Report casts doubt on IRS hacking-detection system
630912
An Internal Revenue Service system designed to protect the agency's modernized systems from hacking isn't working properly, according to a report by the Treasury inspector general for tax administration.
283682
A computer hacker apparently broke into a database, leaving 32,000 people uncertain whether their finances or identities might be compromised.
80703
The MacSweeper site purports to scan Macs for security issues, then sell users a software fix--but researchers have their doubts.
201232
As the U.S. prepares to shift to controversial RFID-based electronic passports, security and privacy concerns rage around the documents. One expert: "Of course [they] will be hacked."
343394
Identity thieves can snare Social Security numbers from a potpourri of public records, especially those maintained by state and local governments, according to a new report by the Government Accountability Office.
680349
TechWeb - A government report is blaming a botched software project for the loss of $318 million, which the IRS mistakenly paid in bad tax refunds.
277363
(InfoWorld) - The U.S. National Institute of Standards and Technology (NIST) has recommended that the U.S. government require touch-screen electronic voting machines to include independent audit technology, such as printouts. "The lack of an independent audit capability in systems is one of the main reasons behind continued questions about voting system security and diminished public confidence in elections," says a NIST paper released this month. "In practical terms the software-dependent approach cannot be made secure or highly reliable." The Technical Guidelines Development Committee of the U.S. Elections Assistance Commission (EAC) is scheduled to review the NIST's recommendation that direct record electronic (DRE) machines include voter-verified paper trails or other auditing mechanisms at a meeting Monday and Tuesday. DREs do not assure that voting records are accurate, and 15 states using the e-voting machines do not use independent audit mechanisms statewide, the NIST paper says. "Trust in an election outcome relies heavily upon trusting the correctness of the DRE's software and upon trusting that the DRE software has not been replaced or tampered with," the paper says. "Simply put, the DRE architecture's inability to provide for independent audits of its electronic records makes it a poor choice for an environment in which detecting errors and fraud is important." A spokesman for the Information Technology Association of America (ITAA), representing e-voting machine vendors, didn't immediately return a message seeking comment on the NIST recommendations. The ITAA has argued that paper trail ballots may simply print out the same results stored on the DREs. Paper trail systems can be costly to add on to DREs, and printer breakdowns can cause problems during elections, the ITAA has said. One e-voting critic praised the report. "That's really good news," said Barbara Burt, director of the election reform program at Common Cause, one of several groups calling for e-voting paper trails. "It looks like it's going to help us finally get rid of the paperless DREs." NIST's recommendations come after scattered reports of problems with DREs in the Nov. 7 U.S. elections. In Florida's 13th congressional district, Democratic candidate Christine Jennings has filed a lawsuit asking for a revote after 18,000 voters failed to cast a vote in the U.S. House of Representatives race. Two recounts found Republican Vern Buchanan the winner of the race, but Sarasota County did not require the Elections System and Software (ES&S) e-voting machines to include paper printouts to back up the electronic vote. While e-voting supporters say the machines make it hard to undervote, Sarasota County voters cast about 16,000 more votes in the Florida governor's race and in the Florida Senate race than were recorded in the House race. About 4,000 more people cast ballots for the county's Southern District Hospital Board than were recorded in the House race. Thirty-five states either mandate voter-verified paper-trail systems or use them statewide without a mandate, according to the NIST report. But 10 states use paper-trail ballots on a county-by-county basis, and five states, including Maryland, Georgia and Louisiana, use DREs statewide without paper- trail ballots. The NIST paper published this month recommends states use "software-independent" voting systems, using either paper-trail ballots or cryptographic audit systems instead of relying on the "correctness of the software" for election results. The paper suggests that the EAC require audit mechanisms in e-voting machines, and recommends that federal election officials stop certifying e-voting machines without independent audit systems after 2009 or 2010.ADVERTISEMENTNEW IT SERVICES FROM IBM: EASIER TO BUY AND IMPLEMENTDiscover a simpler, more cost-effective way to get the solutions your company needs to grow more flexible and efficient.
458033
A recent warning from the Internal Revenue Service raises the question of when it is wise to consider placing a security freeze on your credit files.
158448
Blog: Attacks on cash register data are still possible fifteen years after flaws in the systems were cited.
100035
The IRS continues to have "pervasive" information security weaknesses according to a new Government Accountability Office report.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
537751
Security experts cast doubt on claims that Microsofts Vista is "more secure" than other operating systems.
529376
A reassessment by the Central Intelligence Agency has cast doubt on a central piece of evidence used by the Bush administration before the invasion of Iraq to draw links
103643
Makers of security software question the thoroughness and accuracy of evaluations.
547003
If you&#39;re a convicted identity thief, you&#39;ve got about a 50 percent chance of avoiding jail time.That&#39;s one of the findings of a new study of closed U.S. Secret Service case files, released Monday by Utica College&#39;s Center for Identity Management and Information Protection. This is the first time researchers have been allowed to sift through the Secret Service&#39;s data. The study&#39;s authors based their findings on an&#160;analysis of 500 closed Secret Service cases.&quot;Prosecutors had a slightly better chance of sending a convicted identity thief to prison than not (51 percent) and could expect to see the imprisoned offender sentenced to three years or less of incarceration,&quot; the report said.The college has been working with a number of partners, including the Secret Service, IBM, and the Federal Bureau of Investigation, since the Center&#39;s creation in mid-2006 to study the methods used by ID thieves and to help corporations and law enforcement prevent this type of crime.Technology like printers, mobile phones, and computers were used in about half of the cases, but the Internet was the exclusive tool of ID thieves only about 10 percent of the time.Identity theft is concentrated in the northeastern and southern United States, the study found. And the majority of the offenders in the Secret Service cases were African-American; more than two-thirds of all offenders were male.The study also found that ID thieves tended to hit people that they did not know, rather than preying on friends and relatives. A family member or friend was the victim in 16 percent of cases. In about a third of the cases, the theft was an inside job, with the data being stolen from an employer.Identity theft is a well-studied phenomenon, but it&#39;s unusual for a survey to be based on this kind of closed-case data. &quot;This study is significant because it did not depend on self-reported or survey data,&quot; the authors wrote.The median loss from identity theft was just over $31,000, but in one case, investigated by the Secret Service&#39;s Dallas field office, the defendant spent millions on luxury vehicles and then managed to set up shell companies and defraud investors. Total losses: $13 million. &quot;In general,&quot; however, &quot;the more offenders involved in the case, the higher the victim loss,&quot; the study stated.According to Javelin Strategy &amp; Research, identity theft cost U.S.businesses and consumers an estimated $49.3 billion in 2006.&#160;
62632
Lawmakers on House and Senate intelligence committees say that while the National Security Agency has amassed a huge database of Americans&#039; calling records, cooperation with the NSA by telephone companies was not as widespread as USA Today initially reported, the newspaper said Friday.
621931
The program, designed to let the agency detect and analyze cases of unauthorized access to taxpayer data, hasn&#39;t worked correctly since the IRS took delivery in 2002.