The security aspects of social networking sites

Be aware, that through a variety of easy tricks, attackers can hijack a person’s social network account to use as a launching pad for additional attacks against other users, other Web 2.0-based applications, and so on. Social networks can also be incorporated into micro botnets and, by rummaging through a page of misfired direct messages on Twitter, a motivated attacker can unearth the cell phone numbers of prominent people. Read more..

Thanks again to Jack for this. He’s been active today 🙂

The mobile phone as an ultimate personal marketing machine

It seems that advertisers have been getting pretty excited about the potential of the mobile phone. This is no surprise when you consider that cellular carriers possess terabytes of demographic data on their users and they even know where the caller is. Your mobile phone gives all of this away. Advertisers today have the potential to mould campaigns that can be aimed at specific age, gender, income and lifestyle segments and locations. This is bringing advertisers around the world close to their long dreamed of vision: the mobile phone as an ultimate, targeted, personal marketing machine.

The new Google phone is right on, dubbed the G1, has been touted as a working man’s smartphone — a cheap, Web-friendly wireless device that can make life easier for millions of consumers. The G1, as it turns out, also stands to make life a whole lot easier for Google — by making it a snap to track your movements on the mobile Web and send you ads as it does on the desktop. The device, sold exclusively by T-Mobile, gives Google access to your e-mail, instant messages, contact lists, Web-search history and geographic location. By keeping tabs on your mobile life, Google (GOOG) can quickly figure out what sort of ads to send your way, and when

“It’s like a walking surveillance device,” says Jeffrey Chester, executive director of the Center for Digital Democracy, a consumer watchdog group.

Mobile advertising is still relatively new — G1 users, for now, get ads only through search results, for instance — but it’s clearly a hot spot. The market is expected to reach $2.2 billion by 2012, from about $800 million now, according to JupiterResearch. Ultimately, it could surpass the traditional Web, now a $20 billion ad market. Read more…

Thank you Jack for sending this my way 🙂

World Maths Day 2009

World Maths Day is an opportinity for students around the world to play against each other in mental arithmetic games. Direct feedback that I had from the head of IT at a school in Austria (thanks Neil) was that “the level of engagement in learning that students had in competing with students around the world in simple arithmetic tasks was stunning!”

Students are captivated by the fact that they are playing in real time. Each game lasts for 60 seconds, students can play as many games as they wish. The questions are appropriately leveled for different ages and abilities. Also open to school aged private individuals and homeschoolers.

So if you’re a school teacher, check it out. Your students can have some fun, learn at the same time, and do a bit of healthy online maths competition with other students from other schools around the world!

U.K. wants yet another database!

As if it’s not enough with the databases for the heathcare, and then of course the failed ID card databases, and the children databases, the U.K. government just can’t get enough of this, now they are building a database for all international travel for U.K. residents all in the guise of the fight against crime, illegal immigration and terrorism.

Computerised records of all 250 million journeys made by individuals in and out of the UK each year will be kept for up to 10 years. Read more…

Violation of the DPA in Spain with YouTube

Well this is an interesting one. I have found at least two cases now whereby it has been ruled as a violation of the Data Protection Act (which I understand is called the Organic Law on Data Protection, LOPD) by uploading videos without the consent of the subjects of the material. Fines for grave violations run from 60,000 to 300,000 Euros.

The first case I am referring to was in the summer of 2008 whereby residents in Spain were fined for putting prostitute clients on YouTube.

Then there is the recent case that I can’t yet find anything in English or Spanish. The short of it is that the Spanish Data Protection Agency (AEPD) on Wednesday this week took enforcement action against those responsible for uploading a video clip on the Spanish site, and declared that publishing the image of a person on YouTube without that person’s consent is a grave violation of LOPD. The decision by the AEPD followed widespread media reporting on the case of Italian youths posting to YouTube a video disparaging a teenager with a disability, but this case involved a smaller, 1,500 Euros fine. Article 6 of the Spanish LOPD requires, with some exceptions, a data subject’s unambiguous consent for the processing of his or her personal data, unless laid down otherwise by law.

If any of my Spanish visitors have some reference to this article in English or Spanish, would love if you could share this with us? My searches in English are coming up with nothing useful.

Is Google tracking me?

This is a good question. Google have just realised a new service called Latitude. Latitude lets smartphone and laptop users share their location with friends and allows those friends to share their locations in return. Although not pinpoint accurate, Latitude can display your general location based on information from GPS satellites and cell towers. Latitude works on both mobile devices and personal computers.

From a privacy perspective, it is an opt-in service (i.e. you have to ask to get it, it is not provided automatically without asking your permission first) which is good. It also gives a choice of levels of visibility. However the privacy concerns are similar to that as with the increasing practice of tracking mobile phones today. Apart from the obvious risks to privacy, e.g. everyone getting to know where everyone is, that is if you care, and Google holding more information than what they have promised, finally providing yet another vector for surveillance by government authorities. There is the concern for the privacy and safety of children. 

It risks in fact becoming quite a fashionable thing to do amongst young people, and in just 5 years we may even forget how life was without this service. Children today will be sharing their location information with their friends, and if they are unable to determine the difference between online friends and real friends the risk of physical sexual exploitation is higher than what it is today.

Children are easily befriended online. If they agree to share their location information with someone that has befriended them, and has in fact intentions to groom them. The online grooming process (this is described in the book “Virtual Shadows”) is speeded up significantly. It will give the predator the child’s movement data to help them to build up a profile of the victim.  Latitude will in effect become yet another tool in the existing toolkit used by online predators to groom any individual child ready for sexual abuse.

Following is a clip from google explaining the privacy features of the service.

[youtube=http://www.youtube.com/watch?v=u9H4xaTspaQ&hl=en&fs=1]

In memory of my HP colleague and friend Kjell Östman

I am saddened to hear that my colleague and friend Kjell died on Monday, 2nd February, this week at the age of 46. Cause of death unknown as of yet, but we can guess that it was natural. It was sudden, on Friday my colleagues tell me that he left work early feeling unwell, and on Monday he was no longer with us 🙁candles_25

He was with HP 22 years having originally been with Digital. Kjell was loyal and hardworking, solid and calm and kind. He had a sense of humour that I will miss, we will all miss him! He was not making alot of noise around him, and sometimes surprisingly spontaneous in his communications. I will miss his smile when I came into the office, almost mischievous, as he liked to have a joke with me.

Kjell was a regular visitor to my blog and often sent me tidbits that I could share. He also contributed a paragraph to my book “Virtual Shadows” that I will share with you now 🙂

(preceding para) “…….you can build an online reputation that can be negative (as is mainly publicised by the popular media) or positive.”

kjell1

In the last e-communication I had with Kjell, I shared with him the index to the book before the hard copy was available because I wanted him to see his name there. He thought it was pretty cool and replied with the following

“well this is the first time I’ve seen my name in the index of a book, and it will probably be the only time”..

how true 🙁

It is a pity that he never got to see the hard copy of the book, the copy I promised arrives on Friday this week, a thank you for his valuable contribution. I am now thinking that maybe a close member of his family would like Kjell’s copy. It is a nice published souvenir of something that Kjell once said, I think he would have liked that 🙂

We will miss you Kjell!

Game accounts to be linked to ID in China

The Chinese Government’s next step is to implement a real name registration system in 2009, which would link game accounts with a given person’s ID number. Apparently the government claims to have a system implemented that can limit the number of hours each day an individual can spend playing games. This is the alleged motivation for this initiative, China’s young are spending too long playing online games. Read more..

Of course during online gaming young people are meeting for long periods of time other players from all over the world. This may start to give them new perceptions on the censorship that is going on in China… this is probably not desirable either for the Chinese government.

DPA amendments

There is some strange legislation changes happening in the U.K. It is an amendment to the Data Protection Act 1998.

Taken from computer weekly: “…an ‘information sharing order’ to share personal information. This seems to circumvent whatever purpose the information was gathered for; for example, child protection data could be shared with police, benefits officials or your local school. (……) Furthermore, the sharing process can include publishing that personal information.”

Just to give an example:
Part 8 — Data Protection Act 1998 (c. 29)
50A Power to enable information sharing
(1) Subject to the following provisions of this Part, a designated authority may by order (an “information-sharing order”) enable any person to share information which consists of or includes personal data.

(3) For the purposes of this Part a person shares information if the person–
(a) discloses the information by transmission, dissemination or otherwise making it available, or
(b) consults or uses the information for a purpose other than the purpose for which the information was obtained.

This means “mission-creep” is acknowledged as ok… not good. This provides an opening for the further sharing of any personal information that we have originally shared for a specific purpose, including our DNA data. After this change, there will be another amendment in a few years time, and bingo before we know it the DNA data of our children is stored and used for all sorts of unethical practices. Although of course, today we see them as so, in 20 years time, they will probably be accepted as normal.
Read more from computer weekly.

Thanks to ARCH blog for highlighting.