Archive for the ‘Security’ Category

Compliance vs. Hard drives in printers, photocopiers and scanners

Thursday, May 13th, 2010

Here is a news report that explains well something we have been telling our clients for a while now. Multifunction machines, scanners, printers, photocopiers, etc. contain hard drives which capture ALL documents that run through them, unless you take action!

This means that any confidential (personal information, privileged material, commercial and industrial secrets, etc.)  information contained on the documents you print, copy or scan on a daily basis are retained on the hard drive contained in the machine unless it is wiped or set not to record images. That means, in many cases, you and/or your organisation are violating different statutes and regulations every day… As explained in this news report, this situation is exacerbated when you decommission these machines and give or sell them to third parties who, in turn, send them abroad to be reused or recycled:

Canadian Tire Embroiled in Privacy Rights Scandal

Tuesday, December 22nd, 2009


Photo: Luc Cinq-Mars

A Canadian Tire store in Verdun, Montréal recycled unshredded documents that contain employee social security numbers and other highly confidential personal information, as reported in the French language daily 24 Heures, “Des informations personnelles se retrouvent au recyclage». In this case the paper was “accidentally” re-used to print-out a duplicate customer receipt. Let’s hope this was one limited incident and not a careless practice potentially widespread throughout the company and its stores. Regardless, it points to the pressing need of every corporation to develop, implement and monitor a seal-tight information management policy. The consequences of not doing so are potentially significant, as Dominic Jaar writes about in an article published in the International In-house Counsel Journal. (See the article on PIPEDA published elsewhere on this blog).

Cybercrime Newsletter – eNac

Wednesday, July 1st, 2009


Ledjit is glad to announce that it is the first Canadian organisation to partner with Cybex, an initiative cofunded by the European Commission’s Directorate General Freedom, Security and Justice within the framework of the Criminal Justice 2008 JPEN Programme.

Accordingly, we are happy to present you the first issue of the “Electronic Newsletter on the Fight Against Cybercrime” (eNAC). We also invite you to subscribe to this facinating newsletter”

The eNAC is a free monthly e-Newsletter mostly directed to judges, technicians, prosecutors, lawyers, computer forensics specialists, human resources managers, jurists, law enforcement bodies, and any person that deals with electronic evidence and seeks to prevent cybercrime. It is being disseminated to more than 30 countries and distributed in English, Spanish and Russian.

INDEX
E-Newsletter on the Fight Against Cybercrime – ENAC July | 2009 | no 1

Legal
“Cybercrime and electronic evidence”
Pedro Verdelho • Public Prosecutor and trainer at the Centro de Estudos Judiciários
 

Information and communication networks are a very fruitful field to new illegal activities that were in the origin of the so called cybercrime, a new branch of criminal law. Even if it is still under construction, this new legal area is already a major issue.

Data Protection
“Personal data protection in collecting traffic data in electronic communications: the Spanish experience”
Elena Domínguez Peco • Public Prosecutor and Collaborator of the Spanish Data Protection Agency

Overview of the Spanish personal data protection policy in collecting traffic data in electronic communications.

Technical
“The battle against cybercrime in our society isn’t lost”
Interview with Bruce Schneier • Security technologist

Law enforcement
“Cybercrime training, education and research: a vision for the future”
Nigel Jones • Director of Technology Risk Limited

Initiatives to harmonize cybercrime training and education across international borders plus the potential for national centers of excellence to be developed.

Institutional
“Institutional fight against cybercrime: introductory view”
Liljana Selinšek • Assistant Professor at the Law Faculty in Maribor

Different types of institutional fight against cybercrime and some opened questions connected to it.

Jurisprudence
Russian Federation • Resolution of the Federal Arbitration Court of Moscow
Norway • Borgarting Appelate Court
Singapore • Alliance Management SA v Pendleton Lane Pand another
Slovenia • Constitutional Court of the Republic of Slovenia

Stephen Mason • Barrister, Chambers of Stephen Mason

Hat tip to Stephen Mason for sending me a copy!

Cracking down on spam

Friday, February 6th, 2009

Are you tired of receiving more unsolicited email than solicited one?

The Honourable Senator Goldstein is and yesterday, he gave the opening speech for the second reading of his anti-spam bill, S-220, An Act respecting commercial electronic messages (the Anti-Spam Act). If passed, the bill would crack down on spam by prohibiting the sending of commercial emails to Canadians without their prior consent.

I have to say that it is about time. Everyone who has an email account has suffer from «spam» or «phishing» attacks, which occur when spam messages lure email users to fraudulent websites resembling those of trusted businesses in the hopes that the users will be fooled into entering their user names, passwords, or other information that can be used to gain access to their online accounts.

Anti-spam softwares were unsuccessful to protect the common user from these attacks and Senator Goldstein Anti-Spam act might be the answer. In fact, as Senator Goldstein says “Yet despite the widespread recognition that spam is a serious problem that costs our economy billions in fraud and lost productivity, Canada remains the only G8 country without anti-spam legislation.” 

Furthermore, he believes that “To compete in the 21st century, Canada must be able to harness the vast commercial potential of the internet without worrying about security.» According to him «The measures in bill S-220 are urgently needed to protect Canadians from cybercrime and to restore confidence in the internet as a platform for business. »

Let’s wish he is right and in the meantime, let’s be vigilant!

Fact to be noted, the email containing the information was unsolicited and failed to fall in any of the categories proposed by the act.

More details here

Health info goes missing on encrypted USB stick but…

Saturday, January 24th, 2009

A memory stick that may have contained information was lost at Preston Prison. This appears to be a banal story that happens everyday… The “funny” part follows:

“An urgent investigation was launched after the USB data stick – with the password attached to it on a memo note – went missing”!!!

- Lancashire Evening Post