• Exclusive: Millions of printers open to devastating hack attack, researchers say

    Columbia University

    This time-lapsed image of a screen on an HP LaserJet shows the impact of a rogue print job used to reprogram the device.
    By Bob Sullivan, Columnist, NBC News

    Could a hacker from half-way around the planet control your printer and give it instructions so frantic that it could eventually catch fire? Or use a hijacked printer as a copy machine for criminals, making it easy to commit identity theft or even take control of entire networks that would otherwise be secure?

    It’s not only possible, but likely, say researchers at Columbia University, who claim they've discovered a new class of computer security flaws that could impact millions of businesses, consumers, and even government agencies.

    Printers can be remotely controlled by computer criminals over the Internet, with the potential to steal personal information, attack otherwise secure networks and even cause physical damage, the researchers argue in a vulnerability warning first reported by msnbc.com.  They say there's no easy fix for the flaw they’ve identified in some Hewlett-Packard LaserJet printer lines – and perhaps on other firms’ printers, too – and there's no way to tell if hackers have already exploited it.

    The researchers, who have working quietly for months in an electronics lab under a series of government and industry grants, described the flaw in a private briefing for federal agencies two weeks ago. They told Hewlett-Packard about it last week.

    HP said Monday that it is still reviewing details of the vulnerability, and is unable to confirm or deny many of the researchers’ claims, but generally disputes the researchers’ characterization of the flaw as widespread.  Keith Moore, chief technologist for HP's printer division, said the firm "takes this very seriously,” but his initial research suggests the likelihood that the vulnerability can be exploited in the real world is low in most cases.      

    “Until we verify the security issue, it is difficult to comment,” he said, adding that the firm cannot say yet what printer models are impacted.

    But the Columbia researchers say the security vulnerability is so fundamental that it may impact tens of millions of printers and other hardware that use hard-to-update “firmware” that’s flawed.

    'Crystal clear'
    The flaw involves firmware that runs so-called "embedded systems" such as computer printers, which increasingly are packed with functions that make them operate more like full-fledged computers. They also are commonly connected to the Internet. 

    "The problem is, technology companies aren't really looking into this corner of the Internet. But we are," said Columbia professor Salvatore Stolfo, who directed the research in the Computer Science Department of Columbia University’s School of Engineering and Applied Science. “The research on this is crystal clear.  The impact of this is very large. These devices are completely open and available to be exploited.”

    Printer security flaws have long been theorized, but the Columbia researchers say they've discovered the first-ever doorway into millions of printers worldwide.  In one demonstration of an attack based on the flaw, Stolfo and fellow researcher Ang Cui showed how a hijacked computer could be given instructions that would continuously heat up the printer’s fuser – which is designed to dry the ink once it’s applied to paper –  eventually causing the paper to turn brown and smoke.

    In that demonstration, a thermal switch shut the printer down – basically, causing it to self-destruct – before a fire started, but the researchers believe other printers might be used as fire starters, giving computer hackers a dangerous new tool that could allow simple computer code to wreak real-world havoc.

    Hewlett Packard, in a statement, said all its printers include such thermal switches, and these would prevent a printer fire in all cases.

    "(The thermal breaker) cannot be overcome by a firmware change or this proposed vulnerability," it said.

    Click here to read H-P's full statement issued in response to this story.

    Cui and Stolfo say they've reverse engineered software that controls common Hewlett-Packard LaserJet printers. Those printers allow firmware upgrades through a process called "Remote Firmware Update." Every time the printer accepts a job, it checks to see if a software update is included in that job.  But they say printers they examined don't discriminate the source of the update software – a typical digital signature is not used to verify the upgrade software’s authenticity – so anyone can instruct the printer to erase its operating software and install a booby-trapped version.

    In all cases, the Columbia researchers claim, duping a would-be target into printing a virus-laden document is enough to take control of that person's printer; but in some cases, printers are configured to accept print jobs via the Internet, meaning the virus can be installed remotely, without any interaction by the printer's owner.

    “It's like selling a car without selling the keys to lock it,” Stolfo said. “It’s totally insecure.”

    Columbia University

    Columbia researcher Ang Cui explains how he was able to infect an HP printer with malicious code.

    Rewriting the printer's firmware takes only about 30 seconds, and a virus would be virtually impossible to detect once installed. Only pulling the computer chips out of the printer and testing them would reveal an attack, Cui said.  No modern antivirus software has the ability to scan, let alone fix, the software which runs on embedded chips in a printer.

    “First of all, how the hell doesn't HP have a signature or certificate indicating that new firmware is real firmware from HP?” said Mikko Hypponen, head of research at security firm F-Secure, when told of the flaw. “Printers have been a weak spot for many corporate networks.  Many people don’t realize that a  printer is just another computer on a network with exactly the same problems and, if compromised, the same impact.”

    There are plenty of points of contention between HP and the researchers, however. Moore, the HP executive, said the firm’s newer printers do require digitally signed firmware upgrades, and have since 2009. The printers tested by the researchers are older models, Moore said. 

    In contrast, the Columbia researchers say they purchased one of the printers they hacked in September at a major New York City office supply store.

    Moore also said that the impact of any potential vulnerability is limited because most home users have InkJet printers – not LaserJet printers – and they do not permit remote firmware upgrade, he said.

    Still, a widespread flaw in LaserJet printers would raise serious issues. Hewlett Packard dominates the printer market; the firm says it's sold 100 million LaserJet printers since 1984, meaning millions of computers could be vulnerable. HP, by far the dominant printer seller worldwide with 42 percent of the market, sells about 50 million printers of all kinds annually, according to IDC.

    In an exclusive demonstration for msnbc.com at Columbia University’s Intrusion Detection Systems Laboratory, Cui and Stolfo revealed the kind of havoc an attacker could wreak once they gained control of a printer. After sending a virus-laced print job to a target printer, the device's small screen read, in sequence, "Erasing...Programming...Code Update Complete."

    In one demonstration, Cui printed a tax return on an infected printer, which in turn sent the tax form to a second computer playing the part of a hacker’s machine. The latter computer then scanned the document for critical information such as Social Security numbers, and when it found one, automatically published it on a Twitter feed.

    A hacker who merely wanted to wreak havoc could easily disable thousands – or perhaps millions – of vulnerable printers, Cui said, as it is trivial to send the printer upgrades that would render it inoperable.  

    Beachhead?
    But the researchers say the possibilities created by hijacked printers go far beyond pranks or identity theft. Printers on a company network are nearly always trusted by other computers. A hijacked printer could act as a beachhead to attack a company's network that was otherwise protected by a firewall. Few companies are prepared to protect themselves from an attack by their own printer.

    Moore also disagreed with this assertion. He said standard print jobs could not be used to initiate a firmware upgrade; only specially-crafted files sent directly to the printer can do that. Were that true, the vulnerability could only be exploited on printers left exposed to the Internet; printers behind a firewall would be safe.

    “This (vulnerability) is probably not as broad as what I had heard in their first announcement,” Moore said. “It sounds like we disagree on what the exposure might be.”

    But the Columbia researchers say standard print commands sent both from a Macintosh computer and a PC running Linux tricked an HP printer into reprogramming itself. Moore later conceded that might be true; but the two sides disagreed on whether users in a Microsoft Windows environment were safe from the attack.

    Even home users with printers that are not directly connected to the Internet are at risk, Cui said.  As long as the printer is connected to a computer – through a USB cable, for example –  it could be used to launch attacks, or as part of a botnet.

    A quick scan of unprotected printers left open to Internet attack by the researchers found 40,000 devices that they said could be infected within minutes. 

    Cui discovered the lack of authentication by physically disassembling the printer, and painstakingly reading output from its chipset, one character at a time. The chips run off-the-shelf operating systems like VxWorks and Linx, a scaled-down version of the Linux operating system designed for embedded devices.  Reprogramming the chip was relatively easy, he said – and now that the concept has been proven, he thinks others could reproduce his work in a day or two. 

    "In fact, it's almost impossible to think that someone else hasn't already done this," he said.

    Fixing the flaw will not be easy, Stolfo said.  There is no natural path to update printer operating system software, as there is for desktop PC software.  It's possible a consortium of firms could "push out a fix," once one is available, he said. He urged HP to work with companies like Microsoft to help consumers update their printers. (Msnbc.com is a joint venture of Microsoft and NBC Universal.)

    One particularly vexing part of the fix: Printers that are already compromised by rogue software likely cannot be fixed. An attacker could easily shut down the pathway for future updates that would “cure” an infected printer.

    “If and when HP rolls out a fix, if a printer is already compromised, the fix would be completely ineffective.  Once you own the firmware, you own it forever. That’s why this problem is so serious, and so different,” Cui said. “This is nothing like fixing a virus on your PC.”

    Such inability to help consumers manually secure their printers could ultimately have disastrous consequences, Stolfo said.

     “It may ultimately lead to telling everyone they just have to throw their printers out and start over,” he said. "Fixing this is going to require a very coordinated effort by the industry," Stolfo said.

    Rogue software
    Hypponen said that the anti-virus industry could develop software tools that would detect booby-trapped print jobs in word processing documents or emails, and thwart attempts to update printers with rogue software that way. But such an approach would hardly be foolproof.

    The Columbia researchers are just beginning to sample printers sold by other manufacturers; the research is inconclusive so far, but Stolfo and Cui believe the problem is not limited to Hewlett-Packard machines.

     “I think it is very wise to broadcast the problem as soon as possible so all of the printer manufacturers start looking at their security architectures more seriously,” Stolfo said.  “It is conceivable that all printers are vulnerable. …Printers that are 3-, 4-, 5-years-old and older, I’d think, all used unsigned software. The question is, ‘How many of those printers are out there?’ It could be much more than 100 million.”

    That’s why Stolfo and Cui decided to go public with the vulnerability: They believe the sheer scope of the flaw requires immediate attention and cooperation from multiple elements of the tech industry. The two are currently helping HP devise a mitigation strategy.

    HP continues to research the potential flaw, but it’s too early for the firm to announce which products might be impacted, or what consumers should do.

    “Until we know things like whether Windows users are affected, whether this is a class or specific product issue, it is frankly irresponsible to say more,” Moore said.  “If this turns out to be the broad (problem) that's being discussed…we will reach out to customers and get it fixed.  We support our customers and value their trust.”

    Printers, however, are just the tip of the iceberg when it comes to vulnerable embedded devices, Stolfo warned.  Columbia researchers have found that many gadgets now wired to connect to the Internet – including DVD players, telephone conference tools, even home appliances – have no security at all.

    "Right now, very few people are thinking about the security of all these devices, so we're moving on to look at many more of them,” Stolfo said, noting that supposedly secure offices – even in sensitive government agencies – have networked teleconferencing devices, printers, even thermostats that create security risks.

    “This is a whole area that is being ignored,” he continued. “While most folks are focused on applications, there is a comfort level with (embedded systems) that is nonsensical. There's no focus on the security of these devices we take for granted and we carry into secure environments every day.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

    Comment

    Show more

  • Can't afford to retire in the US? There's always Panama

    By Bob Sullivan, Columnist, NBC News

    Carol Denne and her husband Larry both worked government jobs for decades, but as they entered their late 50s, Larry's fast-shrinking 401(k) account and Carol’s modest pension pointed to one stark reality: Retiring with dignity in their Philadelphia suburb would be impossible. In fact, Carol ran the numbers over and over and came to the conclusion that retiring anywhere in the U.S. was unrealistic.

    "Either my husband was going to have to work until he died, or we were going to have to leave the country," she said.  "He'd been working since he was 15, and that was long enough.  So we left."

    So four months ago, Carol and Larry departed the U.S. -- leaving behind their four children and five grandchildren -- and moved to a mountain village in Panama.

    "We found we could live on my retirement here," Carol said by phone from their new home outside the town of David, on the Latin America's country's west side. They were surprised to find a healthy number of "gringos" already living in their suburb, called Volcan.  "We are seeing a growing number of 'ex-pats' who are in our same situation. This points to a growing number of families that are torn apart as parents and aunts and uncles are forced to move away to retire.”

    They pay $500 per month to rent a four-bedroom home, enjoy dinners for $10, and now believe they'll be able to live out their lives without worrying about running out of money.

    With Larry 59 years old and Carol 57, the Dennes fit into the demographic that might actually be suffering the most during the current economic downturn.  While much has been written about youth who graduate college and have few economic opportunities and families threatened with foreclosure, both groups will presumably benefit when the economy rebounds -- even if the recovery is 10 years off.  But for workers nearing retirement, there is no time to make up their share of the $2.7 trillion in retirement investments that vanished between 2007 and 2009, according to the Urban Institute.

    As we’ve chronicled here before on Red Tape, older Americans who lose their jobs have a hard time finding new employment. Many unemployed 50-somethings believe ageism is a factor, and there is some data that might support those accusations. The unemployment rate for workers aged 55-64 has more than doubled, from 3 percent in 2006 to 7.1 percent in 2010, according to a recent report by Congress’ Government Accountability Office. Median unemployment length for the group soared from 11 weeks to 31 weeks from 2007 to 2010. The report also found that an estimated 25 percent of adults 50 and over had exhausted their savings in response to a layoff or other recession-related event, and half in that age group say they had delayed a medical or dental procedure to make ends meet. Meanwhile, the normal safety net of home equity has been decimated by the housing bubble collapse.

    Things were different for the Dennes before 2008, before the economic crash caused by the near collapse of the financial system. Larry was a manager at a local recycling company and had dutifully socked away money into his 401(k). Between her $3,000 per month pension earned as a civilian working for the Navy and his retirement savings, the couple thought they'd have options. Then, the crash swept away most of Larry's 401(k) and reality hit.   

    "I'm angry about that, angry that was situation we were faced with. It was difficult leaving friends and family behind," Carol said. "We didn’t have that much to start with. To lose all that was a big deal."

    The couple had never been to Latin America, and spoke no Spanish, but they were desperate for options and attended a seminar on retiring in Panama.  They were hooked.

    "Our friends couldn't believe we were going to do that," Carol said.

    It's a conversation that's being repeated around the country. Solid data on the number of U.S. retirees is hard to find, but the trend seems on the rise.  The Social Security Administration paid benefits to 509,000 overseas retirees in 2008, the most recent available data. That's a sharp uptick from the 396,000 who received benefits in 2000.

    The economics seem irresistible.  Housing costs in places like Ecuador, Mexico and Panama are a fraction of those in the U.S. Many Latin American countries offer retirement benefits and health care to U.S. ex-pats living there.  And the pace of life is hard to beat.

    "We live in an eternal spring," Carol said.  "We’re in the mountains, where the temperature is always around 75 or 80. It never snows. There's no leaves to rake in the fall, no shoveling in the winter. It's absolutely beautiful here."

    Panama regularly ranks among the top places for ex-pats to retire when magazines like International Living or organizations like AARP conduct surveys. International Living ranked Panama third globally, behind only Ecuador and Mexico, in a survey that weighed cost of living, health care, culture, infrastructure, etc. (The U.S., by the way, ranked 22nd, just ahead of Slovenia and the Dominican Republic). Panama's "pensionado" program also offers deep discounts to seniors on everything from prescription medicine to food and airline tickets.

    Those will come in handy, as the couple has plans to return to the U.S. frequently to see their children and grandchildren. Meanwhile, a steady stream of visitors is coming to their piece of paradise.

    "We've already had one daughter come down, and another one is coming in January," Carol said.

    Technology helps keep them connected with home -- Facebook, email, and Skype make it relatively easy to keep up with friends and family.  Of course, it's not flawless. I had to dial the Dennes’ phone number six times before the call went through. Other ex-pats on bulletin boards devoted to life in Panama complain that electricity and water services aren't always reliable.  But such hiccups are part of life in Panama, Carol said.

    "You learn to go with the flow," she said. "The pace of life is different."

    The couple has already adjusted, for the most part, Carol says. 

    "I miss nothing. Maybe the convenience having so many stores nearby," she said.  A painter, she has to travel about 45 minutes to buy supplies like acrylic paints.

    But that's not going to change, as the couple plans has no plans to return to the U.S.

    "We're down here for the long haul. We can't afford to live in the States," she said. "My sister is older, she has a good job, and she's going to have to work 10 years before she retires.  I'm shocked that that has happened. I don't know what's going on. Boomers are working even longer, or until they die, or are leaving country like we are. The recession has affected everybody in hard ways."

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Netflix users offered pennies by Wal-Mart to settle collusion charges

    By Bob Sullivan, Columnist, NBC News

    Netflix subscribers are being offered a $27 million payment by Wal-Mart to settle a class action lawsuit that alleges the two retail giants violated federal antitrust laws by agreeing to stop competing with each other in 2005.

    At the time, Wal-Mart agreed to get out of the DVD-by-mail rental business and, in exchange, Netflix agreed to stop selling discs and promote Wal-Mart’s DVD sales. A press release about the arrangement from 2005 says Wal-Mart rental customers were offered a chance to transfer their memberships to Netflix for one year at the lower Wal-Mart price.

    The settlement was revealed in an email sent to Netflix subscribers on Wednesday, and covers anyone who paid fees to Netflix between May 2005 and September 2011. Wal-Mart has not admitted wrongdoing.

    But consumers, who claim they've already been wronged because DVD rental prices remained artificially high from the arrangement, won't benefit much from the settlement. After $7 million for attorney's fees, and an additional $2 million for expenses, are paid, less than $1 each will remain for the 25 million current and former subscribers covered in the class.

    Consumers have until Feb. 14 to opt out of the settlement.  Those who remain in the class will receive their payouts via gift card.

    That doesn't sit well with Netflix subscriber Christopher Ambler.

    "The lawyers get double-digit millions of dollars and the consumers get a few bucks on a gift card," he said. "All this does is raise prices for consumers to pay for the lawyers getting a big bonus."

    As is often the case in what are sometimes called "coupon" class action settlements, Wal-Mart could actually benefit from the settlement payout.  The small gift cards it would send to consumers would entice them to visit Wal-Mart stores, similar to a marketing campaign.

    A judge must still approve the Wal-Mart settlement; the final hearing is slated for March 14 in a federal court in Oakland, Calif.

    Netflix, also named in the lawsuit, is taking a different legal strategy, with lawyers so far signaling they plan to allow the lawsuit to go to trial, scheduled Jan. 23 in a federal court in California. Netflix's lawyers have argued that the Federal Trade Commission found nothing wrong with the agreement it made with Wal-Mart.

    More details on the lawsuit are available at www.OnlineDVDclass.com

     Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Using a credit card induces euphoria, new research shows

    By Bob Sullivan, Columnist, NBC News

    Credit cards take us out of our right minds, inducing a kind of euphoria that makes people ignore the downsides to purchases, suggests a new study in the Journal of Consumer Research. 

    Like a starry-eyed new lover who ignores the downsides of an obviously incompatible but very attractive partner, consumers who swipe plastic when they buy are often blinded to the true costs of their purchases.  They even tend to exaggerate the perceived benefits of whatever they're buying, according to research by Promothesh Chatterjee of the University of Kansas and Randall L. Rose or University of South Carolina.

    To put it another way: Buying things with credit cards is more like lust than love.

    Buying with cash, however, makes people focus on the pain of a purchase -- not just the costs, but other downsides of the purchases, such as a product's limitations.

    “Our research suggests that, when it comes to product evaluation, beauty truly lies in the eyes of the cardholder,” the authors say in the report.

    The research might help consumers get a better grasp on why they seem to overspend when using plastic. It has broader social implications, too, particularly as new and even more-frictionless payment systems like Google Wallet enter the marketplace. 

    It also may help consumers understand exactly how large corporations are trying to exploit their behavioral weaknesses, so they can develop their own personal counter-measures.

    It's long been observed that consumers spend more when paying with plastic than cash, a phenomenon known as the "credit card premium." But there hasn’t been much research devoted to why, said Chatterjee. It's generally been presumed that consumers who feel the pain of dollar bills leaving their hands spend less than those who zoom through checkouts with just a swipe. But Chatterjee argues that something much deeper is going on.

    "The effects of credit cards go far beyond increasing consumer spending power and shifting consumption from the future to the present; fundamental product perceptions are affected as well,” Chatterjee says in the report.

    Researchers primed subjects using traditional behavioral study methods, such as making them play words games which focused their attention either on credit cards or on cash. Then they gave the consumers information on items they could theoretically buy, such as a notebook computer or an iPhone.  Repeatedly, consumers "primed" to think about credit cards had a harder time recalling products’ price or other downsides.

    “Our findings suggest that marketers may be affecting not just the amount of money consumers are willing to spend but also the nature of the goods and services that find their way into consumers’ market baskets,” the report says. 

    'I keep buying things I don't really want'
    Chatterjee said he become interested in the field after he observed his own behavior with regards to credit cards.

    "I hardly ever carry cash and as a consequence I keep buying things I don't really want,” he said. “I'm not even thinking about the cost, I'm so consumed with the benefit of what I’m getting. It has been bugging me for a long time. People do not realize how their payment mechanism influences behavior."

    The research is even more relevant as new "touchless" forms of payment become common, such as cellphone payments like Google Wallet, enabled by Near Field Communications chips. 

    "The pain is missing," when consumers make such effortless payments, Chatterjee said. And that prevents them from engaging in an otherwise normal cost-benefit analysis before they acquire things, he said.

    "(New electronic payments allow) consumers to make payments without a lot of deliberation. ...This arrangement, ostensibly for the consumers’ convenience, seems to offer an even more powerful disconnection of spending from payment," Chatterjee said.

    Retailers have conducted high-level research on consumer behaviors for decades, of course.  For example, something as simple as making product containers taller distorts consumers' perceptions of volume, and therefor compromises their ability to comparison shop.

    But credit card euphoria is so powerful because it can impact literally every kind of purchase, the new research indicates.

    Something as simple as the display of a MasterCard or Visa logo on a cash register could actually nudge consumers to buy more stuff, Chatterjee thinks.

    "If we can somehow put that pain back in, we could perhaps retain the convenience of plastic, which at the same time help consumers make more informed decisions,” he said. Perhaps a simple reminder at the point of sale -- an image of cash, or a cell phone reminder of a bank account balance -- could tip the scales closer to normal for consumers.

    The research could also inform government agencies distributing social welfare payments. Most now use some form of pre-paid debit card for unemployment payments and other benefits.  It's possible that might be encouraging poor spending habits.

    As an antidote, Chatterjee suggested that consumers set aside money separately for gifts, or vacations -- a method that recalls old Christmas club savings accounts.

    "It's old-fashioned, but it works really well,” he said. “A lot of research shows that when you earmark money for this or that, people see that money as out of bounds and don't touch it until they use it for the intended purpose. The thing I want to tell consumers is to be cautious when paying with credit cards.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Congress takes up controversial anti-piracy SOPA legislation

    By Bob Sullivan, Columnist, NBC News

    Congress began debating Wednesday another controversial effort by the movie industry and other content makers to stem Internet piracy through federal legislation. The measure, known as SOPA, for Stop Online Piracy Act, would empower the nation's attorney general to tell search engines and other Internet providers to stop sending Web surfers to alleged piracy sites, a measure opponents describe as "an Internet blacklist."

    The Electronic Frontier Foundation calls the proposal "the most extreme, anti-Internet, anti-privacy, anti-free speech copyright proposal in U.S. legislative history."

    Some websites, such FreePress.net, turned themselves black on Wednesday to protest the legislation, which was discussed in a House Judiciary Committee hearing. 

    A coalition of rights holders, including the U.S. Chamber of Commerce, supports the effort, and claims that advocacy groups are overreacting to the legislation's provisions. It claims the law would not create a blacklist.

    “Websites that blatantly steal the creativity and innovation of American industries violate a fundamental right to property,” Thomas J. Donohue, CEO of the U.S. Chamber, said when the legislation was introduced. “Operators of rogue sites threaten American jobs, endanger consumer safety and undermine the vitality of the online marketplace." The coalition claims that "rogue sites" attract 53 billion visits per year, jeopardizing the more than $7.7 trillion of U.S. gross domestic product.

    This battle of titans pits consumer groups and tech firms like Google, Facebook, and eBay against much of Hollywood.

    The legislation would allow the U.S. attorney general to order pirate websites be cut off through alternations to entries in the Domain Name System (DNS), a process opponents call blacklisting. It also creates mechanisms for content owners to tell payment processors like Visa and MasterCard to stop processing payments for alleged offending sites.

    The DNS proposal is most offensive to technology firms.  Andrew Lee, CEO of security firm ESET, compared the technique to the "clickjacking" tools uncovered recently by FBI agents that hackers used recently to steal $14 million worth of advertising. In that scam, computer criminals allegedly altered DNS instructions to place rogue advertisements on major websites like ESPN.com, then collected the commissions.

    "(SOPA) would require DNS server operators in the US to replace the correct IP address for a website with an alternate address provided by the Attorney General's Office if the website was ‘infringing,'” he wrote in an open letter to Congress. "While we are all in favor of stopping piracy, messing about with DNS and legalizing state-controlled DNS changing seems like overkill."

    But Michael O'Leary, policy chief for the Motion Picture Association, rejected complaints that the law would harm consumers or stifle innovation.

    "You and your colleagues have heard a great deal from those who suggest this bill, and our efforts to fight online theft, will 'break the Internet,' or harm legitimate online social media platforms and Internet services," O'Leary said, according to a written version of his testimony published by CNet.com. "Nothing could be further from the truth." 

    He went on to complain that the current system for removing content that violates copyright -- governed by the Digital Millennium Copyright Act, or DCMA -- doesn't work with rogue websites that ignore the law. He argued that law enforcement officials already have the right to redirect traffic away from criminal websites, and that suspected pirates would have access to due process to appeal DNS changes.

    No date for a Judiciary Committee vote on the legislation, or on its companion PROTECT IP Act in the Senate, has been announced.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • After 16 hours on air at Wall Street protests, a Ustream star is born

    Bob Sullivan / msnbc.com

    Tim Pool at Zuccotti Park.

    By Bob Sullivan, Columnist, NBC News

    The revolution will be Ustreamed. 

    When police ran Occupy Wall Street protestors out of Zuccotti Park in the middle of the night on Tuesday, there was really only one way to watch it live: On Tim Pool's "TheOther99" video stream. Pool, armed only with a cellphone and donated backup batteries, filmed the event through the night. He hosted the coverage news anchor style, the way Brian Williams would, talking almost continuously, stopping occasionally to conduct interviews.

    It might have looked a bit like grainy home video, but Pool had a sizable international audience. His Ustream.TV "channel" had, at various times, more than 20,000 simultaneous viewers, an audience some cable channels might envy. The audience exploded when word went out across Twitter that Pool’s stream was the best way to watch the protests online.

    When I met Tim Tuesday afternoon, he'd been "on the air" continually for nearly 16 hours. And while plenty of video streams have come and gone during the protests, Pool’s broadcast earned him a lot of credibility with protesters, and he was still going strong into the evening.

    "Other than my hand cramping up from holding up the phone, I feel pretty good," he said.  He hadn't gone dark, or gone to the bathroom, that entire time.  "I do really need a piece of fruit, though," he added.

    Pool, from Chicago, has been at the Occupy Wall Street protest from the start. He said had no experience hosting a TV show or live stream, but honed his ability to fill air time with talk during the past two months while documenting the protest. Anyone -- including police officers and foul-mouthed protesters -- who walked near Pool risked being broadcast instantly to the world. 

    Pool spent most of the time Tuesday morning running after crowds of evicted protesters as they tried to reorganize, or showing live video of sanitation workers gathering tents and other personal items in the park for disposal.  He rarely turned the camera on himself.

    "I'm here to document what's going on," he said. "I've been doing this since the beginning."

    Bob Sullivan / msnbc.com

    Tim Pool uses simple equipment to "broadcast" live video of the protest on the Internet.

    What Pool’s doing is vaguely similar to what’s called “lifecasting,” where individuals chronicle their lives online through a continual video stream or similar real-time techniques.  The difference is this: Pool’s all-night broadcast on Tuesday morning was riveting.

    The quality of his video stream -- both in content and technology -- is surprisingly good. And the simplicity of his gear can't be beat. He's using a Samsung Galaxy S2 on Sprint's 4G network to stream video, using the onboard camera and microphone to record, and connecting the phone to a small but powerful backup battery.  If you want to know, it’s an "Energi to Go" 18,000 battery produced by Energizer which provides 18,000 milliamp hours (roughly 10 cell phone charging cycles). When his backup battery drained dangerously low, he put out a plea for help on his stream and received two more donated batteries.

    "That's why I've been able to keep doing this long," he said.

    Perhaps the most complicated part of his video gear was the umbrella he had to raise to protect his gear Tuesday night when rain began falling in lower Manhattan. But by that time, police had allowed protesters back into Zuccotti Park, and Pool wasn't about to let a little rain get in the way of his broadcast.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Why fine print might ground your high-flying 4G cellphone service

    By Bob Sullivan, Columnist, NBC News

    Mark Rasch is dying to get in on the super-fast 4G cellphone networks he keeps hearing so much about.  Advertisements with streaming movies, live sports, even lightning bolts that help create stirring multimedia experiences on the go have been tempting him for more than a year.

    An AT&T customer, he was thrilled last week when the firm released its first two "real" 4G LTE phones -- the HTC Vivid and Samsung Galaxy S II Skyrocket. A Washington, D.C.,-area resident, he's lucky to live in one of the handful of cities where the providers' highest-speed service is currently available, so he was ready to jump in with both feet.

    Then, he read the contract.  

    It says this: "Data sessions may be conducted only for the following purposes: (i) Internet browsing; (ii) email; and (iii) intranet access."  Nothing about lightning bolts, and according to Rasch, nothing that he can't already do with his old phone. He found the limitations troubling.

    "If you buy these phones thinking that you can use them, any of the thousands of Android apps, and the LTE data network for a host of really cool things like making VOIP calls, using Skype, streaming audio or video, remotely accessing a home PC, accessing cloud services, or any of the thousands of things that such apps enable, think again," he said. "In effect, you are buying a fully enabled phone, crippled by AT&T’s Terms of Use."

    The new AT&T 4G LTE service, promising download speeds of 5-to-12 Mbps, could be incredibly attractive to consumers because that much bandwidth is almost enough to permit streaming of HD movies or sports to big living room flat-screen televisions, while leaving enough headroom for other family members to still surf the Web.  It theoretically could replace the need for a hard-wired Net connection, and make that home broadband connection completely portable – but not if providers saddle the service with restrictions.

    This holiday shopping season will be the first that all four major cellphone providers will be hawking their faster 4G networks. But Rasch is concerned about the long list of activities that appear to be prohibited by AT&T's terms of service. While such restrictions are not new for 4G, they are far more relevant -- why pay for a high-bandwidth phone if not for high-bandwidth activities?

    "AT&T promotes and advertises all the ‘cool’ things their devices can do,” said Rasch, a digital law consultant and the former head of the Department of Justice's computer crimes unit. “You can download apps, listen to radio stations, stream TV, watch movies, play games with third parties, share data, log into your home PC, do real-time GPS, get traffic and weather reports, and thousands of other things. But only, according to the contract, on WiFi. To me, advertising and promoting services that you know you don’t offer in the way that people are likely to use them is ... false advertising."

    AT&T, in an e-mail statement, didn’t directly address Rasch’s complaints, but it did say that its new phones offer rich experiences to users, including apps with video, and that it continually works to balance bandwidth demands to keep its network running smoothly.

    "Our (terms of service) help us ensure the efficient use of limited wireless spectrum and strong network performance for all customers," the firm said. "A variety of video apps, including Sling, Netflix, YouTube and others, are optimized for use on wireless networks, and are available for AT&T customers today.  Among other things, this optimization ensures a quality experience for the customer without excessive data usage. We are committed to working with apps developers to help them to optimize apps for use over our wireless network." 

    The firm did not answer requests for clarification about individual elements contained in its terms of contract, responding simply: "We’re comfortable with our terms of service and the many ways customers use AT&T’s mobile broadband network.”

    So does AT&T’s terms of service contract for new high-speed wireless gadgets throw a wet blanket on consumers, or not? The difference may be mere semantics at the moment – AT&T appears to allow many of the activities that Rasch believes are restricted by the terms of service. And at the moment, AT&T’s 4G LTE service only works in Boston, Washington, D.C., Baltimore, and Athens, Ga. It will turn on LTE in six more cities next week, and hopes to reach a total of 15 cities by the end of the year.

    But Michael Weinberg, staff attorney at consumer advocacy firm Public Knowledge, says the semantics matter.

    "(The contract) does read incredibly restrictive, essentially, only Web browsing and email.  Is downloading apps using one of those two things? Playing Scrabble?” Weinberg said.  “The classic definition of Internet browsing is things done in a browser. This is another example of a terms of service written in a way that has traps …  that can be pulled up to stop people doing things (the company) doesn’t like."

    The new 4G -- for "Fourth Generation" -- cellphone standard is off to a rocky start.  Promising speeds that rival fast, hard-wired home Internet connections, 4G phones create possibilities such as streaming full-screen HD movies in the back seat of a moving family minivan. But carriers have co-opted the term 4G, turning it into catch-all phrase that includes refer to lower-speed networks such as AT&T's HSPA+.  Marketplace confusion reigns – the new 4G LTE phones released by AT&T this month are the providers first “real” 4G entrants. And, early 4G users on all networks report it doesn’t really provide video streaming nirvana.

    Meanwhile, bandwidth caps render true 4G devices essentially useless, some critics say.  A report by Public Knowledge published in Augustsaid that users streaming at top 4G speeds would use up a typical 2 gigabyte monthly bandwidth allotment after watching just 3 hours of a Netflix movie or uploading two 10-minute HD movies. Since then, basic capped plans have risen slightly, and data plans let users pay for more bandwidth, but the costs quickly become prohibitive.

     "They promise unlimited possibilities. However, they will deliver little except anxiety and disappointment to millions of consumers who will pay extra for speeds they cannot use for fear of running over their data cap," the group said in its report, which concluded that 4G services are "a waste of money. … For the perhaps first time, the introduction of a generationally faster technology will not have a widespread impact on online behavior."

    Cellphone service providers must perform a delicate dance with each new network rollout. On one hand, they have to brag about great new features and capabilities, but at the same time they must avoid creating a gold rush that clogs their networks and avoid inviting network abuse.  High overage fees are the most practical way to stop bandwidth hogs from degrading fragile high-speed networks, but restrictive usage contracts are a handy legal arrow to have in the quiver.

    AT&T's been down this road before. In 2009, the firm temporarily blocked usage of the popular Slingbox streaming TV service. It was restored nearly a year later, when the two firms reached an agreement that helped AT&T manage network usage.

    AT&Ts current 4G and 3G contracts contain language that appears to restrict usage of the Slingbox by its subscribers. The terms clearly prohibit "redirecting television signals for viewing on Personal Computers,” for example.

    But Jay Tannenbaum, Slingbox spokesman, said that the Slingbox app works just fine on AT&T's network, and he doesn’t anticipate problems with the new 4G LTE service.

    "We have no problems with any carrier," he said. "We try to be good network citizens and work with the bandwidth we have. ... We have had no problems with our data being limited on any network."

    Net neutrality advocates worry that a provider like AT&T could choose to discriminate against a specific application like Slingbox and favor its own flavor of the same tool. But the terms of service issues raised by Rasch don’t suggest any underhanded attempt to gain a market advantage; they sound more like an effort at self-preservation. Many activities expressly forbidden in the AT&T contract are illegal anyway, and much of the language is standard across many carriers.

    But the restrictive nature of AT&T's contract does stand out.  For example, AT&T language says, "data sessions may be conducted only for the following purposes," and then lists browsing, email, and intranet access.

    Verizon's terms of service puts it this way: "You can use our Data Services for accessing the Internet and for such things as: (i) Internet browsing; (ii) email; (iii) intranet access ... (iv) uploading, downloading and streaming of audio, video and games; and (v) Voice over Internet Protocol (VoIP)."

    T-Mobile's contract falls somewhere in between. It reads: "Your Data Plan is intended for Web browsing, messaging, and similar activities on your Device and not on any other equipment. Unless explicitly permitted by your Data Plan, other uses, including for example, using your Device as a modem or tethering your Device to a personal computer or other hardware, are not permitted.

    Sprint’s contract merely prohibits illegal activity, or “excessive utilization of network resources.”

    AT&T’s restrictive list of unwelcome behaviors offers considerable detail.

    “Examples of prohibited uses include, without limitation, the following: (i) server devices or host computer applications, including, but not limited to, Web camera posts or broadcasts, automatic data feeds, automated machine-to-machine connections or peer-to-peer (P2P) file sharing; (ii) as a substitute or backup for private lines, wirelines or full-time or dedicated data connections,” it reads.

    AT&T's lawyers are grabbing as much legal ground as they can to support any possible usage challenge, Rasch said, "to make it easy for them to enforce their rights at some later date." 

    The problem is, even if the contract isn’t functionally restrictive, it raises doubts about the future Rasch argued.

    "Show me where in contract it says I can use Slingbox, unless you consider Slingbox to be Internet browsing, which is absurd,” Rasch said. “And is FTP use Internet browsing? The problem is they can decide at any time that doing these things is a violation of their terms of service and terminate you, and you would have no legal recourse."

    The real problem with such assertive language, even if it's loosely interpreted, is the chilling effect it could have on mobile broadband technology, said Michael Weinberg, staff attorney at Public Knowledge.

    “If i am the kind of consumer who tries to stay on the right side of the law, I could read this and worry – should I use my Slingbox? Will I wake up one day and find it's been cut off?” he said.  He conceded that there are good reasons to terminate network abusers, and that there’s nothing wrong with AT&T’s decision to spell out restrictions in detail. 

     “But they talk about things like web broadcasting, saying you can’t do that. But web broadcasting is really an undefined term. You can download an app right now that lets you use your phone to broadcast what’s going on to the world using your phone. Why should that be restricted? We don’t even know what that will turn into,” he said. “This is a classic problem a terms of service policy where they reserve the right to cut people off. They don’t necessarily enforce it, but it’s there if they need it.” 

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Email voyeurs are everywhere, as mayor finds out the hard way

    By Bob Sullivan, Columnist, NBC News

    An amazing tale of political corruption and breach of trust has arrived courtesy of scandal-ridden Hoboken, N.J., in case you needed a reminder that electronic voyeurs of many stripes might be reading your email. The town's information systems specialist allegedly set up a system to intercept all email going to or from Hoboken's mayor, and apparently made copies of the private notes for potential political opponents. The news was first reported in Hoboken's Patch.com Web site.

    It's an open secret among IT workers that many find casually snooping on co-workers’ emails just too tempting. In a 2008 survey conducted by security firm Cyber-Ark, one in three "senior IT professionals" said they'd spied on co-workers’ email. This year, Cyber-Ark asked a slightly different question:  "Have you ever used an administration password to access information that is otherwise confidential or sensitive?" One in five North American respondents said they had, as did one in three in Europe, the Middle East, and Africa.

    It's hard to imagine a more sensitive example of IT data snooping than the Hoboken e-spying incident alleged by federal prosecutors.

    The accused IT worker, Patrick Ricciardi, 45, is a longtime municipal employee. The current mayor, Dawn Zimmer, came to power in 2009 after a wide-ranging scandal involving the previous mayor, Peter Cammarano, who resigned from office in disgrace and received a 24-month prison sentence after an FBI corruption sting that netted 60 area officials.

    In April, employees of the mayor's office became suspicious that emails were somehow being leaked after information in private messages began appearing in local media and on websites devoted to town politics.  In May, according to Patch.com, FBI agents raided Town Hall and left with computers tagged as evidence.

    Ricciardi did little to hide his tracks, according to the complaint. He's accused of using e-mail server settings to create an "Archive File" which created duplicates of every email sent to or from the mayor's account, and the accounts of other employees in the mayor's office.  That archive file was allegedly found on Ricciardi's hard drive.

    "This configuration intercepted emails as they were being sent, and placed them in the Archive File," the complaint alleges. A security audit also found that emails from the archive file had been forwarded to one current and one former municipal employee.

    The indictment says Ricciardi confessed during an interview with FBI agents to creating the email archive in early 2010. 

    The archive was created "so that he could 'spy' on the Mayor and the mayor's office employees, and determine whether his job was secure," according to the indictment.

    Electronic snooping is one of the ugly byproducts of the digital age; surveys are full of anonymous confessions from otherwise normal people turned e-spies by temptation.  In a survey released in July by Retrovo Gadgetology, 33 percent of respondents said they'd checked their lovers email or call history without their knowledge. Among young people, the trend is even more dramatic, with 47 percent admitting such snooping. 

    Spouse spying is so common that many lovers have come to expect it. But unexpected, illicit snooping by backroom IT workers that victims may not even know seems even more creepy, and more Big Brotherish. Of course, in the U.S., companies enjoy a relatively unlimited right to snoop on their employees when they are using work computers. That right doesn't extend to casual voyeurism by IT workers, but it's important for every worker to know that email is not for their eyes only.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

     

     

  • Secretive lawsuit could limit access to safety warnings, advocates argue

    By Bob Sullivan, Columnist, NBC News

    One mystery company really doesn't want you to hear about a complaint that its product allegedly hurt a child. 

    The unnamed firm has sued the Consumer Product Safety Commission to prevent it from releasing the report to the public as part of a new database of consumer complaints, now available at SaferProducts.gov. It has also asked a federal court in Maryland to seal all court documents related to the case, filed in October.

    "This company going to great lengths to keep its name secret," said Scott Michelman, staff attorney at consumer advocacy group Public Citizen.  Along with the Consumer Federation of America and Consumers Union, Public Citizen filed an objection with the U.S. District Court in Maryland on Oct. 31, asking that the seal request be denied.

    The mystery lawsuit threatens the entire concept of publicly available government complaint data, consumer advocates say. 

    In March, the Consumer Product Safety Commission launched SaferProducts.gov to make it easy to find consumer complaints about products and services. The site was created as the result of a law passed by Congress in 2008 called the Consumer Product Safety Improvement Act.

    For the first time, relatively raw complaints -- not complaints vetted or confirmed by the government agency -- were made public starting in March.

    Businesses have 10 business days to respond to each complaint before it's published. But that's not enough for the company involved in the complaint, which involves “an incident that allegedly harmed a child,” according to a report in the Washington Post. 

    The company involved says the lawsuit must not be made public because doing so would effectively publish the consumer complaint it seeks to quash, according to the Post.

    Despite all this mystery, the lawsuit represents an important legal crossroads, Michelman said. If a company can sue to keep a complaint out of public eye, the entire concept behind the public database would be threatened, he said.

    "If this company is allowed to keep a report of a potentially hazardous product out, it would effectively undermine a tool that Congress ordered created to protect consumers," he said.

    Many raw government consumer complaint databases -- such as complaints filed with the Federal Trade Commission -- are not readily available to the public under the theory that consumers can file incorrect reports that would unfairly besmirch a company. On the other hand, agencies can take months to study complaints before making them public, severely diminishing the usefulness of the information. A Public Citizen report advocating creation of the product safety database, titled “Hazardous Wait,” claimed that government officials waited on average more than 200 days to issue recalls after receiving complaints from consumers.

    "If important product safety information is not provided to consumers, they might be subjecting themselves to grave danger, or even death, by buying and using a product about which serious hazards were known and documented, but not told to consumers," Michelman said.

    A report issued by the Government Accountability Office in October found that 5,464 complaints had been filed by consumers through SaferProducts.org as of July 7. Only 1,847 were published to the database; many reports weren’t published because they were deemed incomplete, or involved products or services outside the agency’s jurisdiction.

     

     

     

     

     

    The Internet age has created myriad headaches for companies trying to handle consumer complaints.  Popular websites like RipoffReport.com or ConsumerAffairs.com compile thousands of complaints and make them easy for consumers to find.  Meanwhile, consumers – or even competitors --  can easily blog, tweet, write Facebook post, or create YouTube videos that unfairly tarnish companies’ products, making it difficult for firms to do damage control.

    In this regard Saferproducts.gov is a bit late to the game. Yet product makers worry that, because it is maintained by a government agency, it will have added weight with consumers – and thus have the potential to do greater reputational harm.

    In addition to allowing company rebuttals, there is also a procedure for removing demonstrably false reports from the database. And the website includes disclaimers that the information on it has not been verified. But opponents say that’s not enough to prevent unfair damage to companies by inaccurate reports.

    Before launch this March, the National Association of Manufacturers was among the most vocal industry groups opposing SaferProducts.gov.

    “The (association) believes the rule makes it more difficult for manufacturers to effectively defend their reputations and will not improve product safety for children,” the industry group said on its website in January. “This database has alarmed manufacturers, who fear that it will become a poorly monitored site that encourages reputation-harming complaints.”

    Successful suppression of the complaint in the October lawsuit would have far-reaching impacts on any government effort aimed at greater disclosure, Michelman argued. Two similar databases that can publish information detrimental to businesses – accident data logged by the National Highway Traffic Safety Administration and a Food and Drug Administration database on medical devices  –  could also be undermined by the lawsuit’s success, he said.

    “By attacking the statute (that created Saferproducts.org) on some other broad theory, it would keep a lot of complaints out of the public eye,” he said. “We don’t know what the company is arguing, but this and other databases are likely going to be in jeopardy.”

    Michelman concedes that inaccurate reports could damage a company’s reputation or product sales, but he said the greater risk involved delaying release a complaint that could protect consumers.

     “If false complaints about a product get out, the company can defend itself in the press with advertisements. The real unfairness at stake is the unfairness to consumers if information is not disclosed,” he said. “This is why Congress acted to order creation of this database.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Feds indict 7 in massive click-fraud scheme that hit 4 million computers

    By Bob Sullivan, Columnist, NBC News

    A band of Estonian and Russia cybercriminals infected at least 4 million computers worldwide with a virus and used a complex ad click-fraud scheme to pocket $14 million, federal authorities alleged Wednesday.

    The scheme operated from 2007 to October of this year, according to an indictment filed in the Southern District of New York and unsealed on Wednesday.  The operation was shut down in October.

    Consumers caught up in the scheme -- including at least 500,000 victims in the U.S. -- were unaware that their everyday Web browsing contributed to the scheme. When infected users visited popular Web sites like Apple's iTunes, Netflix, ESPN.com or WSJ.com, advertisements in the sites were replaced by ads controlled by the hackers, earning them illicit gains through advertising affiliate arrangements.  The scam is sometimes called "advertising replacement fraud."

    The same virus also altered search engine results so consumers who clicked on some links were rerouted to websites designated by the defendants, which triggered payments under advertising contracts.

    In one example cited in the indictment, a user who clicked on a link for the Internal Revenue Service after searching for "IRS" at Yahoo.com was instead redirected to an H&R Block tax preparation website.

    The malicious software also prevented victims from connecting with their antivirus software providers and updating their software, so the virus would evade detection.

    Six suspects were arrested in Estonia on Tuesday, said Assistant U.S. Attorney Preet Bhahara. One suspect is still at large. The suspects face 27 charges, including wire fraud and computer intrusion. Government computers, including at least 100 computers at NASA, were infected in the scheme, the indictment alleges.

    When consumers type in typical Web addresses, such as www.msnbc.com, that address is converted to a numerical Internet Protocol address utilizing a trusted Domain Name Server on the Internet. But files located on each local computer can tell a victim's machine to get their DNS information from a different computer on the Internet. The  computer criminals infected computers in 100 countries, directing them to loop for DNS information from a set of hacker-controlled machines in Chicago and New York, according to the indictment. This enabled to criminals to serve up rogue ads and earn commissions no them.

    The U.S. Attorney's Office called the scheme "massive and sophisticated," in its indictment, and implied that many victims have not yet been discovered.

    Bhahara credited Estonian authorities with assistance in the case, called the case "the first of its kind." The NASA infections tipped off U.S. investigators to the scheme, Bhahara said.

    In an effort to obtain additional evidence, and to identify more victims, a third-party firm replaced the rogue DNS servers with "clean" government-controlled DNS servers, and will continue to operate them for the next 120 days, logging connections and keeping track of infected computers. FBI agents are also using the data to inform Internet service providers about infected consumers.

    The FBI has has more details about the allegations on its Web site. It also wants to hear from consumers who think their computer is infected, and offers a tool for testing your Internet connection on that site. Standard, up-to-date antivirus software should detect the virus.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • What's it like to share your SSN with 50 people? Follow a victim's struggle

    Jonathan Barnett

    By Bob Sullivan, Columnist, NBC News

    Jonathan Barnett is also Jose Cruz. And Jesus Ramirez.  And Pilar Terrones, Pilar Sanchez, Esmeralda Gonzalez and dozens of other people, at least according to the nation’s identity system.

    Barnett unintentionally shares his Social Security number with all those people  –  and probably many more  – yet his credit report and Social Security earnings records are completely clean. That seeming contradiction is a big part of his harrowing identity nightmare.

    Barnett’s predilection for assiduous recordkeeping offers a rare glimpse into the deeply flawed identity system used by the nation’s creditors and employers.  It relies on the secrecy of SSNs. But Barnett’s number is hardly a secret; it’s the fraud connected to his identity that remains off limits, even to the victim.  

    “It's like I have a ghost out there,” he said. “Lots of ghosts.”

    The canary in Barnett's identity coal mine was an innocent-looking email from Wells Fargo Bank. It arrived in August, soon after he opened an account there, offering savings tips.

    But the email was addressed to someone named “Pilar Sanchez.” 

    Then he received another, and another – all sent from Wells Fargo to his email account, but addressed to Sanchez.

    Barnett, a 27-year-old who lives and works near Austin, Texas, called the bank.   An operator told him it was probably a simple error, perhaps a typo, and that he shouldn't worry. But he knew better.

    For years, Barnett had a sense something might be wrong with his identity records. But each time he obtained his credit report or his Social Security statement, his identity was "clean."  This time, however, he was determined to get to the bottom of the problem.

    He started doing research and found out, through various news stories, that a certain kind of identity theft can allow imposters to "share" victims' SSNs without blemishing their credit reports. So he became more assertive with creditors and changed the way he quizzed them.

    "I started calling and asking if they had any accounts under my Social Security Number, without giving my name," he said. "And if the person I got wouldn't do it, I just called back and tried again." 

    Using this method, he got "hits" – confirmation of multiple accounts under a single SSN --  from his own creditors. Credit accounts at Lowe's and Home Depot were among the first he discovered. Emboldened, he began cold-calling every major creditor -- cell phone issuers like Verizon, banks like Bank of America -- and asking about his SSN. 

    He discovered his identity was being used at nearly every creditor he could think of.

    "The approach I took was just calling up and saying I had an account and asking them to look it up, because if I didn't say that, they wouldn't help me at all. ... I just started calling random companies, and my SSN seemed like it was everywhere," he said. It was if he could throw a dart at any U.S. company, and he'd find his SSN at use there. "It was pretty awful."

    Worse yet, none of these creditors would give him any details about the accounts -- ironically citing privacy concerns.  He knew his SSN was being used, but he didn't know by whom, when the account was opened or if it was active.  So he switched strategies again.

    "I'd give them my SSN only, and then just wait, and they might say, 'OK, you are Jose Cruz?' And I'd write that down. Or they'd say, 'You're in California?' And I'd write that down," he said.

    Using this investigative technique, he started to build a vague picture of what was happening, but there were many, many blanks to fill in.

    "What shocks me is the unwillingness to cooperate with victim,” he said. “It's baffling that I’ve never know about it until now.”

    Barnett had already done all the basics, such as placing fraud alerts on his credit reports and checking his annual Social Security earnings statement. Again, zilch.  So he started making phone calls.  He called the FBI, which told him to file a report with his local police department. He called the Treasury Department’s inspector general. He called the Office of the Comptroller of the Currency, which told him to file a report online. He filed something at the Internet Computer Crime Complaint Center, but was told not much could be done because the imposters were not using his name.

    He had his first real "hit" when talking to his credit union, which was forthcoming about results it found looking up his SSN on a system that tracks individuals who attempt to pass bad checks. 

    "They were more than happy to talk with me about … what they thought was going on,”  he said. 

    Undocumented workers need to provide Social Security numbers when they begin a new job. Often, they provide stolen or invented SSNs. Because employers often don't check the accuracy of the numbers, the technique is effective.  When a particular SSN is used successfully in obtaining work permission, it is often shared with others.  Some who use the SSN at work go on to use it for obtaining credit cards, loans, government benefits and so on. If imposters use their own names -- or invented names -- on those applications, none of the usual identity theft protections will be triggered, and the rogue accounts are not reported on the standard consumer credit report. Instead, the credit bureaus create what are sometimes called "sub-files" to indicate that multiple identities are associated with that SSN.  Consumers are generally only able to obtain information about their own sub-file, attributed to their correct name.

    It's unclear how common sub-files are, but identity protection service ID Analytics provided insight into this critical question last year. After studying more than a billion applications for credit, it revealed that 40 million SSNs have multiple names connected to them. While many of these can be attributed to innocent typographical errors or legitimate name changes, others indicate fraud. About 2 million U.S. adults have three or more SSNs associated with their names, said Stephen Coggeshall, head of research at ID Analytics.

    How many Jonathon Barnetts are out there?  It's not as rare as you might expect. More than 140,000 SSNs are associated with five or more people, and 27,000 are connected to 10 or more people, according to ID Analytics.

    Despite widespread acknowledgment of the problem, Barnett has spent the past four months running into one wall after another when trying to get details about how his identity was compromised and the status of those fraudulent accounts.

    "When I call, the data in their records is obviously false. Anyone can see it. I can tell by the tone in the (operator's) voices that they want to tell me more, but they are hesitant because they'd been instructed not to," he said. "I found that when I called the California state tax office.  I asked them, and the woman told me, 'Yes, it was very common.’ So common they just issued a different number (to the imposter).  I was told not to worry about it if I hadn’t received a letter from them. That just worries me more."

    Barnett later turned to a company named Identity Guard and paid to get a report detailing potential compromises. For the first time he got a sense of the depth of his problems.

    Nearly 50 names were connected to his SSN.

    "I really gulped when I saw that list," he said. 

    Identity Guard says it uses data from a long list of providers to create a database that goes far beyond what consumers get when they obtain a credit report.  Public records, such as dog licenses or legal filings, billing applications and payday loans are also included in its database. The firm declined to provide additional detail during an interview.

    "If I had to take a guess, I’d say most of this is employment fraud,” said Tim Rohrbaugh, vice president of information security at Intersections Inc., which operates Identity Guard. “If you look at the surnames, that's what would appear to me.”  Because the SSN is not used for financial identity theft, such as opening a credit card and not paying the bill, the compromise often isn’t discovered for years, he said.

    The credit industry sometimes refers to this as creation of a “synthetic identity,” because the SSN and name combination don’t actually represent a real person, but merely an entry in a database.

    “It stays at a low level so, so the SSN is usable over and over to get a job, or to open utilities. … But  it can be just as damaging as credit-based stuff,” Rohrbaugh said.

    As Barnett worked his way through the Identity Guard "hit list,” the news got progressively worse.

    In September, he found two active bank accounts at Chase; both have been closed by the bank. He found three active AT&T accounts, since closed, and a fourth attempt to open an account. In October, he found a Capital One checking account, an attempted account opening at Bank of America and a federal tax return filed in February using his SSN.

    Perhaps most unnerving of all, he found a Verizon account closed back in 2002. He has no idea when it was opened. The discovery means the secret life of his SSN has a long history.

    He then recalled an incident when he was in college in 2004, when Bank of America sent him a debit card with someone else's picture on it.

    "They told me it was just a mistake. I was naive about it at the time," he said. 

    Two weeks ago, Barnett contacted msnbc.com and asked for help.  At msnbc.com's request, ID Analytics ran his information through its database and found 17 active users of his SSN.  Again, because of privacy rules, ID Analytics cannot share the information directly with the victim. But the company shared it with the nonprofit Identity Theft Resource Center, which maintains confidentiality agreements with the credit industry.  That agency is now calling special contacts within fraud departments at the various creditors and helping close the offending accounts. 

    The nonprofit agency confirmed it is working to help Barnett, but said it was unable to divulge details about his imposters. Karen Barney, program director at the Identity Theft Resource Center, did say the agency has since found abuse of Barnett’s SSN dating back as far as 1995.

    Barnett feels like he's finally getting on top of some of the identity abuse he's discovered. This week, he also heard from his local police department, which said officers had passed along two potential suspects’ names he’d discovered to local police in other jurisdictions.  Such leads are precious -- he wants identity criminals to be prosecuted so they won't continue to abuse his SSN, and so he might ultimately get to the bottom of the problem.

    But it's just a start.

    "I could do a lot more if I had names and addresses of all the imposters," he said.  "I feel a little conflicted. I feel good now that I am finding places that can verify the information is stolen.  It's still disconcerting -- not only the ID theft, but I'm still hitting walls with companies that have the information."

    Want to share your story as an ID Theft victim? Leave it in comments below or e-mail BobSullivan@feedback.msnbc.com

    Barnett's father worked in finance, and he was raised to pay close attention to his credit report, his credit card interest rates and anything else connected to his financial life.  Many companies he's dealt with during his ordeal have assured him that he's suffering no harm; no unpaid bills have surfaced on his credit report, for example. But he's suspicious of that, and he's convinced that an unexpected delay in his mortgage application during 2010 can be attributed to his identity problems.

    Still, after spending several months obsessing over the problem, he's come to terms with it.

    "It really wasn't until last couple of weeks that I started taking it in stride. I did let it get to me for a while," he said. "Now, sometimes, it's almost like a game for me to call these companies and get more details out of them."

    No one knows how many imposters have his SSN, and no one can really stop others from using his SSN on an application in the future. But better fraud-fighting tools would render a stolen SSN useless to would-be imposters.

    "I know a lot of people are working on this problem, but it's still here. And it begs the question as to why it's all possible," he said.

    RED TAPE WRESTLING TIPS

    SSN-only ID Theft is particularly vexing; it’s almost always discovered by accident, as in this case.  Victims might be tempted to request a change of SSN, but the Identity Theft Resource Center strongly recommends against this strategy. The consequences of dropping an old SSN -- losing a lifetime of credit history, along with college records, employment history, and so on – are more severe than fighting fraudulent accounts, Barney says. Also, creditors almost always end up linking the new and the old SSN anyway, so the potential benefits of changing are quickly lost. A new SSN only makes sense for very young victims who have no established history, she said.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Recession threatens generation of young adults, inspires 'Occupy' protests

    Don Emmert / AFP - Getty Images

    An Occupy Wall Street protester on Tuesday holds up an American flag with corporate logos replacing the stars.

    By Bob Sullivan, Columnist, NBC News

    Their employment prospects are dim, their debt is high, their lives are on hold and a stunning number are living with their parents, even into their 30s. They are young adults, 18 to 34, struggling to begin their adult lives during the worst economy since the Great Depression, and they risk becoming a lost generation, according to an extensive new study released Wednesday by two advocacy groups.

    While begun long before the "Occupy Wall Street" movement, the research may help explain why so many young people are taking part in the protests.

    Some data unearthed by the study by the advocacy groups Demos and The Young Invincibles, which combined an independent telephone poll with U.S. Census Bureau data, is stark and stunning.  Rent is taking up nearly 33 percent more of young adults’ income than a decade ago -- at least for those who have their own place.  But nearly 20 percent live with their parents. They are postponing buying a home, having children, even getting married.

    Despite accumulating historic piles of student loan debt, nearly 50 percent aren't working in their chosen field. That might suggest college is a waste of time, but young adult men who hold high school degree earn only 75 percent of what their high-school-educated fathers did, creating an educational Catch-22.

    While government underemployment data tells a sobering story – that 16.5 percent of U.S. adults don’t have a job, are being forced to take part-time work or have given up looking for work --  it may markedly understate the problem for young adults.  About 60 percent of working young adults questioned by pollsters said they wish they could work more hours for more pay, likely offering a much better approximation of underemployment.

    "A lot of the findings in this report could have cause serious economic scarring going forward," said Lauren Strayer, a spokeswoman for New York-based Demos, a non-partisan think tank that says it promotes economic equality and democratic values. “People who have no hope for the future don't plan for it.”

    The report, “Young America: Economic Barriers to the American Dream,” was released Wednesday to highlight the groups’ year-long effort to focus attention to economic issues facing young people.

    “About half of young Americans between the ages of 18 and 34 believe that a fundamental tenet of the American dream is broken — that the next generation will be better off than they are,” the report concludes.

    The research comes at a time when the Occupy Wall Street movement is approaching a crossroads.  Now past the mere curiosity stage, can its organizers continue momentum when news interest lulls and winter weather makes Wall Street parks much more inhospitable?

    Whether it survives or not, the anger being expressed at Zuccotti Park isn't going anywhere anytime soon, said Demos spokesman Tim Rusch.  Demos began its young adult research six years ago, and has been seeing the worsening plight of young Americans for a while.

    "Young people were restless and frustrated before the recession," he said. "The 'Occupy' movement is the expression of how much worse it's gotten in last three years, a direct result of how disgusted people are. ... We reached a tipping point." 

    The themes of poor economic opportunities and a sense that "things are unfair" have permeated the movement, but the data released Wednesday "gives some texture to that," Rusch said.

     Only half of young adult workers earn more money than they did four years ago, while only 47 percent earned more than $30,000 last year. Twenty percent of those in the 25-to-34 age bracket are only working part-time, while 12 percent say they've given up looking for work, assuming they have no prospects. Roughly 25 percent are uninsured.

    But even among those who work, there's widespread dissatisfaction. An astonishing 57 percent said they would work "more hours for more pay" if given the option.

    "They are not underemployed in the (government data) sense, but in their own minds," said Robert Hiltonsmith, a Demos researcher who worked on the report.  "That's a huge proportion."

    Perhaps it shouldn't be a surprise that young adults need the money, given their soaring rent costs and debt.  The report found that nearly 10 percent of undergraduate students leave school with more than $40,000 in debt and begin life saddled with a typical monthly payment of $460. Meanwhile, rent is devouring most young people’s paychecks. In 1980, rent consumed 23.7 percent of 18-to-24 year olds' pre-tax income.  By 2009, that had jumped to 32.1 percent, with most of the increase hitting during the past decade.  Meanwhile, the share of 25- to 34-year olds spending more than 30 percent of their income on rent -- a critical threshold often cited by landlords -- jumped from 28 percent to 41.3 percent over the same time period.

    Those bleak numbers have many young adults putting off critical life decisions, and is imposing a kind of extended adolescence on them.  Almost half (46 percent) have delayed purchasing a home, while 30 percent have put off starting a family, and 25 percent said they had delayed getting married.

    Meanwhile, the number of older young adults living at home with parents has skyrocketed. In 1980, 10 percent of 25- to 34-year-old men lived at home. In 2010, 21 percent of that age group told the researchers that they'd lived with parents at some point during the prior year.

    This social shift has far-reaching consequences, even beyond the young adults, said Hiltonsmith.

    "When you have 30-year-olds living with parents, they are putting an extra burden on the older generation, perhaps forcing them to postpone retirement," he said.  Other recent data Demos has examined suggest that older women are facing economic instability, and the two trends could be related. "Many of them are caretakers for adult children. This could be a long-term negative trend that we've just begun."

    College was sold to young people as the surest route to a secure spot in the middle class, something that has turned out to be, at best, a half-truth.  Clearly, their peers without college degrees are struggling even more during the recession.  Men and women with college degrees earn about $20,000 more annually than their less-educated peers, a gap that has doubled since 1980.

    On the other hand, college degrees are hardly a guarantee of good employment.  One third of young adults holding a four-year college degree told researchers that they are not working in their chosen profession. And 29 percent of those who attended graduate school said they weren't working in the field they'd studied. Among students who attended "some college," the figure jumped to 54 percent

    The disappointing results almost certainly mean college graduates are not earning as much as they would if they were working in their chosen field, but the results suggest something even more sobering, Hiltonsmith said.

    "The bigger point here is that college was sold as the only way to get into middle class. But with these people not working in their field, the connection between school and career has broken down,” he said. “They really are at risk of college being a complete wash for them."

    All this negativity carries with it societal risks that might last for decades. Only 12 percent of those polled believe their generation will be better off than their parents’ generation, and nearly all of them indicating they have serious concerns about their ability to save money for retirement.

    "We're at risk of losing them and seeing permanent effects," Hiltonsmith said. "These conditions really could set this generation of young people on a different trajectory."

    But despite all this pessimism, researchers were surprised to find a glint of old-fashioned American optimism within their research.  About 70 percent of survey responders said they still believed the American Dream "is achievable."

    "We were surprised by that," Rusch said. But he said the seeming paradox of simultaneous generational pessimism with a belief in the American Dream suggests that young people believe things don't have to be as bad as they are. 

    "It tells me they think there's something possible we can do as a society, but I don't think people see the resources or the opportunity in front of them right now," he said.

    Want to share your story as a struggling young adult? Leave it in comments below or e-mail BobSullivan@feedback.msnbc.com

    Other interesting findings in the research:

    *Across categories, young women worried than more men. Women's biggest concern was being able to afford to send their future children to college.

    *Young war veterans are faring far worse than other young adults.  The unemployment rate for the 2.2 million Gulf War-era veterans 18- to 24-years-old was 20.9 percent in 2010 -- 3.6 percent higher than the unemployment rate for all 18- to 24-year-olds, and over 11 percent higher than the unemployment rate for the general population.

    *Young whites are the most pessimistic that their generation will be worse off than previous generations, with 55 percent expecting they'll be worse off. Only 40 percent of African Americans and 36 percent of Latinos feel that way.

    *A debt-distressed household puts 40 percent or more of its monthly wages toward debt service payments.  In 2007, 16 percent of all households headed by 25 to 34-year-olds qualified as distressed, up from 13 percent in 1989.

    *The price of child care, a major concern in two-income households, is rising faster than inflation. The average monthly child care fees for two young children exceed median rent in nearly every state.

    *Unemployment hits young adults hard, even according to official government statistics. In 2010, unemployment among those 35 and older was 7.6 percent, compared to 10.1 percent for the 25-to-34 group and 17.3 percent for the 18-to-24 group.  The recession has made that disparity worse, with unemployment increases of 4.4 percent for those 35 and over, 5.4 percent for 25- to 34-year-olds, and 7.7 percent for 18- to 24-year-olds.

    The nationwide survey reached a total of 872 adults ages 18 to 34. The sample included 472 young adults reached on landlines and 400 young adults reached on cellphones. Its margin of error is plus or minus 3.32 percent.  The survey was conducted Sept. 24-Oct. 4.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).