Pretexting ban signed into law in Calif.
245028
Calif. Gov. Arnold Schwarzenegger has signed into a law a bill that will ban the practice of pretexting in the state beginning on Jan. 1.
185521
U.K. prosecutors have received guidance on interpreting amendments to a&#160;computer crime law&#160;that introduce stronger penalties for computer hacking.A six-page document published on Monday by the Crown Prosecution Service (CPS) gives prosecutors pointers for handling offenses under soon-to-change provisions of the Computer Misuse Act (CMA) of 1990.The amendments were passed into law in November 2006 but have not yet come into force. The changes are designed to strengthen the government&#39;s ability to prosecute and punish hackers, and increase penalties for accessing systems without authorization.Computer security professionals have expressed concern&#160;about the drafting of the changes, however.The most-discussed change, contained in Section 3A of the CMA, makes it illegal for someone to create an application that is &quot;likely&quot; to be used for hacking. But the precise definition of &quot;likely&quot; has prompted fears the law could potentially target those undertaking activities such as penetration testing.According to the CPS document, prosecutors should look at what an application does and who its creator thought would use it. Conditions to consider would be whether the hacking tool was given to a &quot;closed and vetted list of IT security professionals or was posted openly,&quot; CPS said.Prosecutors should also find out whether the tool has a legitimate purpose, if it has a large installation base and whether it&#39;s commercially sold.Some applications will &quot;have a dual use, and prosecutors need to ascertain that the subject has a criminal intent,&quot; CPS said. Possession of a program is not enough to prosecute, it said.Computer security researchers &quot;might find some comfort in this guidance&quot; since criminal intent must be demonstrated, said Struan Robertson, senior associate with law firm Pinsent Masons.The guidance is generally acceptable, wrote Richard Clayton, a computer scientist at the University of Cambridge, on his blog. But using the criterion of whether a hacking program is available for sale ignores the fact that much software is free, Clayton said.On another issue, the document also clarifies what constitutes unauthorized access to a computer, a crime under Section 1 of the amended CMA. The defendant must know that the intended access wasn&#39;t permitted, and prosecutors must show that the person intended to improperly access information from the computer.&#160;
318342
Â· Internet industry asked to help curb illegal materialÂ· Terror bill proposes new powers against suspects
428355
(InfoWorld) - The U.S. Federal Trade Commission has asked a federal court to make two Florida companies stop telephone pretexting and to pay back victims of the practice. One of the companies, Action Research Group, has been linked in press reports to last year'sÂ Hewlett-Packard pretexting scandal, which led to theÂ resignation of HP Chairman Patricia DunnÂ last September. The second company, Eye in the Sky Investigations, has "performed services" for Action Research Group, the complaint said. Eye in the Sky also was called to testify before a congressional investigation into the matter. In a complaint filed Wednesday in U.S. District Court in Orlando, the FTC claims that the practice of pretexting violates the U.S. Telecommunications Act of 1996. Telephone pretexting is illegal in some states, but Thursday's complaint seeks to clarify where the FTC stands on the practice. "Selling the records constitutes an invasion of privacy that could endanger the health and safety of consumers," the FTC said in a statement released Thursday. It is also a violation of federal law, the statement says. HP's top executives became embroiled in a pretexting scandal late last year. While trying to clamp down on a boardroom leak dating back to 2005, HP hired private investigators who obtained telephone records of company employees and journalists by falsely representing themselves as account holders or telephone company employees. The scandal at HP also led to the resignation of Ann Baskins, formerly HP's senior vice president and general counsel, and Kevin Hunsaker, the company's senior legal counsel. On Thursday, an HP spokesman said he welcomed the FTC's move. "HP is opposed to pretexting and has expressly called for the practice to be made illegal," said HP's Ryan Donovan. "We support the FTC's efforts to permanently halt telephone record pretexting." All five FTC commissioners voted to authorize the complaint, the FTC said.
655421
Having sex with corpses is now  officially illegal in California after Gov. Arnold  Schwarzenegger signed a bill barring necrophilia, a spokeswoman  said on Friday.
467699
California on Friday banned motorists from talking on cell phones unless they use a headset or speakerphone, although the law will not take effect until July 1, 2008, to allow time to educate the public.
294975
Consultants in frame? Definitely Maybe The UK government has published guidelines for the application of a law that makes it illegal to create or distribute so-called "hacking tools".â¦
489516
Two U.S. representatives introduce a law to give the U.S. Federal Trade Commission authority over imposters who gain access to private telephone records.
121478
California Gov. Arnold Schwarzenegger signed a law on Friday making it a crime to buy telephone records or obtain them through deceit, an issue that has become important amid a furor over Hewlett-Packard Co.'s attempts to track down boardroom leaks to the press.
12038
The California attorney general expects to file charges against people at Hewlett-Packard Co and other companies in relation to the 'pretexting' scandal at HP, in which HP paid investigators who hacked the phone records of its directors and several journalists.
73778
(09/30/04)-- A federal judge in New York has struck down a law that authorizes the government to make secret searches of telephone and Internet records.
666817
California Gov. Arnold  Schwarzenegger signed a law on Friday making it a crime to buy  telephone records or obtain them through deceit, an issue that  has become important amid a furor over Hewlett-Packard Co.'s   attempts to track down boardroom leaks to the press.
396090
By Nicole C. Wong, San Jose Mercury News, Calif.  Mar.
762883
(InfoWorld) - There's already an RFID security brouhaha brewing in Washington, and if some people have their way, it won't be the last legal fight waged in the nation's capital over use of the wireless technology. The IT security community is buzzing with interest over a legal spat that broke out on Feb. 27, one day ahead of the start of the Black Hat DC 2007 conference. Officials with Seattle-based IOActive were forced to scale back a planned presentation at the government-themed security trade show in which an expert from the company was to have detailed a technique for hacking data transmitted by HID's popular proximity identification cards used by millions of people nationwide.Â  Chris Paget, IOActive's director of research and development, had planned to show off an RFID "cloning" device that could be used to steal access codes from HID-brand proximity cards, store them, then use the stolen codes to fool an HID card reader. According to show organizers, HID quashed the session by threatening to file a patent infringement suit against IOActive over the use of HID's source code in the demonstration. Despite the Black Hat lecture's amendment, U.S. lawmakers say the debate over use of similar RFID security technologies in the government space is far from over. IOActive claims that its initial experiment in hacking the HID system was partially spawned by the firm's physical proximity to government IT assets protected by the devices. The security service provider maintains that its offices are located in a building that uses HID's cards for physical access that also houses "components of the nation's critical infrastructure." Such concerns have pushed some lawmakers to introduce new bills seeking to limit the use of RFID-based systems in the government sector. Among those backing legislation is California State Senator Joe Simitian, a Democrat who is currently pushing five related bills in his home state. One of the laws introduced by Simitian (California SB-31), whose 11th Senate District encompasses much of California's Silicon Valley, directly addresses "skimming," the same hacker technique to have been displayed by IOActive through which wireless transmissions from RFID technologies may be captured. A second bill (California SB-30) calls for a moratorium on the adoption of RFID technology in government-issued IDs, while the others propose similar controls for a range of use cases for the technology, including barring applications for tracking students in the state's school systems. Simitian submitted the bills after California Gov. Arnold Schwarzenegger vetoed a broader piece of legislation proposing limits on the use of RFID in the government in Oct. 2006. The governor cited his belief that the bill could "unduly burden the numerous beneficial new applications of contact-less technology" as his main reason for shooting it down. To help illustrate the seriousness of the situation to his colleagues in California's senate and state assembly, Simitian conducted a test in 2006 through which a security expert was hired to visit the state's capitol building in Sacramento and hack an RFID card system used to gain entry to the building's garage. The cards used in that test were made by Motorola. "We're at the state capitol building in the post-9/11 environment, and we've spent millions to improve security, but in the space of several minutes, someone with a laptop can compromise the badge system," Simitian said in an interview with InfoWorld. "The main problem is that the issues aren't widely understood. That's why we've come back with five bills -- because I want to ensure I get to tell this story in every venue that I can; if we can sit down and explain the issue to people, they get it, but it's a hard, complex technical issue." Simitian said that HID was involved in negotiating the terms of the bill vetoed by Gov. Schwarzenegger but said that the firm still refused to give the legislation its blessing. The lawmaker labeled HID's move to stop the IOActive Black Hat briefing as proof of its "embarrassment" over the ease with which its products can be defeated. As the son of a computer programmer and the recipient of several awards from the IT security industry, including an honor bestowed at the RSA 2007 conference earlier this month, Simitian said he hardly considers himself as conservative when it comes to promoting new technologies. He has a hard time understanding why Schwarzenegger and others have blocked laws that require "practical" security measures for the use of RFID. "I'm a moderate on this issue, which is what frustrates me with the pushback, but those of us who are advocates for technology also know best that it must be used well and wisely," he said. "We have only ourselves to blame if not, and the notion of embedding government documents with RFID with no protections, or to use it in government ID cards, just strikes me as irresponsible." One of the solutions proposed by HID, whose officials maintain that the company's proximity cards have not been targeted by skimming attacks on a widespread basis, is for concerned customers to upgrade to its more expensive smart card IDs, which use a more advanced form of "active" RFID. "That's what was so frustrating about governor's message: He said that placing limits on RFID is premature, but the technology has already been with us for a decade," Simitian said. "Should we wait until it's deployed to millions of Californians and then worry? The time to identify problems is now before things get out of control. I think the public expects that." And data skimming isn't the only security concern to have been posed regarding RFID systems, which are being used for a wide range of industrial applications beyond providing access to facilities. In March 2006, Dutch researchers published a research report that contends that RFID chips can be infected with malware and used to spread attacks to the back-end IT systems to which they're connected. People like Simitian who oppose further adoption of RFID technologies in the government sector often refer to a now-defunct pilot program operated by the Department of Homeland Security (DHS) as further evidence that the tools aren't ready for widespread use. As part of the U.S. Visitor and Immigration Status Indicator Technology (U.S. VISIT) program, DHS used documents bearing RFID technology between 2005 and 2006 to help track the movement of individuals at several major land border crossings. In a report issued on Jan. 31, 2007, the U.S. Government Accountability Office (GAO) indicated that the RFID portion of the program had been halted based on concerns about the technologies' usefulness and security ramifications. Like the HID proximity cards hacked by IOActive and those made by other popular vendors, the RFID technology used in the DHS pilot featured long-range radio frequency technology, which is considered by experts to be the most dangerous based on the ability for the devices' signals to be intercepted from as far as 30 feet away. Jim Harper, director of information policy studies at the Cato Institute, a public policy think-tank based in Washington, helped author a DHS report that reviewed security and privacy issues related to the use of RFID within the U.S. VISIT program. The HID-IOActive imbroglio serves as yet another example of how commonly-used RFID technologies aren't ready for application in the government and elsewhere, he said. "I don't think the government should try to lead the way on RFID; we should let the technologies mature further and iron-out the security risks first," Harper said. "Up to this point, the government has been a leading adopter, and all that has done is put U.S. citizens into the role of guinea pig." On the flip side, RFID proponents maintain that lawmakers must be prudent in drafting any limitations they place on the use of the technology so as to not limit potentially beneficial innovation. Randy Vanderhoof, executive director of the Smart Card Alliance, a 160-member nonprofit group that promotes the use of RFID in cutting-edge identification systems, said that legislators are correct to demand that security and privacy concerns surrounding use of the tools be addressed, but he observed that some of the bills that have been proposed are far too vague and all-inclusive. "The intention is right in terms of protecting citizens' privacy, but legislation that seeks to outlaw technologies without further defining their use is the wrong approach," Vanderhoof said. "One of the things that people in smart card industry have told me in reading this legislative language is that it is really broad and subject to interpretation and that the technical nuances between various forms of RF-enabled technologies are not taken into consideration." Despite the bad press being given to RFID by incidents such as the HID-IOActive squabble, the expert believes that common sense will win out and U.S. lawmakers will create regulations that allow for use of more secure applications of the technology in the government setting. "Our interest is to try to get people to become more specific about their language. When they say it's insecure to use long read-range RFID for an access card, they're probably right," said Vanderhoof. "We would like to see legislators putting meat into laws that will make it costly for people to try to exploit weaker forms of these technologies to commit fraud; we think it's smarter to use legislation as a deterrent rather than to restrict the use of technologies, many of which have proven very cost effective and productive."
349113
Companies and others that secretly install "spyware" programs on people's computers to quietly monitor their Internet activities would face hefty federal fines under a bill the House passed Tuesday.    The most egregious behaviors ascribed to the category of such software - secretly recording a person's computer keystrokes or mouse clicks - are already illegal under U.S...
659234
(InfoWorld) - When the U.S. Congress adjourned in the early morning hours Saturday, it left a number of technology-related bills unfinished, including two bills addressingÂ fraudulent access to personal telephone records. Despite pressure from members of the House of Representatives Energy and Commerce Committee, the full House failed to act on the Prevention of Fraudulent Access to Phone Records Act. The law would have allowed the U.S. Federal Trade Commission to seek civil penalties against businesses that obtain personal data under false pretenses. The committee has been looking into privacy concerns related to so-called pretexting since early this year, but the issue came to a head last month, whenÂ Hewlett-Packard revealedÂ it had used questionable investigative techniques in the surveillance of board members, employees, and reporters. With pretexting, private investigators or identity thieves pretend to be customers of mobile phone carriers or other companies in order to gain access to personal records such as call logs. Congress still has more time to act on the pretexting legislation or six related bills this year, however. After a month-plus break allowing lawmakers to focus on the Nov. 7 election, Congress will return for a lame-duck session Nov. 9. Democrats last week complained that the House Republican leadership had held up the pretexting legislation, but Representative Joe Barton, a Texas Republican and Energy and Commerce chairman, said he'd continue to push for the legislation. Congress alsoÂ failed to pass a wide-ranging broadband billÂ that would replace local franchise rules with a national system for telecom providers launching Internet Protocol-based television services in competition with cable TV. And although U.S. President George Bush called on Congress to pass legislation authorizing a controversial National Security Agency (NSA)Â surveillance program, two bills making it easier for the government to conduct surveillance without court-ordered warrants also stalled. One piece of Internet-related legislation did pass early Saturday. The Senate passed a bill providing money for seaport security, and added to the bill was a provision prohibiting U.S. banks and credit-card companies from processing payments to online gambling sites. A group of professional poker players had asked Congress to reject the bill, but a group of House Republicans pushed for the legislation, saying offshore gambling sites were breaking U.S. gambling-control laws. Bush had called for legislation to authorize the NSA program, which has listened in on the electronic communications of U.S. residents without court-ordered warrants, as a way to head off multiple lawsuits targeting the program. He has argued the program is necessary to help keep U.S. residents safe from terrorism. The HouseÂ passed one surveillance bill, but the Senate failed to act. The House bill would allow federal law enforcement officials to spy on U.S. residents for up to 90 days without a court order in the period after a terrorist attack. The Center for Democracy and Technology (CDT), a civil liberties and privacy advocacy group, said it was happy to see the surveillance and broadband bills stall. Republicans supporting the surveillance bill were pushing it as a way to show they were focused on national security during the last weeks of the congressional campaign, said Nancy Libin, a staff counsel at CDT. "Now that they've gone home, I'm not sure what kind of priority it will be when they come back," she said. Several civil liberties groups had opposed the broadband bill as it lacked protections for so-called net neutrality. Net neutrality advocates want a law that would prohibit broadband providers from blocking or slowing service to Web sites offering competing content, and they have successfully halted the Senate version of the broadband bill, despiteÂ heavy lobbying from large broadband providers.
41373
Top "white hats" share their hacks in California.