judgecorp writes "British Members of Parliament have warned that the UK's cyber warfare strategy is getting it wrong. According to a defense committee report, the country's IT security forces are inadequately prepared for a cyber attack, rely too heavily on inadequately protected systems, and do not sufficiently appreciate the difficulty of attributing the source of an attack."

Chris453 writes "Earlier today, a Texas High School student named Andrea Hernandez and her family lost the first round of the lawsuit filed to prevent her school district from forcing its students to wear RFID badges for tracking purposes. The judge in the case declared that the district's compromise for the student (a badge without the battery) was sufficient and dismissed any First Amendment issues. The badges are RFIDs powered by built-in batteries and one of the concerns was that the badges would be used to track students off-campus. Interestingly enough, the school district claims in court documents that 'The badges do not work off campus (PDF).' However, on their website, the school district confirms that it is conceivable that an off-campus RFID reader could access badge serial numbers, but tries to downplay the significance: 'Therefore, an intruder or "hacker" can only learn that the tag serial number is, for example, #69872331, but that does not provide any useful information. Has the district committed perjury by claiming that the active RFIDs magically deactivate themselves when off school property?"

New submitter Oxide writes "A Kuwaiti court sentenced a man to two years in prison on Monday for insulting the country's ruler on Twitter, his lawyer said, the second person to be jailed for the offense in as many days. The Gulf state has clamped down in recent months on political activists who have been using social media websites to criticize the government and the ruling family. What's interesting is that the tweets in question did not mention the ruler directly but just indicated it might be him it is referring to."

mask.of.sanity writes "Researchers have examined writing styles to identify previously anonymous carders and hackers operating on underground forums. Up to 80 percent of users who wrote at least 5000 words across their posts could be identified using linguistic techniques. Techniques such as stylometric analysis were used to track users who posted across different forums, and could even be used to unveil authors of thesis papers or blogs who had taken to underground networks."

iComp sends word of a Chinese businessman who pleaded guilty to selling pirated software the retail value of which totaled more than $100 million. The software came from over 200 different companies, and was sold to buyers in 61 different countries over a 3-year period. The man was arrested by the U.S. Department of Homeland Security on the island of Saipan in 2011, after undercover agents had been working on the case for 18 months (PDF). "Li trolled black market Internet forums in search of hacked software, and people with the know-how to crack the passwords needed to run the program. Then he advertised them for sale on his websites. Li transferred the pirated programs to customers by sending compressed files via Gmail, or sent them hyperlinks to download servers, officials said. ... Agents lured Li from China to the U.S. territory of Saipan under the premise of discussing a joint illicit business venture. At an island hotel, Li delivered counterfeit packaging and, prosecutors said, "Twenty gigabytes of proprietary data obtained unlawfully from an American software company." Officials did not identify the company in court documents."

Spy Handler writes "A software update of the California welfare computer system (CalWIN) caused 37,000 Food Stamp recipients to lose their EBT (a credit card paid for by the government) benefits last weekend. According to the article, Hewlett Packard was responsible for the failed update of CalWIN, but at 8:00 a.m. today Xerox (who administers another state welfare system called CalFresh) issued a patch that reactivated the EBT cards."

chicksdaddy writes "A security researcher who was looking for vulnerabilities in Facebook's platform instead stumbled on a much larger hole that could affect scores of firms who rely on a secure file transfer platform from Accellion. Writing on his blog on Monday, Israeli researcher Nir Goldshlager said he discovered the password reset vulnerability while analyzing a Accellion deployment that is used, internally, by Facebook employees. Goldshlager used public knowledge of the Accellion platform to access a hidden account creation page for the Facebook deployment and create a new Facebook/Accellion account linked to his e-mail address. After analyzing Accellion's password reset feature, he realized that — with that valid account — he could reset the password of any other Facebook/Accellion user with some cutting and pasting and a simple HTTP POST request, provided he knew the user's login e-mail address — effectively hijacking the account. Goldshlager said he informed Facebook and that the hole has been patched by Facebook and Accellion. However, other Accellion customers using private cloud deployments of the product could still be vulnerable."

Antipater writes "Disney parks and resorts have long had a system that combined your room key, credit card, and park ticket into a single card. Now, they're taking it a step further by turning the card into an RFID wristband (called a 'MagicBand'), tracking you, and personalizing your park experience, targeted-ad style. 'Imagine booking guaranteed ride times for your favorite shows and attractions even before setting foot in the park,' wrote Tom Staggs, chairman of Walt Disney Parks and Resorts, in a blog posting on Monday. 'With MyMagic+, guests will be able to do that and more, enabling them to spend more time together and creating an experience that's better for everyone.' Disney does go on to talk about all the things you can opt out of if you have privacy concerns, and the whole system seems to be voluntary or even premium." With a theme park, at least, you can also choose to avoid the place entirely; that makes it, however creepy, a bit different from compulsory education settings, or mandatory car tracking.

Sir Realist writes "Apparently Microsoft's R&D offices in Mountain View were broken into over the holidays: the only things stolen were Apple iPads and the theft has apparently been confirmed from a number of sources."

inode_buddha writes "After completing its bailout rescue and paying back the money with interest, AIG is considering suing the US Government for doing so. The reasons why? Among other things, the 14% interest rate paid to the government. 'The lawsuit does not argue that government help was not needed. It contends that the onerous nature of the rescue — the taking of what became a 92 percent stake in the company, the deal's high interest rates and the funneling of billions to the insurer's Wall Street clients — deprived shareholders of tens of billions of dollars and violated the Fifth Amendment, which prohibits the taking of private property for "public use, without just compensation." The former CEO and current major shareholder said: "The government has been saying, 'We're your friend, we owned and controlled you and we let you go.' But A.I.G. doesn't owe loyalty to the government," a person close to Mr. Greenberg said. "It owes loyalty to its shareholders."' The lawyer representing him is none other than David Boies of SCO fame."

jfruh writes "Evidence of a gang rape committed by members of an Ohio high school football team, including video, was, in the way of digital native teenagers today, put online on various social media sites — and was quickly taken down as students began realizing the magnitude of the situation. The hactivist group Anonymous has been able to find archived and cached versions of the damning content, which may help prosecutors make their case." (The original story from December at the New York Times adds more detail.)

arclightfire writes "Endgame:Syria billed itself as the first game to cover on ongoing war in a mashup of interactivity and journalism. However it seems like Apple is not happy with this idea, as PocketTactics reports; 'Apple's app guidelines have once again tripped up the release of a strategy game rooted in a real-world conflict. Auroch Digital's Endgame Syria has been rejected by Apple's approvals team for violating guidelines section 15.3, "solely target[ing] a specific race, culture, a real government or corporation, or any other real entity." If section 15.3 sounds familiar, it's because it was the clause invoked when Cupertino said no to Pacific Fleet back in September – the game ran afoul of the guidelines for including Japanese flags in a WWII naval sim.'"

New submitter Fnordulicious writes "Although Canada's anti-spam legislation is already in place, the rules to implement it have been under development for more than a year. This weekend the proposed rules from the Department of Industry were published in the Canada Gazette. Kady O'Malley reports on the CBC Inside Politics Blog that Canadian ISPs will not be allowed to secretly monitor activity except in the case that the activity is illegal and represents an 'imminent risk to the security of its network.' In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"

CowboyRobot writes with news about a federal initiative to support federated authentication for government services. From the article: "The U.S. Postal Service will be the guinea pig for a White House-led effort to accelerate government adoption of technologies that allow federal agencies to accept third-party identity credentials for online services. The program involves using services ... through standards like OpenID rather than requiring users to create government usernames and passwords. ... The federated identity effort, known as the Federal Cloud Credential Exchange, is just one piece of a broader Obama administration online identity initiative: the National Strategy for Trusted Identities in Cyberspace (NSTIC), which aims to catalyze private sector-led development of a secure, digital 'identity ecosystem' to better protect identities online. ... The Postal Service pilot is but one of several different pilots that are part of NSTIC. There are also three cryptography pilots and two non-cryptographic privacy pilots in the works. Each of those pilots is being carried out by multiple private sector organizations ranging from the Virginia Department of Motor Vehicles to AOL to AARP to Aetna."

Qedward writes "Software developed by the FBI and Ernst & Young has revealed the most common words used in email conversations among employees engaged in corporate fraud. The software, which was developed using the knowledge gained from real life corporate fraud investigations, pinpoints and tracks common fraud phrases like 'cover up,' write off,' 'failed investment,' 'off the books,' 'nobody will find out' and 'grey area'. Expressions such as 'special fees' and 'friendly payments' are most common in bribery cases, while fears of getting caught are shown in phrases such as 'no inspection' and 'do not volunteer information.'"