For those who believe revenge is a dish best served cold...

Like so many around the country, David Welles has had to endure a long cold Winter this year -- only made worse by the volume of snow in front of his Chicago home, and the untimely disappearance of his snow shovel. While Welles is no better equipped to dig his way out of a snowstorm than anyone else without a shovel, he was perfectly equipped to identify the perpetrator -- or, at least her car. That's because Welles works for a security company by the name of Tunnel Vision Technology, and it appears as though he's been visiting the supply closet.

While we'll presume that David's "eagle eye" came with a receipt, the snow shovel he caught his neighbor stealing on digital video didn't. Under ordinary circumstances, one might turn the evidence over to the police. Then again, under ordinary circumstances, it's not likely there would have been any evidence. But, these are no ordinary circumstances, and these are no ordinary times.

David's shovel was probably worth less than $25, maybe ten on the street. The trail was cold before it was laid. And the "perp" wore gloves, so no fingerprints. This wasn't about money. This was about the age's-old relationship between a man and his tools. Besides, Welles had another idea. He entered an arms race, added a dose of PsyOps... and then he turned to YouTube. The result? What Welles calls, "The Quadrilogy of My Favorite Snow Shovel". See the results for yourself.

(NOTE: If you are ONLY connaisseur of revenge, skip to the mid-point.)

Zurich-based photoblogger Mirco Wilhelm says Flickr deleted his paid ("Pro") account by mistake and lost 4,000 of his photos. Flickr confirmed that Wilheilm's account was mistakenly deleted after he reported that another user was stealing his photos.

According to an email from the company:

Unfortunately, I have mixed up the accounts and accidentally deleted yours.

Given all the recent discussion regarding government-mandated data retention for investigative purposes, this event certainly emphasizes what can happen when there is no data retention policy in place. Unlike many popular online services, who typically disable accounts before deleting them (if they are ever deleted at all), Flickr apparently sends closed accounts directly to the incinerator.

Read more at http://www.observer.com/2011/tech/flickr-accidentally-deletes-users-4000-photos-and-cant-get-them-back

Show of hands: How many people have a reasonable expectation of privacy when you send an email? It turns out, as late as December 2010, you may have had no reasonable expectation of privacy when it came to your email correspondence -- at least that was the opinion of the United States Department of Justice (DOJ). And, between your Internet Service Provider's (ISP) Terms of Service (TOS), and the 1986 Stored Communications Act (18 U.S.C. §§ 2701-2712), you may not have under various circumstances.

M. Scott Koller, of McKennon | Schindler in Newport Beach, CA has written a very comprehensive overview of the decision, why it was ever in doubt, and the 1986 act that got us here in the first place.

Read more at http://www.reasonableexpectation.com/2011/01/09/stored-email-protected-by-the-4th-amendment/

WARNING: Portions of this video may be disturbing to automotive enthusiasts.

A brother and sister from Diamond Bar were arrested on suspicion of insurance fraud after investigators found a video on the Internet that appears to show their high-performance 2009 Nissan GT-R sports car crashing during a street race.

Investigators say Jay Chen, 21 from Diamond Bar, California first reported to his insurance company that his sister crashed his 2009 Nissan GT-R supercar on the 10 Freeway on March 16, 2009, but later withdrew the claim. They say his sister, Tracy Chen, corroborated the story. Months later, according to insurance investigators, Chen filed another claim (estimated at $76,000 in damage), saying that he had crashed the same car on the 60 Freeway in Riverside. Having received information from a body shop that they had the damaged vehicle on their premises for several months, an investigator turned to the Internet and discovered evidence the California Insurance Commission calls "key to building the case" against the Chens. Both have been booked on charges of felony insurance fraud.

More @ San Gabrel Valley Tribune (http://www.sgvtribune.com/news/ci_14666391) & California Department of Insurance (http://www.insurance.ca.gov/0400-news/0100-press-releases/2010/release040-10.cfm)

What do you call the sacrifice of one person's privacy in an attempt to save the privacy of over 1300? If you're a bank, you call it collateral damage.

When I was a kid I earned my first paycheck passing out fliers for a neighbor who was starting a pool cleaning business. With my first $13 in hand, my grandfather took me to the a bank in walking distance to my home, got me a tour of the vault from the branch manager, a neat pouch to hold all my coin, a full explanation of the principals of savings and loans, and helped me open my very first savings account. Believe it or not, back then, all my account information was stored on a double-sided index card behind the teller.

Today, things are much more complicated. Gone are the index cards and passbooks, most of the employees, tellers and branches, a good deal of the service, interest-bearing accounts with only $13 in them, and a lot of the customers' money. Today, it's all computerized, and most banks even attach various penalties to discourage human contact.

I know an awful lot about electronic data systems, but I don't pretend to fully understand how the modern banking system works. Sometimes, I think I do--from a mechanical (as opposed to financial) perspective. But then something convinces me that I don't. For instance, you know how every so often your bank emails its customers' names, addresses, Social Security numbers, and loan information to Gmail?

To be completely honest, I didn't know they did that either, until I found out recently that The Rocky Mountain Bank in Wyoming had sent 1,325 such records to the wrong Gmail account. (Mind you, most would have trouble imagining who could possibly be the right recipient.) Once the error was noticed, the bank attempted to contact the recipient to request immediate destruction of the email and its attachment. When the bank received no response, a request was made to Google for the recipient's identity. Citing its privacy policy, Google refused to provide the information requested, and the bank filed suit.

According to court documents:

"On August 12, 2009, Plaintiff received a request from one of its customers for Plaintiff to send certain loan statements to a third-party representative of that customer. That same day, an employee of Plaintiff attempted to send the requested information to the customer’s representative via email. The next day, Plaintiff discovered that its employee had inadvertently sent the email to the wrong Gmail email address. In addition, Plaintiff discovered that attached to the email was a file containing confidential customer information for 1,325 individual and business customer accounts for customers other than just the customer who requested information. The confidential information includes names, addresses, tax identification numbers, and loan information for each of the 1,325 customer accounts.

After learning of its inadvertent disclosure of confidential customer information, Plaintiff tried to recall the email without success. It then sent another email to the Gmail address, instructing the recipient to immediately delete the prior email and the attached file in its entirety without opening or reviewing it. Plaintiff also requested that the recipient contact Plaintiff to discuss his or her actions. The recipient has not responded to Plaintiff’s email."

Ironically, in a case that pits the privacy interests of innocent parties against each other, the protagonists of this story had some privacy concerns of their own. The Bank's lawyers attempted to file their suit under seal -- which was denied by the U.S. District Court. Though not mentioned in the court's ruling on this issue, most states have security breach notification laws that require disclosure of any records that may have gotten into the hands of unauthorized individuals. Wyoming does, indeed, have such a law (40-12-502. "Computer security breach; notice to affected persons"). It states:

"(a) An individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. If the investigation determines that the misuse of personal identifying information about a Wyoming resident has occurred or is reasonably likely to occur, the individual or the commercial entity shall give notice as soon as possible to the affected Wyoming resident."

While the bank was compounding errors by ignoring its obligations to its customers and state law, their case against Google was being reviewed by another judge who ordered Google to disable the account, and disclose the recipient's identity.

The Rocky Mountain Bank maintains that it contacted the recipient more than once and requested that the individual respond to requests to "discuss his or her actions". The implication is that, had the recipient responded, this whole matter could have been handled amicably and honorably -- among gentlemen, as it were. I wonder if, from the perspective of the bank, its customers, or even the email recipient, a "discussion" would have really sufficed. I know, as a bank customer, John Doe's word that he had deleted all my personal information from his Gmail account wouldn't satisfy me at all. If I were in charge of bank security, I don't think I'd be very satisfied either. In either case, I suppose I would be demanding proof that had been deleted, never copied, forwarded, or printed, and probably some kind of connotative memory-wipe.

Years ago, I was consulted by a judge after a District Attorney's office "accidentally" obtained access to a defense lawyer's hard drive (quotes inserted to cite the provided explanation, not my personal feelings about the explanation). The negotiated remedy and order was an extensive forensic search of the DA's hard drives, and a complete wipe of their contents -- even when the search turned up no conclusive evidence that the DA had ever examined any privileged materials. But I doubt any accidental recipient would agree to that -- especially a civilian. And why should they?

Of course, no one knows, at this point, if the recipient ever saw the message. Many reading this web site would likely have dismissed it, and any subsequent messages from the bank as a phishing scam. The Rocky Mountain Bank even has a link to an oddly nondescript PDF addressing the subject of phishing scams.

There's really no reason to believe that the bank ever considered litigation to be an entirely avoidable option, no matter how cooperative the recipient might have been. Nor am I convinced that the court's decision has provided any comfort to the individual's who's privacy has been sacrificed -- including the one who's email account has been disabled, and personal information shared with a bank that's already demonstrated that they can't be trusted with the information.

So, if suing Google won't assure its customers' privacy and financial security, what should the bank have done? That's an easy one. Ask any programmer. They'll tell you: The only way to fix a 1D10T error is to upgrade your wetware and reboot.

Source: Wikipedia

In a match between Bird-brain vs. broadband, you might be surprised to see who wins.

An old friend of mine pointed out what sounded like an interesting story out of South Africa. Tired of slow download speeds, a South African call center pitted a racing pigeon against Telkom South Africa Ltd.’s ADSL data service to see which could move a 4GB file faster. In total it took just under three hours for the bird to fly approximately 50 miles--about 30 times faster than the ADSL service, which had only downloaded 4% of the file in the same time.

I'm afraid we're not really comparing apapane to apapane, or even apapane to ostriches. I doubt, for instance, that the pigeon would fair quite as well over, say, a 500 or 5000 mile "data run".

The experiment, however, raises what is perhaps a more relevant conclusion: You probably couldn't find a more secure method for moving data than via carrier pigeon. While all Internet traffic is subject to both warranted, and illicit intercept and monitoring at multiple gateways, routers, interconnection points, and hosts, one would be hard pressed to serve a warrant on--or even physically intercept--a carrier pigeon. Not to mention, even if they occasionally drop a "packet", it's hard to argue with their wireless range.

It's certainly something to think about.

Thanks Ron!

More at:

Bloomberg (http://www.bloomberg.com/apps/news?pid=20601116&sid=aB5JSWQt0XYY)

News.com.au (http://www.news.com.au/technology/story/0,28348,26053119-5014239,00.html)

"One in the head still ain't dead!!!!!! On tha run for robbin a bank Love all of yall."

That was 27-year-old Joseph Wade Northington's MySpace status on January 20, 2009, when investigators suspected he robbed the Security Federal Bank in Augusta, S.C.

See C|Net News: http://news.cnet.com/8301-1023_3-10251862-93.html?tag=mncol;txt