Radisson Hotel Data Breach

M4x: Incident happened between Nov2008 to May2009. That long ago and just reported now? What happened to Incident Monitoring, Transaction logging Audits?

Radisson Hotels Reporting Significant Data Breach

8/19/2009

• By David Morrison

The Radisson Hotel chain is the latest American retail company to announce it has suffered a significant breach of its computer systems resulting in the compromise of credit and debit card data.

In an open letter to guests on the hotel's Web site (http://www.radisson.com/openletter/openletter.html) Radisson said that the breach had occurred for a number of months, from November 2008 until May 2009, but said the investigation had not revealed how many card numbers might have been compromised. It also revealed that the data accessed may have included the name printed on a guest’s credit card or debit card, a credit or debit card number, and/or a card expiration date.

“This unauthorized access was in violation of both civil and criminal laws. Radisson has been coordinating with federal law enforcement to assist in the investigation of this incident,” wrote Fredrik Korallus, chief operating officer for the hotel and resort chain.

“While the number of potentially affected hotels involved in this incident is limited, the data accessed may have included guest information such as the name printed on a guest’s credit card or debit card, a credit or debit card number, and/or a card expiration date. We recommend that you review your account statements and credit reports closely.”

The announcement comes on the heels of news of the indictment of Albert Gonzalez, the man law enforcement alleges has been responsible for many computer security thefts and card data breaches since 2007.

http://www.cutimes.com/News/2009/8/Pages/Radisson-Hotels-Reporting-Significant-Data-Breach.aspx?PrintPreview

Most recent breaches posted by Privacy rights Clearinghouse

This AMEX incident is troubling and the fact that this is hard to detect and control, consumers are just sittnig ducks. Well I am unaware of the complete details but many types of incidents like this go unreported. Brace yourself again, AMEX cardholders. Check you recent purchases.

Aug. 14, 2009	American Express (New York, NY)	Some American Express card members' accounts may have been compromised by an employee's recent theft of data. The former employee has been arrested and the company is investigating how the data was obtained. American Express declined to disclose any more details about the incident. The company has put additional fraud monitoring and protection controls on the accounts at issue.	Unknown
Aug. 14, 2009	Calhoun Area Career Center (Battle Creek, MI)	Personal information from 455 students at Calhoun Area Career Center during the 2005-2006 school year was available online for more than three years. The information included names, Social Security numbers, 2006 addresses and telephone numbers, birth dates and school information. There were about 1,000 students at the career center during that time, but an investigation by the Calhoun County Intermediate School district found that information for 455 students was available.	455
Aug. 15, 2009	Northern Kentucky University (Highland Heights, KY)	A Northern Kentucky University employee's laptop computer - which contained personal information about some current and former students -- was stolen from a restricted area. The personal information stored on the employee's computer included Social Security numbers of at least 200 current and former students.	200

Associated Content: Privacy and Monitoring in the USA

Privacy and Monitoring in the USA

The USA Patriot Act and Laws Regarding Privacy and Monitoring in the United States

By D W

http://www.associatedcontent.com/article/2042805/privacy_and_monitoring_in_the_usa.html?cat=17

Takeaways

USA Patriot Act

Privacy and Monitoring Laws

Ethics and Technology

The United States of America has been reducing privacy levels drastically as part of its anti-terrorism campaign. The USA has passed a law known as the USA Patriot Act, which allows criminal and intelligence investigations to go anywhere that Americans used to believe was private. This law allows investigators to break into homes and examine objects without consent, and even examine an individual's personal records. This law can overrule state and federal privacy laws, and is directly linked to the FBI. This is an example of the power of information shifting to the government, and this means that increased use of, and improved, investigation technology will contribute to increasing levels of power being attributed to the US government over it's citizens. If the government keeps this type of action up, then it will soon begin to develop a lot of dominance over it's citizens in the form of restricted information. If citizens wish to maintain any level of privacy, they will need to begin standing up for their own personal privacy rights before they let it's increasingly restrictive government from manipulating and controlling it's people. It is unlikely that many Americans want to see prying monitoring technology end up being installed in private locations just to feed information to it's hungry government, only then to not have access to any of the personal information themselves.

So why not let everyone have access to the receiving end of monitoring technology? It is possible to argue that if all the data that is gathered from this technology was made public and accessible to everyone, that it would be morally acceptable. Should anyone behave in a way that is not acceptable for everyone (at least of a certain age) to witness, even if it is in a private location? The answer to this is a definite no. If everyone had the ability to openly spy on each other, then it would turn into a society where those who had the most attention would be ostracized while those who are fortunate enough get ignored can begin to gain an advantage simply by not being noticed, and likely get off with rule-breaking and criminal activity.

This would lead then lead to lack of efficiency, lack of innovation, dis-utility, and even some inequality because those who are simply more commonly spied on, likely because they are beginning to get ahead, will lose an edge in our competitive society. If human and informational monitoring was reduced only to public areas, then it would be much more ethical because people could simply operate outside of the public eye if they so desired. Still, many of these same issues still exist, with the wealthier members of society being the only ones who can afford the necessary private property, and the poorer being the ones who need to use public services and are forced to conform more strongly to the legal system of the society.

However, many advantages also exist to public monitoring, especially in situations where the nature of the law (or desired restricted/encouraged behaviors) exists in and of itself because the location is public. Good examples are freeways and public intersections, where people simply must adhere to the rules in order for the service to function. Public monitoring in an area like this can only be deemed ethical because all it does is encourage more organized, beneficial behavior in a highly publicized location.

The only downside is that they must access this public location in order to get from one private location to another, but with the monitoring it still becomes a more organized area that should eliminate free-riders, dangerous law-breakers, and unwanted public behavior in a place that everyone has to be. Some semi-public places (such as a hospital or school) may want to reduce monitoring and respect more privacy rights because of the reality that patients have little choice in the matter, as they require the public services to function, and have to spend much of their time at the public locations whether or not they are being monitored.

latimes.com/business/la-fi-cover-privacy16-2009aug16,0,5663794.story

Online, your private life is searchable

Photos, addresses, family ties, court documents, details from MySpace profiles -- the moment information is published online, it can be copied and re-posted, and often is.

By David Sarno

August 16, 2009

When Maya Rupert wrote an article frowning at several Southern states for officially celebrating Confederate History Month, Internet critics lined up to fire back.

But this time, they arrived with more than harsh words.

The 28-year-old Los Angeles attorney's detractors dug up a photo of her and posted it, along with details of political contributions she'd made, in an online discussion of the article she wrote for the L.A. Watts Times. They called their finds evidence of her bias on the emotionally charged subject.

"It really surprised me when I found out that people could see how much I donated to Obama," Rupert said, referring to the $400 she gave to the candidate last year, the record of which is available through several online watchdog sites.

After that, Rupert said, "they pulled a picture off my firm's website and said, 'Of course she's black.' "

Until recently, personal information has been scattered across cyberspace, to be found or not depending on the luck and sophistication of the searcher. But a new crop of "snooper" sites is making it easier than ever for anyone with Internet access to assemble the information into a digital portrait.

"It's amazing what you can Google," one of the people who criticized Rupert wrote in an online forum.

Rupert has since learned that the photo and campaign contributions were just a small part of her online "footprint" -- an expansive dossier that she did not realize was available to anyone searching her name.

On Snitch.name, users can enter a name -- their own or someone else's -- and watch as the site culls information from dozens of search engines, social networks and directories.

Rupert entered her name into Snitch last week, and within a minute she was presented with photos of herself, details of her California Bar membership and the names and addresses of her sister and parents.

"I'm a fan of open records and a fan of a lot of information being public," she said. "But there's public," and then there's the unfettered Web where "at the touch of a button, I can find out private information about you and use that for other purposes."

"It's really creepy," she said.

Latest Data Breach as Reported by the Privacy Rights Clearinghouse

Aug. 13, 2009

National Guard Bureau (Arlington, VA)

An Army contractor had a laptop stolen containing personal information on 131,000 soldiers. on the stolen laptop contained personal information on soldiers enrolled in the Army National Guard Bonus and Incentives Program. The data includes names, Social Security numbers, incentive payment amounts and payment dates.

131,000

http://www.securityfocus.com/news/11556

Two convicted in U.K. for refusal to decrypt data
Chris Williams, The Register 2009-08-12

Two people have been successfully prosecuted for refusing to provide U.K. authorities with their encryption keys, resulting in landmark convictions that may have carried jail sentences of up to five years.

The British government said today it does not know their fate.

The power to force people to unscramble their data was granted to authorities in October 2007. Between 1 April, 2008 and 31 March this year the first two convictions were obtained.

The disclosure was made by Sir Christopher Rose, the government's Chief Surveillance Commissioner, in his recent annual report.

The former High Court judge did not provide details of the crimes being investigated in the case of either individual — neither of whom were necessarily suspects — nor of the sentences they received.

The Crown Prosecution Service said it was unable to track down information on the legal milestones without the defendants' names.

Failure to comply with a section 49 notice carries a sentence of up to two years jail plus fines. Failure to comply during a national security investigation carries up to five years jail.

Sir Christopher reported that all of the 15 section 49 notices served over the year - including the two that resulted in convictions - were in "counter terrorism, child indecency and domestic extremism" cases.

The Register has established that the woman served with the first section 49 notice, as part of an animal rights extremism investigation, was not one of those convicted for failing to comply. She was later convicted and jailed on blackmail charges.

Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted. Sir Christopher did not report whether prosecutions failed or are pending against the five charged but not convicted in the period covered by his report.

To obtain a section 49 notice, police forces must first apply to the National Technical Assistance Centre (NTAC). Although its web presence suggests NTAC is part of the Home Office's Office of Security and Counter Terrorism, it is in fact located at the government's secretive Cheltenham code breaking centre, GCHQ.

GCHQ didn't immediately respond to a request for further information on the convictions. The Home Office said NTAC does not know the outcomes of the notices it approves.

NTAC approved a total of 26 applications for a section 49 notice during the period covered by the Chief Surveillance Commissioner's report, which does not say if any applications were refused. The judicial permission necessary to serve the notices was then sought in 17 cases. Judges did not refuse permission in any case.

One police force obtained and served a section 49 notice without NTAC approval while acting on "incorrect information from the Police National Legal Database", according to Sir Christopher. The action was dropped before it reached court.

Locational Privacy

Another neat paper from EFF on locational privacy:

http://www.eff.org/wp/locational-privacy

On Locational Privacy, and How to Avoid Losing it Forever
By Andrew J. Blumberg and Peter Eckersley, August 2009


Over the next decade, systems which create and store digital records of people's movements through public space will be woven inextricably into the fabric of everyday life. We are already starting to see such systems now, and there will be many more in the near future.

Here are some examples you might already have used or read about:

* Monthly transit swipe-cards
* Electronic tolling devices (FastTrak, EZpass, congestion pricing)
* Cellphones
* Services telling you when your friends are nearby
* Searches on your PDA for services and businesses near your current location
* Free Wi-Fi with ads for businesses near the network access point you're using
* Electronic swipe cards for doors
* Parking meters you can call to add money to, and which send you a text message when your time is running out
* These systems are marvelously innovative, and they promise benefits ranging from increased convenience to transformative new kinds of social interaction.

Unfortunately, these systems pose a dramatic threat to locational privacy.

What is "locational privacy"?
Locational privacy (also known as "location privacy") is the ability of an individual to move in public space with the expectation that under normal circumstances their location will not be systematically and secretly recorded for later use. The systems discusssed above have the potential to strip away locational privacy from individuals, making it possible for others to ask (and answer) the following sorts of questions by consulting the location databases:

* Did you go to an anti-war rally on Tuesday?
* A small meeting to plan the rally the week before?
* At the house of one "Bob Jackson"?
* Did you walk into an abortion clinic?
* Did you see an AIDS counselor?
* Have you been checking into a motel at lunchtimes?
* Why was your secretary with you?
* Did you skip lunch to pitch a new invention to a VC? Which one?
* Were you the person who anonymously tipped off safety regulators about the rusty machines?
* Did you and your VP for sales meet with ACME Ltd on Monday?
* Which church do you attend? Which mosque? Which gay bars?
* Who is my ex-girlfriend going to dinner with?

Of course, when you leave your home you sacrifice some privacy. Someone might see you enter the clinic on Market Street, or notice that you and your secretary left the Hilton Gardens Inn together. Furthermore, in the world of ten years ago, all of this information could be obtained by people who didn't like you or didn't trust you.

Continue reading at:

http://www.eff.org/wp/locational-privacy