Phishers come calling on VoIP

Cheaply available voice over Internet Protocol numbers and Net calling are helping crooks launch new data-thieving scams, a security company has warned.

Companies Read Employee E-mail

Big Brother is not only watching but he is also reading your e-mail.

According to a new study, about a third of big companies in the United States and Britain hire employees to read and analyze outbound e-mail as they seek to guard against legal, financial or regulatory risk.

Berners-Lee applies Web 2.0 to improve accessibility

Accessibility seminars often begin with a quote by Tim Berners-Lee: "The power of the web is in its universality. Access by everyone regardless of disability is an essential aspect." It's an old quote, but the web's inventor offered fresh ideas the day before yesterday.

Phones4u wins passing off appeal against phone4u

An online seller of mobile phones did not infringe the trade mark of John Caudwell's Phones4u chain when it used the domain name phone4u.co.uk, according to the Court of Appeal. But Friday's judgment concluded that there was passing off.

Dealing with a phishing attack

As phishing attacks have grown, the defences and mysterious counter-measures have evolved. Uri Rivner, Head of New Technologies at RSA Cyota Consumer Solutions, tells a detective's story.

The Business of CANning SPAM

The FTC took a short break from the business of security breach enforcement to remind corporate America that commercial email (a/k/a spam) has its rules, and failing to abide by them has a price. In statement released on May 11, the FTC announced that both Kodak Imaging Network (formerly Ofoto, Inc.) and ICE.com had agreed to settle a series of CAN-SPAM charges brought against them in a pair of FTC complaints. According to the Commission, Kodak allegedly "sent a commercial e-mail message to more than two million recipients that failed to contain an opt-out mechanism, failed to disclose in the email message that consumers have the right to opt-out of receiving further mailings, and failed to include a valid physical postal address, as required by law." Meanwhile, ICE.com purportedly "sent more than 6,000 e-mail messages to consumers who had previously requested not to receive future commercial e-mail messages from the company." Neither company was hit with a very big fine ($26,331 for Kodak, and only $6,500 for ICE.com). But, in addition to agreeing not to violate CAN-SPAM again, both companies agreed to submit themselves to a series of FTC monitoring, record-keeping, and reporting provisions intended to keep them honest.
© Copyright 2006 Steptoe & Johnson LLP

GET YOUR ECOMMUNICATIONS GUIDE NOW
If you want your organisation to be compliant with South African eCommunication legislation then email us (info@vangaalenlaw.co.za ) your details (Fulle Name, name of your organisation, website address, email address and tel. no.) and we will forward you our eCommunications Guide. The eCommunication Guide will include the topic as mentioned above - "how to reflect an 'unsubscribe' opt-out function in accordance with sec. 45 of the Electronic Communications and Transactions Act 25 of 2002"

Appeals Court says Denial of Service is a crime

A judge made a mistake when he suggested that a teenager using a 'mail-bombing' program to attack his former employer's computer system was not breaching the Computer Misuse Act, according to the Court of Appeal.

Others must learn from Morgan Stanley's missing emails

Morgan Stanley last week agreed to pay $15 million to settle a civil action brought by the US Securities and Exchange Commission for failing to produce tens of thousands of emails requested during SEC investigations from 2000 to 2005.

ISO/IEC standard benchmarks provision of software asset management

A new ISO and IEC standard for managing software assets is expected to result in cost savings for users, whether large or small enterprises, as well as improved efficiency, risk management and customer (internal and external) satisfaction.

Published by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission), ISO/IEC 19770-1:2006, Information technology - Software asset management - Part 1: Processes will enable organizations to benchmark their capability in delivering managed services, measuring service levels and assessing performance.

Software asset management (SAM) principles apply to the media, installations, licenses, proof of license, and intellectual property associated with the software. Until now the application of these business processes has been arbitrary and relatively few organizations have been able to implement a comprehensive strategy. The implementation of ISO/IEC 19770-1:2006 will standardize the framework making it possible for companies to integrate SAM into their other compliance and best practice models.

ISO/IEC 19770:2006, which is issued in two parts under the general title, Software asset management, will enable service providers to understand how to enhance the quality of service delivered to their customers, both internal and external.

• 
  Part 1: describes the processes involved in SAM.
• 
  Part 2: defines a product identification that will simplify the software inventory process*.

The standard is intended to align closely to, and to support, ISO/IEC 20000:2005, issued in two parts under the general title, Information technology - Service management.

If you think it is time to audit your existing Software Assest Management ("SAW") process / practise and amend same to reflect the latest standard, then contact van Gaalen Attorneys who will be able to:-

1. Execute a SAW audit;
2. Provide a GAP analysis (incl. recommendations);
3. Deliver and assist with the implementation of the required process flows, policies, notices etc.to ensure that your organisation is compliant with the ISO/IEC standard

Contact van Gaalen Attorneys for more information: info@vangaalenlaw.co.za or tel: 011 782 9511/2 or fax: 0866318898

UK Data Protection Authority Takes Surprisingly Flexible Approach to Sale of Consumer Data

Upholding its reputation as one of the most flexible EU data protection authorities (DPAs), the Office of the UK Information Commissioner recently released Good Practice Note taking a surprisingly flexible approach to sale of databases containing consumers' personal data. To the initial question "Can databases be sold?," the Information Commissioner gave a qualified "Yes." The first circumstance in which the Information Commissioner notes that consumer databases may be sold is where the consumers included in the database have given their consent. The second, and more controversial, circumstance is the Information Commissioner's statement that if a business is insolvent, bankrupt, going out of business, or being sold, the "[UK Data Protection] Act will not prevent the sale of a database containing the details of individual customers, providing certain requirements are met." The "requirements" relate mainly to using the information for the "same or similar" purposes to those for which the information was gathered, and providing notice to consumers in the database of the sale. But nowhere does the Information Commissioner say that consumers must be given the chance to object to further use of their information upon a sale, and the authorization of "similar" use is quite flexible. Such guidance will certainly raise a few eyebrows at other EU DPAs.

© Copyright 2006 Steptoe & Johnson LLP

IT Security: Hacking law updates are overdue

It's taken some time for MPs to decide how to update the UK's laws against hackers. Nevertheless, the proposals in the new Police and Justice Bill don't look too shabby.

Apple argues that blogger can't protect source

A US appeals court has been hearing arguments in a case that tests the right of a blogger to protect his sources. Apple Computer wants to know who leaked details of a product called 'Asteroid' and expects bloggers to reveal the names.

IT Security: What's the Inside Attacker Profile?

What's the Inside Attacker Profile?
The United States Secret Service and the Carnegie Mellon University Software Engineering Institute's CERT Coordination Center published an insider threats study report in 2005 which offered critical insights into the mind and motivation of the "inside attacker." According to the statistics gathered, the inside attacker is usually:

• Male
• 17-60 years old
• Holds a technical position (86 percent chance)
• May or may not be married (50/50 chance)
• Racially and ethnic diverse

Sufficiently broad pool? Absolutely. Here are some additional statistics, again from the same CERT study:

• In 92 percent of the incidents investigated, revenge was the primary motivator.
• Sixty-two percent of the attacks were planned in advance.
• Fifty-seven percent of the attackers surveyed would consider themselves "disgruntled."
• Eighty percent exhibited suspicious or disruptive behavior to their colleagues or supervisors before the attack.
• Only 43 percent had authorized access (by policy, not necessarily via system control).
• Sixty-four percent used remote access to carry out the attack.
• Most incidents required little technical sophistication.

Worker can't be fired for Web surfing

A New York City employee cannot be fired for surfing the Web from work, an administrative law judge has ruled.

High costs hamper domain resolution

The Department of Communications expects progress to be made on the development of an alternative domain name dispute resolution process within the next three months. The absence of an alternative dispute resolution process (ADRP) has led to high costs for businesses, say industry players...

ICANN mulls .tel domain for contact info

Reaching out and touching someone used to be as simple as dialing a string of numbers.

But now there are home, cell and work phone numbers from which to choose, and sometimes work extensions to remember. There are also e-mail addresses -- at home and at work -- and instant messaging handles, perhaps separate ones for the various services, some of which now do voice and video besides text.

Some people even have Web pages -- through their employer or Internet service provider, or perhaps a profile or two on MySpace.

To help people manage all their contact information online, the Internet's key oversight agency is considering a ``.tel'' domain name. If approved, the domain could be available this year.

Wireless TV all-clear

Is this something that we will see in South Africa when it comes to the braodcasting of TV over wireless devices or over the internet?

See what was said in Canada:
Cellphone TV services started with hockey clips and news but now the broadcasting regulator has given wireless carriers carte blanche to move beyond traditional television.
Mobile TV services from Telus Corp., Bell Mobility Inc. and Rogers Wireless Communications Inc. are delivered over the Internet and aren't subject to the same rules as those provided by cable operators and broadcasters, the Canadian Radio-television and Telecommunications Commission said Wednesday....

See Canadian Radio-television and Telecommunications Commission's Public Notice on Regulatory framework for mobile television broadcasting services - click here

source: www.theglobeandmail.com

Court rules that an email address is not a signature

A High Court judge has ruled that the presence of a sender's email address in the header of an email does not amount to a signature – although a typed name would have sufficed to form a binding contract.

Corporate blogs are a liability

EDITORIAL: Many bloggers wear suits, not pyjamas. A recent proliferation of corporate blogs has given numerous workers a new platform for self-expression. But while employers hope to see business benefits, lawyers will see nothing but trouble.

ID thect and fraud - The weakest link - uneffective policy implementation!!!

There's some good news and some bad news to report concerning the fight against identity theft and cyber fraud. The good news is that financial institutions and other companies continue to batten down their information security with high-end tecnological measures such as two-stage identification and multifactor authentication. The bad news is that even the most advanced information security systems often have an Achilles heel -- usually in inadequate, or unenforced, policies covering employees and contractors. The recent spate of thefts of employee or contractor laptops thefts, resulting in the loss of sensitive information, is a perfect example. No matter how much money a company spends on fancy data security measures, these less sexy links in its security chain will continue to be vulnerable to exploitation by clever fraudsters. This doesn’t mean companies should give up on the high-end technological measures. Rather, it means companies need to pay as much attention to the more mundane, less glamorous aspects of security, like establishing and enforcing rules on the handling of sensitive data, and regularly using encryption.

© Copyright 2006 Steptoe & Johnson LLP. Steptoe & Johnson LLP