Rockefeller to Target: why haven’t you reported data breach to the Securities and Exchange Commission (US Senate, 28 Jan 2014) – Chairman John D. (Jay) Rockefeller IV today sent a letter to Target asking why the company has not yet reported its recent massive data breach to the Securities and Exchange Commission (SEC), as the Commission recommended in an October 2011 guidance. Rockefeller encouraged the SEC to issue this guidance, and is a strong supporter of giving investors more complete and timely information about cyber incidents such as the Target data breach. “A data breach involving the theft of personal information about tens of millions of Target customers is clearly a material cyber attack that has affected how your business operates. I am therefore puzzled why your company has not yet updated its SEC filings to reflect this event. Your failure thus far to provide this information to your investors does not seem consistent with the spirit or the letter of the SEC’s financial disclosure rules,” Rockefeller wrote. More recently, Rockefeller encouraged SEC Chairman Mary Jo White in April 2013 to issue Commission-level guidance to spur companies to take their cybersecurity efforts seriously. Chairman White recently asked SEC staff to review disclosure rules, saying, “I believe we should rethink not only the type of information we ask companies to disclose, but also how that information is presented, where and how that information is disclosed, and how we can take advantage of technology to facilitate investors’ access to information and make it more meaningful to them.” Rockefeller and Senator Claire McCaskill (D-Mo.) asked Target on January 14, 2014 for the latest findings on the circumstances that permitted unauthorized access to the financial and personally identifying information of as many as 110 million Americans. [Polley : see also the earlier To 8-K, or not to 8-K? For Target, that is indeed the question (Mintz Levin, 17 Jan 2014)]

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/Stuart Miles.

US forces Coursera to ban students from Cuba, Iran, Sudan, and Syria (Slashdot, 29 Jan 2014) –“Coursera is an online website that offers free courses from many of the world’s top universities. Now, all students from Syria, Sudan, Iran and Cuba will no longer be able to access Coursera . The official blog provides more info regarding the ban: ‘ Until now the interpretation of export control regulations as they relate to MOOCs has been unclear and Coursera has been operating under the interpretation that MOOCs would not be restricted. We recently received information that has led to the understanding that the services offered on Coursera are not in compliance with the law as it stands … United States export control regulations prohibit U.S. businesses, such as MOOC providers like Coursera, from offering services to users in sanctioned countries, including Cuba, Iran, Sudan, and Syria. Under the law, certain aspects of Coursera’s course offerings are considered services and are therefore subject to restrictions in sanctioned countries, with the exception of Syria.’”

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/cooldesign.

The law belongs in the public domain (EFF, 14 Jan 2014) – For nearly two centuries it has been a basic precept that the law lives in the public domain. It’s simple: in a democratic society, people must have an unrestricted right to read and speak their own laws. Full stop. Of course, that principle means the law can never be subject to copyright restrictions. If any single entity owns a copyright in the law, it can buy, sell or ration the law, and make all sort of rules about when, where, and how we share it. People should never have to pay a fee to review and compare the rules and regulations they must obey, and no private entity should be the gatekeeper to the law. As an appellate court put it [I]t is hard to see how the public’s essential due process right of free access to the law (including a necessary right freely to copy and circulate all or part of a given ?law for various purposes), can be reconciled with the exclusivity afforded a private copyright holder . . . . Fortunately, open access crusaders like Public.Resource.Org (whose founder, Carl Malamud, is testifying before Congress today about this issue), and the Center for Information Technology Policy, have worked hard to correct the situation, by publishing legal and government documents and giving citizens the tools to do so themselves. A private company, Google, has also done its part by including court opinions in the Google Scholar database. Until recently, these folks haven’t had to deal with copyright infringement lawsuits as they worked to free the law. No longer. A group of standards-development organizations (SDOs) have banded together to sue Public.Resource.Org, accusing the site of infringing copyright by reproducing and publishing a host of safety codes that those organizations drafted and then lobbied heavily to have incorporated into law. The SDOs argue that they hold a copyright on those laws because the standards began their existence in the private sector, and were only later “incorporated by reference” into the law. That claim conflicts with the public interest, common sense, and the rule of law. The fundamental right to access and share the law does not disappear just because the law in question is a technical standard. And a good thing, too, because these standards are now a significant part of the laws that shape our lives. Once incorporated, they become mandatory requirements, just like any other law. The case involves crucial national standards like the national electrical codes, fire safety codes, and so on. Public access to such codes-meaning not just the ability to read them, but to publish and re-use them-can be crucial when there is an industrial accident, when there is a disaster such as the Moore, Oklahoma tornado, or when a homebuyer wants to know whether her house is code-compliant. Publishing the codes online, in a readily accessible format, makes it possible for reporters and other interested citizens to not only view them easily, but also to search and excerpt and generate new insights.

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/Salvatore Vuono.

Confide: an app for execs who want sensitive messages to vanish Snapchat-style (GigaOM, 8 Jan 2014) – Many people associate “disappear” apps like Snapchat with young people who want to send each other bong or boob shots. But kids are hardly the only ones who want to relay sensitive or silly messages without leaving a permanent trace on the internet. That’s the thinking behind “ Confide ,” a new app aimed at professionals who want to message each other about job references, corporate intrigue or other subjects that could cause trouble if a written record landed before HR or the legal department. Messages sent via Confide disappear on reading and can’t be retrieved later. Available for Apple devices as of January 8, Confide is the brainchild of Jon Brod, a co-founder of local news site Patch, and Howard Lerman, the CEO of marketing start-up Yext. Brod says the app came about after Lerman contacted him by email about a potential employee who Brod did not want to discuss in writing. He suggested they speak by phone instead. “We’re busy and it took us six days to connect,” he said in a phone interview, explaining why they created the app. “Professional relationships require tools for impermanence and confidence. We wanted to take the proven model of meeting for an off-the-record cup of coffee and bring it online.” To address the issue of screenshots, which can provide a way to preserve disappearing messages, Confide uses a “wand” feature that requires recipients to pass their fingers over the message to reveal additional words. The app also includes a notice feature, common among other disappear apps, that alerts the sender if the recipient took a screenshot of the message. Confide also includes another feature that might appeal to paranoid executives: end-to-end encryption that means Confide doesn’t possess a retrievable copy of the message. As for the possibility that professionals could use Confide to skirt legal duties (such as by-laws that require them to preserve corporate communications), Brod said the app is simply a platform and that it would be up to individuals to comply with their obligations.

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/KROMKRATHOG.

New industry contracts say “no data in the USA,” report says (GigaOM, 27 Dec 2013) – Is this the backlash? A handful of companies are requiring cloud service providers to promise – in writing – that they won’t store any client data in the United States, according to Bloomberg . The report says that a British grocery chain and a Canadian pharma company have responded to the ongoing US surveillance scandal by adding language to existing contracts that mandate suppliers to segment their data and keep it out of America. The report of the revised contracts comes as the cloud computing industry continues to digest news that America’s National Security Agency is tapping underwater cables and infiltrating the servers of storage providers as part of a sweeping counter-terrorism program. In August, shortly after news of the surveillance was leaked by Edward Snowden, a Forrester analyst reported that it could cost the U.S. cloud computing industry up to $180 billion as a result of foreign firms bolting American providers. The $180 billion figure (which appears plucked from the air) was cited as a worst case scenario and so far there has been no systemic exodus from American cloud companies. But the fear and anger in Europe and elsewhere over America’s surveillance activities are very real; a recent PWC report said that 15 percent of German companies are looking for cloud providers that promise not to cooperate with U.S. or U.K. intelligence services. So does the Bloomberg report portend the start of a trend? It’s too soon to say. The report, which also claimed a Canadian agency had asked for the “no data in USA” clause, was based on a single source (an Indiana security firm known as Rook Consulting ) and did not name any of the companies involved.

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/samuiblue.

Japan warns of security risk in software for language input (Bloomberg, 26 Dec 2013) – Japan’s government warned that certain software used for writing Japanese characters could lead to security leaks, including some programs made in China. The National Information Security Center asked all central government ministries to avoid the programs when making confidential documents because a record of the writing can be sent to servers outside the country. The programs, made by Beijing-based Baidu Inc. (BIDU), Microsoft Corp. (MSFT) and Google Inc. (GOOG), allow people to use an English-language keyboard to write Japanese characters by spelling them phonetically.

Provided by MIRLN.

Image courtesy of FreeDigitalPhotos.net/Stuart Miles.