Reppler analyzes your Facebook risks

Originally posted 4/6/2011 at lubbockonline.com/glasshouses

Reppler is a free service that will analyze and monitor your Facebook account and see if you have left any holes in the privacy settings and tell you what kind of tone your wall posts have. I'm not sure how accurate a lot of the information is, but having your privacy settings checked by a third party doesn't hurt. Having someone monitoring to tell you if you do something that could be career threatening isn't bad, either. But remember, even if Reppler says your information is safe, all it's really telling you that all of the settings are set to the level of privacy allowed by Facebook. Even at it's most private, Facebook is pretty wide open.

Using Reppler is easy. You just go to the site, give it your Facebook login and permission to check everything - yes, it wants everything, but no more than you've already given Facebook and most of the apps you use.

Google accidentally spys on open WiFi

Ben Rooney of cnnmoney.com reports that the Google has admitted that it's Streetview cars have been collecting data from open WiFi hotspots. Google first admitted to collecting the publicly broadcast information of open hotspots, things like the network names and router numbers, on April 27th. But after being asked for more information, Google says that they discovered more data was being collected - private data in the packets being transmitted across the network. Supposedly the code that gathered data packets was accidentally entered into software used to gather public information on WiFi.

The software changes channels five times a second, so only bits and pieces of data would be gathered. Encrypted data, like the communications between you and your bank account, cannot be read, so it won't have been compromised by Google's illicit scans.

Google is, of course saying that it was an accident. In response they have stopped all scanning of open WiFi by their streetview cars until they can repair and replace the faulty software. They have arranged for a third party to review the software and the data collected from public WiFi networks.

This is a major blunder by Google. Whether it was a case of pushing the envelope to see what the reaction would be or an honest mistake, it's going to hurt Google's reputation. This one I tend to believe was an accident. In many nations it is illegal to tamper with electronic communications. Google may want to gather and use information, but breaking the law to do it isn't good business.

Could Buzz become Facebook for education?

In his blog entry on ZDNet, "A social networking call to arms" Christopher Dawson looked at Google as the potential social networking provider for education and business. He makes some good points. In the past Google has been considered a nemesis of personal privacy for their retention of user search and email data long after the fact. But they have responded to their users concerns by limiting the time data is kept, and when they made the major blunder at the introduction of Buzz were quick to fix the problem. Facebook, on the other hand, is continually expanding what user information is considered public without consulting users or seeming to care about their wishes. Schools have to keep certain data private, and Facebook does not allow that.

There was a time when Facebook might have been useful as a tool for teachers. That time is long past. But a social network run by Google could work. Google does not make change their privacy policy every six months (or less) in an effort to make more of the user data public. And Google has experience providing secure services in the cloud to businesses already. They already have most of the ingredients of a successful social media site if they can find a way to tie them all together. Google Search, Google Reader, Youtube, Blogger and Google's handling of privacy issues are some pieces of the puzzle. All Google needs is a way to package them together that satisfies the privacy and security needs of educational institutions while providing the social experience people want.

Alcohol + camera + Facebook = no play

Greg Cergol from nbcnewyork.com reports that several lacrosse players at Ward Melville High School in New York were suspended when school officials saw pictures of them drinking on Facebook.

Fifteen lacrosse players were suspended because of the pictures - six of them indefinitely. This kind of occurrence isn't anything new, although this may be the largest group of high school students to hose themselves on Facebook to date. If I had any illusions about high school students thinking about how private Facebook really is, my favorite quote from the article would have disabused me:

"Maybe it's not the smartest move to have put the photos up," said senior Teddy Ouwerkerk. "I guess Facebook isn't the most private after all."

Facebook users risk blackmail

Everyone who follows this blog knows that I do not like the way Facebook pretends to protect our privacy. But my statements pale in comparison to what Jennifer Stoddart, Canada's Privacy Czar, has to say. In a story in the Globe and Mail she says:

“I’m very concerned about these changes. More than half a million developers will have access to this data. The information will be stored indefinitely and it opens the possibility that a lot of people can be blackmailed from all corners of the world.”

That's a pretty strong assertion. I'm not sure how real a danger that is, but I understand her concern. It's embodied in another quote regarding how well Facebook is living up to the promise it made to the Canadian government to better protect members privacy. After the privacy changes announced last week she said, “They certainly seem to be moving in the opposite direction."

It's true that the constant privacy policy rewrites by Facebook would be better called 'personal publicity faciliators'. And with the odd, bewildering, and downright idiotic things that people post on Facebook blackmailable data will probably be posted by more than a few people. But once it's been posted to Facebook, how much of a lever can it be for blackmail?

Choosing to host malware

ZDNet's Dancho Danchev report on a disturbing development in activism; the opt-in botnet.

In case you don't know what a botnet is, it is a group of computers that have been taken over by malware that allows someone besides the computers owner to take control and/or use the computer to attack other computers, servers, and even botnets. Usually the people hosting the computers in the botnet don't know they've been infected. In the case of an opt-in botnet, though, they do. Not only do they know, they've intentionally infected their computers so a coordinated attack against an entity their activist group doesn't like can be launched. This is similar to activists chaining themselves to trees, vandalizing government (or other) buildings, or bombing whatever they don't like.

This kind of activity is illegal, but most people who become part of opt-in botnets either don't know this, don't care, or think that, as part of a large group, they are less likely to be singled out. They may or may not be right about that last one.

One of the things that make opt-in botnets feasible is the rise of social networking sites such as Facebook and Twitter. But while they make such things easier, they don't guarantee success. The article examines some successful and not so successful opt-in botnets. It's interesting reading. If you find such things interesting, check it out.

Bad security a financial industry issue, not just banks

Alan of Sun Country's Weblog reports that FINRA (the Financial Industry Regulatory Authority) recently fined the brokerage firm Davidson & Co. $375,000 for failing to use adequate security measures to protect customers information.

The breach occurred in 2007, but Davidson & Co. didn't find out until 2008. To make it worse, they didn't find it, one of the hackers tried to extort money in return for not releasing the stolen data to the public.

According to FINRA, Davidson made such basic security blunders as not encrypting customer data, keeping the customer data on a web server with default admin password, and keeping the insecure webserver online 24 hours a day. The company also failed to follow a 2006 auditors recommendations that it implement an intrusion detection system and review server logs so that they could have detected the breach sooner.

According to a Davidson spokeswoman the FINRA statement ignored some pertinent information, such as a third party auditor being unable to break into their systems shortly before the breach, and the attack using what were, at the time, very cutting edge techniques.

What the FINRA report does tell us is that the attack was a SQL injection attack. In 2007 SQL injection was going on 10 years old, hardly cutting edge. Changing the default admin password is basic security. So is encrypting your customer data and not placing the database on a server directly connected to the web. Different companies use different terminology for the same tasks, so I suspect Davidson was looking for a pentester and hired something else, but I can't be sure. Any pentester should have hacked a server using the default admin password in no time. But an auditor might not even try.

These types of problems are coming to light often enough to show that a large segment of the financial sector has major security problems. I would like to see the industry police itself, but the stakes are too high, and the industry moves too slow. It's time for regulatory involvement.

Linux: As vulnerable as Windows?

Before any Linux users burn me in effigy, please read a little further. Enterprise Linux is rock solid and as secure as anything out there - and more secure than most. But how secure is desktop Linux?

Before answering that, perhaps we should think about why Linux in the Enterprise is so secure. Actually, we don't have to think about it because Fewt of the Fewt blog already has. And the conclusion he has come to is that the things that make installing and using desktop Linux so user friendly are exactly the things that make it insecure.

I'm ashamed to admit that I've never considered that the changes made to make desktop Linux simpler to install and run than enterprise Linux could create security risks. For instance, creating a single partition instead of having different partitions for different directories removes one of the security features of enterprise Linux. Fewt says it much better than I can:

With a Desktop Linux system, non enterprise savvy users are given the keys to a wide open platform and nothing protects them from the elements. We as a community have falsely sold our users that this platform inherits the security capabilities that you find within Enterprise Linux, we just aren't telling them the whole story.

By default, every single Desktop Linux system I have reviewed or tested fails in every possible way. None of the measures normally applied to protect Enterprise Linux systems are present to reduce risk of vulnerability. In addition those enterprise controls must be altered slightly as the use case is so greatly different than that of an Enterprise Linux deployment.

Are you using desktop Linux? Do you have the know-how to secure it, and if you do, have you? If you've convinced friends to run Linux, have you secured their systems for them?

Fewt doesn't just bemoan the fact that desktop Linux is not secure. He points users who want to secure their systems to resources to help them do exactly that:

https://help.ubuntu.com/community/Security
http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf
http://people.redhat.com/sgrubb/files/hardening-rhel5.pdf
http://ubuntuforums.org/showthread.php?t=510812

He then offers the advice that if you find the information at any of those links too complicated you should stop using linux. He's not being snobbish or suggesting you have to be a Linux administrator to secure Linux. He's saying that if you're not comfortable taking the steps needed to protect your data - and perhaps your reputation - you should use an operating system that protects you while staying in your comfort zone.

If you are a user or a fan of desktop Linux I suggest you check out fewts blog entry and the links he gives to help you secure your desktop. He gives a very clear, very informative case for desktop Linux's insecurity.

In any security situation you're only as secure as the weakest point. Often that's the users password. In desktop Linux it looks like the OS itself may be the weak point. There are already enough weak links in any OS without opening the lock and throwing open the gate for the bad guys.

Facebook causes syphillis

No, really, it does. According to the Telegraph, "Facebook 'Linked to Syphillis.'"

Reading the article, it turns out that "linked to" is a little stronger than what the Professor Peter Kelly, the researcher who saw a connection said. He saw that a couple of areas of Britain that have increased incidence of syphillis also have high Facebook usage. Professor Kelly observed that "Social networking sites are making it easier for people to meet up for casual sex."  Apparently the data he used included where people were hooking up, and a lot of them were through Facebook. Not a smoking gun, more like circumstantial evidence.

Facebook is, of course coming out swinging about the assertion. A spokesman said, among other things, that "Facebook is no more responsible for STD transmission than newspapers responsible for bad vision." Not a perfect analogy, but close enough, I suppose.

I don't know that Facebook is actually making it any easier for people to have casual sex. I do suspect that attitudes and fears about sex have probably changed somewhat in the last 20 years, and that might have something to do with it.

Of course, "Some people on Facebook meet each other for unprotected sex and get STD's" just isn't as snappy a headline.

Is answering the census safe?

NOTE: Checking Census law reveals that it is illegal to refuse to answer the census questions.

In an opinion piece on csmonitor.com James Bovard examines the possibility that our census answers may not be as private as we're promised they'll be. He looks at the historical record the census bureau has built regarding privacy of census data. It doesn't look too good. The first mar on the bureaus record was the production of a list of Japanese Americans on the East coast within days of Pearl Harbor. Although they are now remembered (when mentioned at all) as "internment camps," or "War Relocation Camps," Japanese Americans were rounded up and put into concentration camps. The Census Bureau denied any such activity until 2000, and denied giving specific names and addresses until it was proved in 2007 that exactly that information had been provided.

The Department of Homeland Security was given similar information by the Census Bureau in 2003-2004 regarding people of Middle Eastern ancestry in the U.S. No roundups occurred, but they would have been much easier with that information.

Mr. Bovard talks about the abuses to citizen privacy in the last 10 years, and points out that all the census is really required to gather by the constitution is a count of citizens, and the number of people living at each address is all that anyone should provide. Especially since the government obviously is more concerned with gathering as much information as it can about citizens than protecting their rights. It was true of the Bush administration, and by all the evidence nothing has changed with the Obama administration. I have no doubt that census data will be used in whatever fashion the government feels the need to use it, no matter what the law says.

OS X: Safer but less secure than Windows

Darren Murph at Endgadget reports that Charlie Miller is going to expose 20 zero day exploits for OS X at the upcoming CanSecWest. Mr. Miller has been exposing holes in OS X for years, and has twice won the PWN 2 OWN hacker contest by taking control of Apple computers. A third time he took control of an iPhone.

A zero day exploit is a piece of malware that takes advantage of a vulnerability that is not generally known, so there are no patches, updates, or workarounds to keep it from being used. Unless the person who discovers the zero day exploit informs the creators of the software being exploited the vulnerability probably won't patched until after someone writes some type of malware that takes advantage of the exploit.

If you, like me, are a big fan of Apple Macs, you know that Apple likes to tout the security of OS X and the Mac. If you are an honest Mac user you realize that OS X has vulnerabilities. Some have even been exploited, if not very successfully.

Charlie Miller is very good at what he does - find security holes so they can be patched before the bad guys can take advantage of them. His years of work in computer security have given him a good perspective on the state of Mac security vs Windows security, and that insight produced one of my favorite quotes on the subject:

"Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town."

In other words, Macs are safer, because there aren't that many people trying to break into them. Windows computers are more secure because the security holes are constantly being patched. As much as I wish it weren't so, the analogy works.

OS X: Safer but less secure than Windows for now

Darren Murph at Endgadget reports that Charlie Miller is going to expose 20 zero day exploits for OS X at the upcoming CanSecWest. Mr. Miller has been exposing holes in OS X for years, and has twice won the PWN 2 OWN hacker contest by taking control of Apple computers. A third time he took control of an iPhone.

A zero day exploit is a piece of malware that takes advantage of a vulnerability that is not generally known, so there are no patches, updates, or workarounds to keep it from being used. Unless the person who discovers the zero day exploit informs the creators of the software being exploited the vulnerability probably won’t patched until after someone writes some type of malware that takes advantage of the exploit.

If you, like me, are a big fan of Apple Macs, you know that Apple likes to tout the security of OS X and the Mac. If you are an honest Mac user you realize that OS X has vulnerabilities. Some have even been exploited, if not very successfully.

Charlie Miller is very good at what he does – find security holes so they can be patched before the bad guys can take advantage of them. His years of work in computer security have given him a good perspective on the state of Mac security vs Windows security, and that insight produced one of my favorite quotes on the subject:

“Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town.”

In other words, Macs are safer, because there aren’t that many people trying to break into them. Windows computers are more secure because the security holes are constantly being patched. As much as I wish it weren’t so, the analogy works. Hopefully Apple is working to change that.

PlainsCapital vs Hillary: Symptom of a larger problem

Tom Field of the Field Report blog wrote an entry titled, "Trust on Trial" after returning from the RSA security conference. According to him there were three words on everyones mind: cloud, computing, and trust.

Trust was the surprise word. It seems a lot of business people are questioning the safety of using a bank at all, let alone banking online. Two cases are specifially mentioned in his post:

Experi-Metal, Inc. vs Comerica Bank and PlainsCapital vs Hillary Machinery.

These two aren't picked because of their unusual nature (although PlainsCapital vs Hillary is unusual), but because they are the latest in an ongoing trend: business customers account is pilfered, bank claims no responsibility. Normally the customer sues the bank, but in the case of PlainsCapital, the bank preemptively sued the customer, asking a court to declare it's security practices "reasonable".

What is reasonable security for a bank? Nobody really knows, since no clearcut definition has ever been coined. That doesn't mean there aren't standards and minimum requirements, it just means that there isn't an official definition of "reasonable."

If you think about it, there is actually a very good reason why that particular term isn't defined. And many security experts fervently hope it remains that way. Internet security changes quickly. What is reasonable today may be totally hopeless tomorrow. Defining reasonable security will give banks a hardcoded standard to comply with - a standard that will quickly become unreasonable. What needs to be done is not define "reasonable security," but to require financial institutions to keep abreast of the latest security risks and adapt their protections accordingly. Hopefully the judge in PlainsCapital vs Hillary will recognize the danger of giving banks a definition to hide behind and will refuse to define exactly what reasonable means when it comes to banking security.

So outside of lawsuits, what can be done to solve this problem of banks being robbed and refusing to accept any culpability? First of all, business accounts should be given the same protections that personal accounts enjoy.  Second, the regional and smaller banks that seem to be the main offenders in the lack of adequate security category should honestly examine their security measures in light of what is currently out there in the way of bad guys and take steps to protect against them. Banks that are involved in lawsuits need to review their security and see if they should just settle to save time.

The business customers aren't totally innocent either, although the cases I've seen appear to implicate the banks more. If a customer who does 1 or 2 electronic transfers a month suddenly has 10 a day it should ring alarm bells and stop the transfers. This failure to stop unusual transfers is a common complaint by business customers who have had money stolen by electronic transfers. The business may have to accept some blame, however. Are their virus definitions up to date? Has someone been going to questionable websites? Are their security policies clear and well thought out?

If things keep going the way they are now, before long no business will trust their banks. That will make for some serious headaches, since it's almost impossible to do business without a bank account these days.

Facebook, Twitter used to scam brides-to-be, vendors

This is an interesting tale. Setup a Facebook page, garner followers (real or not), get a Twitter account, and rake in the dough. These internet entrepreneurs created a facebook account and tweeted about a nonexistent bridal show, and sold upwards of 5000 tickets, plus getting booth fees from hopeful vendors and a free radiospot in exchange for a reduced booth rental. Not a bad scam. I first read of the scam on Ars Technica in an article by Jacqui Cheng.

It seems that almost $150,000 was scammed from attendees and vendors with this scam. The Facebook page is down, and the twitter account probably is, too. The bad thing is, short of calling the convention center to see if the event is really scheduled, I don't know how you could see through this scam. Maybe the fact that payment was taken through paypal? That's not really an indicator. I'm sure we'll see more about this, and more examples of similar scams in the future.

High school predator stalks Facebook

In Wisconsin a darker side of Facebook was revealed last December when Anthony Stanci plead no contest to two felonies. It must have been a plea bargain, because the 19 year old had blackmailed at least seven of his fellow students for sex. Between 2007 and 2008 he had a Facebook page that he used to trick male classmates into sending him nude pictures of themselves. He pretended to be a girl, and after classmates exchanged pictures with him (it's not hard to find nude pictures of girls on the internet), he threatened to post the boys pictures online unless they had sex with him.

Stanci might still be blackmailing teens for sex, if he hadn't been greedy. One of his victims had been unwilling to speak up to protect himself, but when Stanci wanted pictures of the young mans brother that was too much. He went to his parents, and the police were called.

Last week Stanci was sentenced to 15 years in prison. According to his lawyer, that is a fair sentence, and will give him time to rebuild his life after he gets out. That's really great, but I wonder who is making sure the youngsters who were victimized by Stanci get their lives rebuilt?

It's important we make sure our children know that they cannot assume that they know someone online. And that we remember it ourselves. Otherwise we make it too easy for predators to prey on us.

FTC: Beware P2P Breach

The Federal Trade Commission is warning 100 companies and organizations that their data has been compromised by P2P software. According to the FCC press release data on both employees and customers is involved.

The release also indicates that the breach is not because of any new exploit, but because of poorly configured P2P clients. Some P2P clients, like Limewire, set a specific share folder and only make files in that folder available to the network by default. Others share the entire hard drive by default. If you are using a client that shares the entire drive by default and don't set it to only show one specific folder, anything on your HD can be seen and downloaded by anyone else on the network.

This is nothing new, but it is obviously something that is still relevant. FTC Chairman Jon Leibowitz said,

“Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers’ sensitive information at risk. For example, we found health-related information, financial records, and drivers’ license and social security numbers--the kind of information that could lead to identity theft,”

I remember being amazed at what I could find with gnutella way back when. Sadly, it's not surprising that more than a decade since I first noticed really neat stuff that obviously shouldn't be on a P2P network the neat stuff that shouldn't be there still is. P2P is really neat, and really useful (not just for sharing music). But if you are a business, and you use P2P, or one of your employees decides he needs to use P2P on his work computer and it shares the wrong folder or the whole drive you could find yourself in violation of laws such as the Gramm-Leach-Bliley Act or HIPAA. As an individual, you know that Quicken or Microsoft Money file that has all of your banking info and can connect to your bank account? Your neighbors 14 year old in now has access to all your money. And all he wanted was music.

The FTC isn't just talking about the users of P2P software. The say that it's just as important that companies who "distribute P2P programs, for their part, should ensure that their software design does not contribute to inadvertent file sharing. The easy way to do that is to have the P2P software's default setting "share this folder." And that's what you need to do if you are developing P2P software.

More fallout from PlainsCapital vs Hillary Machinery

Last week Hillary Machinery filed it's counter to PlainsCapitals lawsuit. The PlainsCapital suit seeks nothing from Hillary (other than legal fees and court costs), but wants a judge to rule that PlainsCapitals security measures were commercially reasonable at the time of the bogus transfers. Hillary is seeking the return of the unrecovered monies and legal costs.

Most of the security community, or the most of the portion making their opinion known, seem to believe Hillary is in the right. But not everyone is ready to pick a side just yet. Benjamin Wright, an expert in data security and cyber investigations law has pointed out in his blog that we only have Hillary's side of things, so until PlainsCapital has it's say, any conclusions we come to are speculation.

But as things have developed, PlainsCapital's say may be too little, too late. Hillary has not stood still and has not played the quiet game. They have told their story loudly to anyone willing to listen, and it is a compelling story. Even if PlainsCapital had security measures in place that Hillary hasn't mentioned, the Banks reputation has been tarnished, and this incident will probably pop up when least expected for years to come. And regardless of who wins, both litigants will probably both find the way they handle financial transfers changed forever when this is over, because real fallout from this whole event is not going to hit just PlainsCapital or Hillary Machinery. It could change the way banks do business, and that will affect anyone who deals with banks.

DarkReading.com reports that at next weeks RSA Security conference Authentify, Inc. (who are consulting with Hillary) will be asking security professionals to sign a petition to Congress in an effort to force banks to establish better security for business customers. I don't think anyone wants more government regulation, but the fact is that what happened to Hillary Machinery and PlainsCapital isn't unique, or even unusual, even if the lawsuit is. Apparently small and medium size banks haven't done anything to correct the situation. With the attention of Washington being called to it, the government probably will.

Jamere Holland latest facebook casualty

If you're like me, you may not know who Jamere Holland is. The former Oregon Ducks receiver was kicked off the team for his strong statements on Facebook. From a curse laden tirade regarding the booting of Kiko Alonso  as reported by Buster Blogger Brad Young to a statement reported in the Ducks Beat Blog regarding having white people as Facebook friends, Mr. Holland provides a prime example of not thinking before posting on his Facebook page. And he also needs to change his privacy settings. I'd never heard of Jamere Holland until today, but I was able to go to his Facebook page and take a screenshot of his wall:

[caption id="attachment_1061" align="center" width="500" caption="How to make and influence Facebook friends"][/caption]


I don't know, but I see more than one thing that probably shouldn't have been said. And Mr. Holland is paying a price for his outburst - an outburst that was at least premature, since the friend he was defending had not been kicked off the team. How this will affect his future, both on and off the field, probably won't be very obvious for a long time, but in the short term, he's provided one more example of how a short temper and a Facebook page can put you in hot water.

Facebook speech protected (sometimes)

Katherine Evans probably wasn't thinking about being part of a landmark case in online Free Speech when she created her Facebook rant against a teacher in 2007. She didn't keep it up long - apparently she was one of the few who didn't like the teacher - but the principal took exception anyway, took her out of her advanced placement classes and suspended her for three days.

In todays Miami Herald Hannah Sampson reports that a Magistrate Judge Barry Garber ruled that the Facebook page falls under the umbrella of Free Speech:

``Evans' speech falls under the wide umbrella of protected speech,'' Garber wrote. ``It was an opinion of a student about a teacher, that was published off-campus, did not cause any disruption on-campus, and was not lewd, vulgar, threatening, or advocating illegal or dangerous behavior.''

This is a very good ruling, in my opinion. The judge recognizes that the schools cannot, and should not, be able to dictate students life off campus. But at the same time it recognizes that there may be cases that Facebook or other online speech would not be protected.

As the internet continues to mature and governments start putting more effort into taming this beast cases like this one will define what we can and can't say online. And in the era of social media, what we can say online will be a defining factor in having a free society.

Better secure that wireless

A recent post by Thomas O'Toole of the Ecommerce and Techlaw blog reports that a federal court in Oregon has decided that if your network is not secured, you have given up your right to privacy. So, according to the judge evidence taken from the defendants computer was admissable, even though the sheriff searched without a warrant - because he accessed the computer over the open wireless network in the defendants home.

With no more information than that, I would say the defendant, John Henry Ahrndt, was right. But there is a lot more to tell. Mr. Ahrndt had an unsecured network, sharing a folder using limewire, and sharing his iTunes library. A neighbor often had trouble with her internet connection, and her modem would automatically pickup Mr. Ahrndts network and connect to it. One day she noticed a shared iTunes library, also with no password. She looked at it, saw some things that looked wrong to her, and reported it. A sheriff's deputy responded, and she repeated what she had done before. Based on what was found, a series of warrants were issued that culminated in seizing the defendants router, computer and a variety of storage devices.

O'Toole has no problem with the decision. He doesn't believe it breaks any new ground. Mike Masnick at Techdirt disagrees. He is concerned because having an open wireless network appears to mean you have surrendered your right to privacy on your computer.

I read the decision, and it appears to be completely in line with similar decisions regarding technologies like cordless phones and cell phones. And I can't really find any fault with it. Not only is the decision in accord with similar cases regarding analogous technologies, the judge explicitly states that having an open wireless network does not, by itself, remove your constitutional privacy protections:

Society's recognition of a lower expectation of privacy in unsecured wireless networks, however, does not alone eliminate defendant's right to privacy under the Fourth Amendment. In order to hold that defendant had no right to privacy, it is also necessary to find that society would not recognize as reasonable an expectation of privacy in the contents of a shared iTunes library available for streaming on an unsecured wireless network.

I can't speak for society, but for myself the combined facts that the guy was running an unsecured wireless network and broadcasting a shared, unprotected iTunes library on it pretty much removes any right to privacy on his computer. Claiming invasion of privacy in such a case is kind of like building a glass house, not putting up curtains and complaining if someone sees you naked.

I might feel differently Mr. Ahrndt were not a convicted sex offender and the evidence gathered wasn't pictures of children as young as five. But I doubt it.

[This is the second time I've had a post not publish when it's supposed to. What's going on?]