Raj Goel - Social Media & Cloud Computing Threats to Privacy, Security & Liberty – A GLOBAL Perspective

Raj Goel,CISSP
ChiefTechnologyOfficer
Brainlink International, Inc.
raj@brainlink.com / 917-685-7731

2
“Everything You Say Can And Will Be Used Against You, By Anybody,
Now Or Decades Into The Future.” – Falkvinge
http://www.brainlink.com/free-stuff/webinars/what-to-teach-your-kids-employees-and-interns-
about-social-media/
October 19, 2011 ©2013 Raj Goel / Raj Goel, CISSP / raj@brainlink.com / 917-685-7731

3
- Al Pacino,The Devils Advocate
“If you have something that you don’t want
anyone to know maybe you shouldn’t be doing
it in the first place”
- Eric Schmidt
“The Age Of Privacy is Over”
– Mark Zuckerberg

 Burglary Ring in Nashua, NH committed 50 break-ins,
stole $100,000+. Targeted victims who posted their
location on Facebook.
 http://gawker.com/5635046/real+life-burglary-ring-
uses-facebook-to-choose-victims
 Adam Savage, Mythbusters, posted photo of his new
truck, parked in front of his house. Fans (and crooks!)
discover his address via GeoTags embedded in the
photo.
 http://text.broadbandreports.com/forum/r24657556-
MythBusters-stalked-down-with-geotag-photos
4October 19, 2011 ©2013 Raj Goel / Raj Goel, CISSP / raj@brainlink.com / 917-685-7731

 University ofWisconsin-La Crosse student Adam
Bauer was ticketed for underage drinking in
November 2009 after accepting a friend request from
a seemingly good-looking girl on Facebook.The
request was actually a ruse from La Crosse police, who
had set up a sting to catch underage drinkers. Bauer
had posted photos of himself holding a beer, an act
that ultimately led to his $227 fine. Bauer was at least
one of eight people who said they had been cited for
photos posted on social-networking sites.
 http://tech.ca.msn.com/most-notorious-facebook-
arrests?page=7

 Mr. Crisp worked at an Apple Retail store in the UK.
 He posted negative comments aboutApple on his Facebook page
and marked them PRIVATE.
 First because "Apple had in place a clear social media policy and
stressed in their induction process that commentary on Apple
products, or critical remarks about the brand were strictly
prohibited".
 Despite having "private" Facebook settings, the tribunal decided
that there was nothing to prevent friends from copying and
passing on Crisp’s* comments, so he was unable to rely on the
right to privacy contained in Article 8 of the European Convention
on Human Rights (covered in the UK by the Human Rights Act
1998). He retained his right to freedom of expression under Article
10, but Apple successfully argued that it was justified and
proportionate to limit this right in order to protect its commercial
reputation against potentially damaging posts.
6
http://www.theregister.co.uk/2011/11/03/apple_employee_fired/

 Users offered no safety from Facebook-trawling.
 Australia’s communications regulator has ruled that television
networks are not breaking the industry’s code of practice when
publishing photos lifted from a public Facebook profile.
 The Australian Communications and Media Authority ACMA
determined that Channel Seven did not breach the Commercial
Television Industry Code of Practice when it accessed and
broadcasted photographs – specifically in the case of a deceased
person lifted from a Facebook tribute page, and another which
broadcasted the name, photograph and comments penned by a
14-year old boy.
 http://www.itnews.com.au/News/284896,acma-finds-facebook-
photos-are-not-private.aspx

 Children and young people are posting thousands of sexually explicit
images of themselves and their peers online, which are then being stolen
by porn websites, according to a leading internet safety organisation.
 A study by the InternetWatch Foundation (IWF) reveals that 88% of self-
made sexual or suggestive images and videos posted by young people,
often on social networking sites, are taken from their original online
location and uploaded on to other websites.
 Reams of sexually explicit images and videos are being uploaded by
children and young people, the study found. During 47 hours, over a four-
week period, a total of 12,224 images and videos were analysed and
logged.The majority of these were then mined by “parasite websites”
created for the sole purpose of displaying sexually explicit images and
videos of young people.
 - http://www.guardian.co.uk/technology/2012/oct/22/parasite-porn-
websites-images-videos

 ATexas woman (Melissa Walthall) has been
arrested and charged with a felony for posting a
publicly available photograph of an undercover
police officer to her Facebook profile, reports
say.According to the Associated Press, Melissa
Walthall, 30, of Mesquite,Tex., was arrested last
week and charged with retaliation, a felony, for
posting the photo.
 - http://www.huffingtonpost.com/2012/10/16/melissa-walthall-texas-undercover-
cop-facebook-arrest_n_1970479.html?utm_hp_ref=technology
9

 You know those deadbeat friends of yours on Facebook? They could end up killing your
credit score and costing you a loan. At the very least, your no-account pals could bump up
your interest rate.
 […] details the efforts of several online banks that plan to analyze your social media profiles
to determine how big a credit risk you are. It’s yet more evidence that, unlike LasVegas,
what happens on Facebook doesn’t stay on Facebook – and could come back to bite you in
unexpected and unpleasant ways.
 How are banks going to use this information? First, they’re going to use your friends list to
troll for future prospects. If you just took out a line of credit against the equity in your
house, maybe your friends will too – assuming they’ve got any equity left.
 It gets worse. Let’s say you fall a few months behind on your payments and you’ve decided
to banish the bill collecting goons to voice mail. Hong Kong-based micro-lender Lenddo –
which asks for your Facebook, Twitter, Gmail,Yahoo, and Windows Live logons when you
sign up — reserves the right to rat you out to all your friends
 http://www.pcworld.com/article/246511/how_facebook_can_hurt_your_credit_rating.html

11
http://www.guardian.co.uk/technology/2011/mar/08/
facebook-us-divorces
http://www.dailymail.co.uk/femail/article-
2080398/Facebook-cited-THIRD-divorces.html

 According to the American Academy of Matrimonial Lawyers, 81%
have used or faced evidence from Facebook, MySpace,WOW,Twitter,
LinkedIn, etc. See http://kotaku.com/5576262/farmville-world-of-
warcraft-are-divorce-lawyers-latest-weapons-in-court and
http://www.usatoday.com/tech/news/2010-06-29-facebook-
divorce_N.htm?loc=interstitialskip
 For example
▪ 1. Father seeks custody of the kids, claiming (among other things) that his ex-
wife never attends the events of their young ones. Subpoenaed evidence from
the gaming siteWorld ofWarcraft tracks her there with her boyfriend at the
precise time she was supposed to be out with the children.
▪ 2. Mom denies in court that she smokes marijuana but posts partying, pot-
smoking photos of herself on Facebook.

 Madison police say two young teens have been arrested after video of
their street fight was posted to Facebook.
 A CapitalTimes report onTuesday says the video showed adults standing
around watching the boys fight in the street last week. No serious
injuries were reported.
 Police say the fight lasted about 2½ minutes.The video shows a 14-year-
old repeatedly slamming the head of a 13-year-old into the pavement.
The younger boy told police he may have blacked out briefly.
 Police began to investigate after they learned of a video of the fight that
one of the boys had posted on his Facebook page.
 The teens were arrested on tentative charges of battery and disorderly
conduct.
 http://www.fox11online.com/dpp/news/wisconsin/facebook-video-leads-
to-arrest-of-two-teens

 Bobbi Duncan desperately wanted her father not to know she is
lesbian. Facebook told him anyway.
 One evening last fall, the president of the Queer Chorus, a choir
group she had recently joined, inadvertently exposed Ms.
Duncan’s sexuality to her nearly 200 Facebook friends, including
her father, by adding her to a Facebook Inc. discussion group.That
night, Ms. Duncan’s father left vitriolic messages on her phone,
demanding she renounce same-sex relationships, she says, and
threatening to sever family ties. The 22-year-old cried all night on
a friend’s couch. “I felt like someone had hit me in the stomach …
 -
http://online.wsj.com/article/SB1000087239639044416580457800
8740578200224.html

 That doesn’t mean that there still aren’t some oddities in the case,
however. As a number of folks have sent over, reading through the
indictment (also embedded below) shows that a significant chunk of the
“evidence” seems to consist of Facebook “likes” and shared content
among the accused. From the indictment:
 I have reviewed several of the social media web sites for KABIR,
SANTANA, DELEON, each of whom has posted radical prom jihad
content on their respective pages.Additionally, portions of the social
media show that DELEON and SANTANA “liked” postings on KABIR’s
Facebook page as early as May 2011.
 Public items posted by KABIR to his social media accounts include
photographs of himself, non-extremist content, radical Islamist content,
and items reflecting a mistrust of mainstream media, abuses by the
government, conspiracy theories, abuses by law enforcement, and the
war inAfghanistan. …
 http://www.techdirt.com/

 Noam Neusner, a formerWhite
House speechwriter for President
GeorgeW. Bush, thought he had
given $250 to Ohio GOP Senate
candidate Josh Mandel.
 He hadn't.
 Instead, Neusner was one of nearly
3,000 donors who stumbled onto a
network of look-alike campaign
websites that have netted more
than $570,000 this year in what
some are calling a sophisticated
political phishing scheme.
 -
http://www.theatlantic.com/politics/
archive/2012/09/look-alike-sites-
funnel-big-money-to-mystery-
pac/262150/

 John McAfee, the millionaire software
executive turned semi-fugitive,
was falsely reported captured over the
weekend. Now, in a new post on his
blog, he claims that he’s left Belize for
another country in the company of two
Vice journalists and his longtime female
companion, Sam. He also noted that
Vice would be publishing a story today
that would end all the speculation as to
whether or not he is a “drug-crazed
madman.”can be charged with cyber-
libel,” the senator said.
 http://www.wired.com/gadgetlab/2012/
12/oops-did-vice-just-give-away-john-
mcafees-location-with-this-photo//

 Dell spends $2.7 million per year to protect founder Michael Dell's family,
but tweets and blogs from the billionaire's kids describing where they are
and what they're doing don't make the job any easier.
 An Instagram account linked to theTwitter postings of Dell's daughter,
Alexa, 18, divulged where she was shopping and where she stayed on a
recent trip to NewYork. Alongside that, her tweets detailed GPS
information that could track her exact location; she even tweeted the
location of her high school graduation dinner, which her family attended.
 A photo of Zachary Dell, 15, appeared on aTumblr blog called "Rich Kids
of Instagram," showing the scion devouring a grand buffet just before
departing for Fiji on the family's jet.

http://www.foxnews.com/tech/2012/08/13/dell-faces-major-security-
breach-over-daughter-tweets

 Mark’s sister posted a family photo.
 Photo showed up on someone else’s newsfeed, friend
tweeted it.
 Randi Zuckerberg said that the sharing of a private
photo was 'not about privacy settings, it's about
human decency'.
 "Not sure where you got this photo," Zuckerberg
wrote, in subsequently deleted correspondence
captured by BuzzFeed. "I posted it only to friends on
FB.You reposting it onTwitter is way uncool.“
 http://www.guardian.co.uk/technology/us-news-
blog/2012/dec/27/facebook-founder-sister-zuckerberg-photo

20
We know where you are.We know where you’ve been.
We can more or less know what you’re thinking about.”
“Streetview the cars we drive only once, you can just
move, right?”
“I ACTUALLY think most people don’t want Google to
answer their questions, they want Google to tell them
what they should be doing next.

 Facebook users who have listed themselves as “In a
Relationship” or “Married” and linked their profile to
their partner’s will find that Facebook has
automatically generated them a couple page,
celebrating their love.The couple’s page skims off a
photo of the happy pair together as the profile
picture, lists all events that the two have mutually
attended and the Likes that they have in common. It
shows all photos that both are tagged in and lists wall
posts that each have put on the other’s wall.
 You don’t need to be a dyspeptic technology hack to
find this nauseating.
 http://www.theregister.co.uk/2012/11/15/facebook_couples_page/

 On Friday, a researcher by the name of Suriya Prakash claimed
that the majority of phone numbers on Facebook are not safe. It’s
not clear where he got his numbers from (he says 98 percent,
while another time he says 500 million out of Facebook’s 600
million mobile users), but his demonstration certainly showed he
could collect countless phone numbers and their corresponding
Facebook names with very little effort.
 Facebook has confirmed that it limited the Prakash’s activity but
it’s unclear how long it took to do so. Prakash disagrees with when
Facebook says his activity was curtailed.
 This is not a bug, but a FEATURE of facebook.
 http://thenextweb.com/facebook/2012/10/10/facebook-confirms-
researcher-exploited-privacy-settings-to-quickly-collect-user-
phone-numbers//

 As far as I can tell, the app “GirlsAround Me” wasn’t
violating any laws. But it was high on the creepy scale
when, according to reports, women’s identity,
photographs and location were being revealed to
strangers, even though the women never opted into
the service.Although the developer, Moscow-based
I-Free, hardly deserves any awards, the app’s a good
wake-up call for people to use the privacy settings of
legitimate social networking and location services.
 The app mashed together information people posted
about themselves publicly on Foursquare
and Facebook and created a map showing the
location and photographs of nearby women.
 http://www.forbes.com/sites/larrymagid/2012/04/09/
girls-around-me-app-is-a-reminder-to-be-aware-
what-you-share/

 Remember all those movies where the hero
ducked into a bar to avoid the bad guys?
 Or all those bars you walked into with your date,
because the vibe felt right?
 Kiss those days good bye.
 Bars equipped with SceneTap record all patrons in
real time, perform gender & demographic
analysis, and publish that data on the web &
mobile apps.
 So much for the privacy and anonymity of your
local bar…
 - http://venturebeat.com/2012/05/13/scenetap-is-
watching/

 1.2 Billion users
 All 10 fingers & both irises
 300 million people already enrolled.
 400 million by end of 2014
 State agencies and other entities allowed to ask questions above
the Federal limit – Caste, Religion, etc.
 API allows access by Law Enforcement, Banks, Corporations,
Other entities
 At completion, 20PB of data – 128x bigger than DHS’ database
 99% effective.
 1% error rate = 12 million faulty records per day
 http://www.wired.com/magazine/2011/08/ff_indiaid/all/

 103 million fingerprints
 15 million faces
 Digital Signatures
 14 Million records in Sep 2009, 102 million by Sep 2012
 They sought World Record Academy recognition for
having the largest biometric database in the world in
Oct 2012
▪ http://gulfnews.com/news/gulf/uae/government/uae-has-largest-
biometric-database-1.1117910

27
- Oscar Benavides, former Peruvian President

 ECPA declared that e-mail was a private means of communication,
and that we might hope for the same level of privacy in it as we
have in phone calls and letters. Among other things, it means that
police need a wiretap warrant to read your e-mails, and that your
e-mail company's employees can't disclose your e-mails to others.
 [...] E-mail in transit is protected, but those in law
enforcement advocate that once mail is processed and stored, it is
no longer the same private letter, but simply a database service.
 GMail's big selling point is that they don't simply deliver your mail.
They store it for you, and they index it so you can search it.
 - BradTempleton, Chairman of the Electronic Frontier
Foundation, http://www.templetons.com/brad/gmail.html

 If former CIA Director David Petraeus had secretly stashed love letters he
exchanged with his paramour at home under his mattress, he might have
actually done a better job of protecting his privacy.
 Because of the way a key federal privacy law was worded in 1986, back in the pre-
Internet days of analog modems, floppy disks, and the 2.8 MHz Apple IIgs, e-mail
stored in the cloud receives less legal protection than it would if printed out.
 For love letters stashed under a mattress, FBI agents would have had to secure a
search warrant from a judge to enter Petraeus’ bedroom. Perhaps just as
important, he would likely have known that his house had been raided. Front
doors bashed in with a “Hydra Ram” forcible entry tool tend to make that
obvious. So does Rule 41 of the Federal Rules of Criminal Procedure.
 But for love letters stored in draft format on Gmail, something that Petraeus and
biographer Paula Broadwell reportedly did, the Justice Department claims that
police have the right to access those without a search warrant. It says only a
subpoena, signed by a prosecutor without a judge’s prior approval and without
demonstrating probable cause related to a crime, is necessary.
 http://news.cnet.com/8301-13578_3-57550072-38/petraeus-e-mail-affair-
highlights-u.s-privacy-law-loopholes/

30
http://www.windows7news.com/2011/06/23/patriot-act-azure-cloud-security/

31
http://www.aidanfinn.com/?p=10367

 European data stored in the "cloud" could be acquired and inspected by U.S. law enforcement and
intelligence agencies, despite Europe's strong data protection laws, university researchers have
suggested.
 The research paper, titled "Cloud Computing in Higher Education and Research Institutions and
the USA Patriot Act," written by legal experts at the University ofAmsterdam's Institute for
Information Law, support previous reports that the anti-terror Patriot Act could be theoretically
used by U.S. law enforcement to bypass strict European privacy laws to acquire citizen data
within the European Union.
 The Patriot Act, signed into law in 2001, granted some new powers to U.S. authorities, but it was
mainly a "framework law" that amended and strengthened a variety of older laws, such as the
Foreign Intelligence Services Act (FISA) and the Electronic Communications Privacy Act (ECPA).
 "Most cloud providers, and certainly the market leaders, fall within the U.S. jurisdiction either
because they are U.S. companies or conduct systematic business in the U.S.," Axel Arnbak, one of
the authors of the research paper, told CBS News.
 http://www.cbsnews.com/8301-205_162-57556674/patriot-act-can-obtain-data-in-europe-
researchers-say/

 Trailblazer was commissioned from the ScienceApplications
InternationalCorporation at a cost of $280 million and never worked as
intended, while violating the laws on privacy.The final bill for the project,
which was cancelled in 2003, is estimated to be over a billion dollars.
 But Drake warned that the NSA has not learned its lesson from the
incident, and that it was one of the NSA’s deepest, darkest secrets that it
had effectively turned onlineAmerica into a foreign country for legal
purposes. More worrying, similar lax attitudes are now pervasive in the
corporate world.
 “Industry self-regulation is not working, contrary to what you have seen
or heard,” he warned. “Let’s not kid ourselves. It’s also patently
disingenuous to say that no names are collected, only a computer
number, when the technology is out there to discover everything about
you electronically.”
 -
http://www.theregister.co.uk/2011/10/19/nsa_whistleblower_intelligence
_thinthread/

 Wyden was also scathing about the Patriot Act,
pointing out that there were in fact two forms
of the legislation, the public law and the
interpretation of it by government - the latter
being secret. He said that if the American people
could see what the secret interpretation was they
would be surprised and angry. He said he would
love to lay out the way the act was being used, but
was bound by secrecy rules.
 http://www.theregister.co.uk/2011/10/18/riaa_biggest_threat_innovat
ion_senator/

 Denied the right to travel without consent from their male
guardians and banned from driving, women in Saudi
Arabia are now monitored by an electronic system that
tracks any cross-border movements.
 Since last week, Saudi women’s male guardians began
receiving text messages on their phones informing them
when women under their custody leave the country, even
if they are travelling together.
 Manal al-Sherif, who became the symbol of a campaign
launched last year urging Saudi women to defy a driving
ban, began spreading the information onTwitter, after she
was alerted by a couple.
▪ http://www.rajgoel.com/saudi-arabia-implements-electronic-
surveillance-on-women

 When a cellphone is reported stolen in NewYork, the
Police Department routinely subpoenas the phone’s call
records, from the day of the theft onward.The logic is
simple: If a thief uses the phone, a list of incoming and
outgoing calls could lead to the suspect.
 But in the process, the Police Department has quietly
amassed a trove of telephone logs, all obtained without a
court order, that could conceivably be used for any
investigative purpose.The call records from the stolen
cellphones are integrated into a database known as the
Enterprise Case Management System, according to Police
Department documents from the detective bureau.
▪ http://www.nytimes.com/2012/11/27/nyregion/new-york-city-police-
amassing-a-trove-of-cellphone-logs.html
36

37
http://www.theregister.co.uk/2011/08/08/blackberry_riots/

38
http://www.theregister.co.uk/2011/10/28/blackberry_help_indian_government_sip_data/

 Mobile carriers responded to a staggering 1.3 million law enforcement
requests last year for subscriber information, including text messages
and phone location data, according to data provided to Congress.
 Nine mobile phone companies forwarded the data as part of a
Congressional privacy probe brought by Rep. Edward Markey, (D-
Massachusetts), who co-chairs the Congressional Bi-partisan Privacy
Caucus.
 The number of Americans affected each year by the growing use of
mobile phone data by law enforcement could reach into the tens of
millions, as a single request could ensnare dozens or even hundreds of
people. Law enforcement has been asking for so-called “cell tower
dumps” in which carriers disclose all phone numbers that connected to a
given tower during a certain period of time.
 So, for instance, if police wanted to try to find a person who broke a store
window at anOccupy protest, it could get the phone numbers and
identifying data of all protestors with mobile phones in the vicinity at the
time — and use that data for other purposes.
▪ - http://www.wired.com/threatlevel/2012/07/massive-phone-surveillance/

 Scott Ludlam, Greens senator … “We’ve already taken some pretty
dangerous steps … towards the surveillance state.”
 LAW enforcement and government departments are accessing vast
quantities of phone and internet usage data without warrants,
prompting warnings from the Greens of a growing ”surveillance state”
and calls by privacy groups for tighter controls.
 Figures released by the federal Attorney-General’s Department show
that federal and state government agencies accessed
telecommunications data and internet logs more than 250,000 times
during criminal and revenue investigations in 2010-11.
 The Greens senator Scott Ludlam highlighted the statistics while calling
for tighter controls on access to mobile device location information
▪ http://www.theage.com.au/technology/technology-news/police-spy-on-web-phone-
usage-with-no-warrants-20120217-1tegl.html

 As the price of digital storage drops and the technology to tap electronic
communication improves, authoritarian governments will soon be able to
perform retroactive surveillance on anyone within their borders, according to a
Brookings Institute report.
 These regimes will store every phone call, instant message, email, social media
interaction, text message, movements of people and vehicles and public
surveillance video and mine it at their leisure, according to "Recording
Everything: Digital Storage as an Enabler of Authoritarian Government," written
by JohnVillaseno, a senior fellow at Brookings and a professor of electrical
engineering at UCLA.
 That will enable shadowing people's movements and communications that took
place before the individuals became suspects, he says.
 "For example, if an anti-regime demonstrator previously unknown to security
services is arrested, it will be possible to go back in time to scrutinize the
demonstrator's phone conversations, automobile travels, and the people he or
she met in the months and even years leading up to the arrest," the report says.
▪ - http://www.networkworld.com/news/2011/121511-government-surveillance-254137.html

 An FBI investigation manual updated last year, obtained by the ACLU,
says it's possible to warrantlessly obtain Americans' e-mail "without
running afoul" of the Fourth Amendment.
 The U.S. Department of Justice and the FBI believe they don't need a
search warrant to review Americans' e-mails, Facebook chats,Twitter
direct messages, and other private files, internal documents reveal.
 Government documents obtained by the American Civil Liberties Union
and provided to CNET show a split over electronic privacy rights within
the Obama administration, with Justice Department prosecutors and
investigators privately insisting they're not legally required to obtain
search warrants for e-mail.The IRS, on the other hand, publicly said last
month that it would abandon a controversial policy that claimed it could
get warrantless access to e-mail correspondence.
▪ - May 8, 2013 – CNET - http://news.cnet.com/8301-13578_3-57583395-38/doj-we-dont-
need-warrants-for-e-mail-facebook-chats/

 If attorney general Eric Holder wanted to perform even a momentary
Internet wiretap on Fox News' e-mail accounts, he would have had to
persuade a judge to approve what lawyers call a "super search warrant."
 A super search warrant's requirements are exacting: Intercepted
communications must be secured and placed under seal. Real-time
interception must be done only as a last resort. Only certain crimes
qualify for this technique, the target must be notified, and additional
restrictions apply to state and local police conducting real-time
intercepts.
 DOJ was able to obtain a normal search warrant -- lacking those
extensive privacy protections -- that allowed federal agents to secretly
obtain up to six years of email correspondence between Fox News
correspondent James Rosen and his alleged sources.
▪ - May 25, 2013 – CNET - http://news.cnet.com/8301-13578_3-57586211-38/why-doj-didnt-
need-a-super-search-warrant-to-snoop-on-fox-news-e-mail/

 A federal judge tells Google to comply with
the FBI's warrantless National Security Letter
requests for user details, despite ongoing
concerns about their constitutionality [and
several active law suits].
▪ - May 31, 2013 – CNET - http://news.cnet.com/8301-
13578_3-57587003-38/judge-orders-google-to-comply-
with-fbis-secret-nsl-demands/

 Secret lawsuit in Manhattan filed last month asks judge to force
Google to cough up user data without a search warrant. A
different court has already ruled that the process is
unconstitutional.
 An inspector general's report (PDF) found that the FBI made
50,000 NSL requests in 2006, and 97 percent of those included
mandatory gag orders. NSLs can demand user profile information,
but the law does not permit them to be used to obtain the text of
e-mail messages or most log files. (Even if NSLs are eventually
ruled unconstitutional, the FBI would still have a formidable array
of investigative tools including subpoenas, court orders, search
warrants, wiretap orders, pen registers, sneak and peek warrants,
and surveillance under the Foreign Intelligence Surveillance Act.)
▪ - May 31, 2013 – CNET - http://news.cnet.com/8301-13578_3-57587005-
38/justice-department-tries-to-force-google-to-hand-over-user-data/

 The FBI has been abusing its power and the letters have sought information to which
the FBI was not entitled. Without the gag orders issued on recipients of the letters, it
is doubtful that the FBI would have been able to abuse the NSL power the way that it
did. So the combination of free reign for FBI to write its own warrants without judicial
review, combined with the never-ending gag orders are the ingredients of a perfect
storm of abuse potential.
 Nicholas Merill

47
- William Gibson, Author, futurist

 1936 - SSNs established
 1938 -Wallet manufacturer includes secretary's SSN
card inside a wallet. 40,000 people thought it was
their SSN. 12 people used it in 1977.
 Pre-1986 - kids under 14yrs not required
 Post-1990 - Kids get SSN # with Birth Certificate
 Repeatedly, laws state that “we” oppose the creation
of a national ID card. SSNs become defacto national
ID numbers.
 Result: Experian,TransUnion, Equifax
▪ http://en.wikipedia.org/wiki/Social_Security_number
▪ http://www.socialsecurity.gov/history/ssn/ssnchron.html

 The numbers are run through public databases to determine
whether anyone is using them to obtain credit. If not, they are
offered for sale for a few hundred to several thousand dollars.
 Because the numbers often come from young children who have
no money of their own, they carry no spending history and offer a
chance to open a new, unblemished line of credit. People who buy
the numbers can then quickly build their credit rating in a process
called "piggybacking," which involves linking to someone else's
credit file.
 If they default on their payments, and the credit is withdrawn, the
same people can simply buy another number and start the process
again, causing a steep spiral of debt that could conceivably go on
for years before creditors discover the fraud.
▪ http://www.foxnews.com/us/2010/08/02/ap-impact-new-id-theft-targets-kids-
social-security- numbers-threaten-credit-737395719/

 Streetview captured a woman climbing into her hammock in the
front yard her. The photograph is now being used as evidence in a
tax-evasion case brought by Lithuanian authorities against the
undisclosed owners of the home.
 Tax authorities have spent months combing through footage
looking for unreported taxable wealth.
 "We were very impressed," said Modestas Kaseliauskas, head of
the StateTax Authority. "We realized that we could do more with
less and in shorter time."
 More than 100 people have been identified so far after
investigators compared StreetView images of about 500
properties with state property registries looking for undeclared
construction.
▪ -Wall Street Journal,
http://online.wsj.com/article/SB10001424127887324125504578511182111677320
.html

 IBM has banned employees from using Dropbox andApple’s iCloud at
work as it claws back permission to use third-party cloud services.The
rethink has also resulted in a edict against the iPhone 4S’s Siri voice
recognition technology at Big Blue.
 Jeanette Horan, IBM’s chief information officer, told MIT’sTechnology
Review that the restrictions had been applied following a review of IBM’s
BringYour Own Device BYOD Policy, introduced in 2010. IBM still
supplies BlackBerrys to about 40,000 of its 400,000 employees, but a
further 80,000 others now access its intranet using rival smartphones and
tablets, including kit they purchased themselves.The [BYOD - ed.]
initiative has not yielded anticipated cost reductions even though it has
created various security headaches.
 An internal survey of IBM workers discovered they were “blissfully
unaware” about the security risks from popular apps, according to Horan.
In some cases, staff forwarded internal corporate emails to webmail
inboxes, potentially pushing sensitive information beyond Big Blue’s
security perimeter.
▪ - http://www.theregister.co.uk/2012/05/25/ibm_bans_dropbox_siri/

 The new bill (HB 2268) has been sent to the governor, and looks to provide a
roadmap to updating the 1986 Electronic Communications Privacy Act (ECPA)
which requires federal law enforcement to obtain warrants only when accessing
recent emails, before they are accessed by recipients.
 TheTexas governor now has until June 16, 2013 to either sign the new law, which
passed both chambers of the state legislature without a single dissenting vote
and is slated to take effect on September 1, 2013 - or veto.
 According to theTexas Electronic Privacy Coalition, at the time that ECPA was
introduced no one conceived that data would be stored for more than six
months. Data older than [180 days] was considered “abandoned.”
 “Most people are shocked when they learn that law enforcement or government
agencies like the Department of Insurance can get the contents of email or find
out everywhere you’ve been for the past two months by going directly to your
service provider,” said Greg Foster, of EFF Austin.
▪ - http://rt.com/usa/texas-email-privacy-law-916/

 Maine may become the first state to enact law requiring
law enforcement agencies obtain a warrant before
tracking cellphones and other forms of GPS-capable
hardware.The bill, LD 415, passed Maine’s House 113 to
28.The Maine Senate already passed the bill 20 to 15.
 LD 415 would institute a requirement that state agencies
inform individuals that they are being tracked within the
first three days. However, as Slate notes, there is an
exception if the agency can “prove that secrecy is
necessary.” If they do so, the informing can be pushed
back to 180 days.
▪ - http://thenextweb.com/insider/2013/06/01/maine-likely-to-pass-law-
requiring-warrants-for-cell-phone-tracking-provided-it-can-come-up-
with-234000/

 Want a blueprint on how to control the internet?
Learn from China
 All important foreign sites are cloned for the Chinese
audience
 Servers MUST be located in China
 Companies are required to self-censorAND pay for
censors
 50-cent Army publishes government narrative
 Regions can be isolated from the internet without
users being aware
 Developed by Cisco, Blue Coat Systems (friend to dictators
everywhere)
 Refined by China

 www.PleaseRobMe.com
 www.WeKnowWhatYouAreDoing.com
 http://www.economist.com/news/special-report/21574628-
internet-was-expected-help-democratise-china-instead-it-
has-enabled
 www.brainlink.com/tag/social-media-risks

 We know where you are.We know where you’ve been. We can
more or less know what you’re thinking about.”
 “If you have something that you don’t want anyone to know
maybe you shouldn’t be doing it in the first place”
 “Streetview the cars we drive only once, you can just move,
right?”
 “Just remember when you post something, the computers
remember forever”
 “I ACTUALLY think most people don’t want Google to answer their
questions, they want Google to tell them what they should be
doing next.
 "Tell your kids on their third birthday, 'We will always know your
password until you're 18.'Tell them again on their fourth birthday,
on their fifth birthday." By the time they're 13 Schmidt
argues, they'll accept it.
 You have to fight for your privacy or you will lose it

Raj Goel, CISSP
ChiefTechnology Officer
Brainlink International, Inc.
C: 917-685-7731
raj@brainlink.com
www.RajGoel.com
www.linkedin.com/in/rajgoel
Author of “The Most Important SecretsTo Getting Great Results From IT”
http://www.amazon.com/gp/product/0984424814

Raj Goel - Social Media & Cloud Computing Threats to Privacy, Security & Liberty – A GLOBAL Perspective

More Related Content

What's hot

Similar to Raj Goel - Social Media & Cloud Computing Threats to Privacy, Security & Liberty – A GLOBAL Perspective

More from Raj Goel

Recently uploaded

Raj Goel - Social Media & Cloud Computing Threats to Privacy, Security & Liberty – A GLOBAL Perspective