adobe hits Reader users with 23-patch ‘whammy’ – Computerworld.

Google Wi-Fi data grab snared passwords, e-mail – Computerworld

Wi-Fi traffic intercepted by Google’s Street View cars included passwords and e-mail, according to the French National Commission on Computing and Liberty (CNIL).

CNIL launched an investigation last month into Google’s recording of traffic carried over unencrypted Wi-Fi networks, and has begun examining the data Google handed over as part of that investigation.

Google revealed on May 14 that the fleet of vehicles it operates to compile panoramic images of city streets for its Google Maps site had inadvertently recorded traffic from unencrypted Wi-Fi networks. Google’s intention was only to record the identity and position of Wi-Fi hotspots in order to power a location service it operates, the company said. However, the software it used to record that information went much further, intercepting and storing data packets too.

At the time, Google said it only collected “fragments” of personal Web traffic as it passed by, because its Wi-Fi equipment automatically changes channels five times a second. However, with Wi-Fi networks operating at up to 54M bits per second, it always seemed likely that those one-fifth of a second recordings would contain more than just “fragments” of personal data.

That has now been confirmed by CNIL, which since June 4 has been examining Wi-Fi traffic and other data provided by Google on two hard disks and over a secure data connection to its servers.

“It's still too early to say what will happen as a result of this investigation,” CNIL said Thursday.

“However, we can already state that [...] Google did indeed record e-mail access passwords [and] extracts of the content of e-mail messages,” CNIL said.

via Google Wi-Fi data grab snared passwords, e-mail – Computerworld.

French probe Google over privacy | SF Gate

Google Inc. recorded passwords and bits of e-mail messages while collecting data for its Street View mapping service, France’s privacy watchdog said Thursday after conducting the first outside review of the information.

Google, under investigation in several nations for possible privacy breaches because of its data-gathering practices for Street View, collected data without the knowledge of the people concerned, said France’s Commission Nationale de l’Informatique et des Libertes, or CNIL. Officials in Germany, Spain and other European countries started probing the practices of Google over how it collected data from Wi-Fi networks.

“The recording of such data could put Google in possession of data such as visited Web sites, the content of exchanged messages or even passwords,” the French data-protection agency said in a statement. “That’s why the agency went on site on May 19 for an inspection of the nature of the collected data and the measures taken to remedy this.”

The privacy practices of Google, owner of the world’s most-used search engine, have also come under scrutiny in Canada, the Czech Republic and Italy. Last month, the Federal Trade Commission said it would take a “very close look” at Google’s data gathering.

The Mountain View company has said it’s cooperating with the authorities.

“We have reached out to the data protection authorities in the relevant countries and are working with them to answer any questions they have,” Google said in an e-mailed statement. “Our ultimate objective is to delete the data consistent with our legal obligations and in consultation with the appropriate authorities.”

The French regulator said it’s “the first data protection authority in the world to get access to the data collected by Google in the case of Street View” and that “it seems the Spanish and German authorities have made the same request.”

via French probe Google over privacy.

Italy investigates Google’s Street View | Reuters

Google Street View Car in Southampton, Hampshi...
Image via Wikipedia

Italy has started an investigation into Google Inc’s Street View web service, a local watchdog said on Wednesday following the U.S. group’s announcement it had accidentally collected personal data over wireless networks.

Google said last week its fleets of cars which have been photographing streets around the world had for several years accidentally collected personal information — which a security expert said could include e-mail messages and passwords.

Italy’s privacy regulator said it would verify whether Google treated correctly the data acquired by Street View, which allows users to navigate around a 360-degree view of city streets using pictures taken by Google’s camera vehicles.

The regulator said Google Italy had admitted it collected pictures but also “data regarding the presence of wireless networks … as well as electronic communications, eventually transmitted by users via unprotected wireless networks.”

via Italy investigates Google’s Street View | Reuters.

Don’t lose sleep over U.S. e-discovery nightmares

Broadly speaking, there are two major differences between general Canadian practice and the U.S. federal rules, said Maddex.

One is the scope of discovery. “In the U.S., you can ask for pretty much anything, which is why e-mail has become such an important problem there,” he said. But Canadians “don't have that same problem because the scope is narrower.”

For example, in the U.S., a company may be asked to file through its entire database and produce everything it has, which could be billions of e-mail messages, he said. “The cost to go through that and figure out what you need and what you don't need to provide is extremely expensive,” he said.

Second is the duty to disclose. “In the U.S., parties have the right to compel the other side to produce whatever they ask for, whereas here in Canada, by and large, litigants have an affirmative duty to search their own records for themselves and produce what they think is relevant,” he said.

Canadian businesses and individuals are required to keep certain records, but this is governed by specific legal requirements like tax laws, he said. “Other than that, you have no real obligation to keep anything,” he said.

via Don’t lose sleep over U.S. e-discovery nightmares.

S.E.C. Enforcement Chief: ‘Creative Investigation Techniques’ Coming

The use of wiretaps and recordings of conversations to help underpin the insider trading case against the Galleon Group hedge fund struck legal experts as unusual, for an investigation involving the Securities and Exchange Commission.

“It is unusual,’’ said Robert S. Khuzami, the director of enforcement at the S.E.C., at a discussion of hedge fund regulation at the Practising Law Institute in New York Monday. But, a year from now, “I hope it’s more common.’’

Khuzami noted that the S.E.C. has no wiretapping authority. That belongs to the U.S. Department of Justice, which would have to act in concert with the securities regulator on a probe of potentially illegal activity.

But don’t be surprised if more creative techniques involving the capturing of electronic messages or other evidence are used as the S.E.C. tries to step up its game, in the wake of the multibillion-dollar Ponzi scheme run by Bernard L. Madoff and other fallout of the two-year-old financial crisis. Prosecutors built their case against former Bear Stearns Cos. hedge-fund mangers Ralph Cioffi and Matthew Tannin around e-mail messages.

“We will do everything we can to adopt whatever creative investigation techniques that appear appropriate to the case” being pursued, he said.

Khuzami said the commission is not just interested in insider trading or fraudulent investment management schemes. Also of interest: how assets get valued and how performance of investments get reported to investors.

continued: S.E.C. Enforcement Chief: ‘Creative Investigation Techniques’ Coming.